Re: bracketed paste mode in xterm and urxvt

[Stephane Chazelas <stephane.chazelas@xxxxxxxxx>]

2015-06-04 01:48:25 +0200, Oliver Kiddle:
> Stephane Chazelas wrote:
> > To sum-up, for a safe bracketed paste, you need either:
> > 
> > - terminal emulator to filter out ^[ and ^C
> > 
> 
> ^C is only the default interrupt character. From some basic testing, it
> seems you can use tcgetattr/tcsetattr on the master side of the pty.
> So the terminal could perhaps disable isig before writing the string
> and restore it afterwards. I doubt that an ssh would pass that through,
> however.

ssh (the client) disables ISIG already. It passes the ^C along
and it's the remote pty line discipline that may send SIGINT to
the process upon receiving that ^C, so there's nothing ssh could
do there.

> >  - a different paste mode than xterm's \e[200~<to-paste>\e[201~ which
> >    doesn't work as <to-paste> may contain \e[201~ (something
> >    like: insert-formatted("\033[202~%S~%s",
> >    CLIPBOARD,PRIMARY,CUT_BUFFER0) would do).
> 
> Would have been better if xterm had done it that way in the first place. 
> As it is, stripping a fake end string should do the job.

zsh could use a heuristic approach similar to the one I use in
the pty wrapper at
http://security.stackexchange.com/questions/39118/how-can-i-protect-myself-from-this-kind-of-clipboard-abuse/52655#52655

That is detect paste by the fact that all characters come at
once. Not foolproof when done by the shell as there's the case
of the user typing or pasting before the prompt is issued.

> >  - zsh to disable isig.
> > 
> > Maybe a better approach would be to query the X selection for
> > instance with xclip/xsel where available. That can also be
> 
> I've got a widget based on xclip. There isn't always an X connection
> back, however. It might be worth remembering for when copying text from
> firefox.
> 
> The nice thing about getting bracketed paste working is that it
> potentially doesn't require users to learn anything new: they already
> know how to paste in their terminal. That's also why I think it is worth
> trying to include support in a form that doesn't need ohmyzsh plugins or
> lines in .zshrc. And putting security aside, there are other benefits
> like the single undo event, newlines not being accepted and the option
> of manipulating the string such as with shell quoting.
[...]

Agreed.