3 ms·

local fake_clipboard=/tmp/clipboard-data.txt if is-ssh && is-port-in-use $clipper_port; then # Pipe to the clipper instance and the fake clipboard. te

by jwilk 9y ago

local fake_clipboard=/tmp/clipboard-data.txt if is-ssh && is-port-in-use $clipper_port; then # Pipe to the clipper instance and the fake clipboard. tee >(nc localhost $clipper_port) "$fake_clipboard" This is not a secure use of /tmp; and in general /tmp is not suitable for such inter-process communication. Please create the fake clipboard file somewhere in the user's home directory.

sa46 9y ago
Why is /tmp not suitable for IPC? Is it because it's generally more open than a home directory?
- harrygeez 9y ago
  Probably because everyone can access your clipboard
- cxseven 9y ago
  Someone could put a symlink at that location to direct the output to clobber or create a file under your control.
- stevekemp 9y ago
  First of all because anybody can read the contents of files there - presuming you don't have a sane umask. Secondly because other uesrs might create files. Imagine somebody ran: ln -s /home/foo/.bash_profile /tmp/clipboard-data.txt The next time you ran your clipboard-script your .bash_profile file would get its contents erased, due to the symlink. Predictable filenames are a big security hole for multiuser systems, even though in practice you're probably the sole user of your desktop/laptop. I've reported numerous bugs of this kind, including this small set against GNU emacs: http://seclists.org/oss-sec/2014/q2/269 http://seclists.org/oss-sec/2014/q2/269
sedachv 9y ago
> Please create the fake clipboard file somewhere in the user's home directory. /tmp works perfectly fine for this purpose: local fake_clipboard=$(mktemp) See mktemp(1), mkstemp(3), and mkdtemp(3). Please stop spreading these rumors that mislead people into writing programs that leave trash in my home directory. The real issue with that code is the fact that Clipper is configured to listen on a TCP port instead of a socket file (placed in a /tmp subdirectory created by mktemp -d, of course).
- jwilk 9y ago
  > local fake_clipboard=$(mktemp) So every time you copy or paste a new clipboard will be created. That defeats the purpose of clipboard.
  - sedachv 9y ago
    That is what environment variables are for.
PuercoPop 9y ago
> in general /tmp is not suitable for such inter-process communication. Yeah, it is not like X11 uses it for precisely that purpose or anything. ^_^

by jwilk 9y ago

sa46 9y ago

Why is /tmp not suitable for IPC? Is it because it's generally more open than a home directory?

harrygeez 9y ago
Probably because everyone can access your clipboard
cxseven 9y ago
Someone could put a symlink at that location to direct the output to clobber or create a file under your control.
stevekemp 9y ago
First of all because anybody can read the contents of files there - presuming you don't have a sane umask. Secondly because other uesrs might create files. Imagine somebody ran: ln -s /home/foo/.bash_profile /tmp/clipboard-data.txt The next time you ran your clipboard-script your .bash_profile file would get its contents erased, due to the symlink. Predictable filenames are a big security hole for multiuser systems, even though in practice you're probably the sole user of your desktop/laptop. I've reported numerous bugs of this kind, including this small set against GNU emacs: http://seclists.org/oss-sec/2014/q2/269 http://seclists.org/oss-sec/2014/q2/269

sedachv 9y ago

> Please create the fake clipboard file somewhere in the user's home directory. /tmp works perfectly fine for this purpose: local fake_clipboard=$(mktemp) See mktemp(1), mkstemp(3), and mkdtemp(3). Please stop spreading these rumors that mislead people into writing programs that leave trash in my home directory. The real issue with that code is the fact that Clipper is configured to listen on a TCP port instead of a socket file (placed in a /tmp subdirectory created by mktemp -d, of course).

jwilk 9y ago
> local fake_clipboard=$(mktemp) So every time you copy or paste a new clipboard will be created. That defeats the purpose of clipboard.
- sedachv 9y ago
  That is what environment variables are for.

PuercoPop 9y ago

> in general /tmp is not suitable for such inter-process communication. Yeah, it is not like X11 uses it for precisely that purpose or anything. ^_^