Git Product home page Git Product logo

clipby's Introduction

Clipby - clipboard manipulation and organization

Clipby will monitor your clipboard and organize copies by type. The clipboard data is stored in an embeded db for easy access. Clipby also embeds mruby for custom scripts.

Ruby Script Example

This plugin will replace all copied data that contains the letter e with ZZ. Obviosuly this is a stupid example but you could do cool stuff like .. copy json, upload to gist.. return a new type and data to replace the contents of the clipboard.

The run function must return a type and data.

#
# Clipby Module
#
# Clipby adds a few things but not much.
# Subclass Plugin for helpers and validation methods.
#
module Clipby

  #
  # Subclass from Clipby::Plugin
  #
  class ReplacePlugin < Plugin

    def initialize
      @name = "Replace Plugin Plugin"

      @description <<-description
      replace e with word
      description

      @author = "Dustin Willis Webber"
      @version = "0.1.0"
    end

    def self.some_network_stuff
      s = TCPSocket.open("intel.criticalstack.com", 80)
      s.write("GET / HTTP/1.0\r\n\r\n")
      log s.read
      s.close
    end

    def self.run(type, data)
      decode = Base64.decode(data)
      return type, decode.gsub!("e", "(づ。◕‿‿◕。)づ ︵ ┻━┻")
    end

  end

end

plugin output

Build

  • make sure you have godep installed.
  • clone the go-mruby repo.
  • build mruby using the build_config.rb in the clipby root dir.
  • make sure to add gems you make need - by default i add base64, socket and pack.
  • copy the libmruby.a to the root of the clipby dir.
  • make
  • Enjoy!

Notes

  • THIS IS BETA
  • Should work on linux, mac osx and windows. (I have been building on macosx tho)
  • Clipby will create $HOME/.clipby & $HOME/.clipby/plugins/
  • Any .rb file in plugins will be loaded automatically.

clipby's People

Contributors

djcas9 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

clipby's Issues

Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation

Hello,

I am writing to report a potential Regular Expression Denial of Service (ReDoS) vulnerability or Inefficient Regular Expression in the project. This issue arises when specially crafted input strings are used in the context of distributed, high-volume requests, potentially leading to a denial-of-service attack.

Location of Issue:

The vulnerability is related to a regular expression used in the following validation file, which may result in significantly prolonged execution times under certain conditions.

re := regexp.MustCompile(`(?s)<(?:style|script)[^<>]*>.*?</(?:style|script)>|</?[a-z][a-z0-9]*[^<>]*>|<!--.*?-->`)

PoC Files and Comparisons:

// Proof of concept
filename := os.Args[1]
content, err := ioutil.ReadFile(filename)
re := regexp.MustCompile("(?s)<(?:style|script)[^<>]*>.*?</(?:style|script)>|</?[a-z][a-z0-9]*[^<>]*>|<!--.*?-->")
re.ReplaceAllString(string(content), "")

PoC Files Here:
poc.zip

To evaluate the performance of this inefficient regular expression matching with varying input contents, the following commands can be executed within the PoC folder:

time ./poc AttackString10MB.txt
# real    72m38.173s
# user    72m30.083s
# sys     0m5.653s
time ./poc RandomString10MB.txt
# real    0m0.029s
# user    0m0.016s
# sys     0m0.026s
time ./poc AttackString1MB.txt
# real    0m54.028s
# user    0m53.917s
# sys     0m0.088s
time ./poc RandomString1MB.txt
# real    0m0.011s
# user    0m0.007s
# sys     0m0.011s

The significant difference in processing time between random strings and malicious strings highlights the potential effectiveness of this regex for malicious exploitation. And as string length grows, the nonlinear increase in processing time reflects potentially greater risks.

Proposed Solution:

A possible mitigation strategy could include limiting the input length to prevent excessive processing times. If the corresponding function or feature is not in use, it is recommended to clean up risky third-party packages or code content to prevent malicious exploitation through methods such as code injection.

Additional Considerations:

Historically, it was believed that using regex engines with non-backtracking implementations (such as those in Rust or Go) would not lead to ReDoS vulnerabilities. However, recent studies have shown that this is not always the case. I recommend an assessment of how this issue might impact this project.

Thank you for your attention to this matter. Your evaluation and response to this potential security concern would be greatly appreciated.

Best regards,

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.