zlacker

[return to "Detecting the use of "curl | bash" server-side"]

>>rubyn0+(OP)
This is immune to the attack:

    bash -c "$(curl -sSLf $URL)"

The key is to download first and then run

>>jamesc+01
Do you know if

  . <(curl -sL $url)

works (sourcing from a Process Substitution)?