Hacker News Reader

Comment by axaxs | Hacker News Reader

This is exactly what I was thinking.

Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n

View on HN

This can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942

Really interesting(and terrifying) reads, thank you.

Seems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)

They can append the message to whatever you'll actually want to copy, which is how websites used to do things like this.

- Copied from https://news.ycombinator.com/item?id=26590437

The real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.

Is it still possible to paste into vim, for example? If so, how does the terminal make the distinction?

Every Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0]

[0] https://i.imgur.com/ubCXASQ.png

Huh, I've never gotten a prompt like that in Terminator.

Same for Windows Terminal:

https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...

Gnome-terminal, probably the largest by user base, does not sadly.

Reply on news.ycombinator.com