CODEWITHSUNDEEP
bash
Hao Wang
Hao Wang

Reputation: 135

What is the difference between these two Bash commands?

What's the difference between these two Bash commands? :

bash <(curl -sL https://raw.githubusercontent.com/node-red/raspbian-deb-package/master/resources/update-nodejs-and-nodered)

curl -sL https://raw.githubusercontent.com/node-red/raspbian-deb-package/master/resources/update-nodejs-and-nodered | bash

The first command gave me this prompt:

Are you really sure you want to do this ? (y/N) ?

but the second did not.

Upvotes: 2

Views: 51

Answers (1)

chepner
chepner

Reputation: 532208

In the first command, bash inherits its standard input from its parent. Assuming you typed the command at your prompt, the parent would be your interactive shell, whose standard input is (in the absence of any other change) your terminal emulator.

In the second command, bash's standard input is the output of curl, not a terminal, which means the standard input of the script executed by bash is also the output of curl.

Whatever command is asking for confirmation only does so if it detects that standard input is a terminal. Worse, if the script is trying to read from standard input, it may actually consume part of itself, if it wins the race condition with bash for reading from the pipe.

The correct thing to do (and the secure thing) is to save the output of curl to a file first, then verify what it is you are running before actually doing so.

curl -sL https://raw.githubusercontent.com/node-red/raspbian-deb-package/master/resources/update-nodejs-and-nodered > update-script
# look at update-script
bash update-script

By "look", I mean either visually inspect the output, or at least compare a locally computed checksum with a checksum provided by the source to ensure that the bytes you received are the bytes that you were supposed to get. (This guards agains network corruption, man-in-the-middle attacks, etc.)

Upvotes: 6

Related Questions