[deleted]
With Firefox on X11, any page can pastejack you anytime (middle button paste)
11–20 of 195 posts
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#12Earlier quoted context omitted.
Have you never pasted a new line?
There are terminals that have protections against that AFAIK.
I'm sure they exist.
Gnome shell doesn't AFAIK.
It's an odd thing to protect from; any program that has access to the X11 clipboard is going to be able to run a process as the current user.
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#13I am surprised that Firefox freely allows access to the clipboard. I'm using Brave and there's an explicit permission for it that is disallowed by default.
I boggled over this particular obvious problem for years.
But I don't recall Firefox ever being hardcore security and privacy (even though some of their techies are). For Mozilla, that's a fairly recent positioning that they're growing into.
Initially, there was competition to be the most popular browser.
But most of the history is a constant movement towards having the browser facilitate what companies wanted to do towards users (moving away from the "user agent" as an agent of the user).
In parallel, Google paying Mozilla for placement, and then possibly to keep a nominal competitor alive.
In recent years, Mozilla has been positioning itself as one of the champions for Internet freedom, and I assume that some of their people were that all along (e.g., the kind who could've gone to Google, but chose to work for much less money at Mozilla). Though I don't know how genuine that sentiment is from the top, when leadership draws huge compensation, for poor performance, while laying off techies. (Techies traditionally have lead Internet freedom, from the ground, up, and leadership might be better thought of as a humble support system for that.)
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#14You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...
I thought the bug is that you don't need to interact with FF to get injection into pasted payload... So am I wrong to think that as long as FF runs in the background, you can still get injection to the payload you just copied from the editor?
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#15You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...
I paste into address bar to remove formatting etc.
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#16This does not require javascript to be running either, that surprised me. But it's not that big of an issue.
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#17Well yeah, this is one of the core issues that Wayland was built to address. X11 has zero security.
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#18Well yeah, this is one of the core issues that Wayland was built to address. X11 has zero security.
This sounds like it's not really an X11 issue. From the article:
> For firefox running in Wayland, `writeXPrimary()` will only succeed when the firefox window (the main window, not necessarily the tab the code runs in) has the focus. Otherwise the selection will be cleared. At first I assumed that this is something specific to the Wayland protocol, but that turned out to be utterly false; it's just some quirk, bug or "feature" specific to either firefox itself or GTK.
> But I think that's still bad enough, even if the page should take care to only set the selection when the main window has gained focus.
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#19I am surprised that Firefox freely allows access to the clipboard. I'm using Brave and there's an explicit permission for it that is disallowed by default.
There are guardrails around access to the clipboard (and the post talks about the circumstances around it) but this exploit takes advantage of the fact that simply selecting text on X11 puts it in the primary selection buffer. The code just tells Firefox to select the text.
Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)
#20Earlier quoted context omitted.
There are terminals that have protections against that AFAIK.
I'm sure they exist. Gnome shell doesn't AFAIK. It's an odd thing to protect from; any program that has access to the X11 clipboard is going to be able to run a process as the current user.
gnome-terminal does support bracketed paste[0], and both bash 5.1 and zsh 5.1 enable it by default, so if you paste into it it will input a newline in the prompt instead of executing the command