4 ms·
Is this dangerous if the link is able to inject Bash commands as the value of JS_ARG? If so, that's RCE and that's bad. Is it possible to do this using the HTM
by freeqaz 6y ago
Is this dangerous if the link is able to inject Bash commands as the value of JS_ARG? If so, that's RCE and that's bad.
Is it possible to do this using the HTML5 clipboard functions instead?
- coopsmgoops 6y agoMaybe, but I'm pretty sure browsers block the clipboard functions unless they were triggered via user input. I don't know if a page load counts as a valid trigger.
- bovine3dom 6y ago`document.execCommand("copy")` works without user input - https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand https://developer.mozilla.org/en-US/docs/Web/API/Document/ex....
- earthboundkid 6y agoNope. > Conditions of having this behavior enabled vary from one browser to another, and have evolved over time. If you're not running based on a click event, you'll certainly fail.
- bovine3dom 6y agoPerhaps extension code gets different rules. This code works in Firefox without needing interaction from the user: https://github.com/tridactyl/tridactyl/blob/5e8f94ff06bd5f143732f2dabd32b08dabf1e65a/src/commandline_frame.ts#L349 https://github.com/tridactyl/tridactyl/blob/5e8f94ff06bd5f14...
- earthboundkid 6y agoExtensions get different rules.
- bovine3dom 6y agoJS_ARG here is coming from the user - `:cp [search term]` would be typed interactively into our iframe which pages don't have access to. Tridactyl provides a `:shellescape` function for sanitising untrusted input but I don't think it is needed in this case.