Bracketed Paste vulnerability, end sequence in payload not escaped #1095
Description
What Operating System(s) are you seeing this problem on?
Linux Wayland
Which Wayland compositor or X11 Window manager(s) are you using?
Mutter
QTerminal version
1.3.0
Describe the bug
If the text you're pasting happens to contain the same sequence of characters that the terminal uses to signify the end of a paste operation, it might prematurely signal the end of the paste. This could cause the remaining part of the pasted text to be interpreted as if it were manually typed, leading to unexpected behavior.
See the second payload here: https://thejh.net/misc/website-terminal-copy-paste from Jann Horn (@thejh) of Google's Project Zero
To Reproduce
https://thejh.net/misc/website-terminal-copy-paste
Payload that is problematic:
- 2nd in link
Configuration
no config
Expected Behavior
The expected behavior of the terminal is to escape the end sequences in the payload, so that bash will not interpret those as the actual end sequence .
Logs
No response
Anything else?
gnome-terminal, wezterm, konsole, terminator etc aren't vulnerable to this issue.