Don't Copy-Paste from Website to Terminal

Re:Don't Copy-Paste from Website to Terminal by joliss on Sunday April 07, 2013 @03:42PM (#5508403)

I suspect that the only way to effectively mitigate this is in the terminal application, by displaying a confirmation with the pasted text before accepting any multi-line[1] paste. For example here: https://code.google.com/p/iterm2/issues/detail?id=594

[1] There may be other dangerous characters besides newlines, e.g. escape sequences. I'm not sure if it's possible to make an exhaustive list for something like Bash. Perhaps one has to guard against any paste?

[ Parent | on HN ]

Re:Don't Copy-Paste from Website to Terminal by jakub_g on Sunday April 07, 2013 @05:21PM (#5508820)

It's still possible to circumvent this by creating a one-liner using semicolons. Just grab a code like [2] and append `; rm -rf` to the selection. If the original selection was a one-liner, it'll still be.

[2] http://stackoverflow.com/a/4777746/

[ Parent | on HN ]

Re:Don't Copy-Paste from Website to Terminal by joliss on Sunday April 07, 2013 @05:55PM (#5508932)

My idea was that if you're pasting a single line, then at least you can review the command you pasted before hitting enter.

[ Parent | on HN ]

Re:Don't Copy-Paste from Website to Terminal by jakub_g on Monday April 08, 2013 @02:59PM (#5513721)

I've just realized that you meant the fact that multiline pastes are often immediately executed, right?

I've tried various ways of input to my console (MINGW/WinXP) for multiline pastes, and the results are as follows: 1. Right-click multiline paste: unsafe (executes immediately) 2. Windows paste (alt-space, e, p): unsafe (executes immediately) 3. Insert or Shift-Insert: safe (pastes only the first line)

[ Parent | on HN ]

Re:Don't Copy-Paste from Website to Terminal by TheJH_ on Sunday April 07, 2013 @04:54PM (#5508707)

That sounds like a really good approach.

[ Parent | on HN ]