[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [oss-security] Re: Terminal Control Chars
- From: Simon McVittie <smcv AT debian.org>
- Subject: Re: [oss-security] Re: Terminal Control Chars
- Date: Thu, 12 Apr 2018 23:54:41 +0100
- Arc-authentication-results: i=1; mx.google.com; spf=pass (google.com: domain of oss-security-return-24051-oss-security=bentasker.co.uk AT lists.openwall.com designates 22.214.171.124 as permitted sender) smtp.mailfrom=oss-security-return-24051-oss-security=bentasker.co.uk AT lists.openwall.com
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=subject:user-agent:in-reply-to:content-disposition:mime-version :references:message-id:to:from:date:delivered-to:reply-to:list-id :list-subscribe:list-unsubscribe:list-help:list-post:precedence :mailing-list:arc-authentication-results; bh=MLapQUbNrXIa3ay+ZpA7q1T3twN2FneVdTn4ScH6R+s=; b=PNidsMxCB2URecdMGqWg83ufePBbN7MoV5NRCnm1eBXuKiFCWa/fCttZ50fRfPVVxx zzsRZKiBvSfbe4saADxK8Lbm89d4erMpzOUThxHH81D3paPpSe3s2bv73jaUSzPfE+cA AOKERuVKSZ33kbobtcWbqc2ZqzhMjA5fmxukF2AU5KMQj18N1izys6bgiHIYSXJaLRbm C6bKLmU58/OUmRFC1gROL7v/buqQmI/kkeGZtzrKcKz5kBg2euU+ctUP2gmS5hkEhSJ+ USTSf8sUr8gnDOMDrIlkYgAKRo+bVtg3lHQUF+l0pkqGnosYcde+1fqWMo8ghaBpDgEM s/2g==
- Arc-seal: i=1; a=rsa-sha256; t=1523573752; cv=none; d=google.com; s=arc-20160816; b=xEgdXeqcxeExYpWOJ4tmS2l9aWhG5L2LgySmhggrqX7TqxoFCHyGkgcG/Lj/oUYk32 TK1yIQJ226oZ6AU06kKDSwYBmnRefSogIHOzY2I/bzbnA1N5zFwerMtErjoFd+yCh9xF YsHtiHhnCk/tMhunFzil8+0eqFTvx/rZ5xSJ7NCqpwAPLOHoQUr5ykB9FcmfCeCKS3eU HCyO/C4SnaqDKXeLwkVRlXkNXRI1s1XP/F3QBHHwTMnOA/HKGNzyI4Kr1lRrZljbk+wI iE4DNBGWpHVQE564oYAXgb9jhzV34c5FM3viaR8KlvJcRNR4hJy2aJtYB+bsraIjtPAH HvsA==
- Mailing-list: contact oss-security-help AT lists.openwall.com; run by ezmlm
- Reply-to: oss-security AT lists.openwall.com
- To: oss-security AT lists.openwall.com
On Thu, 12 Apr 2018 at 17:18:45 -0400, David A. Wheeler wrote:
> Russ Allbery:
> > I think a useful definition of "control character" in this context (and I
> > realize this doesn't exactly match the ASCII definition) is a character
> > that results in an action other than insertion being taken...
> > CR and LF would not be control characters in that definition
> As you noted, that definition doesn't match the ASCII definition, but
> I also think it's misleading. If someone pastes a CR/LF into a shell prompt,
> it certainly *DOES* cause an action, namely, execution of that line.
I hope you're not proposing that, to protect users of terminal emulators,
general-purpose web browsers should not allow copying more than a
paragraph at a time? That seems like a change that is unlikely to be
Similarly, if filtering of pastes is done at the destination side (the
terminal emulator), it would seem bad to be unable to paste more than
a line at a time into a text editor that happens to be running in a
terminal emulator (for instance the one in which I'm writing this email).
Russ's more loose definition of "control character" (in particular,
preventing copying and/or pasting ESC and the 0x80-0x9F range) would be
enough to protect users of a terminal/shell combination that supports
bracketed paste, as far as I'm aware?