fix: state the OSC 52 policy instead of inheriting it - #36
Merged
Merged
Conversation
Checked whether anything else can lift the clipboard now that ⌘V redacts. OSC 52 has a read request as well as a write, and the read needs no keystroke: text arriving on the terminal is enough to trigger it, so `cat`ing a hostile file would be enough to send what you copied to whatever is running. termit was already closed. alacritty_terminal gates clipboard_load on config.osc52, and the default Osc52::OnlyCopy does not include reads, so the request never even reaches an event. Verified by feeding the sequence to a real Term: no ClipboardLoad arrives. Set it explicitly anyway. Inheriting the default means that if the default ever changes, termit starts answering clipboard reads without anyone deciding to. Writes stay allowed -- an agent inside a container has no other way to hand you something. Two tests next to the policy cover both halves, and reversing the value to CopyPaste makes the read test fail, so it has teeth. The README capability table now separates clipboard write from clipboard read, and the paste section says what redaction does not cover: a program that reads the clipboard itself never passes through it, which is what Claude Code's Ctrl+V image paste does through its own native clipboard module. ⌘V is seen, Ctrl+V is not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #34/#35: with
⌘Vredacting, is there another way for the clipboard to leave?OSC 52 has a read request (
\x1b]52;c;?) as well as a write. The read needs no keystroke from you — text arriving on the terminal is enough to trigger it, socating a hostile file would be enough to hand whatever you copied to whatever is running. Unlike a paste, there is no moment at which redaction could apply.termit was already closed — I was wrong to call it a hole
alacritty_terminalgatesclipboard_loadonconfig.osc52, and the default isOsc52::OnlyCopy, which its own comment describes as "a compromise between entirely disabling it (the most secure) and allowing paste (the less secure)". Reads never reach an event at all. Verified by feeding the sequence to a realTerm: noClipboardLoadarrives.Setting it explicitly anyway
Inheriting a dependency's default means that the day the default changes, termit silently starts answering clipboard reads with nobody having decided that. The policy is termit's, so it is written in termit.
Writes stay allowed: an agent inside a container has no other way to hand you something.
Two tests sit next to the policy in
term.rs— reads unanswered, writes accepted. Flipping the value toCopyPastemakes the read test fail, so it has teeth. They run against aTermdirectly rather than through a pty, so they are deterministic and instant (0.02 s against 3 s for the timing-based version I tried first).What redaction does not cover, now written down
A program that reads the clipboard itself never passes through termit at all. Claude Code does exactly that: it ships a native clipboard module (
CLIPBOARD_NAPI_NODE_PATH, "Clipboard image read failed") andCtrl+Vreads the host clipboard directly, at least for images. termit does not bindCtrl+V, so0x16passes straight through and no redaction runs.⌘Vis seen;Ctrl+Vis not. That is in the README's limits list now, because a masking feature whose boundary is undocumented is worse than none.Claude Code does not issue OSC 52 read requests (0 occurrences of
52;c;?in the binary), so nothing here changes how it behaves.Test
233 pass, 1 ignored. clippy
-D warningsandfmt --checkclean.🤖 Generated with Claude Code