Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

161–170 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#161

Post by sfphoton »

hulitu wrote: post #137

> In firefox running on X11, any script from any page can freely write to the primary selection, and that can be easily exploited to run arbitrary code on the user's machine. This is a problem with web browsers. They shall not run untrusted code from the internet. But we are now in the stage "oh, cool, i can access my USB from internet".

No, Firefox doesn't technically run anything on your machine. It is only that some scripts can write shell code into the "middle click buffer" which the user can unintentionally execute later.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#162

Post by layer8 »

mmis1000 wrote: post #104
layer8 wrote: post #65

Earlier quoted context omitted.

I don’t care about middle-click paste, but having selection auto-copy is also implemented by terminal emulators like Putty on Windows, and I wouldn’t want to miss that. What’s problematic with the Firefox behavior is that content gets copied (pasted) that wasn’t selected by the user.

I don't think selection along is enough to copy in windows terminal or putty. You also need to right click once to trigger the copy. So the moment that triggers actual copy always requires human interaction.

No, it works immediately upon selection in Putty: https://documentation.help/PuTTY/using-selection.html

Also in Mintty: https://mintty.github.io/mintty.1.html#%03Text%20selection,%...

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#163

Post by layer8 »

o11c wrote: post #87
layer8 wrote: post #65

Earlier quoted context omitted.

I don’t care about middle-click paste, but having selection auto-copy is also implemented by terminal emulators like Putty on Windows, and I wouldn’t want to miss that. What’s problematic with the Firefox behavior is that content gets copied (pasted) that wasn’t selected by the user.

It's absolutely no different than if the actual HTML contained invisible text though. The patch here would not help security at all. Only using control-x control-e before pasting (so that it comes into a real editor, not directly in the terminal) can help.

It’s different in that the content can change after you selected it.

Invisible text can add to what you selected, but it can’t replace it.

There’s also an argument to be made that invisible text shouldn’t be copied, though that’s harder to define precisely (you don’t want to copy “display: none”, but you want to copy scrolled-out content).

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#164

Post by MadnessASAP »

kevin_thibedeau wrote: post #68
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

It's not a Linux feature. It's an X11 feature that is super intuitive if you've been using it for 30 years. Wayland tried to remove it but it has been begrudgingly allowed because of it's incredible usefulness since it cuts out all keyboard interaction.

Meanwhile I'm sitting here trying to cut out all my mouse interaction. I'm annoyed when I have to move my hand back to the mouse.

Of course that means I also don't have a horse in the "What should middle click do race".

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#165

Post by charcircuit »

lolinder wrote: post #160
charcircuit wrote: post #155

Earlier quoted context omitted.

Windows has clipboard history

Oh, I missed that! I've been mostly on Linux since before Windows 10.

FYI Window's clipbord history has better security than what desktop Linux has. For example desktop Linux currently has no way to copy an image and specify that the contents are sensitive and should not be added to the history.

Poor API design and the inability for APIs like the clipboard to evolve are part of the reason why desktop Linux's security keeps falling behind other operating systems.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#166

Post by TacticalCoder »

kstenerud wrote: post #150
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

A colleague of mine once destroyed a customer's system with a middle mouse button fat finger. He was copying a listing all of the executables in various locations on the machine he'd created using ls -l, into a text document (logged in as root). Unfortunately, he accidentally middle-clicked while moving the mouse to the text editor, and it pasted everything into the shell. Since it was mostly symlinks in the standard…

> Since it was mostly symlinks in the standard /bin /sbin /usr/bin /usr/sbin etc, the shell dutifully redirected garbage into each destination binary, rendering the OS unusable.

One must be root to be able to do that.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#167

Post by kelnos »

emersion wrote: post #158
kelnos wrote: post #99

Earlier quoted context omitted.

> Additionally, the Wayland protocol carries an event identifier, so that the compositor can tie the clipboard request to a pointer/keyboard/touch event and take a better decision. That's actually not the case. There's a serial number that the client provides when they want to set the selection (that is, cut/copy)[0][1], but nothing when a client requests a paste[2][3]. I always thought this is weird; while yes, it's…

By "clipboard request", I meant "request to set the clipboard".

Heh, just noticed your username, obviously you know what you're talking about.

I also misinterpreted what this issue was about; my mental assumption of "pastejacking" is when a malicious app grabs the (possibly sensitive) clipboard contents without the user knowing about it (which the Wayland protocol doesn't protect against via a serial number in the request)... but that's the opposite of this issue. And you're right, in this case a compositor could absolutely reject Firefox's set_selection() request here since any serial passed to it would probably be out of date.

And correct me if I'm wrong, but IIRC wlroots does make an effort to check that the serial passed is current enough.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#168

Post by motleyhatch »

jdashg wrote: post #123

Is there no link to a Firefox bug report for this, or am I just missing it?

There was no link in the mailing list post or any of its replies. As of right now, there is no link in a HN comment.

I tried hard but could not find a relevant bug on Bugzilla, but that could be because security-related issues are typically kept under wraps until the details are safe to be publically revealed. At least that was the case for the one I submitted a few years ago; as the submitter, I can see it when I'm logged in, but it doesn't show up on anonymous searches.

If Mozilla's stance on this really is as described in the mailing list, I would very much like to add a dissenting opinion. This is clearly a security issue that needs addressing. If the clipboard buffer needs special protection, so does the primary selection buffer.

Whether most people like or dislike copy/pasting this way is irrelevant. Some people use it. The other browsers on X11 are properly protected. Even Edge on Linux gets it right. Firefox is the odd one out here and they should fix it.

Especially these days, where install instructions on web pages often look like this:

  curl -o- https://example.com/trust/me/install.sh | sudo bash
EDIT: As per the author's GitHub issues, the bug report is indeed still hidden:

https://bugzilla.mozilla.org/show_bug.cgi?id=1855345

https://github.com/turistu/odds-n-ends/issues/1#issuecomment...

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#169

Post by livrem »

oasisaimlessly wrote: post #113
codedokode wrote: post #105

Earlier quoted context omitted.

Having two clipboards is a bad decision. Also, trackpad doesn't have middle button.

Yep; I often wish there were three buffers! All trackpads I've tried support middle click via a three-finger tap.

But there are three buffers! There is a Secondary buffer as well. Emacs supports it at least, but no idea how to access it elsewhere? Top answer to this su question claims there is some old X10 cutbuffers supported in X11 as well (that I learned about just now) so maybe at least four buffers in theory?

https://superuser.com/questions/90257/what-is-the-difference...

https://www.gnu.org/software/emacs/manual/html_node/emacs/Se...

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#170

Post by livrem »

kstenerud wrote: post #150
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

A colleague of mine once destroyed a customer's system with a middle mouse button fat finger. He was copying a listing all of the executables in various locations on the machine he'd created using ls -l, into a text document (logged in as root). Unfortunately, he accidentally middle-clicked while moving the mouse to the text editor, and it pasted everything into the shell. Since it was mostly symlinks in the standard…

One of the terminal emulators I use, possibly the one that comes with lxqt that Lubuntu installs by default, pops up an "are you sure?" window showing exactly what I am about to paste whenever I middle-click-paste anything with a new-line. It can be disabled, but I found I quite like that extra check and would not mind if other applications did that.
Post reply on HN