Repository: xonsh/xonsh

Issue:
protect users from paste jacking
Xonsh together with prompt-toolkit is safe from pastejacking: pasting the malicious but harmless looking command [here](https://thejh.net/misc/website-terminal-copy-paste) in Bash will auto-execute, but on xonsh (w/ prompt-toolkit) I get to see the whole code and have to press Enter explicitly. Xonsh with readline is not protected from this.

I think it's worth mentioning Xonsh protects users against pastejacking, even if this feature was not on purpose.

References:  
- https://github.com/dxa4481/Pastejacking.
- https://github.com/Aaronmsv/PastejackingProtection

Edit: this does not apply to all xonsh users, changed to a feature request.



Discussion:
It is not safe when doing it on windows (cmd.exe running xonsh with prompt_toolkit).

@rahiel, I'm not sure this is true generally speaking.  If I copy something that contains the newline at the end, it is still be run automatically.

Sorry guys, I assumed the behaviour would be the same for everyone. I run xonsh \w prompt-toolkit on Linux (Ubuntu), in a xfce4-terminal. @adqm what is your setup? 

I've changed the issue to be more of a feature request.

@adqm usually runs with the readline shell, so that could be one difference.  
I'm on Arch using PTK and I do have the pastejacking protection you noticed

Hi @rahiel - yeah, on ubuntu with ptk it does not execute automatically, but with readline it does. I think this would be a nice thing to have but hard to implement on readline, since by its very nature reads in lines :).  Pull requests welcome for sure.

> Hi @rahiel - yeah, on ubuntu with ptk it does not execute automatically, but with readline it does. I think this would be a nice thing to have but hard to implement on readline, since by its very nature reads in lines :). Pull requests welcome for sure.

Starting from readline 7 it also has paste jacking protection, but it's off by default. Bash users can add `set enable-bracketed-paste on` to their `~/.inputrc` to enable it. Maybe xonsh can also enable it when it is in readline mode?

Ahh OK, This should like a good idea.  Would you be willing to put in a PR to this effect?  You'll want to modify the "setup_readline()" function, somewhere around https://github.com/xonsh/xonsh/blob/master/xonsh/readline_shell.py#L91

IIRC the parse and bind function lets you set config option programatically.

This should still be implemented for the readline backend and should definitely be documented, on the website (#3225) and/or the manual(#2315)

Resolving patch:
diff --git a/xonsh/readline_shell.py b/xonsh/readline_shell.py
--- a/xonsh/readline_shell.py
+++ b/xonsh/readline_shell.py
@@ -161,6 +161,13 @@ def setup_readline():
         except Exception:
             # this seems to fail with libedit
             print_exception("xonsh: could not load readline default init file.")
+
+    # Protection against paste jacking (issue #1154)
+    # This must be set after the init file is loaded since read_init_file()
+    # automatically disables bracketed paste
+    # (https://github.com/python/cpython/pull/24108)
+    readline.parse_and_bind("set enable-bracketed-paste on")
+
     # properly reset input typed before the first prompt
     readline.set_startup_hook(carriage_return)
 


Test patch: