• 1 Post
  • 149 Comments
Joined 1 year ago
cake
Cake day: September 22nd, 2025

help-circle







  • eleijeep@piefed.socialtoLinux@lemmy.ml•BSOD
    link
    fedilink
    English
    arrow-up
    0
    ·
    14 days ago

    Oh I see. If the URL puts the sensitive information after the anchor, like https://example.com/bsod#sensitive-info-goes-here then the browser would never send that part to the server. Everything after the anchor is just used locally by the browser to scroll the page to a specific place (or in this case for the javascript to read and process).

    You’d need to check every time you scan a QR code though that the # is in the URL and it’s not malformed. Trivially replacing the # with a ? would turn the private URL into one that sends all the data in the GET request. It’s training users to do something risky.

    Oh and it also assumes that the javascript hasn’t been tampered with to upload the data somewhere.

    I don’t like it.











  • Some solutions:

    set -e  
    TEMPDIR=$(mktemp -d)  
    # script exits if mktemp returns error  
    

    or

    TEMPDIR=$(mktemp -d || echo "/invalid")  
    # TEMPDIR gets the value "/invalid" if mktemp fails  
    

    or

    TEMPDIR=$(mktemp -d)  
    TEMPDIR=${TEMPDIR:-"/invalid"}  
    # TEMPDIR gets the value "/invalid" if mktemp returns an empty value  
    

    or

    TEMPDIR=$(mktemp -d)  
    rm -rf ${TEMPDIR:-"/invalid"}  
    # rm is passed "/invalid" if TEMPDIR is empty  
    

    My personal preference is the last one. Any time you call rm -rf you provide a default value to variables to ensure that if they are empty they get some other value instead.