zlacker

This is immune to the attack:

    bash -c "$(curl -sSLf $URL)"

The key is to download first and then run

>>jamesc+(OP)
Or better yet:

curl $URL

less $FILE

bash $FILE

This attack only works at all if you download something and execute it immediately without looking at it.

>>jamesc+(OP)
Do you know if

  . <(curl -sL $url)

works (sourcing from a Process Substitution)?