Rendered at 05:14:17 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
nsagent 1 hours ago [-]
> So if you happen to be able to make ␛]8;;https://example.com/"/...␇ appear in the job logs —4 which you can, either without even having an account, by sending a patch to a public mailing list with continuous integration turned on
The fact that this could be triggered so easily — just sending a malicious patch to a mailing list — is pretty insane.
JamesCoyne 8 hours ago [-]
Really commendable work fixing up the upstream python project. I don't think there's anything to be embarrassed about in the timeline.
arusekk 6 hours ago [-]
I would prefer to do a super proper disclosure with coordinated release dates and everything. My first submitting to SourceHut security ML ended up making the vuln existence somewhat public before upstream ever knew.
kgraves 51 minutes ago [-]
Congrats on the write up, seems extremely serious, I hope Sourcehut and Drew paid you well for this.
arusekk 16 minutes ago [-]
I hope they will one day. I took verbal credit so I won't nag them directly.
Joker_vD 6 hours ago [-]
Oh my God, it's OSC 8 again. Because copy-pasting an URI from the terminal window is so 2003, and goodness gracious, having to look at an actual URL instead of an arbitrarily inaccurate description of it? That's, like, 1993. When I wrote my variant of ansi2html, I aggressively stripped out every C0 and C1, and all of the possible APC/DCS/OSC/PM sequences.
Meanwhile, internal links between different parts of a man page still don't exist (unless you use GNU Info but seriously, I'd rather use lynx on a folder of HTML files instead).
oefrha 5 hours ago [-]
OSC 8 hyperlinks are extremely useful for tables and other kinds of compact displays.
Joker_vD 3 hours ago [-]
They're also extremely useful for introducing CVEs into terminal emulators; I think I've seen about 5 of those on HN — including one OSC sequence that would cause the terminal emulator to just straight up automatically launch the web browser with whatever URLs were sent its way, no prompts no nothing.
bstsb 7 hours ago [-]
haven’t been properly rickrolled in years, wasn’t expecting that!
arusekk 6 hours ago [-]
You're welcome!
kwhitlock 4 hours ago [-]
Build logs are such a tricky attack surface; sanitizing arbitrary build output is practically impossible without breaking useful formatting. Always assume untrusted input.
I love sourcehut, and I can't really think anything to replace it. But here's my shot. It's a popular myth that independently from the project size, someone should always take the main stream product in the field than small projects because most of the people would use the main stream product and there's an higher chance that vulnerabilities get already exploited/recognized/fixed. Is that true or not? TL;DR: in the evaluation of such products (sourcehut but even self hosted stuff), should we also take account about the project history and the exposition to threats?
rvz 8 hours ago [-]
HN hug of death, strikes again.
arusekk 6 hours ago [-]
That might have been DNS, the website itself is on sourcehut pages. Should be fine now for a while.
The fact that this could be triggered so easily — just sending a malicious patch to a mailing list — is pretty insane.
Meanwhile, internal links between different parts of a man page still don't exist (unless you use GNU Info but seriously, I'd rather use lynx on a folder of HTML files instead).