WYSINWYC (What you see is not what you copy)

[vasilis]

It’s not a good idea to copy-paste from a website to teminal, details and PoC demo:

• http://www.ush.it/team/ascii/hack-tricks_253C_CCC2008/wysinwyc/what_you_see_is_not_what_you_copy.txt
• https://thejh.net/misc/website-terminal-copy-paste

[core]

Really nice! That moment when you get paranoid that you download the article and open it in a text editor to make sure there are no malicious hidden characters…

I guess telling people not to copy and paste is pretty much useless because that is super important when learning linux basics. But I think one mitigation would be to enable escaped pasting (I don’t remember how to do that). Where when it pastes, it doesn’t put there the new lines that automatically execute the paste.

This way the user can at least notice something is wrong with the command. Not much more than that can be done about it, I think.

edit: so many mistakes in the document, though…

[vasilis]

@core

But I think one mitigation would be to enable escaped pasting (I don’t remember how to do that). Where when it pastes, it doesn’t put there the new lines that automatically execute the paste.

You mean the bracketed paste mode?

One mitigation is to add the following in ~/.inputrc (given that you are using Bash):

set enable-bracketed-paste on

[core]

@vasilis

You mean the bracketed paste mode?

Yup. Exactly that bracketed paste mode