With Firefox on X11, any page can pastejack you anytime (middle button paste)

#1

Post by jackdoe » Sat, Oct 21, 2023, 7:30 AM UTC

With Firefox on X11, any page can pastejack you anytime (middle button paste)
openwall.com

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#2

Post by Zetobal » Sat, Oct 21, 2023, 10:42 AM UTC

Who pastes something and executes it without a second look?

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#3

Post by throwaway71271 » Sat, Oct 21, 2023, 10:46 AM UTC

Zetobal wrote: post #2

Who pastes something and executes it without a second look?

thats kind of unfair, when you select something and you are confident what is selected, pasting with middle button and hitting enter can be milliseconds apart

you already decided to hit enter while you are selection something, could be just a bit above your current cursor in the terminal

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#4

Post by whatwhaaaaat » Sat, Oct 21, 2023, 2:02 PM UTC

Zetobal wrote: post #2

Who pastes something and executes it without a second look?

Have you never pasted a new line?

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#5

Post by c7DJTLrn » Sat, Oct 21, 2023, 2:04 PM UTC

I am surprised that Firefox freely allows access to the clipboard. I'm using Brave and there's an explicit permission for it that is disallowed by default.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#6

Post by jowea » Sat, Oct 21, 2023, 2:10 PM UTC

whatwhaaaaat wrote: post #4

Zetobal wrote: post #2

Who pastes something and executes it without a second look?

Have you never pasted a new line?

There are terminals that have protections against that AFAIK.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#7

Post by kzrdude » Sat, Oct 21, 2023, 2:12 PM UTC

jowea wrote: post #6

whatwhaaaaat wrote: post #4

Earlier quoted context omitted.

Have you never pasted a new line?

There are terminals that have protections against that AFAIK.

`set enable-bracketed-paste on` in .inputrc (at least compatible with bash, terminal also needs support)

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#8

Post by jowea » Sat, Oct 21, 2023, 2:14 PM UTC

Zetobal wrote: post #2

Who pastes something and executes it without a second look?

People on a hurry and the uninformed that still haven't heard that you can end up with malicious stuff on the clipboard if you haven't careful e.g. someone who inspects the text "systemctl restart cups" on the webpage, concludes it's what they want to run, then copies it straight to the terminal without noticing the web page was hiding malicious code in invisible text.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#9

Post by b112 » Sat, Oct 21, 2023, 2:14 PM UTC

You should always paste into an editor first, just copying any text from a webpage is a risk.

There are even examples using terminal escape codes, to hide what happened.

https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#10

Post by LinuxBender » Sat, Oct 21, 2023, 2:17 PM UTC

b112 wrote: post #9

You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

Adding to the demo here is one using CSS [1]

[1] - https://thejh.net/misc/website-terminal-copy-paste