• Arthur Besse@lemmy.mlM
    link
    fedilink
    arrow-up
    8
    ·
    edit-2
    1 year ago

    sites like this are neat until you remember that curl’s willingness to write ansi escape codes to stdout when it is a tty (as this site relies on to format the output when the user agent is curl) is actually a security vulnerability.

    • tal@lemmy.today
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      I’m more-inclined to blame a virtual terminal than the program writing the sequences if there’s an exploit there.

      • Arthur Besse@lemmy.mlM
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Of course the terminal emulators are ultimately to blame but when there are so many problems in so many of them, imo curl’s default behavior should be to filter its output when writing to a tty.

          • Arthur Besse@lemmy.mlM
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            You can redirect curl’s output to a file with the -o filename option (or with > filename for shell redirection). But in the case of sites like this which output ansi-escape-formatted data that isn’t very useful.

            Also, after saving unknown data to a file it’s common to look at it with less or perhaps xxd or strings or file … all of which have had their own CVEs in recent years 🤦

            Computer security is a fractal of bad news.