With Firefox on X11, any page can pastejack you anytime (middle button paste)

I couldn't get this working in librewolf, maybe the hardening it uses prevents this. It works like a hot damn in tor browser though, which is supposed to be fairly locked down. Don't forget to turn off javascript before you leave home, kids. In chrome based browsers it rewrites the X11 paste buffer if you select anything on the page that's running the script, which is effectively the old fashioned clipboard rewrite attack. This is a nice find, I like it.

To those wondering who would paste and execute without a second look, there are ways to hide text. You can also paste control characters, so if you pasted into vim the command would get executed without any visible feedback. Same could be true for emacs, someone who knows it better could pipe in.

Any time you run potentially malicious code (like clicking on a random link when you have javascript enabled) on the same computer as data you care about, you're taking a risk. Sandboxing is a compromise, but one that's usually worthwhile.

For disabling X11 middle click paste, I found an interesting SO post but the best answer I saw and tested myself and it works, was the one by Suraj Inamdar about one third of the way down the page:

https://unix.stackexchange.com/questions/24330/how-can-i-tur...

What sucks is I use middle click paste all the time so now I'll have to decide if I want to leave it disabled for potentially improving security.

Not that it matters, but it does not really put it into a buffer at least not in the sense that there is a place within X11 that is storing your selection. I think that when you paste the primary selection. X11 directs your application to the application that last selected something and you ask it for the selected bit in a specific (usually text) format.

More on topic, this works fine within the trusted green zone of local desktop applications. but the browser is(or should be) a high security zone. with a really tricky security policy. which to paraphrase would be "Allow passing information to the rest of the os. but only as a result of a direct user request." You don't really want to disallow the browser to script selecting anything, this is useful for editors. but you probably want to maintain a flag on that selection as to if it was done by the user or not.

Well there is my useless pedantry for the day done. My apologies and thank you for letting me get that off my chest.

Middle mouse paste is broken in GTK. Glad someone pointed it out, I hope it gets fixed

Since when is openwall hosted in Russia? I only know because RU IP space is blocked at my gateway. Kind of ironic.