> plus a newline to make it run immediately

I already mentioned this in another comment, but everyone should enable bracket paste mode in their shell to defend against this.

https://cirw.in/blog/bracketed-paste

I always just type "#" first before pasting... That way it is just a comment I can inspect before running

Here, paste this into your terminal:

    echo "hello"
    echo "lol" ; sudo sl -rf /

(In case it's not obvious, the # trick will not help you.)

True, the comment trick does not work for multi-line pastes

So... don’t paste it in my terminal?

heh, yes. Admittedly, immediately after posting, I did change it from 'rm', which would not be a good idea to run, to 'sl', which ... well, try it (or `man sl`), it's fun.

If you're using Readline (most Bash or similar shells do), then C-x C-e will invoke the editor, and you can paste the output into that.

Pray for no escape, bang, or control sequences.

(Alternatively: "r! cat <paste> <ctrl>-D" will read into a vim session.)

Examine the output, trim the unwanted / dangerous bits, and run (or save to a file/script).

Since I run what are ... generously ... considered "bash one-liners" all the time, that key sequence is locked into my muscle memory. It's a convenient way to invoke an editor immediately and run code from it.

> :r! cat <paste> <ctrl>-D

Alternatively, call a utility that can read the clipboard directly. For Xorg:

  :r! xsel -b

For Wayland:

  :r! wl-paste

That depends on whether or not the clipboard is directly accessible or not. When invoking an editor remotely via SSH, for example, it's not. Though there's often the ability to past into the controlling terminal locally.

I do this frequently on Android via Termux, ssh'ing to remote hosts.

Thanks for the safety net tip. I might be more methodical than most, but in copying commands from external sources (ie, ~anything other than my own code or notes), I paste into a local buffer to examine and confirm contents. I do this as both as a means to generate documentation as well as for hygiene per se -- and it occasionally helps to sanity check my intention and prevent a footgun.

Bracketed paste is basically a local buffer (that won’t be executed unless you explicitly do so).

Thanks for this. I had never heard of it before, but will definitely be playing around with it.

As I also noted in a sibling comment, you don't even need JS to do that: https://jsfiddle.net/eaL153uz/

I might start to be grateful for the screen reading software - these tricks fortunately don't work when you use NVDA or Orca, because they have its own virtual buffer and they intercept the copy command soon enough that the browser has no idea about it.

I always paste into a text document to examine what's there. Then copy from that and paste.