-
Notifications
You must be signed in to change notification settings - Fork 108
Closed
Labels
Description
less -U can be used to see nearly the source text, but this includes tab. There are cases where attacks like Trojan Source are possible via the backspace character, for example:
printf "echo evil #\b\b\b\b\b\bgood\n" > some-file
# compare the two below
less -R some-file # "good"
less -UR some-file # "evil"
sh some-file # "evil"This works, however:
printf "\techo evil #\b\b\b\b\b\bgood\n" > some-file
less -UR some-fileTabs look ugly and it's not possible to consider setting -U as a default in git diff and other such views, where source code is displayed.
We can prototype how this would look by creating a tabless like so:
cat > ~/bin/tabless <<'EOF'
#!/bin/sh
expand "$@" | exec less -UR
EOF
chmod +x ~/bin/tabless
# expands tabs, but shows backspaces raw.
tabless some-fileIt would be good if tabless could be built into less in some form, i.e. allowing a way to expand tabs, but not allowing "trojan source" type attacks.
Reactions are currently unavailable