‹ BackHN Continuity

Thread

Sourcehut account takeover via build logs (XSS in ansi2html)

153 points · 29 comments · arusekk

  1. Joker_vD · · focus · HN ↗
    Oh my God, it's OSC 8 again. Because copy-pasting an URI from the terminal window is so 2003, and goodness gracious, having to look at an actual URL instead of an arbitrarily inaccurate description of it? That's, like, 1993. When I wrote my variant of ansi2html, I aggressively stripped out every C0 and C1, and all of the possible APC/DCS/OSC/PM sequences.

    Meanwhile, internal links between different parts of a man page still don't exist (unless you use GNU Info but seriously, I'd rather use lynx on a folder of HTML files instead).

    1. oefrha · · focus · HN ↗
      OSC 8 hyperlinks are extremely useful for tables and other kinds of compact displays.
      1. Joker_vD · · focus · HN ↗
        They're also extremely useful for introducing CVEs into terminal emulators; I think I've seen about 5 of those on HN — including one OSC sequence that would cause the terminal emulator to just straight up automatically launch the web browser with whatever URLs were sent its way, no prompts no nothing.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.