Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

71–80 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#71

Post by Asooka »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

This is in fact my most favourite feature. Having a selection and a clipboard just feels like second nature to me and lets me copy selected text around without having to destroy the clipboard contents.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#72

Post by teo_zero »

Zetobal wrote: post #2

Who pastes something and executes it without a second look?

If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed.

In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#73

Post by charcircuit »

voxic11 wrote: post #60
somat wrote: post #25

Earlier quoted context omitted.

Not that it matters, but it does not really put it into a buffer at least not in the sense that there is a place within X11 that is storing your selection. I think that when you paste the primary selection. X11 directs your application to the application that last selected something and you ask it for the selected bit in a specific (usually text) format. More on topic, this works fine within the trusted green zone of…

So in X11 if you select something then close the application then middle click paste into another application nothing will happen?

The same thing happens with normal ctrl c + ctrl v. One of the oddities of the Linux desktop of X and Wayland is that for some reason the display server is also in charge of letting people use the clipboard instead of it being done by a dedicated clipboard service.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#74

Post by _flux »

b112 wrote: post #9

You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

My Tilix/zsh combination just pastes the content as a multi-line entry to the terminal. If the clipboard contains control codes (e.g. arrow up) they are entered verbatim (as if I had used the quoting function ^V to enter them).

So I suppose we're not very far from this not being a problem in general.

Though I understand this also works via control codes. I hope Tilix is smart enough to filter them out from the clipboard before doing this..

edit: I tested that case out, and it works. I suppose the protocol uses quoting.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#75

Post by frrlpp »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

ffs middle click paste is the only reason to use the mouse

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#76

Post by torgard »

You can set clipboard.autocopy to false in about:config to disable this. It breaks the example, at least.

EDIT: I thought the behavior was preserved for textareas, as the comment box here still copied on select. But it suddenly disabled it here too. Restarting the browser is probably a safe bet :)

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#77

Post by dotancohen »

gpvos wrote: post #45
somat wrote: post #33

Earlier quoted context omitted.

The trick with a laptop are Thinkpads. some models have three physical "mouse" buttons. I was not looking for this as a feature when I bought one a few years ago but it had them and it has proved the thing I like about the machine the most.

That is a strong recommendation for me! I really hope three-button mice (no scrollwheel) will make a comeback.

You might like the Evoluent vertical mouse. The scrollwheel and the middle mouse button are separate.

And it is the absolute most comfortable mouse I've ever used.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#78

Post by emersion »

> For firefox running in Wayland, `writeXPrimary()` will only succeed when the firefox window (the main window, not necessarily the tab the code runs in) has the focus. Otherwise the selection will be cleared. At first I assumed that this is something specific to the Wayland protocol, but that turned out to be utterly false; it's just some quirk, bug or "feature" specific to either firefox itself or GTK.

Most Wayland compositors will refuse clipboard requests from unfocused clients.

Additionally, the Wayland protocol carries an event identifier, so that the compositor can tie the clipboard request to a pointer/keyboard/touch event and take a better decision. (This metadata is missing for X11 clients, of course.)

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#79

Post by dotancohen »

xigoi wrote: post #70
ndriscoll wrote: post #50

Earlier quoted context omitted.

Why is it so easy to find people in this industry who don't care that users can't trust their own computers (or, by extension, anything they own with a computer in it, which is quickly becoming everything)? If I select some text and press Ctrl+C, it should copy the text I selected. The user intent is obvious. There's no excuse for the ability to hijack the clipboard to exist in the first place. Web pages shouldn't be…

> Web pages shouldn't be able to modify my selection. Why is there even an API for this? To make “copy to clipboard” buttons possible.

Does not sound like a worthwhile trade-off.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#80

Post by owl57 »

dolorian wrote: post #21

I couldn't get this working in librewolf, maybe the hardening it uses prevents this. It works like a hot damn in tor browser though, which is supposed to be fairly locked down. Don't forget to turn off javascript before you leave home, kids. In chrome based browsers it rewrites the X11 paste buffer if you select anything on the page that's running the script, which is effectively the old fashioned clipboard rewrite a…

> Same could be true for emacs, someone who knows it better could pipe in.

I believe Emacs differs in two relevant ways, both not technically inherent: command prefixes are by default non-printable, and it's relatively uncommon to run Emacs without GUI.

Just tried `echo -en '\x18\x03' | xclip`.

Emacs in the default GUI mode works as expected, just pastes ^X^C (that's two control characters, they are just rendered this way) into the buffer.

xfterm4 or gnome-terminal pastes Unicode Control Pictures [1] (TIL there's such a thing) ␘␃, the same in bash, cat or `emacs -nw`.

Finally, bash in xterm echoes the control characters raw, but Emacs once again manages to get ^X^C in the buffer.

[1] https://en.wikipedia.org/wiki/Control_Pictures

Post reply on HN