laravel.build privilege escalation

[eknowlton]

I ran the laravel.build script the other day, instead of the composer install.

curl -s https://laravel.build/example-app | bash

When I ran the install, it finished by asking for my password for elevated permissions ( i'm on Linux ).

My question is, why does this need elevated permissions? Can I see this script somewhere? I'm guessing it has something to do with Sail and docker but I still can't see the need.

Is there a way to disable that?

[eknowlton]

 ➜ curl -s https://laravel.build/donnabel
docker info > /dev/null 2>&1

# Ensure that Docker is running...
if [ $? -ne 0 ]; then
    echo "Docker is not running."

    exit 1
fi

docker run --rm \
    -v $(pwd):/opt \
    -w /opt \
    laravelsail/php80-composer:latest \
    bash -c "laravel new donnabel && cd donnabel && php ./artisan sail:install --with=mysql,redis,meilisearch,mailhog,selenium"

cd donnabel

CYAN='\033[0;36m'
LIGHT_CYAN='\033[1;36m'
WHITE='\033[1;37m'
NC='\033[0m'

echo ""

if sudo -n true 2>/dev/null; then
    sudo chown -R $USER: .
    echo -e "${WHITE}Get started with:${NC} cd donnabel && ./vendor/bin/sail up"
else
    echo -e "${WHITE}Please provide your password so we can make some final adjustments to your application's permissions.${NC}"
    echo ""
    sudo chown -R $USER: .
    echo ""
    echo -e "${WHITE}Thank you! We hope you build something incredible. Dive in with:${NC} cd donnabel && ./vendor/bin/sail up"
fi```

After looking at the script, I guess its because the docker builds the directory as a different user and needs to be changed back to the current user.  

[jonathanstanley]

This seems like a security issue:

• Docs don't mention that this prompt will appear
• The prompt gives only vague explanation ("final adjustments") for what it is doing
• The prompt doesn't give reasoning why this is needed
• The prompt doesn't clarify that this is from Laravel. It just says "your application"