4 ms·
> Pasting into a terminal is interpreted literally, meaning an attacker can hide ;sudo do $really_evil_thing; in innocent looking, pasteable HTML with CSS trick
by Myrmornis 8y ago
> Pasting into a terminal is interpreted literally, meaning an attacker can hide ;sudo do $really_evil_thing; in innocent looking, pasteable HTML with CSS trickery. Therefore, we can’t blindly paste text into a terminal.
It depends on the probability that an "attacker" has done such a thing, which depends on the website among other things.
Sincere question: is it really appropriate that so many of us think in such black and white terms about security? I submit that it is not appropriate to strive for zero-probability-of-being-pwned solutions in all personal computing scenarios; there is a cost benefit analysis always.
- sa46 8y agoAuthor here. I figured it was an easy enough hole to fix that it was worth including. The ZSH line editor will paste without sending the command so you don't really harm usability. Installing dev tools via paste and pipe into sh is fairly common: curl https://sh.rustup.rs -sSf | sh The overall risk is probably really low, but there's no downsides.
- Myrmornis 8y agoCool, I’m sure that’s good advice! I’ve just always been curious about the general question — there’s a large contingent of programmers who role their eyes whenever they see curl|sh and there’s probably an equally large component who think that life’s short and contains more important issues than command line security neuroticism...