starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-04 05:35:20 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Multi-line paste warning doesn't detect \r, only \n #11825

New Issue
Closed
opened 2026-01-31 02:58:29 +00:00 by claunia · 12 comments
claunia commented 2026-01-31 02:58:29 +00:00
Owner
Copy Link

Originally created by @DHowett on GitHub (Dec 16, 2020).

Certain shells will execute commands on \r as well as \n, so we should try to catch \r as well.

This should probably be tackled at the same time as paste filtering. I originally thought that we should detect newlines after filtering, or perhaps during filtering, but would result in us doing a "lot" of work in the case where the user declines the paste.

Filtering: #5821.

Originally created by @DHowett on GitHub (Dec 16, 2020). Certain shells will execute commands on \r as well as \n, so we should try to catch \r as well. This should probably be tackled at the same time as paste filtering. I originally thought that we should detect newlines _after_ filtering, or perhaps _during_ filtering, but would result in us doing a "lot" of work in the case where the user declines the paste. Filtering: #5821.
claunia commented 2026-01-31 02:58:30 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Dec 17, 2020):

@PankajBhojwani has expressed some interest in the various multiline paste issues. 😄

@DHowett commented on GitHub (Dec 17, 2020): @PankajBhojwani has expressed some interest in the various multiline paste issues. :smile:
claunia commented 2026-01-31 02:58:30 +00:00
Author
Owner
Copy Link

@skyline75489 commented on GitHub (Dec 17, 2020):

I've done some work previously regarding paste filter in #7508 . But it's more of a PoC of bracketed paste mode. The security issue it trys to resolve is a serious one, though. See https://github.com/microsoft/terminal/issues/395#issuecomment-477206196. I plan to focus on brackted paste for that PR when I get the time to work on it later. So It would be nice if paste filtering is landed first.

My implemention was explained here https://github.com/microsoft/terminal/pull/7508#discussion_r482084353, if anyone's interested

@skyline75489 commented on GitHub (Dec 17, 2020): I've done some work previously regarding paste filter in #7508 . But it's more of a PoC of bracketed paste mode. The security issue it trys to resolve is a serious one, though. See https://github.com/microsoft/terminal/issues/395#issuecomment-477206196. I plan to focus on brackted paste for that PR when I get the time to work on it later. So It would be nice if paste filtering is landed first. My implemention was explained here https://github.com/microsoft/terminal/pull/7508#discussion_r482084353, if anyone's interested
claunia commented 2026-01-31 02:58:31 +00:00
Author
Owner
Copy Link

@Ry0taK commented on GitHub (Dec 17, 2020):

I'm a security researcher who reported this issue to MSRC.
As this issue already made public, I'm posting the PoC here to help someone who will work on this issue.

<html>
	<head>
		<title>Windows Terminal multiple line paste warning bypass</title>
	</head>
	<body>
		<script>
			function copyListener(e){
				e.clipboardData.setData("text/plain" , "echo 'evil command :P'\r");    
				e.preventDefault();
			}
			document.addEventListener("copy" , copyListener);
		</script>
		<div>
			<code>
				echo 'normal command'
			</code>
		</div>
	</body>
</html>

To reproduce this issue, open this HTML in the browser, and copy the echo 'normal command'. Then paste it to Windows Terminal.

@Ry0taK commented on GitHub (Dec 17, 2020): I'm a security researcher who reported this issue to [MSRC](https://msrc.microsoft.com/). As this issue already made public, I'm posting the PoC here to help someone who will work on this issue. ```html <html> <head> <title>Windows Terminal multiple line paste warning bypass</title> </head> <body> <script> function copyListener(e){ e.clipboardData.setData("text/plain" , "echo 'evil command :P'\r"); e.preventDefault(); } document.addEventListener("copy" , copyListener); </script> <div> <code> echo 'normal command' </code> </div> </body> </html> ``` To reproduce this issue, open this HTML in the browser, and copy the `echo 'normal command'`. Then paste it to Windows Terminal.
claunia commented 2026-01-31 02:58:31 +00:00
Author
Owner
Copy Link

@skyline75489 commented on GitHub (Dec 17, 2020):

OK so this issue seems to be more about filtering multi-line content, whereas my comment above focuses on filtering control sequences.

@DHowett Feel free to ignore my comments or do whatever you may want with it. I do believe these 2 issues belong to the same category and are closed related.

@skyline75489 commented on GitHub (Dec 17, 2020): OK so this issue seems to be more about filtering multi-line content, whereas my comment above focuses on filtering control sequences. @DHowett Feel free to ignore my comments or do whatever you may want with it. I do believe these 2 issues belong to the same category and are closed related.
claunia commented 2026-01-31 02:58:31 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Dec 17, 2020):

@DHowett - today I am full of questions.. sorry..

Can you explain

This should probably be tackled at the same time as paste filtering. I originally thought that we should detect newlines after filtering, or perhaps during filtering, but would result in us doing a "lot" of work in the case where the user declines the paste.

When I saw this I said.. OK..just add "find \r" in TerminalPage::_PasteFromClipboardHandler. What have I missed (I mean we already do the same search for \n")?

@Don-Vito commented on GitHub (Dec 17, 2020): @DHowett - today I am full of questions.. sorry.. Can you explain >This should probably be tackled at the same time as paste filtering. I originally thought that we should detect newlines after filtering, or perhaps during filtering, but would result in us doing a "lot" of work in the case where the user declines the paste. When I saw this I said.. OK..just add "find \r" in TerminalPage::_PasteFromClipboardHandler. What have I missed (I mean we already do the same search for \n")?
claunia commented 2026-01-31 02:58:31 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Dec 18, 2020):

So @Don-Vito - my concern is multifold.
We're already scanning through the string once to replace CRLF combos and once to detect newlines. We're running the risk of scanning through it a third time to detect carriage returns.

I'd rather avoid scanning the string three times, and I was thinking that if we're going to scan it once, we might as well do the \r\n, \r and \n -> \r filtering and the detection all at the same time.

@PankajBhojwani wanted to work on the multi-line paste warning enhancements, so it felt like a nice way for him to knock out three workitems at once.

@DHowett commented on GitHub (Dec 18, 2020): So @Don-Vito - my concern is multifold. We're already scanning through the string once to replace CRLF combos and once to detect newlines. We're running the risk of scanning through it a _third_ time to detect carriage returns. I'd rather avoid scanning the string three times, and I was thinking that _if we're going to scan it once_, we might as well do the `\r\n`, `\r` and `\n` -> `\r` filtering and the detection all at the same time. @PankajBhojwani wanted to work on the multi-line paste warning enhancements, so it felt like a nice way for him to knock out three workitems at once.
claunia commented 2026-01-31 02:58:31 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Dec 18, 2020):

@DHowett - as a quick win we can introduce std::find_if in detection to check for both. WDYT?

@Don-Vito commented on GitHub (Dec 18, 2020): @DHowett - as a quick win we can introduce std::find_if in detection to check for both. WDYT?
claunia commented 2026-01-31 02:58:32 +00:00
Author
Owner
Copy Link

@DHowett commented on GitHub (Dec 18, 2020):

I dunno if we need a quick win at the moment 😄

If it weren’t for Pankaj saying he wanted to work on this, I’d say we would want a quick win. 🤷🏻

(I wouldn’t reject a PR that did that, but it would be in short order steamrolled with a second PR that did the other things, too!)

@DHowett commented on GitHub (Dec 18, 2020): I dunno if we need a quick win at the moment :smile: If it weren’t for Pankaj saying he wanted to work on this, I’d say we would want a quick win. 🤷🏻 (I wouldn’t reject a PR that did that, but it would be in short order steamrolled with a second PR that did the other things, too!)
claunia commented 2026-01-31 02:58:32 +00:00
Author
Owner
Copy Link

@Don-Vito commented on GitHub (Dec 18, 2020):

I dunno if we need a quick win at the moment 😄

If it weren’t for Pankaj saying he wanted to work on this, I’d say we would want a quick win. 🤷🏻

(I wouldn’t reject a PR that did that, but it would be in short order steamrolled with a second PR that did the other things, too!)

Makes sense! Assumed quick win might be helpful because of MSRC report. I will convert my PR to a draft.. in case it is somehow relevant. 😊

@Don-Vito commented on GitHub (Dec 18, 2020): > > > I dunno if we need a quick win at the moment 😄 > > If it weren’t for Pankaj saying he wanted to work on this, I’d say we would want a quick win. 🤷🏻 > > (I wouldn’t reject a PR that did that, but it would be in short order steamrolled with a second PR that did the other things, too!) Makes sense! Assumed quick win might be helpful because of MSRC report. I will convert my PR to a draft.. in case it is somehow relevant. :blush:
claunia commented 2026-01-31 02:58:32 +00:00
Author
Owner
Copy Link

@Ry0taK commented on GitHub (Dec 18, 2020):

Just FYI, the MSRC doesn't consider this as a security issue, so they already closed the MSRC report.

@Ry0taK commented on GitHub (Dec 18, 2020): Just FYI, the MSRC doesn't consider this as a security issue, so they already closed the MSRC report.
claunia commented 2026-01-31 02:58:32 +00:00
Author
Owner
Copy Link

@ghost commented on GitHub (Jan 28, 2021):

:tada:This issue was addressed in #8634, which has now been successfully released as Windows Terminal v1.5.10271.0.🎉

Handy links:

@ghost commented on GitHub (Jan 28, 2021): :tada:This issue was addressed in #8634, which has now been successfully released as `Windows Terminal v1.5.10271.0`.:tada: Handy links: * [Release Notes](https://github.com/microsoft/terminal/releases/tag/v1.5.10271.0) * [Store Download](https://www.microsoft.com/store/apps/9n8g5rfz9xk3?cid=storebadge&ocid=badge)
claunia commented 2026-01-31 02:58:32 +00:00
Author
Owner
Copy Link

@ghost commented on GitHub (Jan 28, 2021):

:tada:This issue was addressed in #8634, which has now been successfully released as Windows Terminal Preview v1.6.10272.0.🎉

Handy links:

@ghost commented on GitHub (Jan 28, 2021): :tada:This issue was addressed in #8634, which has now been successfully released as `Windows Terminal Preview v1.6.10272.0`.:tada: Handy links: * [Release Notes](https://github.com/microsoft/terminal/releases/tag/v1.6.10272.0) * [Store Download](https://www.microsoft.com/store/apps/9n8g5rfz9xk3?cid=storebadge&ocid=badge)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-UserInterface Issue-Bug Priority-3 Product-Terminal Resolution-Fix-Committed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#11825
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?