668f6fa257d638913d8c5b3e72f2c3c8a15498b4
The previous code performed only one replacement on the bracketed
paste content. This procedure didn't stop someone embedding the
terminating sequence anyway. POC:
1) $ x=$'\033[201~'; printf '%s%s%s\necho hello world\n' "${x:0:1}" "$x" "${x:1}" | xclip
2) paste into kitty
3) see the shell execute a command!
This patch closes this hole.
= kitty - the fast, featureful, GPU based, terminal emulator See https://sw.kovidgoyal.net/kitty image::https://travis-ci.org/kovidgoyal/kitty.svg?branch=master[Build status, link=https://travis-ci.org/kovidgoyal/kitty]
Languages
Python
43.6%
C
28.3%
Go
20%
Objective-C
6%
Shell
1.5%
Other
0.5%