3 ms·
Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Z
by teolandon 9y ago
Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge).
It is though, still another reason to be careful when copy pasting.
Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it into vim, it goes to normal mode and starts performing commands. Hmm...
- pasta 9y agoWel I think you can just insert the escape 'character' into the text.
- jwilk 9y agoHere are PoC exploits against various editors: http://www.openwall.com/lists/oss-security/2018/03/05/2 http://www.openwall.com/lists/oss-security/2018/03/05/2 Even pasting to cat(1) might be insecure. The paste can contain ^D, which will make cat quit; then the rest of the paste will be interpeted by shell.