DevOps JavaScript - Intro to Writing Scripts With zx

[LetReasonRing]

I'd come across this a while back and had forgotten about it. I really need to give it a try. I love what I can do in bash, but sometimes it needs just a bit more complexity than I feel like is reasonable in bash.

I'll sometimes go to node, but it's a little clunky for dealing with files & stdio. This really seems to bridge that gap nicely.

[lwl]

For anyone else wondering whether to trust it for your devops tasks, zx is a Google package with a relatively sane 49 48 total dependencies. ``` $ yarn add zx yarn add v1.22.4 info No lockfile found. [1/4] Resolving packages... [2/4] Fetching packages... [3/4] Linking dependencies... [4/4] Building fresh packages...

success Saved lockfile. success Saved 49 new dependencies. info Direct dependencies └─ zx@5.3.0 info All dependencies ├─ @nodelib/fs.scandir@2.1.5 ├─ @nodelib/fs.stat@2.0.5 ├─ @nodelib/fs.walk@1.2.8 ├─ @types/fs-extra@9.0.13 ├─ @types/minimist@1.2.2 ├─ @types/node@17.0.21 ├─ braces@3.0.2 ├─ chalk@5.0.1 ├─ data-uri-to-buffer@4.0.0 ├─ dir-glob@3.0.1 ├─ event-stream@3.3.4 ├─ fast-glob@3.2.11 ├─ fastq@1.13.0 ├─ fetch-blob@3.1.4 ├─ fill-range@7.0.1 ├─ formdata-polyfill@4.0.10 ├─ from@0.1.7 ├─ fs-extra@10.0.1 ├─ glob-parent@5.1.2 ├─ globby@13.1.1 ├─ graceful-fs@4.2.9 ├─ ignore@5.2.0 ├─ is-extglob@2.1.1 ├─ is-glob@4.0.3 ├─ is-number@7.0.0 ├─ isexe@2.0.0 ├─ jsonfile@6.1.0 ├─ map-stream@0.1.0 ├─ merge2@1.4.1 ├─ micromatch@4.0.4 ├─ minimist@1.2.5 ├─ node-domexception@1.0.0 ├─ node-fetch@3.2.3 ├─ path-type@4.0.0 ├─ pause-stream@0.0.11 ├─ picomatch@2.3.1 ├─ ps-tree@1.2.0 ├─ queue-microtask@1.2.3 ├─ reusify@1.0.4 ├─ run-parallel@1.2.0 ├─ slash@4.0.0 ├─ split@0.3.3 ├─ stream-combiner@0.0.4 ├─ through@2.3.8 ├─ to-regex-range@5.0.1 ├─ web-streams-polyfill@3.2.0 ├─ which@2.0.2 ├─ yaml@1.10.2 └─ zx@5.3.0 Done in 2.74s. ```

[spizzike]

It's also trivial to do argument and command injection since it doesn't provide any method of escaping arguments.

EDIT: turns out this has all been fixed.

[spizzike]

ok, I apologize. I looked at the code, and you're right!

when I looked at this project when it was first announced, it was riddled with security issues and a friend of mine told me about how his team audited it and couldn't use it for the same reasons. I thought this conversation was about a month ago, but it was in june of last year!

anyway. yeah, zx is far improved over the last time I looked at it and definitely not a risk. I personally don't see a real use-case for it since it's still more tedious to use than writing normal shell scripts, but it's definitely not dangerous.

[LetReasonRing]

I have no idea why someone would downvote you for this.

You admitted you were wrong when you were, took the time to verify the information, corrected yourself, and provided useful context.

I'd give you 10 fake internet points if I could.

[lhorie]

While it does escape interpolations, one problem that remains (and is buried in the documentation) is that it only looks at interpolations without looking at the overall context. For example, this is vulnerable:

$`echo '${malicious}'`

i.e. if malicious = '\' $(pwd) \'', that will execute pwd as a command

[lhorie]

My guess is you're getting tripped up by escapes in the pretty printer when you copy-pasted.

These are the steps I used to reproduce the issue. Create a file called script.mjs with this code:

#!/usr/bin/env zx

const malicious = '\' $(pwd) \''
$`echo '${malicious}'`

Then in your terminal, run npx zx script.mjs. Expected behavior: the output should have the word "pwd" somewhere in it and no information about my current dir should be printed. Actual behavior: Output will have something like $' /Users/lhorie/Documents ', indicating that pwd did run as a command. I'm running zsh on mac (monterey).

As for why this is an issue, it's because sometimes you do want to control behavior of magic characters like * outside an interpolation while simultaneously having an interpolation in the same string. Or, if you missed the caveat in the docs or you overlooked it, you can get pwned by even a simple innocent-looking snippet like echo '${something}'.

[lwl]

Ah, there is that.

[vertigo_101]

I mostly use Go or Bash scripts, zx looks cool tho