Hacker News Reader

Comment by teolandon | Hacker News Reader

Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.

View on HN

I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it:

  cd /tmp;<span>rm -R ~/;</span>ls;

At least Firefox 52 doesn't copy the "display: none" stuff. You have to use other means to hide the text.

Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge).

It is though, still another reason to be careful when copy pasting.

Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it into vim, it goes to normal mode and starts performing commands. Hmm...

Wel I think you can just insert the escape 'character' into the text.

Here are PoC exploits against various editors:

http://www.openwall.com/lists/oss-security/2018/03/05/2

Even pasting to cat(1) might be insecure. The paste can contain ^D, which will make cat quit; then the rest of the paste will be interpeted by shell.

https://thejh.net/misc/website-terminal-copy-paste

Don't forget the fun you can have making JavaScript look innocuous:

https://www.stefanjudis.com/blog/hidden-messages-in-javascri...

Yeah, OhMyZsh also warned me on my Mac. I definitely think it is a must for Unix environments.

Reply on news.ycombinator.com