I can't believe vim allows executing commands when pasting text. Who on earth thought it was a good idea?
I just used it today to run 200 commands I generated from Excel.
Pastejacking
121–130 of 246 posts
Re: Pastejacking
#122Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?
Firefox and IE let this feature be configurable: https://msdn.microsoft.com/en-us/library/bb250473(v=vs.85).a... http://i.stack.imgur.com/jvDUh.png https://developer.mozilla.org/en-US/docs/Mozilla/Preferences... But the same quick search shows that it does not appear possible to control this in Chrome. If anyone knows how, please correct me.
I tried the demo in Safari 9.1.1 (11601.6.17) and got "not evil" in the Terminal.
Re: Pastejacking
#123There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…
I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
Or inspect and copy from there?
Re: Pastejacking
#124Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?
Firefox and IE let this feature be configurable: https://msdn.microsoft.com/en-us/library/bb250473(v=vs.85).a... http://i.stack.imgur.com/jvDUh.png https://developer.mozilla.org/en-US/docs/Mozilla/Preferences... But the same quick search shows that it does not appear possible to control this in Chrome. If anyone knows how, please correct me.
It's honestly probably because it's been done in Flash for so long that any difficulties would be worked around with more Flash.
Re: Pastejacking
#125The author noted that iTerm on MacOS notifies when a paste that's about to happen contains a newline. Cmder on Windows does this as well, it's a nice feature even outside of the security concerns.
Didn't get a confirmation on iTerm 2.1.4, Firefox 46.0.1, OSX 10.11 (latest stable everything). Not sure if I missed something.
It's only in the iTerm beta IIRC. I see it on (beta) build 2.9.20160510.
Re: Pastejacking
#126Edit: I visited the "about:config" page, searched for "dom.event.clipboardevents.enabled", then I have set it to false, but that wasn't nearly enough. The linked PoC still works :-(
Re: Pastejacking
#127Even if browsers didn't allow changing the clipboard, there's still this older problem: http://thejh.net/misc/website-terminal-copy-paste
The solution is definitely to avoid pasting commands with newlines in them into your terminal. With Vim, you can use the + register to paste (e.g. "+p). Using iTerm on OS X, I've added a custom keymap for Cmd+V, bound to Run coprocess:
pbpaste | tr -d "\n"
Re: Pastejacking
#128I can't believe vim allows executing commands when pasting text. Who on earth thought it was a good idea?
It's not something that vim explicitly allows, it's a side-effect of running the editor in a terminal. When you paste into a terminal, it's as if the keys are actually being pressed, rather than just text inserted.
The proper way of pasting into vim, which doesn't have this problem, is "+p (as mentioned in the article).
Re: Pastejacking
#129I was like why does not it works!
Then I remembered I had no script enabled, and then I remembered I don't trust JS and browsers by default, they are like OS in my OS that are way complex to be audited and they have access to way too much sensitive things (files, display, keyboard, network).
Re: Pastejacking
#130Earlier quoted context omitted.
To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.
FTFY: To solve this, browsers should probably disallow modifying the clipboard .
That would probably break a lot of WYSIWYG-like editors.