Earlier quoted context omitted.
shoulda used 'cat
Using cat with arbitrary input exposes you to many terminal-side security issues. It is insufficiently complex.
Alternatively use "cat -v" and any terminal escape characters will be escaped.
Man who thought opening a TXT file is fine thought wrong
121–130 of 316 posts
Re: Man who thought opening a TXT file is fine thought wrong
#122Hmm, I can't replicate this on my Mac running 10.9.
printf '' > test.txt
Re: Man who thought opening a TXT file is fine thought wrong
#123Hmm, I can't replicate this on my Mac running 10.9. printf ' ' > test.txt Opening test.txt shows the exact code I printed. Am I missing something?
He said it was patched in 2020
Re: Man who thought opening a TXT file is fine thought wrong
#124Re: Man who thought opening a TXT file is fine thought wrong
#125Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…
I think it carries over from NeXTstep, iirc.
It feels like a choice when "net" meant "my campus network", not "the internet."
Because why would you be connected to the internet all the time? And how could you even afford those long distance calls?
Re: Man who thought opening a TXT file is fine thought wrong
#126Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.
TextEdit dates back to NeXTStep, so it was originally written in the late 1980s probably. Guessing it didn't render HTML originally, but it always had RTF capability. Not that it's an excuse in 2021, but very few applications from that era woudl be considered "safe" today.
Edit.app is the original NeXTSTEP text editor from the 1989. It supported plain text and rich text files. Famously, the first web browser was based on the rich text capabilities built into NeXSTEP.
TextEdit.app is the OpenStep rewrite of Edit.app and dates to the mid 1990s. It was likely one of the first OpenStep apps. It supported the same rich text files as the original Edit.app.
Apple bought NeXT, OpenStep became Cocoa, TextEdit was ported to Java, and then back to garbage collected Objective-C, then ARC Objective-C, (then Swift, probably).
Along the way it picked up features for reading/writing/editing HTML and Microsoft Word documents.
Apple used to publish the source code for TextEdit as part of their Xcode sample code, but they stopped a few years ago.
Re: Man who thought opening a TXT file is fine thought wrong
#127Why is TextEdit accessing the Internet without permission? Does Big Sur's Access Control block stuff like this?
From the OP it sounds like there is a very weird feature/component in MacOS called "AutoMount" and/or "AutoFS" that lets HTTP GET network requests be made via reading file system locations... and it may somehow escape other access controls? I too am curious for more details about this. Where did this feature come from, how has it been used, has it actually been used? Is AutoMount/AutoFS still there after this CVE pat…
I don't think this is doing any HTTP. Autofs is generally used to mount remote file systems like NFS shares.
It's pretty common on Unix-like systems (especially in multi-user environments) and not at all specific to macOS.
References:
https://wiki.archlinux.org/index.php/autofs
https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5
https://access.redhat.com/documentation/en-us/red_hat_enterp...
Re: Man who thought opening a TXT file is fine thought wrong
#128Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…
Looking in /etc/auto_master, which is the configuration for Autofs, the /net mount point is commented out by default. I do not know when (or if) it was ever turned on by default.
Re: Man who thought opening a TXT file is fine thought wrong
#129Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…
/net is really meant for things like nfs.
Re: Man who thought opening a TXT file is fine thought wrong
#130Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.
Agreed. This problem exists because someone wrote a tool that should only do one (really well) and but instead made it do five different things.
That sound in the background is emacs laughing.