On 2023-10-19 17:04:10 +0100 (+0100), Sam Bull wrote: [...] Also a problem with shell security. If you paste something with line breaks into bash, it executes them. If you paste the same into fish, it doesn't (it'll display the multi-line input and expect you to hit the enter key to execute it as a command). That observation may be outdated. At least my bash 5.2.15 on Debian does not execute pasted newlines, it treats it as a multi-line command and waits for an actual enter keypress (tested inside a few different terminal emulators including vanilla xterm, so pretty sure it's not being mitigated at that layer). -- Jeremy Stanley

On Wed, 2023-10-18 at 13:25 -0500, Grant Taylor wrote: I think that this is more a problem with X11 security than it is a problem specific to Mozilla / Firefox. Also a problem with shell security. If you paste something with line breaks into bash, it executes them. If you paste the same into fish, it doesn't (it'll display the multi-line input and expect you to hit the enter key to execute it as a command).

Multiple stack-based buffer overflows in the (1) ExtractRnick and (2) decrypttopic332 functions in FiSH allow remote attackers to execute arbitrary code via long strings.