Hacker News Reader

Comment by cortesoft | Hacker News Reader

I think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"

View on HN

> plus a newline to make it run immediately

I already mentioned this in another comment, but everyone should enable bracket paste mode in their shell to defend against this.

https://cirw.in/blog/bracketed-paste

Thanks for this. I had never heard of it before, but will definitely be playing around with it.

I always just type "#" first before pasting... That way it is just a comment I can inspect before running

Here, paste this into your terminal:

    echo "hello"
    echo "lol" ; sudo sl -rf /

(In case it's not obvious, the # trick will not help you.)

So... don’t paste it in my terminal?

heh, yes. Admittedly, immediately after posting, I did change it from 'rm', which would not be a good idea to run, to 'sl', which ... well, try it (or `man sl`), it's fun.

True, the comment trick does not work for multi-line pastes

If you're using Readline (most Bash or similar shells do), then C-x C-e will invoke the editor, and you can paste the output into that.

Pray for no escape, bang, or control sequences.

(Alternatively: "r! cat <paste> <ctrl>-D" will read into a vim session.)

Examine the output, trim the unwanted / dangerous bits, and run (or save to a file/script).

Since I run what are ... generously ... considered "bash one-liners" all the time, that key sequence is locked into my muscle memory. It's a convenient way to invoke an editor immediately and run code from it.

> :r! cat <paste> <ctrl>-D

Alternatively, call a utility that can read the clipboard directly. For Xorg:

  :r! xsel -b

For Wayland:

  :r! wl-paste

That depends on whether or not the clipboard is directly accessible or not. When invoking an editor remotely via SSH, for example, it's not. Though there's often the ability to past into the controlling terminal locally.

I do this frequently on Android via Termux, ssh'ing to remote hosts.

Thanks for the safety net tip. I might be more methodical than most, but in copying commands from external sources (ie, ~anything other than my own code or notes), I paste into a local buffer to examine and confirm contents. I do this as both as a means to generate documentation as well as for hygiene per se -- and it occasionally helps to sanity check my intention and prevent a footgun.

Bracketed paste is basically a local buffer (that won’t be executed unless you explicitly do so).

As I also noted in a sibling comment, you don't even need JS to do that: https://jsfiddle.net/eaL153uz/

I might start to be grateful for the screen reading software - these tricks fortunately don't work when you use NVDA or Orca, because they have its own virtual buffer and they intercept the copy command soon enough that the browser has no idea about it.

I always paste into a text document to examine what's there. Then copy from that and paste.

Reply on news.ycombinator.com