this post was submitted on 18 Oct 2023
14 points (93.8% liked)

General Programming Discussion

7792 readers
41 users here now

A general programming discussion community.

Rules:

  1. Be civil.
  2. Please start discussions that spark conversation

Other communities

Systems

Functional Programming

Also related

founded 5 years ago
MODERATORS
[email protected]
[email protected]
14
How to audit a shell-completion script? (lemmy.ml)
submitted 1 year ago by [email protected] to c/[email protected]
4 comments fedilink hide all child comments
 

I just stumbled upon a collection of bash completions which can be quite handy: https://github.com/perlpunk/shell-completions

I tried mojo, cpan and pip completions in a sandbox and they worked like a charm!

The only question I've got is, has anyone ever done a security audit of the repository? Anyone has taken the time to look at the code? I could try auditing but I'm not even sure what to look for.

I feel quite wary of letting an unknown source access to my bash session and what I type.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] [email protected] 3 points 1 year ago (1 children)

The mojo, cpan and pip bash scripts don't fail my test of "skimming over the source and looking for dangerous external commands like curl or rm" (good syntax highlighting is helpful here). They look like typical completion scripts. However, if your Linux distribution has a pip completion script in their repos, prefer that one.

[โ€“] [email protected] 1 points 1 year ago

Thanks. At least I've got a few clues to look for when auditing such code.