5 ms·
This is exactly what I was thinking. Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but u
by axaxs 6y ago
This is exactly what I was thinking.
Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n
- judge2020 6y agoThis can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942 https://security.stackexchange.com/a/113630/96942
- axaxs 6y agoReally interesting(and terrifying) reads, thank you.
- kelnos 6y agoSeems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)
- input_sh 6y agoThey can append the message to whatever you'll actually want to copy, which is how websites used to do things like this. - Copied from https://news.ycombinator.com/item?id=26590437 https://news.ycombinator.com/item?id=26590437
- SilverRed 6y agoThe real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.
- vanviegen 6y agoIs it still possible to paste into vim, for example? If so, how does the terminal make the distinction?
- shakna 6y agoEvery Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0] [0] https://i.imgur.com/ubCXASQ.png https://i.imgur.com/ubCXASQ.png
- PowerBar 6y agoHuh, I've never gotten a prompt like that in Terminator.
- judge2020 6y agoSame for Windows Terminal: https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86wUU.png https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...
- axaxs 6y agoGnome-terminal, probably the largest by user base, does not sadly.