TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

With Firefox on X11, any page can pastejack you anytime (middle button paste)

220 点作者 throwaway71271超过 1 年前

27 条评论

macNchz超过 1 年前
The X “primary selection”&#x2F;middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed&#x2F;removed in Wayland.<p>Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a few significant annoyances unintentionally pasting secrets or private messages in the wrong place before I got rid of it.
评论 #37967752 未加载
评论 #37967586 未加载
评论 #37968167 未加载
评论 #37967646 未加载
评论 #37969769 未加载
评论 #37969405 未加载
评论 #37967743 未加载
评论 #37968042 未加载
评论 #37967584 未加载
评论 #37969763 未加载
评论 #37968487 未加载
评论 #37968224 未加载
评论 #37968185 未加载
评论 #37968600 未加载
评论 #37968620 未加载
评论 #37972389 未加载
评论 #37969721 未加载
emersion超过 1 年前
&gt; For firefox running in Wayland, `writeXPrimary()` will only succeed when the firefox window (the main window, not necessarily the tab the code runs in) has the focus. Otherwise the selection will be cleared. At first I assumed that this is something specific to the Wayland protocol, but that turned out to be utterly false; it&#x27;s just some quirk, bug or &quot;feature&quot; specific to either firefox itself or GTK.<p>Most Wayland compositors will refuse clipboard requests from unfocused clients.<p>Additionally, the Wayland protocol carries an event identifier, so that the compositor can tie the clipboard request to a pointer&#x2F;keyboard&#x2F;touch event and take a better decision. (This metadata is missing for X11 clients, of course.)
评论 #37968609 未加载
loxias超过 1 年前
I&#x27;m embarrassed that I&#x27;m confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean:<p>1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access)<p>2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) &lt;-- this would freak me out and require immediate opsec change on my part<p>3) some combination of the above.<p>4) something different.<p>I use exclusively Firefox (as opposed to any browser) and haven&#x27;t touched wayland. I also only type on keyboards with a trackpoint and a middle click button, and have for the past few decades. Hence, I&#x27;m sure I make heavy use of all the various methods of accessing clipboards..<p>(I&#x27;m guessing it&#x27;s closer to #1 than #2, I think I once saw a crypto address in my clipboard unexpectedly on a VM...)
评论 #37968897 未加载
评论 #37968914 未加载
评论 #37968736 未加载
评论 #37968898 未加载
评论 #37968717 未加载
dolorian超过 1 年前
I couldn&#x27;t get this working in librewolf, maybe the hardening it uses prevents this. It works like a hot damn in tor browser though, which is supposed to be fairly locked down. Don&#x27;t forget to turn off javascript before you leave home, kids. In chrome based browsers it rewrites the X11 paste buffer if you select anything on the page that&#x27;s running the script, which is effectively the old fashioned clipboard rewrite attack. This is a nice find, I like it.<p>To those wondering who would paste and execute without a second look, there are ways to hide text. You can also paste control characters, so if you pasted into vim the command would get executed without any visible feedback. Same could be true for emacs, someone who knows it better could pipe in.<p>Any time you run potentially malicious code (like clicking on a random link when you have javascript enabled) on the same computer as data you care about, you&#x27;re taking a risk. Sandboxing is a compromise, but one that&#x27;s usually worthwhile.
评论 #37968320 未加载
hulitu超过 1 年前
&gt; In firefox running on X11, any script from any page can freely write to the primary selection, and that can be easily exploited to run arbitrary code on the user&#x27;s machine.<p>This is a problem with web browsers. They shall not run untrusted code from the internet.<p>But we are now in the stage &quot;oh, cool, i can access my USB from internet&quot;.
评论 #37969935 未加载
评论 #37985210 未加载
deathanatos超过 1 年前
… that they blocked the author&#x27;s extension is like icing on this WTF cake.<p>This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is <i>absolutely</i> within it, as it&#x27;s a superset in terms of bad behavior.<p>(… but browsers have long maligned the primary selection on Linux. Neither Firefox nor Chrome have behaved properly for a long time, so it&#x27;s not really surprising that they don&#x27;t wanna when it comes to this bug. The primary selection is incredibly useful, but unique to Linux and even there, poorly understood amongst its userbase due to being a bit tricky to discover.)
评论 #37969149 未加载
评论 #37969662 未加载
评论 #37968988 未加载
评论 #37974095 未加载
itvision超过 1 年前
This has been known for at least a decade or two already.<p>And a much worse attack exists: you copy e.g. shell code from the page, and instead of what you see, you paste something evil in your terminal.
评论 #37969708 未加载
评论 #37967557 未加载
ajsnigrutin超过 1 年前
Gentoo is great!<p><pre><code> cd &#x2F;etc&#x2F;portage&#x2F;patches&#x2F;www-client&#x2F;firefox&#x2F; nano nomiddleclickhijack.patch #paste patch, save emerge -av firefox</code></pre>
评论 #37968554 未加载
torgard超过 1 年前
You can set clipboard.autocopy to false in about:config to disable this. It breaks the example, at least.<p>EDIT: I thought the behavior was preserved for textareas, as the comment box here still copied on select. But it suddenly disabled it here too. Restarting the browser is probably a safe bet :)
评论 #37977294 未加载
评论 #37969875 未加载
bbarnett超过 1 年前
You should always paste into an editor first, just copying any text from a webpage is a risk.<p>There are even examples using terminal escape codes, to hide what happened.<p><a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;privacy&#x2F;comments&#x2F;rv964x&#x2F;comment&#x2F;hr4z1fv&#x2F;?utm_source=share&amp;utm_medium=web2x&amp;context=3" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;privacy&#x2F;comments&#x2F;rv964x&#x2F;comment&#x2F;hr4...</a>
评论 #37967609 未加载
评论 #37967367 未加载
评论 #37967957 未加载
评论 #37967064 未加载
评论 #37966951 未加载
评论 #37968215 未加载
评论 #37967096 未加载
mcpackieh超过 1 年前
My list of reasons to block all javascript by default grows longer by the day. 90% of websites don&#x27;t need javascript <i>at all</i> to display the content I&#x27;m looking for, about 9% only require first party javascript, and the 1% left usually just gets me to close the tab and go somewhere else.
c7DJTLrn超过 1 年前
I am surprised that Firefox freely allows access to the clipboard. I&#x27;m using Brave and there&#x27;s an explicit permission for it that is disallowed by default.
评论 #37967148 未加载
评论 #37967028 未加载
评论 #37967801 未加载
throwawaaarrgh超过 1 年前
Firefox tends to have worse security by default than other browsers so this isn&#x27;t a surprise to me.<p>Most browser exploits are delivered by JavaScript, so the safest course of action is to use NoScript judiciously, run the browser in a VM, and pray.
评论 #37969515 未加载
dllthomas超过 1 年前
An interesting thing about X11 pasting is that the way it&#x27;s implemented (a request to the server to send a request event to the owner of the selection in question) the place you&#x27;re pasting from can actually see who is requesting the info and could make decisions based on that (even prompting for verification). I always thought that would be a great security feature for a password manager, though I don&#x27;t know if any actually do it.
nativeit超过 1 年前
This might be too controversial to say here, but I have no strong opinions on middle-click behavior one way or another.
评论 #37969735 未加载
talent_deprived超过 1 年前
For disabling X11 middle click paste, I found an interesting SO post but the best answer I saw and tested myself and it works, was the one by Suraj Inamdar about one third of the way down the page:<p><a href="https:&#x2F;&#x2F;unix.stackexchange.com&#x2F;questions&#x2F;24330&#x2F;how-can-i-turn-off-middle-mouse-button-paste-functionality-in-all-programs" rel="nofollow noreferrer">https:&#x2F;&#x2F;unix.stackexchange.com&#x2F;questions&#x2F;24330&#x2F;how-can-i-tur...</a><p>What sucks is I use middle click paste all the time so now I&#x27;ll have to decide if I want to leave it disabled for potentially improving security.
评论 #37972970 未加载
jklinger410超过 1 年前
Middle mouse paste is broken in GTK. Glad someone pointed it out, I hope it gets fixed
jdashg超过 1 年前
Is there no link to a Firefox bug report for this, or am I just missing it?
评论 #37970225 未加载
superkuh超过 1 年前
This does not require javascript to be running either, that surprised me. But it&#x27;s not that big of an issue.
评论 #37967246 未加载
pritambaral超过 1 年前
Doesn&#x27;t work on my KDE setup. Turned out I&#x27;d set the option to disable copy-via-selection in Klipper.
everdrive超过 1 年前
How is this affected by settings in Firefox to prevent sites from reading the clipboard?
评论 #37968932 未加载
m463超过 1 年前
why can the browser work with copy&#x2F;paste and intercept keys in the first place?<p>I would like to turn all that completely off.
pkulak超过 1 年前
Well yeah, this is one of the core issues that Wayland was built to address. X11 has zero security.
评论 #37967123 未加载
评论 #37967656 未加载
评论 #37968725 未加载
demondemidi超过 1 年前
You guys have a middle button? Maaaan. :)<p>Edit: did y&#x27;all miss the smiley at the end of my comment?
评论 #37967888 未加载
评论 #37967455 未加载
评论 #37967745 未加载
评论 #37967412 未加载
评论 #37972002 未加载
Zetobal超过 1 年前
Who pastes something and executes it without a second look?
评论 #37967778 未加载
评论 #37966936 未加载
评论 #37965692 未加载
评论 #37968199 未加载
评论 #37966854 未加载
forward1超过 1 年前
Since when is openwall hosted in Russia? I only know because RU IP space is blocked at my gateway. Kind of ironic.
SubiculumCode超过 1 年前
The problem is the middle paste option in Firefox. To turn it off do as follow:<p><pre><code> open a new tab type: about:config Accept the prompt type middlemouse.paste change value “true” to “false” (double click or switch on the rightside) restart firefox </code></pre> --does this solve it?
评论 #37968342 未加载
评论 #37968107 未加载