4 ms·
I’ve always been curious if mangling stdout or stderr can trigger bad actions, when cat-ing a binary file I occasionally see control characters on my prompt, co
by hsbauauvhabzb 4y ago
I’ve always been curious if mangling stdout or stderr can trigger bad actions, when cat-ing a binary file I occasionally see control characters on my prompt, could I get it to somehow type ‘rm -rf /‘?
- junon 4y agoNot unless your shell or terminal emulator somehow have custom escape codes that can do that, no.
- unpopular42 4y agoDefine "custom"
- junon 4y agoE.g. iterm2 has a set of custom escapes that control aspects about the window. https://iterm2.com/documentation-escape-codes.html https://iterm2.com/documentation-escape-codes.html
- unpopular42 4y agoProbably. Might depend on your terminal emulator. See, for instance, CVE-2019-9535
- XMPPwocky 4y agoModern terminals are not supposed to allow things like this (though there are bugs!) There's historically been stuff like "type the window title as if it was text entered on the keyboard"; since you can set the window title with escapes, this allowed Bad Things, and has subsequently been nerfed by major terminals (e.g. iirc xterm just reports "xterm" regardless of what the window title actually is)
- sublinear 4y agoYeah I'm not a fan of the shell script piped to bash trend in readme files. I don't understand why they can't just distribute a package with the same install script.
- hsbauauvhabzb 4y agoThat’s not what I’m questioning at all, but it’s an invalid threat model unless you’ve audited every other file in the wider application