5 ms·
No, it makes sense. "Copy this" buttons are common on websites, but probably require a button click to initiate. Since you clicked on a button, you provided the
by skzv 6y ago
No, it makes sense. "Copy this" buttons are common on websites, but probably require a button click to initiate. Since you clicked on a button, you provided the input necessary to copy to the clipboard.
- judge2020 6y agoCopying to the clipboard is unrestricted even without a click, but reading clipboard text requires a permission popup. https://web.dev/async-clipboard/#security-and-permissions:~:text=Permissions%20for%20copy%20and%20paste%20have%20been%20added%20to%20the https://web.dev/async-clipboard/#security-and-permissions:~:...
- axaxs 6y agoThis is exactly what I was thinking. Theoretically, a bad actor could have a site or even inject code onto a site with an innocuous looking bash command, but upon copy injects say, rm -rf ~ \n
- judge2020 6y agoThis can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942 https://security.stackexchange.com/a/113630/96942
- axaxs 6y agoReally interesting(and terrifying) reads, thank you.
- kelnos 6y agoSeems like this requires you to select some text (which includes some text that's been hidden using CSS tricks) and copy it. So it's not like the website can just arbitrary write to your clipboard without your interaction? (Still, this is kinda scary and I didn't know about this.)
- input_sh 6y agoThey can append the message to whatever you'll actually want to copy, which is how websites used to do things like this. - Copied from https://news.ycombinator.com/item?id=26590437 https://news.ycombinator.com/item?id=26590437
- SilverRed 6y agoThe real bug is that \n pasted in to the terminal counts as hitting enter. iTerm has fixed this but every linux terminal I have used has this issue.
- vanviegen 6y agoIs it still possible to paste into vim, for example? If so, how does the terminal make the distinction?
- shakna 6y agoEvery Linux terminal I've used has a pop-up when there's a new newline. Like this, which in this case is xfce4-terminal. [0] [0] https://i.imgur.com/ubCXASQ.png https://i.imgur.com/ubCXASQ.png
- PowerBar 6y agoHuh, I've never gotten a prompt like that in Terminator.
- judge2020 6y agoSame for Windows Terminal: https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86wUU.png https://i.judge.sh/sentimental/Lotus/WindowsTerminal_fyi7k86...
- axaxs 6y agoGnome-terminal, probably the largest by user base, does not sadly.
- kelnos 6y agoIs it? When I click the "Write" button, it turns green, but when I click "Write (delayed)", after a while it turns red. So it seems (at least on Firefox 87) even the clipboard write API is restricted to user-action event handlers.