4 ms·

Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newl

Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.

pasta 9y ago
I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it: cd /tmp;<span>rm -R ~/;</span>ls;
- jwilk 9y ago
  At least Firefox 52 doesn't copy the "display: none" stuff. You have to use other means to hide the text.
- teolandon 9y ago
  Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge). It is though, still another reason to be careful when copy pasting. Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it into vim, it goes to normal mode and starts performing commands. Hmm...
  - pasta 9y ago
    Wel I think you can just insert the escape 'character' into the text.
  - jwilk 9y ago
    Here are PoC exploits against various editors: http://www.openwall.com/lists/oss-security/2018/03/05/2 http://www.openwall.com/lists/oss-security/2018/03/05/2 Even pasting to cat(1) might be insecure. The paste can contain ^D, which will make cat quit; then the rest of the paste will be interpeted by shell.
jwilk 9y ago
https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste
sakarisson 9y ago
Yeah, OhMyZsh also warned me on my Mac. I definitely think it is a must for Unix environments.
ubernostrum 9y ago
Don't forget the fun you can have making JavaScript look innocuous: https://www.stefanjudis.com/blog/hidden-messages-in-javascript-property-names/ https://www.stefanjudis.com/blog/hidden-messages-in-javascri...

pasta 9y ago

I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it: cd /tmp;<span>rm -R ~/;</span>ls;

jwilk 9y ago
At least Firefox 52 doesn't copy the "display: none" stuff. You have to use other means to hide the text.
teolandon 9y ago
Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge). It is though, still another reason to be careful when copy pasting. Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it into vim, it goes to normal mode and starts performing commands. Hmm...
- pasta 9y ago
  Wel I think you can just insert the escape 'character' into the text.
- jwilk 9y ago
  Here are PoC exploits against various editors: http://www.openwall.com/lists/oss-security/2018/03/05/2 http://www.openwall.com/lists/oss-security/2018/03/05/2 Even pasting to cat(1) might be insecure. The paste can contain ^D, which will make cat quit; then the rest of the paste will be interpeted by shell.

jwilk 9y ago

https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste

sakarisson 9y ago

Yeah, OhMyZsh also warned me on my Mac. I definitely think it is a must for Unix environments.

ubernostrum 9y ago

Don't forget the fun you can have making JavaScript look innocuous: https://www.stefanjudis.com/blog/hidden-messages-in-javascript-property-names/ https://www.stefanjudis.com/blog/hidden-messages-in-javascri...