jbang: Running a script hosted in an untrusted url fails to read user choice when using `curl -sh https://sh.jbang.dev`
I think the problem is quite known in any shell. If you pipe a shell script for the shell to execute it then the shell won’t be able to read input from the user:
$ curl -sL https://sh.jbang.dev | bash -s -- https://github.com/mperezi/java-cli/blob/master/SendSms.java
[jbang] https://github.com/mperezi/java-cli/blob/master/SendSms.java is not from a trusted source thus not running it automatically.
If you trust the url to be safe to run you can do one of the following:
0) Trust once: Add no trust, just run this time
1) Trust this url in future:
jbang trust add https://github.com/mperezi/java-cli/
Any other response will result in exit.
[jbang] Type in your choice (0 or 1) and hit enter. Times out after 10 seconds.
[jbang] [ERROR] Could not parse answer as a number. Aborting
[jbang] [ERROR] https://github.com/mperezi/java-cli/blob/master/SendSms.java is not from a trusted source and user did not confirm trust thus aborting.
The problem can be spotted in the following line:
[jbang] [ERROR] Could not parse answer as a number. Aborting
Do you think it would be a good idea to provide a flag --trust-once to avoid this edge cases?
About this issue
- Original URL
- State: open
- Created 4 years ago
- Reactions: 1
- Comments: 16 (8 by maintainers)
I do think he has a point though. For most people if they use a
curlcommand it’s probably because they don’t have Jbang installed. So that means that the command we show doesn’t actually work for people that don’t have already set the trust previously 😕