Bug 653244

Summary:	x11-terms/rxvt-unicode: possibility to paste control characters
Product:	Gentoo Linux	Reporter:	Alexander Sergeyev <sergeev917>
Component:	Current packages	Assignee:	Jeroen Roovers (RETIRED) <jer>
Status:	RESOLVED UPSTREAM
Severity:	normal	Keywords:	PATCH
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://software.schmorp.de/pkg/rxvt-unicode.html
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	urxvt-filter-control-chars.patch

Description Alexander Sergeyev 2018-04-15 16:14:29 UTC

Created attachment 527512 [details, diff]
urxvt-filter-control-chars.patch

URxvt allows pasting arbitrary characters, ie characters which might include ESC (or backspace and so on). So, it's possible to paste specially crafted text from a browser into vim (running inside rxvt) -- and by doing so, switch vim to command mode and run arbitrary shell commands (vim is not the only target). For PoC and further details see the URL.

VTE library had the same problem and it was fixed [1] by filtering out some unwanted characters from paste buffer. I've prepared a similar patch for rxvt-unicode (attached) -- the filtering is disabled by default and can be enabled by using xresource setting: `urxvt.filterPastedControls: 1`.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=753197