Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

Copying to the clipboard is unrestricted even without a click, but reading clipboard text requires a permission popup.

https://web.dev/async-clipboard/#security-and-permissions:~:...

This is exactly what I was thinking.

Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n

This can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942

Seems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)

They can append the message to whatever you'll actually want to copy, which is how websites used to do things like this.

- Copied from https://news.ycombinator.com/item?id=26590437

Really interesting(and terrifying) reads, thank you.

The real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.

Every Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0]

[0] https://i.imgur.com/ubCXASQ.png

Same for Windows Terminal:

https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...

Gnome-terminal, probably the largest by user base, does not sadly.

Huh, I've never gotten a prompt like that in Terminator.

Is it still possible to paste into vim, for example? If so, how does the terminal make the distinction?

Is it? When I click the "Write" button, it turns green, but when I click "Write (delayed)", after a while it turns red. So it seems (at least on Firefox 87) even the clipboard write API is restricted to user-action event handlers.

Reply on news.ycombinator.com