A look at terminal emulators, part 1 [LWN.net]

A look at terminal emulators, part 1

Posted Apr 2, 2018 8:41 UTC (Mon) by jwilk (subscriber, #63328)
In reply to: A look at terminal emulators, part 1 by domo
Parent article: A look at terminal emulators, part 1

Enumerating badness usually doesn't end well. There are other control sequences that could be used for code execution (^[^E and ^X^E at least). Proof of concept exploits:

$({ echo; cowsay pwned; }>&2)[201~
[201~Dicowsay pwnedZZ

The latter works only if your editor is terminal-based and uses vi keybindings.

to post comments

A look at terminal emulators, part 1

Posted Apr 3, 2018 14:12 UTC (Tue) by anarcat (subscriber, #66354) [Link] (3 responses)

how about just triggering confirm-paste on any control sequence at all? we have a range for those and while it *is* enumerating badness (somewhat), it seems to me it could just be enough for our cases...

A look at terminal emulators, part 1

Posted Apr 3, 2018 21:30 UTC (Tue) by domo (guest, #14031) [Link] (1 responses)

so perhaps

my $count = ($str =~ tr/[\0-\010\012-\037]//);

i.e. all ascii codes below 32 except tab, to trigger confirm-paste.

A look at terminal emulators, part 1

Posted Apr 4, 2018 13:39 UTC (Wed) by mgedmin (guest, #34497) [Link]

I would also be careful about \233 (CSI). IIRC there are terminal modes (S8C1T) where function keys and such send sequences prefixed with \233 (CS) instead of \033 [ (ESC [).

A look at terminal emulators, part 1

Posted Apr 5, 2018 6:56 UTC (Thu) by pabs (subscriber, #43278) [Link]

An option to always review paste contents would be nice to have in all terminal emulators IMO.

Personally I tend to paste into a GUI text editor before pasting into the terminal.

I sometimes wonder if anyone did any fuzzing of paste routines in those editors.