3 ms·
Good thing Linux users are dragging Windows back to, checks notes, 1978. https://en.wikipedia.org/wiki/VT100 https://en.wikipedia.org/wiki/VT100 Defeating 37
by jodrellblank 6y ago
Good thing Linux users are dragging Windows back to, checks notes, 1978.
https://en.wikipedia.org/wiki/VT100 https://en.wikipedia.org/wiki/VT100
Defeating 37 years of separating content from presentation
https://en.wikipedia.org/wiki/Separation_of_content_and_presentation https://en.wikipedia.org/wiki/Separation_of_content_and_pres... (LaTeX)
So we can embedd garbage in strings again! Causing effects like this:
https://github.com/PowerShell/PowerShell/issues/13071 https://github.com/PowerShell/PowerShell/issues/13071
"On Linux, if you use ls --color then different file types use ANSI escape sequences as color indicators. If you pipe this output to less, then you get paging while retaining the color information. If you redirect this output to a file, that file contains the ANSI escape sequences. If you then use the cat command on the file, you see the coloring as the ANSI escape sequences are rendered by the terminal."
Interpreting commands from log messages! Because we haven't learned from history:
https://en.wikipedia.org/wiki/SQL_injection https://en.wikipedia.org/wiki/SQL_injection
A glorious future awaits.
- dragonwriter 6y agoSQL and VT100 have rather different capabilities.
- jodrellblank 6y agoinb4 the first discovery of a program which "doesn't log plain text passwords" by logging them with the foreground colour set to the background color. And then the one which exploits a terminal for arbitrary command execution with a buffer overflow in the VT escape code parser. Wait, what am I talking about "inb4", that happened already and it didn't even need a buffer overflow: https://www.proteansec.com/linux/blast-past-executing-code-terminal-emulators-via-escape-sequences/ https://www.proteansec.com/linux/blast-past-executing-code-t... > "mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator."
- majkinetor 6y ago> Good thing Linux users are dragging Windows back to, checks notes, 1978. Indeed, there are some non-millennial shenanigans here.