Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

101–110 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#101
post #94

Gentoo is great! cd /etc/portage/patches/www-client/firefox/ nano nomiddleclickhijack.patch #paste patch, save emerge -av firefox

I mean sure but what happens when you have a bunch of patches and updates for the package and it becomes a mess of merge conflicts?

We know if this issue now, when it's fixed, you can remove the patch.

Sometimes you want some custom patches to suit your needs, then, well.. yeah, it takes some manual work.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#102
post #70

Earlier quoted context omitted.

> Web pages shouldn't be able to modify my selection. Why is there even an API for this? To make “copy to clipboard” buttons possible.

I have a copy to clipboard button that's standard across all apps and has decades of precedence: Ctrl+c. Some (older?) keyboards even label it! On my phone, if I select text, my browser pops up a menu with "copy" as an option. Why does a web page need to reinvent that wheel? For the 1/10000000 case where it makes sense, how about a "X page wants to modify your clipboard" dialog? This has been a known security vulnera…

Ctrl-c sends the interrupt signal. Remembering that in normal use (terminal) it sends interrupt, except for this one program (Firefox) where it copies would be pretty confusing and annoying.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#103
I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean:

1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access)

2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above.

4) something different.

I use exclusively Firefox (as opposed to any browser) and haven't touched wayland. I also only type on keyboards with a trackpoint and a middle click button, and have for the past few decades. Hence, I'm sure I make heavy use of all the various methods of accessing clipboards..

(I'm guessing it's closer to #1 than #2, I think I once saw a crypto address in my clipboard unexpectedly on a VM...)

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#104
post #65
post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I don’t care about middle-click paste, but having selection auto-copy is also implemented by terminal emulators like Putty on Windows, and I wouldn’t want to miss that. What’s problematic with the Firefox behavior is that content gets copied (pasted) that wasn’t selected by the user.

I don't think selection along is enough to copy in windows terminal or putty. You also need to right click once to trigger the copy. So the moment that triggers actual copy always requires human interaction.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#105
post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I cannot stand any Operating System that does not utilize left-click highlight and middle click paste. This is great secondary buffer to the clipboard Ctrl+C && Ctrl+V. I HATE the middle click scrolling feature that Windows uses, it is not user-friendly and not needed in the age of the scroll-wheel. Another reason you have to pay me to use Windows.

Having two clipboards is a bad decision. Also, trackpad doesn't have middle button.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#106
post #67

The problem is the middle paste option in Firefox. To turn it off do as follow: open a new tab type: about:config Accept the prompt type middlemouse.paste change value “true” to “false” (double click or switch on the rightside) restart firefox --does this solve it?

Why do you bother writing this up without even testing it?

idk, maybe because I'm not on my linux server on the weekend at the river, and wanted to know. go have coffee or something, you're acting grumpy

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#107
post #20

Earlier quoted context omitted.

I'm sure they exist. Gnome shell doesn't AFAIK. It's an odd thing to protect from; any program that has access to the X11 clipboard is going to be able to run a process as the current user.

gnome-terminal does support bracketed paste[0], and both bash 5.1 and zsh 5.1 enable it by default, so if you paste into it it will input a newline in the prompt instead of executing the command [0] https://en.m.wikipedia.org/wiki/Bracketed-paste

Thanks

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#108
post #103

I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean: 1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access) 2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) 3) some combination of the above…

Websites cannot read clipboard unless you press Ctrl + V, if I remember correctly. The same should apply to any Wayland application.
Post reply on HN