Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given that control characters are usually not rendered, but they are given a special meaning in most terminals, what reasons are there for terminal apps to continue to support copy-pasting of control characters?

One can mask a harmful code as described here for example, so that it causes issues when pasted into a terminal.

The issue that causes this is twofold:

  • Chrome doesn't render the ^H character, making one expect that the copied text is something different.
  • gnome-terminal (or xterm) dutifully accepts it from the user as if it was direct keyboard input, executing the control characters

Why does the terminal do this? Are there any use cases for being able to paste control characters (other than \t,\r,\n) into a terminal?

share|improve this question
Ringing the bell, obviously. Jingle \as, jingle \as, Jingle all the way. Oh! what fun it is to ride In a one-horse open sleigh. – Deer Hunter Feb 7 '14 at 9:16
No particular comment on why they do, but just wanted to add that some editors will display control characters with their own glyph, to alert the fact that they are there. – Owen Feb 7 '14 at 12:04

Terminals pre-date copy and paste. So within the terminal protocol, there is no distinction between pasting versus typing. The idea of pasting content into a terminal emulator window was retrofit into the system by simulating the rapid typing of characters when the terminal when the "paste" function is activated. This just dumps the content in exactly as it appears in the clipboard.

As for pasting control characters: the response of the terminal emulator's programmer would be something along the lines of, "Why would you even do that?" You make a compelling argument that this could actually be an injection vulnerability in the terminal program itself.

As such, it's not out-of-the-question to suggest that programs like PuTTY and GNOME Terminal should have a setting somewhere which allows you to specify whether or not pasting of control characters is something you want to enable. Perhaps disabled by default.

share|improve this answer

I believe this is a good question, since it has a lot of systems involved. In which court is it the ball? Is this really a problem? I have never thought about this, but let me spit some thoughts.

  1. I believe that copy&paste is a tool, and since it is a tool I believe it may be useful to copy&paste control chars from a place to another. Maybe, in example, you want to copy a shell script recipe and paste it into your terminal or your "notes application".

  2. About security implications. Of course there are, you might be copying something you don't know if it is harming and in fact it is hidden so it can trick advanced users so, is this as simple as adding a warning when copying/pasting control characters? Should an especial string be painted whenever it finds a control character? Well, I guess it will depend on the application we consider.

I hope this answer inspire someone else to express inner thoughts, I will be upgrading this answer if I feel I can add some more valuable thoughts.

share|improve this answer

Terminals allow arbitrary input because they are exactly that: terminals. They emulate old physical devices which work over a serial line. Copy-paste was just forcefully pushed into that model, with no actual thought about security.

In fact, in the old-timer Unix+X11 model, security was ensured by preventing outsiders from sending synthetic events. That the user himself is copy-pasting evil data snippets was not considered as a threat.

Terminals will begin to take care if some actual attack occurs, forcing developers to take action in order to avoid utter ridicule.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.