3 ms·
Using cat with arbitrary input exposes you to many terminal-side security issues. It is insufficiently complex.
by jclulow 6y ago
Using cat with arbitrary input exposes you to many terminal-side security issues. It is insufficiently complex.
- cyberpunk 6y agoSuch as?
- jclulow 6y agoAny vulnerability in the escape sequence handling of the terminal emulator, and conceivably, depending on what sequences your terminal supports, access to facilities like local file generation or clipboard contents. There have been a number of issues with escape sequences injected into things people might copy and paste from a web page, or in git commit histories, that have done nefarious things.
- edgyquant 6y agoCat has long been known to expose you to code execution, among other things. https://security.stackexchange.com/questions/56307/can-cat-ing-a-file-be-a-potential-security-risk https://security.stackexchange.com/questions/56307/can-cat-i...
- cyphar 6y agoAlternatively use "cat -v" and any terminal escape characters will be escaped.
- bawolff 6y agoIt can do some sketchy things and rewrite your terminal in weird confusing ways, but afaik most of the out-and-out malicious escape sequences have been patched out at least a decade ago.