[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <E1f6jcD-0002pc-T3@rmmprod07.runbox>
Date: Thu, 12 Apr 2018 17:18:45 -0400 (EDT)
From: "David A. Wheeler" <dwheeler@...eeler.com>
To: "oss-security" <oss-security@...ts.openwall.com>
CC: "oss-security" <oss-security@...ts.openwall.com>
Subject: Re: Re: Terminal Control Chars
On Thu, 12 Apr 2018 11:07:20 -0700, Ian Zimmerman <itz@...y.loosely.org> wrote:
> The term "invisible character" has some obvious (if perhaps informal)
> meaning. But I don't really know what "control character" means. Is a
> page separator (^L) a control character, for example? Is DEL one (ASCII
> 127)?
The term "control character" has a standard definition for every encoding
I'm familiar with. ASCII defined a set of control characters, and
Unicode built on them.
The Unicode list of control characters is here:
https://www.fileformat.info/info/unicode/category/Cc/list.htm
You'll see it includes:
U+0007 BELL
U+0008 BACKSPACE
U+0009 CHARACTER TABULATION
U+000A LINE FEED (LF)
U+000C FORM FEED (FF) (aka ^L)
U+000D CARRIAGE RETURN (CR)
U+007F DELETE
According to Wikipedia <https://en.wikipedia.org/wiki/ASCII>,
the set of control characters in US-ASCII is 00..1F and 7F (hex).
Russ Allbery:
> I think a useful definition of "control character" in this context (and I
> realize this doesn't exactly match the ASCII definition) is a character
> that results in an action other than insertion being taken...
> CR and LF would not be control characters in that definition, since they
> insert a newline and don't cause an action. Similarly, TAB wouldn't be a
> control character in that definition.
As you noted, that definition doesn't match the ASCII definition, but
I also think it's misleading. If someone pastes a CR/LF into a shell prompt,
it certainly *DOES* cause an action, namely, execution of that line.
That's probably not what you meant by "action", but from a security
point-of-view, causing a script to execute is rather important :-).
--- David A. Wheeler
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
