Terminal: prevent paste auto-exec when clipboard has trailing newline

[meganrogge]

Fixes an MSRC-reported issue where pasting clipboard text containing a trailing newline into the integrated terminal would automatically execute the command.

Repro

1. A page calls navigator.clipboard.writeText('calc.exe\\n').
2. User right-clicks (or Ctrl+V) into a cmd / PowerShell terminal.
3. calc.exe runs immediately, before the user reviews it.

Root cause

shouldPasteTerminalText (in terminalContrib/clipboard) special-cases the default auto value of terminal.integrated.enableMultiLinePasteWarning and returns true (paste as-is) whenever the text is a single command followed by a trailing newline — even when bracketed paste mode is not active. The trailing \n is then sent verbatim to the shell, which executes the command.

Fix

In auto mode and when bracketed paste mode is not enabled, strip the trailing newline(s) before pasting (return { modifiedText }). The command appears at the prompt; the user must press Enter to run it. Bracketed-paste-aware shells continue to receive the original text unchanged. Updated the existing unit test to cover both branches.

[Copilot]

Pull request overview

This PR mitigates an MSRC-reported terminal clipboard hijack scenario by preventing a pasted single-line command with a trailing newline from auto-executing when bracketed paste mode is not active.

Changes:

• Update shouldPasteTerminalText to strip trailing newline(s) in auto mode when bracketed paste mode is disabled by returning { modifiedText }.
• Extend the existing unit test to validate the new auto-mode behavior and the bracketed-paste-mode passthrough.

Show a summary per file

File	Description
src/vs/workbench/contrib/terminalContrib/clipboard/browser/terminalClipboard.ts	Strips trailing newline(s) in auto mode (non-bracketed paste) to avoid paste-triggered execution.
src/vs/workbench/contrib/terminalContrib/clipboard/test/browser/terminalClipboard.test.ts	Updates tests to cover the modified return value and bracketed paste branch.

Copilot's findings

Comments suppressed due to low confidence (1)

src/vs/workbench/contrib/terminalContrib/clipboard/test/browser/terminalClipboard.test.ts:63

• The assertion compares objects via JSON.stringify(...), which makes failures harder to read and can mask issues. Prefer importing/using deepStrictEqual (or assert.deepStrictEqual) to compare the returned { modifiedText } structure directly.

			strictEqual(JSON.stringify(await instantiationService.invokeFunction(shouldPasteTerminalText, 'foo\n', undefined)), JSON.stringify({ modifiedText: 'foo' }));
			// Auto with bracketed paste mode: shell handles newline literally, safe to paste as-is.

• Files reviewed: 2/2 changed files
• Comments generated: 2