Httpie: http๋Š” bash ๋ฃจํ”„ ๋‚ด์—์„œ ์ž‘๋™ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค

์— ๋งŒ๋“  2013๋…„ 11์›” 23์ผ  ยท  3์ฝ”๋ฉ˜ํŠธ  ยท  ์ถœ์ฒ˜: httpie/httpie

Looks like a leackage.

I have this file, links.txt:
www.google.com?q=1  
www.google.com?q=2  
www.google.com?q=3  
www.google.com?q=4  


Running this:
$ cat links.txt | while read line; do http --print BHhb GET $line; done

Expected result:
4 http calls, one for each line on the file.

Actual:
1 request executed to the first url in the file and request body having the other 3 lines.

GET /?q=1 HTTP/1.1
Accept: application/json
Accept-Encoding: gzip, deflate, compress
Content-Length: 63
Content-Type: application/json; charset=utf-8
Host: www.google.com
User-Agent: HTTPie/0.6.0

www.google.com?q=2
www.google.com?q=3
www.google.com?q=4

HTTP/1.0 400 Bad Request
Content-Length: 925
Content-Type: text/html; charset=UTF-8
Date: Sat, 23 Nov 2013 19:48:51 GMT
Server: GFE/2.0

<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 400 (Bad Request)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}<strong i="5">@media</strong> screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}
  </style>
  <a href=//www.google.com/><img src=//www.google.com/images/errors/logo_sm.gif alt=Google></a>
  <p><b>400.</b> <ins>Thatโ€™s an error.</ins>
  <p>Your client has issued a malformed or illegal request.  <ins>Thatโ€™s all we know.</ins>



Running same script with curl instead works as expected.


cheers!

๊ฐ€์žฅ ์œ ์šฉํ•œ ๋Œ“๊ธ€

HTTPie๊ฐ€ ๋ฆฌ๋””๋ ‰์…˜๋˜๋Š” ๊ฒฝ์šฐ ๊ธฐ๋ณธ์ ์œผ๋กœ STDIN ์ฝ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค(์—ฌ๊ธฐ ๋ฃจํ”„ ๋‚ด๋ถ€์— ์žˆ์Œ).

๊ทธ๊ฒƒ์„ ์ œ๊ฑฐํ•˜๋Š” ๋ฐฉ๋ฒ•์—๋Š” ์—ฌ๋Ÿฌ ๊ฐ€์ง€๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค.

  • ๊ฐ€์žฅ ์ข‹์€ ๋ฐฉ๋ฒ•์€ --ignore-stdin (์ด ๋ฌธ์ œ๋ฅผ ์ •ํ™•ํžˆ ํ•ด๊ฒฐํ•˜๊ธฐ ์œ„ํ•ด ์กด์žฌํ•จ)๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค.
cat links.txt | while read url; do 
        http --ignore-stdin --verbose $url
done
  • ๋˜๋Š” STDIN ๋ฅผ ํ„ฐ๋ฏธ๋„๋กœ ๋‹ค์‹œ ๋ณ€๊ฒฝํ•ฉ๋‹ˆ๋‹ค.
cat links.txt | while read url; do
        http --verbose $url < /dev/tty
done
  • ๋˜๋Š” ์ฒ˜์Œ๋ถ€ํ„ฐ STDIN ๋ฅผ ๋ฆฌ๋””๋ ‰์…˜ํ•˜์ง€ ๋งˆ์‹ญ์‹œ์˜ค(๊ณต๋ฐฑ์— ์ฃผ์˜).
for url in `cat links.txt`; do 
        http --verbose $url
done

#150๋„ ์ฐธ์กฐํ•˜์‹ญ์‹œ์˜ค.

๋ชจ๋“  3 ๋Œ“๊ธ€

HTTPie๊ฐ€ ๋ฆฌ๋””๋ ‰์…˜๋˜๋Š” ๊ฒฝ์šฐ ๊ธฐ๋ณธ์ ์œผ๋กœ STDIN ์ฝ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค(์—ฌ๊ธฐ ๋ฃจํ”„ ๋‚ด๋ถ€์— ์žˆ์Œ).

๊ทธ๊ฒƒ์„ ์ œ๊ฑฐํ•˜๋Š” ๋ฐฉ๋ฒ•์—๋Š” ์—ฌ๋Ÿฌ ๊ฐ€์ง€๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค.

  • ๊ฐ€์žฅ ์ข‹์€ ๋ฐฉ๋ฒ•์€ --ignore-stdin (์ด ๋ฌธ์ œ๋ฅผ ์ •ํ™•ํžˆ ํ•ด๊ฒฐํ•˜๊ธฐ ์œ„ํ•ด ์กด์žฌํ•จ)๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค.
cat links.txt | while read url; do 
        http --ignore-stdin --verbose $url
done
  • ๋˜๋Š” STDIN ๋ฅผ ํ„ฐ๋ฏธ๋„๋กœ ๋‹ค์‹œ ๋ณ€๊ฒฝํ•ฉ๋‹ˆ๋‹ค.
cat links.txt | while read url; do
        http --verbose $url < /dev/tty
done
  • ๋˜๋Š” ์ฒ˜์Œ๋ถ€ํ„ฐ STDIN ๋ฅผ ๋ฆฌ๋””๋ ‰์…˜ํ•˜์ง€ ๋งˆ์‹ญ์‹œ์˜ค(๊ณต๋ฐฑ์— ์ฃผ์˜).
for url in `cat links.txt`; do 
        http --verbose $url
done

#150๋„ ์ฐธ์กฐํ•˜์‹ญ์‹œ์˜ค.

--ignore-stdin์ด ๋‚ด๊ฐ€ ์ฐพ๋˜ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ์„ค์น˜๋œ ์—…๋ฐ์ดํŠธ๋ฅผ ํ•ด์•ผ ํ–ˆ์Šต๋‹ˆ๋‹ค.
๋ฒ„์ „์ด์ง€๋งŒ ์ง€๊ธˆ์€ ์˜ˆ์ƒ๋Œ€๋กœ ์ž‘๋™ํ•˜๋Š” ๊ฒƒ ๊ฐ™์Šต๋‹ˆ๋‹ค.
๋‚˜๋Š” httpie๋ฅผ ์‚ฌ๋ž‘ํ•˜์ง€๋งŒ ์ด ์ž‘์€ ๊ฒƒ์ด ์–ธ์  ๊ฐ€๋Š” ์ดํ•ดํ•˜๊ฒŒ ๋˜์—ˆ์–ด์š”...

๋งค์šฐ ๋น ๋ฅธ ์‘๋‹ต์— ๊ฐ์‚ฌ๋“œ๋ฆฝ๋‹ˆ๋‹ค.
๊ฑด๋ฐฐ!

2013๋…„ 11์›” 23์ผ ํ† ์š”์ผ ์˜คํ›„ 4์‹œ 17๋ถ„, Jakub Roztoฤil [email protected] ์ž‘์„ฑ:

ํ์‡„ #181 https://github.com/jkbr/httpie/issues/181.

โ€”
์ด ์ด๋ฉ”์ผ์— ์ง์ ‘ ๋‹ต์žฅํ•˜๊ฑฐ๋‚˜ Gi tHubhttps://github.com/jkbr/httpie/issues/181 ์—์„œ ํ™•์ธํ•˜์„ธ์š”.
.

ํ•„๋ฆฌํŽ˜ ๊ณ ๋ฉ”์Šค ์—์ŠคํŽ˜๋ž€๋””์˜ค

์ง€ํ†ก: [email protected]
์Šค์นด์ดํ”„: ํ•„๋ฆฝ์ŠคํŽ˜๋ž€๋””์˜ค
Google ๋ณด์ด์Šค: +1 650 701 7057

์•ˆ๋…•ํ•˜์„ธ์š”, ๋น„์Šทํ•œ ๋ฌธ์ œ๊ฐ€ --ignore-stdin ๋ฅผ ํ†ตํ•ด ํ•ด๊ฒฐ๋˜์—ˆ์ง€๋งŒ ์ œ ์ƒํ™ฉ์€ ์•ฝ๊ฐ„ ๋‹ค๋ฆ…๋‹ˆ๋‹ค.

./run.sh http https://base-url/endpoint\?attributes=all\&nested_attribbutes\=all Authorization:Bearer\ bf54b184d7729ac9bfffb576782e2a1d3cd7bd76 Content-Type:application/json Accept:\ \*/\* -h

HTTP/1.1 422 Unprocessable Entity ๋ฅผ ๋ฐ›๊ณ  ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค.

run.sh ์Šคํฌ๋ฆฝํŠธ๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค. seq 5 | xargs -I {} -n1 "$@"

--ignore-stdin ๋ฅผ ์ถ”๊ฐ€ํ•˜๋ฉด ๋ฌธ์ œ๊ฐ€ ํ•ด๊ฒฐ๋˜์ง€๋งŒ STDIN ์˜ ์š”์ฒญ์„ ์ฝ์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ์ด ๋งฅ๋ฝ์—์„œ ์–ด๋–ป๊ฒŒ ์ž‘๋™ํ•˜๋Š”์ง€ ์„ค๋ช…ํ•ด ์ฃผ์‹œ๊ฒ ์Šต๋‹ˆ๊นŒ?

์ด ํŽ˜์ด์ง€๊ฐ€ ๋„์›€์ด ๋˜์—ˆ๋‚˜์š”?
0 / 5 - 0 ๋“ฑ๊ธ‰