Skip to content Skip to footer
0 items - $0.00 0

Show HN: Uncurl.dev – Convert curl commands to a shareable, executable UI by darubramha

Show HN: Uncurl.dev – Convert curl commands to a shareable, executable UI by darubramha

16 Comments

  • Post Author
    h1fra
    Posted April 7, 2025 at 3:49 pm

    Interesting. Default behavior could be improved. I blindly pasted a curl, except showing my curl it didn't make any headers modifiable. It also didn't redacted the Authorization header.
    Also there is no way to delete a page.

  • Post Author
    niek_pas
    Posted April 7, 2025 at 4:05 pm

    Looks cool! One bug I found:

    `curl http://www.google.com` works using 8.7.1 on macOS, but I get "Please enter a valid curl command" on your website.

  • Post Author
    ajnin
    Posted April 7, 2025 at 4:17 pm

    Hum I'm definitely not the target for this but I don't see the value to obfuscate all the info in an UUID, I'd have kept things simple and stored things into an URL fragment, that way it's possible to operate client-side only and nothing gets leaked to a server I don't know much about like headers or whatever tokens or API keys could be passed in an URL.

  • Post Author
    Tabular-Iceberg
    Posted April 7, 2025 at 4:19 pm

    It seems very particular about what curl options it supports. I keep getting “Please enter a valid curl command” no matter what I do.

    Maybe the only solution is to somehow extract the actual command line parser from curl itself.

  • Post Author
    VWWHFSfQ
    Posted April 7, 2025 at 4:29 pm

    This would be useful if it was client-side only. I only very rarely have curl commands to run that don't also include some stuff like cookies and tokens, which I'm not sending to someone's server so they can run curl for me.

  • Post Author
    treesknees
    Posted April 7, 2025 at 5:06 pm

    This is why in our codebase we have a rule to not use short options/flags for called commands like curl. And if there is only a short option available, it must be explained in a code comment.

  • Post Author
    polishdude20
    Posted April 7, 2025 at 5:28 pm

    Why the need for an account to execute? Are you executing the command on behalf of the user on your server? Is it possible to just do it locally in browser?

  • Post Author
    flipperto
    Posted April 7, 2025 at 6:15 pm

    While it looks good and even possibly useful, it seems to be a great way to leak sensitive cookies (especially since "copy as cURL" is so easy on the browser's network tab).

    I would 100% forbid its use in a company environment and I would encourage people in general not to use it for any non-trivial use case.

  • Post Author
    ustad
    Posted April 7, 2025 at 6:36 pm

    Hey, that looks great.

    Could you describe more about the docker sandbox that you have? I am especially interested in the network restrictions.

  • Post Author
    benoitg
    Posted April 7, 2025 at 6:36 pm

    The Jetbrains suite of IDEs have this handy feature : if you copy a curl command into an HTTP scratch file, it is automatically converted to the HTTP equivalent, which is IMHO much more readable.

    Your project looks very cool though, and expands on the share aspect of the Jetbrains feature, very interesting!

  • Post Author
    fitsumbelay
    Posted April 7, 2025 at 6:59 pm

    This is a pretty cool project.

    One thing: it's rejecting dict lookups as invalid URL,
    eg. `curl dict://dict.org/d:failure:fd-eng-fra`

    I'm checking first here whether I missed something in the docs about not supporting DICT before I add issue to the GH repo

  • Post Author
    lenkite
    Posted April 7, 2025 at 7:01 pm

    Feels like a security nightmare – this is far better distributed as a local desktop UI rather than one hosted.

  • Post Author
    byearthithatius
    Posted April 7, 2025 at 7:26 pm

    I already accidentally uploaded a cookie that I now need to reset because the website doesn't let me delete the curl -_-

  • Post Author
    byearthithatius
    Posted April 7, 2025 at 7:28 pm

    This is just waiting for people to leak cookies oh my lord….

  • Post Author
    trollied
    Posted April 7, 2025 at 7:54 pm

    Flagged this because it is a security clusterfuck.

  • Post Author
    markerz
    Posted April 7, 2025 at 8:02 pm

    Hey OP, your DELETE curl endpoint is unauthenticated! I can't DM you on HN and there's no contact on your website, so sorry for the public security disclosure. :(

Leave a comment

In the Shadows of Innovation”

© 2025 HackTech.info. All Rights Reserved.

Sign Up to Our Newsletter

Be the first to know the latest updates

Whoops, you're not connected to Mailchimp. You need to enter a valid Mailchimp API key.