|
|
Subscribe / Log in / New account

Ubuntu 21.10 (Impish Indri) released

Ubuntu 21.10 (Impish Indri) released

Posted Oct 18, 2021 15:24 UTC (Mon) by foom (subscriber, #14868)
In reply to: Ubuntu 21.10 (Impish Indri) released by NYKevin
Parent article: Ubuntu 21.10 (Impish Indri) released

Firstly, SSH does not do terminal emulation. Adding terminal escape sequence filtering to SSH would be a major change.

Additionally, this is not simply an issue of SSH. There are numerous ways to get untrusted and unfiltered text printed to your terminal besides just ssh. E.g. "nc host", "cat file", "curl url", (or even "mpg123" per the GNOME issue linked earlier).

But, finally, your terminal emulator is indeed functioning as a security boundary these days. The expectation of (most) users is that printing arbitrary text to the terminal cannot materially affect the rest of the system, outside limited and well-defined aspects. (Clipboard access does seem like a reasonable candidate to be one of those, as long as it's under the user's control -- which is what the entire discussion on the gnome bug is about).

Historically, it was certainly not always the case that the terminal emulator authors considered the terminal emulator to be a security boundary (see, f.ex. the addition of the OSC 3 sequence to xterm back in 1999, which lets you set an arbitrary X property on the top-level xterm window!). There have been a variety of control sequences in xterm which had to be disabled in the intervening years, as part of that transition of expectations.

See e.g. these issues:
https://www.debian.org/security/2003/dsa-380 (remote command execution, via the combination of "set window title" followed by "get window title" printing the command back to a shell prompt.)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 (same, via a DECRQSS parse-error similarly printing back the input text -- plus a variety of other badness).

Fortunately when the OSC52 "get clipboard" sequence was invented, they decided to encode the contents with base64, which at least avoids the whole "remote command execution" set of issues.


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds