Commit bad change according to semgrep

[howinator]

No description provided.

[detail-semgrep-dev-test-app]

Data is being eval'd from a curl command. An attacker with control of the server in the curl command could inject malicious code into the eval, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>whatever.bash</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L23 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 23] $(curl -L https://raw.githubusercontent.com/something)</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L23 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 23] eval $(curl -L https://raw.githubusercontent.com/something)</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

_{💬 Reply with /semgrep ignore <reason> or triage in Semgrep AppSec Platform to ignore the finding created by curl-eval.}

[detail-semgrep-dev-test-app]

Data is being eval'd from a curl command. An attacker with control of the server in the curl command could inject malicious code into the eval, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>whatever.bash</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L16 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 16] $(curl -L https://raw.githubusercontent.com/something)</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L16 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 16] scrpt</a>"]

            v3["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L18 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 18] scrpt2</a>"]
        end
            v2 --> v3
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L20 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 20] eval ${scrpt2}</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

_{💬 Reply with /semgrep ignore <reason> or triage in Semgrep AppSec Platform to ignore the finding created by curl-eval.}

[detail-semgrep-dev-test-app]

Data is being eval'd from a curl command. An attacker with control of the server in the curl command could inject malicious code into the eval, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>whatever.bash</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L11 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 11] $(curl $SOME_URL)</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L11 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 11] yy</a>"]
        end
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L14 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 14] eval ${yy}</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

_{💬 Reply with /semgrep ignore <reason> or triage in Semgrep AppSec Platform to ignore the finding created by curl-eval.}

[detail-semgrep-dev-test-app]

Data is being eval'd from a curl command. An attacker with control of the server in the curl command could inject malicious code into the eval, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>whatever.bash</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L7 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 7] $(curl -L https://raw.githubusercontent.com/something)</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L7 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 7] x</a>"]
        end
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/howinator/dotfiles/blob/5a31c0ece1fbadf712f723734aeead9f77e64336/whatever.bash#L9 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 9] eval ${x}</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

_{💬 Reply with /semgrep ignore <reason> or triage in Semgrep AppSec Platform to ignore the finding created by curl-eval.}