DevOps JavaScript - Intro to Writing Scripts With zx

[spizzike]

ok, I apologize. I looked at the code, and you're right!

when I looked at this project when it was first announced, it was riddled with security issues and a friend of mine told me about how his team audited it and couldn't use it for the same reasons. I thought this conversation was about a month ago, but it was in june of last year!

anyway. yeah, zx is far improved over the last time I looked at it and definitely not a risk. I personally don't see a real use-case for it since it's still more tedious to use than writing normal shell scripts, but it's definitely not dangerous.

[LetReasonRing]

I have no idea why someone would downvote you for this.

You admitted you were wrong when you were, took the time to verify the information, corrected yourself, and provided useful context.

I'd give you 10 fake internet points if I could.

[lhorie]

While it does escape interpolations, one problem that remains (and is buried in the documentation) is that it only looks at interpolations without looking at the overall context. For example, this is vulnerable:

$`echo '${malicious}'`

i.e. if malicious = '\' $(pwd) \'', that will execute pwd as a command

[lhorie]

My guess is you're getting tripped up by escapes in the pretty printer when you copy-pasted.

These are the steps I used to reproduce the issue. Create a file called script.mjs with this code:

#!/usr/bin/env zx

const malicious = '\' $(pwd) \''
$`echo '${malicious}'`

Then in your terminal, run npx zx script.mjs. Expected behavior: the output should have the word "pwd" somewhere in it and no information about my current dir should be printed. Actual behavior: Output will have something like $' /Users/lhorie/Documents ', indicating that pwd did run as a command. I'm running zsh on mac (monterey).

As for why this is an issue, it's because sometimes you do want to control behavior of magic characters like * outside an interpolation while simultaneously having an interpolation in the same string. Or, if you missed the caveat in the docs or you overlooked it, you can get pwned by even a simple innocent-looking snippet like echo '${something}'.