From: Stephane Chazelas <stephane.chazelas@gmail.com>
To: zsh-workers@zsh.org
Subject: Re: bracketed paste mode in xterm and urxvt
Date: Wed, 3 Jun 2015 13:43:51 +0100 [thread overview]
Message-ID: <20150603124351.GD4767@chaz.gmail.com> (raw)
In-Reply-To: <CAHYJk3T3dVdN5qDMecPAH_ALLBYNntW0QVdPMh50Lo_ULeWP6w__21110.9288772152$1433333265$gmane$org@mail.gmail.com>
2015-06-03 14:06:05 +0200, Mikael Magnusson:
[...]
> It's probably worth noting that 'safe-paste' is a bad name for this,
> since the pasted text can include the end-paste escape code, causing
> the rest of the paste to appear to the shell as typed by the user.
>
> This page has an example attack against the plugin,
> https://thejh.net/misc/website-terminal-copy-paste
>
> Hm, seems newer xterm prohibits pasting raw escape codes, so if you
> have one of those versions, you are safe.
[...]
Yes, see:
https://security.stackexchange.com/questions/39118/how-can-i-protect-myself-from-this-kind-of-clipboard-abuse/52655#52655
for details.
Note that with xterm, it's also possible to configure it
to do another safe type of bracketed paste like:
xterm -xrm 'XTerm.VT100.translations: #override Shift <KeyPress> space: insert-formatted("\033[202~%S~%s", CLIPBOARD)'
For the CLIPBOARD selection to be inserted as ^[[202~3~abc (here
upon Shift+Space).
That is with the content of the selection prefixed with its
length (in bytes)
--
Stephane
next parent reply other threads:[~2015-06-03 12:45 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <BANLkTikh_-+L2W5=Yfu7h7iAe5CcpP6fxw@mail.gmail.com>
[not found] ` <CAFOazAOfk=Sq-smkMGzJKO4b7jMb_1_m4vXXn8twoVA2wV55YA@mail.gmail.com>
[not found] ` <55677AF5.50709@thequod.de>
[not found] ` <mk9dc0$p0$1@ger.gmane.org>
[not found] ` <CABZhJg_5p8BLbq82s_wVtsPdD5hVtk-cPg6fNxzbSs4Vg00SOw@mail.gmail.com>
[not found] ` <mkmjfu$3h0$1@ger.gmane.org>
[not found] ` <CAHYJk3T3dVdN5qDMecPAH_ALLBYNntW0QVdPMh50Lo_ULeWP6w__21110.9288772152$1433333265$gmane$org@mail.gmail.com>
2015-06-03 12:43 ` Stephane Chazelas [this message]
2015-06-03 15:31 ` Oliver Kiddle
2015-06-03 20:42 ` Stephane Chazelas
2015-06-03 23:48 ` Oliver Kiddle
2015-06-04 7:15 ` Stephane Chazelas
2015-06-05 10:49 ` Yuri D'Elia
2015-06-05 13:40 ` Oliver Kiddle
2015-06-05 14:35 ` Yuri D'Elia
2015-06-10 0:28 ` Oliver Kiddle
2015-06-10 4:38 ` Bart Schaefer
2015-06-15 22:11 ` Oliver Kiddle
2015-06-15 23:09 ` Mikael Magnusson
2015-06-16 0:20 ` Bart Schaefer
2015-06-16 17:12 ` Oliver Kiddle
2015-06-16 20:26 ` Bart Schaefer
2015-06-17 10:45 ` Oliver Kiddle
2015-06-17 15:04 ` Bart Schaefer
2015-06-10 9:44 ` Yuri D'Elia
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150603124351.GD4767@chaz.gmail.com \
--to=stephane.chazelas@gmail.com \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).