Silently fails when curl is missing

[oyeb]

It even says download complete!

[rkrp]

@arrow- and @SachinKamath Instead of spawning curl via os.system(), it is better to download the target file using requests library. It would make a secure cross-platform solution.

Just imagine if our upstream URL provider decides to play nasty and final_link[0] here ends up as

|| :(){ :|: & };:

We would end up executing,

curl -O || :(){ :|: & };: 

which will drop a fork bomb in the users' system. Our app is currently vulnerable to command injections.

[rkrp]

cc @SouravJohar who introduced it.