Re:Don't Copy-Paste from Website to Terminal
by oelmekki on Monday April 08, 2013 @02:40AM
(#5510288)
> This is really just an extension of clickjacking
That's was my first thought too, but in fact, it's quite the reverse of clickjacking (even though the same basic idea is used).
With clickjacking, you would positionate some opacity:0 link on top of some apparently legit link. Here, on the contrary, the malicious content is within the apparently legit content, then moved away with css (setting opacity to 0 would not do the trick).
Not a big difference, but that would deserve a dedicated name, IMO.
Re:Don't Copy-Paste from Website to Terminal
by icebraining on Sunday April 07, 2013 @04:06PM
(#5508516)
Even if the shell had such protection, they could just do 'evil command && visible command'.
If the shell had a protection against text pasted together with an ending newline (and would just strip that newline), it would help, I think.
It would be an interesting experiment to sneak a harmless command after every snippet on a site like commandlinefu.com.
Edit: Also while playing around, I remembered irssi actually has a defense against this. If you try pasting multiple lines, it can detect this. It presents you with a prompt asking if you really intended to paste >5 lines into the text field. I wonder if something like this could be implemented in a shell?