Run scripts from the Internet more securely than `curl | bash` (experimental)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

77 lines
1.9 KiB

#!/usr/bin/env python3
import requests
import subprocess
import sys
import os
import argparse
import shlex
def launch(command, data):
if isinstance(command, str):
command = [command]
elif isinstance(command, tuple):
command = list(command)
elif not isinstance(command, list):
raise ValueError("`command` must be `list`, `tuple`, or `str`")
return subprocess.run(command, input=data)
def yn(question, options="yn"):
options = options.lower()
options_display = f"[{'/'.join(options)}]"
full_question = f"{question} {options_display} "
response = "WILL NEVER OCCUR IN OPTIONS"
while not response in options:
response = input(full_question).lower().strip()[0]
return response
parser = argparse.ArgumentParser(
description="Securely run a script from the Internet"
)
parser.add_argument("url", help="URL of the script")
parser.add_argument(
"-s",
"--skip-pager",
action="store_true",
help="Skip pager and confirmation; run script immediately",
)
parser.add_argument(
"-p",
"--pager",
help="Choose pager to use (default: `less`)",
default="less",
)
parser.add_argument(
"-i",
"--interpreter",
help="Choose interpreter to use (default: `bash`)",
default="bash",
)
args = parser.parse_args()
url = args.url
pager = shlex.split(args.pager)
interpreter = shlex.split(args.interpreter)
print(f"Downloading `{url}`...")
content = requests.get(url).content
print("Download successful.")
print("=" * os.get_terminal_size().columns)
if args.skip_pager:
launch(interpreter, content)
else:
launch(pager, content)
response = yn("Do you want to run this script?")
if response == "y":
print("=" * os.get_terminal_size().columns)
launch(interpreter, content)
else:
print("=" * os.get_terminal_size().columns)
print("Script not run.")