From e1a34f7c6677a8f2208f2416a9febde8277360e3 Mon Sep 17 00:00:00 2001 From: Stella and Charlie <147658063+teamcons@users.noreply.github.com> Date: Fri, 6 Dec 2024 17:55:55 +0100 Subject: [PATCH] Enhance unsafe detection (#800) Not the cleanest. Can always define "more" dangerous behaviours, depends how much we want to get in the weeds. I need to learn more vala contains: Multiple commands: as oneliners chained with ";", "||", "|", "&&", "&" Admin commands: run0, su, pkexec, who serve similar purpose to sudo and doas. "su -" can do a lot too Add a space, to avoid false flag if say, it is a word like "visual" that has "su" in it. A command needs a space after it. Co-authored-by: Jeremy Wootten --- src/Widgets/TerminalWidget.vala | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/Widgets/TerminalWidget.vala b/src/Widgets/TerminalWidget.vala index 65109a32a3..dee5445593 100644 --- a/src/Widgets/TerminalWidget.vala +++ b/src/Widgets/TerminalWidget.vala @@ -536,10 +536,11 @@ namespace Terminal { return; } + string? warn_text = null; - if ("\n" in text) { + if ("\n" in text || "&" in text || "|" in text || ";" in text ) { warn_text = _("The pasted text may contain multiple commands"); - } else if ("sudo" in text || "doas" in text) { + } else if ("sudo " in text || "doas " in text || "run0 " in text || "pkexec " in text || "su " in text) { warn_text = _("The pasted text may be trying to gain administrative access"); }