4 ms·

I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting

I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting, but I'm human and often forget.

db48x 3y ago
Bracketed paste mode!!!1! Seriously, it’s the only safe way to paste into a terminal. When you initiate a paste your terminal emulator sends a control sequence that tells the program that a paste is happening so that it won’t interpret any of it as anything but text to be inserted. It’s completely automatic. And your terminal emulator supports it! So does vim! It’s only be available in xterm for 21 or so years, so I guess it’s not _that_ surprising to find that people still don’t know about it.
- dgl 3y ago
  (Author of the original paper here.) Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh. Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances. For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]: disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out. [1]: https://www.openwall.com/lists/oss-security/2023/10/20/2 https://www.openwall.com/lists/oss-security/2023/10/20/2 [2]: https://www.openwall.com/lists/oss-security/2023/10/20/4 https://www.openwall.com/lists/oss-security/2023/10/20/4 [3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd130fcffa300d9be8f6e76ddfc https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...
  - db48x 3y ago
    And of course the kernel immediately handles the ^C as if it were typed, if the terminal is in cooked mode. Fun. At least that doesn’t work inside of a proper editor.

I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting, but I'm human and often forget.

db48x 3y ago

Bracketed paste mode!!!1! Seriously, it’s the only safe way to paste into a terminal. When you initiate a paste your terminal emulator sends a control sequence that tells the program that a paste is happening so that it won’t interpret any of it as anything but text to be inserted. It’s completely automatic. And your terminal emulator supports it! So does vim! It’s only be available in xterm for 21 or so years, so I guess it’s not _that_ surprising to find that people still don’t know about it.

dgl 3y ago
(Author of the original paper here.) Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh. Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances. For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]: disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out. [1]: https://www.openwall.com/lists/oss-security/2023/10/20/2 https://www.openwall.com/lists/oss-security/2023/10/20/2 [2]: https://www.openwall.com/lists/oss-security/2023/10/20/4 https://www.openwall.com/lists/oss-security/2023/10/20/4 [3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd130fcffa300d9be8f6e76ddfc https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...
- db48x 3y ago
  And of course the kernel immediately handles the ^C as if it were typed, if the terminal is in cooked mode. Fun. At least that doesn’t work inside of a proper editor.