News for hackers. Stuff that matters.
Re:Don't touch my clipboard by oefrha on Monday February 17, 2020 @09:47PM (#22353037)
> plus a newline to make it run immediately

I already mentioned this in another comment, but everyone should enable bracket paste mode in their shell to defend against this.

https://cirw.in/blog/bracketed-paste

Re:Don't touch my clipboard by umvi on Monday February 17, 2020 @11:44PM (#22353518)
I always just type "#" first before pasting... That way it is just a comment I can inspect before running
Re:Don't touch my clipboard by hackmiester on Tuesday February 18, 2020 @12:06AM (#22353611)
Here, paste this into your terminal:

    echo "hello"
    echo "lol" ; sudo sl -rf /
(In case it's not obvious, the # trick will not help you.)
Re:Don't touch my clipboard by umvi on Tuesday February 18, 2020 @12:52PM (#22358214)
True, the comment trick does not work for multi-line pastes
Re:Don't touch my clipboard by jtbayly on Tuesday February 18, 2020 @08:17AM (#22355768)
So... don’t paste it in my terminal?
Re:Don't touch my clipboard by hackmiester on Wednesday February 19, 2020 @04:29PM (#22370291)
heh, yes. Admittedly, immediately after posting, I did change it from 'rm', which would not be a good idea to run, to 'sl', which ... well, try it (or `man sl`), it's fun.
Re:Don't touch my clipboard by dredmorbius on Tuesday February 18, 2020 @03:33AM (#22354414)
If you're using Readline (most Bash or similar shells do), then C-x C-e will invoke the editor, and you can paste the output into that.

Pray for no escape, bang, or control sequences.

(Alternatively: "r! cat <paste> <ctrl>-D" will read into a vim session.)

Examine the output, trim the unwanted / dangerous bits, and run (or save to a file/script).

Since I run what are ... generously ... considered "bash one-liners" all the time, that key sequence is locked into my muscle memory. It's a convenient way to invoke an editor immediately and run code from it.

Re:Don't touch my clipboard by majewsky on Tuesday February 18, 2020 @09:56AM (#22356466)
> :r! cat <paste> <ctrl>-D

Alternatively, call a utility that can read the clipboard directly. For Xorg:

  :r! xsel -b
For Wayland:

  :r! wl-paste
Re:Don't touch my clipboard by dredmorbius on Tuesday February 18, 2020 @10:11AM (#22356572)
That depends on whether or not the clipboard is directly accessible or not. When invoking an editor remotely via SSH, for example, it's not. Though there's often the ability to past into the controlling terminal locally.

I do this frequently on Android via Termux, ssh'ing to remote hosts.

Re:Don't touch my clipboard by chrisweekly on Monday February 17, 2020 @11:57PM (#22353563)
Thanks for the safety net tip. I might be more methodical than most, but in copying commands from external sources (ie, ~anything other than my own code or notes), I paste into a local buffer to examine and confirm contents. I do this as both as a means to generate documentation as well as for hygiene per se -- and it occasionally helps to sanity check my intention and prevent a footgun.
Re:Don't touch my clipboard by oefrha on Tuesday February 18, 2020 @12:10AM (#22353630)
Bracketed paste is basically a local buffer (that won’t be executed unless you explicitly do so).
Re:Don't touch my clipboard by dylan604 on Monday February 17, 2020 @10:42PM (#22353270)
Thanks for this. I had never heard of it before, but will definitely be playing around with it.