Pasting into a terminal is interpreted literally, meaning an attacker can hide ;sudo do $really_evil_thing; in innocent looking, pasteable HTML with CSS tricker

Pasting into a terminal is interpreted literally, meaning an attacker can hide ;sudo do $really_evil_thing; in innocent looking, pasteable HTML with CSS trickery TBH the fact that you can't tell what the fuck you are selecting in a web browser, is more of a UX bug of web browser than a problem with user behaviour or with applications receiving stuff from browsers. That we are addressing this bug in terms of user education and workarounds in terminal emulators mostly says that we, as a community, have given up on web browsers ever making sense.