oss-sec mailing list archives

Re: Re: with firefox on X11, any page can pastejack you anytime


From: Steffen Nurpmeso <steffen () sdaoden eu>
Date: Fri, 20 Oct 2023 22:30:23 +0200

nightmare.yeah27 () aceecat org wrote in
 <jvb6rc36mumsok24coqvjzthbksnbja7hlewhuxljqx3itwahu@deg2z7j4ztug>:
 |What about people like me who don't use the graphical emulator's
 |paste directly at all but interact via a tmux layer in between?

tmux:

   Dsbp, Enbp
           Disable and enable bracketed paste.  These are set automatically
           if the XT capability is present.

I was curious what happens if i embed the user-proram bracketed-paste end
marker (\x1B[201~) in the X selection, as the terminal i use does
not protect itself from doing anything on the selection data
except changing any \n to \r.  Actually 

  printf 'a\x03\x1b[201~echo du' > .T1
  printf 'a\x1b[201~\x03echo du' > .T2

and then xclip .T[12] and then .. whatever.  bash cannot be
"fooled", but the "a" is then invisible here

  printf 'a\x1b[201~\x03echo du' > .T2
  xclip .T2
  echo du~
^pasted
  -bash: cho: command not found

Dunno since when i can no longer copy-selection etc via tmux
without it actively changing what i want to copy!  'Thus that
printf stuff above.  If that is what you meant :-(

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)


Current thread: