With Firefox on X11, any page can pastejack you anytime (middle button paste)

I do agree that overloading the button is terrible. I like the scroll wheel but wish there was a separate middle button. And I loathe middle button auto scroll, I regard it as a useless, user hostile feature.

I didn't know wayland doesn't support that either, one more thing to add to the list of things it doesn't support like screenshots, xclip, mouse/keyboard automation, etc...

Then I try to middle click autoscroll in discord or something (which works in windows!) and I’ll paste in information that I don’t intend to.

This is the first I’m hearing about Wayland fixing this. Maybe I’ll give Wayland yet another try soon.

What’s problematic with the Firefox behavior is that content gets copied (pasted) that wasn’t selected by the user.

Tried a few solutions but they didn't work on Wayland (as most of them were xinput hacks).

I didn't experience such accidental pastes when I had Windows installed.

In places where this doesn't work, clipboard history is an okay replacement (if you need multiple things "transported").

Copying should always be deliberate, not something that blasts out your clipboard when you click in the wrong place and select something unintentionally. And middle click is for opening tabs.

He was copying a listing all of the executables in various locations on the machine he'd created using ls -l, into a text document (logged in as root). Unfortunately, he accidentally middle-clicked while moving the mouse to the text editor, and it pasted everything into the shell.

Since it was mostly symlinks in the standard /bin /sbin /usr/bin /usr/sbin etc, the shell dutifully redirected garbage into each destination binary, rendering the OS unusable.

That's actually not the case. There's a serial number that the client provides when they want to set the selection (that is, cut/copy)[0][1], but nothing when a client requests a paste[2][3].

I always thought this is weird; while yes, it's nice to prevent random applications from spuriously taking over as the source of the clipboard/primary, I think it's much more important to have a mechanism to reduce the risk of a client pasting without permission.

[0] https://wayland.app/protocols/wayland#wl_data_device:request... (regular clipboard)

[1] https://wayland.app/protocols/primary-selection-unstable-v1#... (primary selection)

[2] https://wayland.app/protocols/wayland#wl_data_offer:request:... (regular clipboard)

[3] https://wayland.app/protocols/primary-selection-unstable-v1#... (primary selection)

Usually webpages cannot read the clipboard, and instead rely on the browser/os/whatever sending them its contents when the user ctrl+v or right-click-paste. It would then be received as a javascript event.

On Linux, there's the clipboard, which is the Ctrl+C/Ctrl+V that most people are familiar with.

There's also the "primary selection", which is the currently highlighted text. That selection can be pasted into a different app or text box with middle click. So you can really quickly do highlight, middle-click, highlight, middle click.

The primary selection is stored separately from the clipboard too, so it won't overwrite the contents of such.

But, because setting the primary selection is just selecting text, if JS selects text, then it sets the primary selection. Compare with the clipboard: JS cannot normally set the clipboard except in certain contexts (the OP goes into these).

(Well, technically, it doesn't actually "inject" anything, it just changes the selection, and arguably it's "working as intended").

I believe Emacs differs in two relevant ways, both not technically inherent: command prefixes are by default non-printable, and it's relatively uncommon to run Emacs without GUI.

Just tried `echo -en '\x18\x03' | xclip`.

Emacs in the default GUI mode works as expected, just pastes ^X^C (that's two control characters, they are just rendered this way) into the buffer.

xfterm4 or gnome-terminal pastes Unicode Control Pictures [1] (TIL there's such a thing) ␘␃, the same in bash, cat or `emacs -nw`.

Finally, bash in xterm echoes the control characters raw, but Emacs once again manages to get ^X^C in the buffer.

[1] https://en.wikipedia.org/wiki/Control_Pictures

Not just browsers, users also rightfully malign the primary selection. I highlight text for all sorts of reasons (including because I already have something that I want to paste).

Pages stealing your current middle-mouse-paste selection, however, only requires selecting text in another place, and it seems like the only way to defend against this is by not selecting text. Which, at least for me, is not really feasible.

Say you're about to copy a crypto wallet. You have it selected, and are about to press CTRL-C to copy it. It is entirely possible for malicious code to detect that. And, as it turns out, it's possible for it to change the selection to a different (invisible) string, right as you press CTRL-C.

[1] - https://thejh.net/misc/website-terminal-copy-paste

A solution is bracketed paste[1] as mentioned in earlier comments[2], which would allow the user to examine a pasted command before running it.

[1] https://en.wikipedia.org/wiki/Bracketed-paste

[2] https://news.ycombinator.com/item?id=37966924

and that editor should not be running "inside" a terminal

-- or rather I don't understand why those that like interacting with their editor via a terminal interface don't create a new protocol that doesn't have the warts and vulnerabilities the current ancient protocol has.

So I suppose we're not very far from this not being a problem in general.

Though I understand this also works via control codes. I hope Tilix is smart enough to filter them out from the clipboard before doing this..

edit: I tested that case out, and it works. I suppose the protocol uses quoting.

But I don't recall Firefox ever being hardcore security and privacy (even though some of their techies are). For Mozilla, that's a fairly recent positioning that they're growing into.

Initially, there was competition to be the most popular browser.

But most of the history is a constant movement towards having the browser facilitate what companies wanted to do towards users (moving away from the "user agent" as an agent of the user).

In parallel, Google paying Mozilla for placement, and then possibly to keep a nominal competitor alive.

In recent years, Mozilla has been positioning itself as one of the champions for Internet freedom, and I assume that some of their people were that all along (e.g., the kind who could've gone to Google, but chose to work for much less money at Mozilla). Though I don't know how genuine that sentiment is from the top, when leadership draws huge compensation, for poor performance, while laying off techies. (Techies traditionally have lead Internet freedom, from the ground, up, and leadership might be better thought of as a humble support system for that.)

I've also set dom.event.clipboardevents.enabled to false since I don't want websites messing with the clipboard.

I tried hard but could not find a relevant bug on Bugzilla, but that could be because security-related issues are typically kept under wraps until the details are safe to be publically revealed. At least that was the case for the one I submitted a few years ago; as the submitter, I can see it when I'm logged in, but it doesn't show up on anonymous searches.

If Mozilla's stance on this really is as described in the mailing list, I would very much like to add a dissenting opinion. This is clearly a security issue that needs addressing. If the clipboard buffer needs special protection, so does the primary selection buffer.

Whether most people like or dislike copy/pasting this way is irrelevant. Some people use it. The other browsers on X11 are properly protected. Even Edge on Linux gets it right. Firefox is the odd one out here and they should fix it.

Especially these days, where install instructions on web pages often look like this:

  curl -o- https://example.com/trust/me/install.sh | sudo bash

https://bugzilla.mozilla.org/show_bug.cgi?id=1855345

https://github.com/turistu/odds-n-ends/issues/1#issuecomment...

What do you mean?

Arguably, it's "working as intended" because middle click is supposed to paste whatever is selected, and the JS did select some text. Fixing this in a way that won't cause UX regressions and can't be by-passed relatively easily might be rather tricky.

> For firefox running in Wayland, `writeXPrimary()` will only succeed when the firefox window (the main window, not necessarily the tab the code runs in) has the focus. Otherwise the selection will be cleared. At first I assumed that this is something specific to the Wayland protocol, but that turned out to be utterly false; it's just some quirk, bug or "feature" specific to either firefox itself or GTK.

> But I think that's still bad enough, even if the page should take care to only set the selection when the main window has gained focus.

I was not looking for this as a feature when I bought one a few years ago but it had them and it has proved the thing I like about the machine the most.

you already decided to hit enter while you are selection something, could be just a bit above your current cursor in the terminal

If I select some text and press Ctrl+C, it should copy the text I selected. The user intent is obvious. There's no excuse for the ability to hijack the clipboard to exist in the first place.

Web pages shouldn't be able to modify my selection. Why is there even an API for this?

The web ecosystem (including browsers) turned straight up malicious like 15 years ago, and users became nothing more than a product for everyone involved. That cancer has even metastasized and spread to the OS or even products that people pay thousands or tens of thousands of dollars for. I don't know how people who think that way can live with themselves.

In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.

It's copy that's an exploit vector.

To disable it, set clipboard.autocopy to false.