chubin / chubin/cheat.sh

cht.sh installation: Add checksum validation

Open
#339 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
41.7k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

Installing shell scripts from the internet might be dangerous. The current install instructions ask users to download a shell script and set the executable bit _without any file verification_ (signature check, hashsum verification, etc.).

```bash
curl https://cht.sh/:cht.sh > "$PATH_DIR/cht.sh"
chmod +x "$PATH_DIR/cht.sh"
```

At least a [checksum verification should be implemented](https://github.com/nightwatchcybersecurity/dont_curl_and_bash/blob/main/METHODS.MD#checksumshashes) to make it more difficult for an attacker to temper with the script.

```bash
curl https://cht.sh/:cht.sh > "$PATH_DIR/cht.sh"
echo "d3135e42b800ff2e7aac44d4dfe500f0f4e2c7eb00a1c2191b0dc8b28431f155 $PATH_DIR/cht.sh" | sha256sum --check -
chmod +x "$PATH_DIR/cht.sh"
```

Please note that in case this is implemented, the hash must be updated if the `cht.sh` script is changed.
I'll add a PR for this that includes the checksum of the current script.

/edit: As mentioned in the link above, the shasum and the source file should live on different servers. So the question is: where is the website currently hosted? Looking up the IP of sheet.sh, it seems the IP is [owned by you](https://dnschecker.org/ip-whois-lookup.php?query=5.9.243.188), @chubin. If GitHub Pages is not used for hosting the website, storing the shasums in a file in the repository would add an additional layer of security since an attacker would need to get access to both, your GitHub account and the server that runs somewhere else.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.