curl | sh installer is poorly executed.

kevincox commented 3 years ago

It will execute whatever happens to be at /tmp/tunshell/client and on most systems /tmp is world-writable.
It is not wrapped in a function so incomplete downloads may have surprising results.

Possible fixes:

Don't. Ideally an SSH port would just be provided and an ssh command line can be shown.
Download the client to somewhere user owned such as $XDG_CACHE_HOME.
Check that the /tmp/tunshell directory is owned by the current user before executing code from it.

TimeToogo commented 3 years ago

Thanks for the feedback, please see PR #21

TimeToogo commented 3 years ago

Closed with #21

TimeToogo / tunshell