Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing url handling in iTerm2 and Hyper for code execution

vin01.github.io

Post reply on HN
Print view View original

51–58 of 58 posts

Re: Abusing url handling in iTerm2 and Hyper for code execution

#51

Post by lxgr »

philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

> I would like very much to get off this ride

What's keeping you? It sounds like you want a much more lightweight terminal emulator that iTerm, which is totally fair, and I bet that exists!

Re: Abusing url handling in iTerm2 and Hyper for code execution

#52

Post by pornel »

lxgr wrote: post #41

Slightly off-topic, but... > Hyper is an Electron-based terminal Why!?

Electron beatings will continue for as long as making a proper GUI for major platforms requires learning three different languages and four different UI toolkits, where every one of them is less flexible and harder to use than the web stack.

For developers Electron is the easiest way to have a portable UI, with very flexible and capable styling, decent text rendering, animations, and a layout and rendering engine optimized for a very broad range of use-cases, with fantastic developer tools.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#53

Post by lxgr »

pornel wrote: post #52
lxgr wrote: post #41

Slightly off-topic, but... > Hyper is an Electron-based terminal Why!?

Electron beatings will continue for as long as making a proper GUI for major platforms requires learning three different languages and four different UI toolkits, where every one of them is less flexible and harder to use than the web stack. For developers Electron is the easiest way to have a portable UI, with very flexible and capable styling, decent text rendering, animations, and a layout and rendering engine opt…

I get that tradeoff, and I can see how it makes sense for apps that don't interface that much with the OS/UI they run on (although I'm still not a fan of the resource usage and the occasional UI yankiness).

But for a terminal emulator? These are pretty deeply integrated with the OS they run on and often run with elevated permissions and/or get to pass through passwords as they're entered! I can't imagine using one written in Electron.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#54

Post by Repulsion9513 »

Groxx wrote: post #5
Repulsion9513 wrote: post #4

Earlier quoted context omitted.

You never want to see raw, attacker-supplied text in a terminal, actually.

It sure is a good thing we never run anything in our terminals without fully vetting all output. curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bash

I mean, the context I was replying to was:

> terminals don't have even a small fraction of browsers' malicious-link-defense mechanisms (as demonstrated). I always want to see the full url in a terminal.

And yeah you're right if you're just piping stuff to bash, malicious URLs are the least of your worries, but that doesn't change the fact that outputting data (that may contain raw control codes) to your terminal is dangerous with or without linkified-URLs.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#55

Post by Repulsion9513 »

soraminazuki wrote: post #20
Repulsion9513 wrote: post #14

Earlier quoted context omitted.

> sophisticated enough to send different contents to a browser and to curl Checking the Accept header (or User-Agent or a bunch of other things) is very difficult :)

GP likely meant differentiating `curl` and `curl | bash`. https://web.archive.org/web/20240520142212/https://www.idont...

Did they? IDK, just differentiating browser from curl is incredibly likely to be "good enough" as an attacker.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#56

Post by Repulsion9513 »

lxgr wrote: post #43
Repulsion9513 wrote: post #4

Earlier quoted context omitted.

You never want to see raw, attacker-supplied text in a terminal, actually.

Is that realistic? Sure, text editors and viewers like vim or less can probably filter out terminal escape sequences, but should arbitrary programs printing (potentially user-supplied) strings to stdout have to? Maybe terminal escape sequence processing should be opt-in (on a by-process/job level) rather than opt-out?

`| less`

Re: Abusing url handling in iTerm2 and Hyper for code execution

#57

Post by Dylan16807 »

Repulsion9513 wrote: post #55
soraminazuki wrote: post #20

Earlier quoted context omitted.

GP likely meant differentiating `curl` and `curl | bash`. https://web.archive.org/web/20240520142212/https://www.idont...

Did they? IDK, just differentiating browser from curl is incredibly likely to be "good enough" as an attacker.

I did have that attack in mind, yes.

But honestly it doesn't take a lot of sophistication to hide an exploit somewhere in an entire piece of software. The average person is very vulnerable to a malicious dev and the way they download is very unlikely to matter as long as it's not http://

Re: Abusing url handling in iTerm2 and Hyper for code execution

#58

Post by efilife »

lxgr wrote: post #53
pornel wrote: post #52

Earlier quoted context omitted.

Electron beatings will continue for as long as making a proper GUI for major platforms requires learning three different languages and four different UI toolkits, where every one of them is less flexible and harder to use than the web stack. For developers Electron is the easiest way to have a portable UI, with very flexible and capable styling, decent text rendering, animations, and a layout and rendering engine opt…

I get that tradeoff, and I can see how it makes sense for apps that don't interface that much with the OS/UI they run on (although I'm still not a fan of the resource usage and the occasional UI yankiness). But for a terminal emulator? These are pretty deeply integrated with the OS they run on and often run with elevated permissions and/or get to pass through passwords as they're entered! I can't imagine using one wr…

> I can't imagine using one written in Electron.

Ok but why?

Post reply on HN