Show HN: Tap curl in your editor before it gets to sh

Re:Show HN: Tap curl in your editor before it gets to sh by semi-extrinsic on Sunday November 13, 2016 @09:58AM (#12943567)

A much better feature is available in zsh, called safe-paste, that does this without the user having to insert "tap" or anything else manually. It relies on something called bracketed paste, where the terminal emulator sends special escape sequences to indicate the beginning and end of a paste. These are intercepted by the zsh plugin, which opens $EDITOR with the pasted content.

https://github.com/robbyrussell/oh-my-zsh/blob/master/plugin...

[ Parent | on HN ]

Re:Show HN: Tap curl in your editor before it gets to sh by JadeNB on Sunday November 13, 2016 @10:52AM (#12943882)

Bracketed paste mode can still be broken by a malicious web-site: https://thejh.net/misc/website-terminal-copy-paste . Does this solution have the same vulnerability?

[ Parent | on HN ]

Re:Show HN: Tap curl in your editor before it gets to sh by semi-extrinsic on Sunday November 13, 2016 @12:28PM (#12944415)

Depends on the terminal emulator you're using, I believe. It (and not zsh) needs to filter out escape sequences.

[ Parent | on HN ]

Re:Show HN: Tap curl in your editor before it gets to sh by tree_of_item on Sunday November 13, 2016 @11:19AM (#12944019)

How is it better? Pasting is a totally different use case from `curl | sh`.

[ Parent | on HN ]

Re:Show HN: Tap curl in your editor before it gets to sh by semi-extrinsic on Sunday November 13, 2016 @12:21PM (#12944374)

Typical use case:

* type "curl <paste>" in zsh, vim opens with "curl <pasted-url>

* inspect URL, if OK in Normal mode do !!zsh<CR> (I assume emacs can also somehow eval current line in shell and replace line with output)

* inspect the code downloaded (still in vim) and then execute it (or save to file then execute).

[ Parent | on HN ]