Re: X selection access in xterm (OSC 52)

[Philipp Stephani <p.stephani2@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1375 bytes --]

Stefan Monnier <monnier@iro.umontreal.ca> schrieb am Fr., 17. Apr. 2015 um
15:52 Uhr:

> > If I understand https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593
> ,
> > this functionality was disabled by default on Debian-based systems for
> > security reasons.
>
> Ah, indeed I see in "man xterm" that allowWindowOps defaults to false
> and that disallowedWindowOps includes both GetSelection and SetSelection.
> If I try
>
>    xterm -xrm '*.allowWindowOps: true'
>
> Then things work.  Yay!
>
> I don't see why SetSelection would be a serious security issue (tho
> I guess if a program does the right SetSelection at the right time, you
> could end up pasting dangerous commands into a shell).
> For GetSelection, the problem can show up if you view "raw data" without
> going though a pager, but if your terminal is busy running Emacs you're
> safe ;-)
>

I think the attack vector is: you can trust SSH to not destroy or leak data
on your machine, so you can SSH into arbitrary untrusted machines and run
arbitrary programs there. This trust is broken if the program can initiate
a read of the clipboard of the local machine (the clipboard could contain
confidential information). So I can see why terminal emulator authors would
want to disable/omit this function. Agreed that it wouldn't be an issue to
support it on Emacs's side. I'll try to get my patch working.

[-- Attachment #2: Type: text/html, Size: 1829 bytes --]