I’ve always been curious if mangling stdout or stderr can trigger bad actions, when cat-ing a binary file I occasionally see control characters on my prompt, could I get it to somehow type ‘rm -rf /‘?
Modern terminals are not supposed to allow things like this (though there are bugs!)
There's historically been stuff like "type the window title as if it was text entered on the keyboard"; since you can set the window title with escapes, this allowed Bad Things, and has subsequently been nerfed by major terminals (e.g. iirc xterm just reports "xterm" regardless of what the window title actually is)
There's a lot of people in today's lucky 10,000[1]. "Terminal Bell" is a rarely used feature nowadays, because we've grown out of it, and yet - It's commonly supported. Hopefully from this a few young hackers will get the itch to go a little deeper into how our terminals are represented.
That's nothing- run `curl https://xmppwocky.net/curlme.txt` on, say, OS X Terminal.app (and a lot of Linux terminal emulators, too) and your terminal window will do things like steal focus, maximize and minimize repeatedly, move around the screen...
(don't do this on a terminal you care about! on some older versions of OS X, this would hard-lock the entire UI (for all apps, requiring a reboot or something!), but these days it's sufficient to force-quit Terminal)
> If you less this txt file, your terminal plays a sound
Actually, no it does not. My less displays the bell characters as ^G instead of showing them as raw.
Whether you hear the bell, or simply see ^G, depends upon how you have less configured. I leave mine configured to use the caret notation for control characters (which for my version of less, is also the default).
Worse, it is possible for the server to detect that you are doing that [1]. It could serve you malicious code when you "curl | bash" and then afterwards when you go to download a copy of the script to try to figure out what the heck it did the server could serve you benign code.
22 comments
[ 3.4 ms ] story [ 44.4 ms ] threadhttps://iterm2.com/documentation-escape-codes.html
There's historically been stuff like "type the window title as if it was text entered on the keyboard"; since you can set the window title with escapes, this allowed Bad Things, and has subsequently been nerfed by major terminals (e.g. iirc xterm just reports "xterm" regardless of what the window title actually is)
I don't understand why they can't just distribute a package with the same install script.
The beep character is control-g, ASCII 0x07
[1]https://xkcd.com/1053/
(don't do this on a terminal you care about! on some older versions of OS X, this would hard-lock the entire UI (for all apps, requiring a reboot or something!), but these days it's sufficient to force-quit Terminal)
There's some wacky stuff out there: https://www.xfree86.org/current/ctlseqs.html
Actually, no it does not. My less displays the bell characters as ^G instead of showing them as raw.
Whether you hear the bell, or simply see ^G, depends upon how you have less configured. I leave mine configured to use the caret notation for control characters (which for my version of less, is also the default).
[1] https://news.ycombinator.com/item?id=17636032