Terminal output can read and write the browser clipboard (OSC 52) #7

New Issue

2026-10-07T20:04:27-04:00

jared commented

2026-10-07 20:04:27 -04:00

Source: engineering review, 2026-10-07.

ClipboardAddon() with the default provider (web/src/term.js) answers OSC 52 ? queries with navigator.clipboard.readText() and injects the result as input. With allow-passthrough on and set-clipboard on in share/tmux.conf, any output (a cat'd file, a log line) can read the workstation clipboard, write it, or spoof the devdesk: title.

Fix: a clipboard provider that never reads, allow-passthrough off, and set-clipboard external unless Claude needs OSC 52 writes.

_Source: engineering review, 2026-10-07._ `ClipboardAddon()` with the default provider (`web/src/term.js`) answers OSC 52 `?` queries with `navigator.clipboard.readText()` and injects the result as input. With `allow-passthrough on` and `set-clipboard on` in `share/tmux.conf`, any output (a cat'd file, a log line) can read the workstation clipboard, write it, or spoof the `devdesk:` title. **Fix:** a clipboard provider that never reads, `allow-passthrough off`, and `set-clipboard external` unless Claude needs OSC 52 writes.

jared added this to the v0.5.0 hardening + header/phone milestone 2026-10-07 20:04:27 -04:00

jared added the security label 2026-10-07 20:04:27 -04:00

jared referenced this issue from a commit

2026-10-07 20:15:49 -04:00

fix: v0.5.0 security and robustness fixes from the 2026-10-07 review

jared closed this issue

2026-10-07 20:15:49 -04:00

Sign in to join this conversation.