CERBERUS/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty.git synced 2026-09-06 09:48:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Prevent reading uri-list items for a drag and drop in same window

Browse source
This commit is contained in:
Kovid Goyal 2026-04-09 06:38:58 +05:30
parent 6c35b64356
commit 47b5b2ea65
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
3 changed files with 34 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/dnd-protocol.rst
View file

@ -158,6 +158,12 @@ must respond with ``t=R ; EINVAL`` if the file is not a regular file after
resolving symlinks and ``t=R ; ENOENT`` if the file does not exist. If an
I/O error occurs the terminal must send ``t=R ; EIO``.
For security reasons, terminals must reply with ``t=R ; EPERM`` if the drag
originated in the same window as the drop, this prevents malicious programs
from reading files on the computer by starting their own drag. This is a
defense in depth feature since drags can only be started by the terminal, but
it helps in case of accidental drag starts and drops into the same window.
Reading remote directories
+++++++++++++++++++++++++++
@ -309,6 +315,9 @@ If the client wants to cancel the full drag at any time, it should send:
OSC _dnd_code ; t=E:y=-1 ST
If ``t=e`` or ``t=E`` escape codes are sent to the terminal before the drag is
started and the terminal replies with ``t=R ; OK``, the terminal must respond
with ``t=R ; EINVAL`` and abort the drag.
Multiplexers
-----------------