5 ms·

Who pastes something and executes it without a second look?

throwaway71271 3y ago
thats kind of unfair, when you select something and you are confident what is selected, pasting with middle button and hitting enter can be milliseconds apart you already decided to hit enter while you are selection something, could be just a bit above your current cursor in the terminal
whatwhaaaaat 3y ago
Have you never pasted a new line?
- jowea 3y ago
  There are terminals that have protections against that AFAIK.
  - kzrdude 3y ago
    `set enable-bracketed-paste on` in .inputrc (at least compatible with bash, terminal also needs support)
  - paulddraper 3y ago
    I'm sure they exist. Gnome shell doesn't AFAIK. It's an odd thing to protect from; any program that has access to the X11 clipboard is going to be able to run a process as the current user.
    - bilkow 3y ago
      gnome-terminal does support bracketed paste[0], and both bash 5.1 and zsh 5.1 enable it by default, so if you paste into it it will input a newline in the prompt instead of executing the command [0] https://en.m.wikipedia.org/wiki/Bracketed-paste https://en.m.wikipedia.org/wiki/Bracketed-paste
      - paulddraper 3y ago
        Thanks
jowea 3y ago
People on a hurry and the uninformed that still haven't heard that you can end up with malicious stuff on the clipboard if you haven't careful e.g. someone who inspects the text "systemctl restart cups" on the webpage, concludes it's what they want to run, then copies it straight to the terminal without noticing the web page was hiding malicious code in invisible text.
ndriscoll 3y ago
Why is it so easy to find people in this industry who don't care that users can't trust their own computers (or, by extension, anything they own with a computer in it, which is quickly becoming everything)? If I select some text and press Ctrl+C, it should copy the text I selected. The user intent is obvious. There's no excuse for the ability to hijack the clipboard to exist in the first place. Web pages shouldn't be able to modify my selection. Why is there even an API for this? The web ecosystem (including browsers) turned straight up malicious like 15 years ago, and users became nothing more than a product for everyone involved. That cancer has even metastasized and spread to the OS or even products that people pay thousands or tens of thousands of dollars for. I don't know how people who think that way can live with themselves.
- xigoi 3y ago
  > Web pages shouldn't be able to modify my selection. Why is there even an API for this? To make “copy to clipboard” buttons possible.
  - dotancohen 3y ago
    Does not sound like a worthwhile trade-off.
  - ndriscoll 3y ago
    I have a copy to clipboard button that's standard across all apps and has decades of precedence: Ctrl+c. Some (older?) keyboards even label it! On my phone, if I select text, my browser pops up a menu with "copy" as an option. Why does a web page need to reinvent that wheel? For the 1/10000000 case where it makes sense, how about a "X page wants to modify your clipboard" dialog? This has been a known security vulnerability for at least a decade. Edit: actually, I just noticed that was a reply to selection, which makes even less sense. Just let the user select what they want.
    - xigoi 3y ago
      When copying Unicode characters from sites like symbl.cc, it would be incredibly annoying to have to select them and press Ctrl+C instead of just pressing a single button.
teo_zero 3y ago
If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed. In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.
- Zetobal 3y ago
  #
- knickersniffer 3y ago
  No it does not scroll. Run bash in script(1) then check the typescript.

thats kind of unfair, when you select something and you are confident what is selected, pasting with middle button and hitting enter can be milliseconds apart you already decided to hit enter while you are selection something, could be just a bit above your current cursor in the terminal

whatwhaaaaat 3y ago

Have you never pasted a new line?

jowea 3y ago
There are terminals that have protections against that AFAIK.
- kzrdude 3y ago
  `set enable-bracketed-paste on` in .inputrc (at least compatible with bash, terminal also needs support)
- paulddraper 3y ago
  I'm sure they exist. Gnome shell doesn't AFAIK. It's an odd thing to protect from; any program that has access to the X11 clipboard is going to be able to run a process as the current user.
  - bilkow 3y ago
    gnome-terminal does support bracketed paste[0], and both bash 5.1 and zsh 5.1 enable it by default, so if you paste into it it will input a newline in the prompt instead of executing the command [0] https://en.m.wikipedia.org/wiki/Bracketed-paste https://en.m.wikipedia.org/wiki/Bracketed-paste
    - paulddraper 3y ago
      Thanks

jowea 3y ago

People on a hurry and the uninformed that still haven't heard that you can end up with malicious stuff on the clipboard if you haven't careful e.g. someone who inspects the text "systemctl restart cups" on the webpage, concludes it's what they want to run, then copies it straight to the terminal without noticing the web page was hiding malicious code in invisible text.

ndriscoll 3y ago

Why is it so easy to find people in this industry who don't care that users can't trust their own computers (or, by extension, anything they own with a computer in it, which is quickly becoming everything)? If I select some text and press Ctrl+C, it should copy the text I selected. The user intent is obvious. There's no excuse for the ability to hijack the clipboard to exist in the first place. Web pages shouldn't be able to modify my selection. Why is there even an API for this? The web ecosystem (including browsers) turned straight up malicious like 15 years ago, and users became nothing more than a product for everyone involved. That cancer has even metastasized and spread to the OS or even products that people pay thousands or tens of thousands of dollars for. I don't know how people who think that way can live with themselves.

xigoi 3y ago
> Web pages shouldn't be able to modify my selection. Why is there even an API for this? To make “copy to clipboard” buttons possible.
- dotancohen 3y ago
  Does not sound like a worthwhile trade-off.
- ndriscoll 3y ago
  I have a copy to clipboard button that's standard across all apps and has decades of precedence: Ctrl+c. Some (older?) keyboards even label it! On my phone, if I select text, my browser pops up a menu with "copy" as an option. Why does a web page need to reinvent that wheel? For the 1/10000000 case where it makes sense, how about a "X page wants to modify your clipboard" dialog? This has been a known security vulnerability for at least a decade. Edit: actually, I just noticed that was a reply to selection, which makes even less sense. Just let the user select what they want.
  - xigoi 3y ago
    When copying Unicode characters from sites like symbl.cc, it would be incredibly annoying to have to select them and press Ctrl+C instead of just pressing a single button.

teo_zero 3y ago

If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed. In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.

Zetobal 3y ago
#
knickersniffer 3y ago
No it does not scroll. Run bash in script(1) then check the typescript.