? Unsafe terminal escape sequences and ANSI codes from decryption
"G.K." <[email protected]> Sun, 5 Mar 2023 03:19:15 -0600
| Newsgroups | sci.crypt,alt.security.pgp,alt.bbs,comp.terminals,alt.computer.security |
|---|---|
| Organization | Cyber23 news |
| Message-ID | <[email protected]> |
Is it unsafe to concatenate certain terminal escape sequences or ANSI
codes inside a terminal emulator?
Here is the scenario. I am working from a terminal emulator (lxterm,
gnome-terminal, mate-terminal, guake, terminology). I decrypt a message
to a file. I cat the plaintext file to the terminal ('cat $filename' or
'less -r $filename').
What could go wrong here?
Is there potential for malicious escape sequences in the plaintext?
Could such escape sequences or ANSI codes hijack the terminal and
somehow compromise the system? If so then how?
Where would I find timely information on such escape sequences and
mitigating any problems they could cause or safely filtering them?
What tools are there to filter out such sequences to ensure safely
catting in a terminal? Are there any relevant tools in the GNU coreutils?
--
G.K.