commit a2a704492b9f4d2408d180f7aeeacf4c789a1d67
from: Hiltjo Posthuma <hiltjo@codemadness.org>
date: Sat May 30 20:06:15 2020 UTC

config.def.h: add an option allowwindowops, by default off (secure)

Similar to the xterm AllowWindowOps option, this is an option to allow or
disallow certain (non-interactive) operations that can be insecure or
exploited.

NOTE: xsettitle() is not guarded by this because st does not support printing
the window title. Else this could be exploitable (arbitrary code execution).
Similar problems have been found in the past in other terminal emulators.

The sequence for base64-encoded clipboard copy is now guarded because it allows
a sequence written to the terminal to manipulate the clipboard of the running
user non-interactively, for example:

printf '\x1b]52;0;ZWNobyBoaQ0=\a'

commit - 0f8b40652bca0670f1f0bda069bbc55f8b5e364d
commit + a2a704492b9f4d2408d180f7aeeacf4c789a1d67
blob - 293e00c4284d411fd80bbe9a1f3cd437068a57bd
blob + 6f05dce6aaec83db925b9ec9af40284b4bf13fd7
--- config.def.h
+++ config.def.h
@@ -43,6 +43,10 @@ static unsigned int tripleclicktimeout = 600;
 /* alt screens */
 int allowaltscreen = 1;
 
+/* allow certain non-interactive (insecure) window operations such as:
+   setting the clipboard text */
+int allowwindowops = 0;
+
 /*
  * draw latency range in ms - from new content/keypress/etc until drawing.
  * within this range, st draws when content stops arriving (idle). mostly it's
blob - 2d901ab66e2436c95906d5edeb77ee05e7ae5058
blob + ef8abd5d04928739f2bb4004e26b6c82da8098b6
--- st.c
+++ st.c
@@ -1861,7 +1861,7 @@ strhandle(void)
 				xsettitle(strescseq.args[1]);
 			return;
 		case 52:
-			if (narg > 2) {
+			if (narg > 2 && allowwindowops) {
 				dec = base64dec(strescseq.args[2]);
 				if (dec) {
 					xsetsel(dec);
blob - d978458425934fa1db8c5c03a62c917e244d8933
blob + 3d351b69ea3746bf80de58a1ce1a2b2a4dc30ba5
--- st.h
+++ st.h
@@ -118,6 +118,7 @@ extern char *stty_args;
 extern char *vtiden;
 extern wchar_t *worddelimiters;
 extern int allowaltscreen;
+extern int allowwindowops;
 extern char *termname;
 extern unsigned int tabspaces;
 extern unsigned int defaultfg;