Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Oct 2023 18:45:04 +0200
From: Steffen Nurpmeso <>
Subject: Re: with firefox on X11, any page can
 pastejack you anytime

Sam Bull wrote in
 |On Wed, 2023-10-18 at 13:25 -0500, Grant Taylor wrote:
 |> I think that this is more a problem with X11 security than it is a 
 |> problem specific to Mozilla / Firefox.
 |Also a problem with shell security. If you paste something with line \
 |breaks into bash, it
 |executes them. If you paste the same into fish, it doesn't (it'll display \
 |the multi-line
 |input and expect you to hit the enter key to execute it as a command).

That is plain not true, but depends on the "bracketed paste" mode
of readline which in turn depends on the terminal (emulator) and
likely even upon the ncurses library.
See bash(1) (Readline Variables, enable-bracketed-paste, default
on).  Btw Mr. Dickey (ncurses, xterm, vile, etc) has an
informative page on this:

 --End of <>

(Not that it matters, but the MUA i maintain does not yet support
bracketed paste mode, its own yanking mechanism works only like
that though.  I will implement it for v14.10, it is in TODO.)

|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.