16 ms·
Chrome allows websites to write to the clipboard without the user’s permission
Steps to reproduce:
1. Visit https://webplatform.news/ in a Chromium-based browser
2. Inspect your clipboard (paste it somewhere)
- egberts1 4y agoCool. Now couple that with ability to store on the user’s file system. Can we all now say in unison: FILELESS MALWARE? Oh, wait.
- donclark 4y agoThis is what was in my clipboard: Hello, this message is in your clipboard because you visited the website Web Platform News in a browser that allows websites to write to the clipboard without the user’s permission. Sorry for the inconvenience. For more information about this issue, see https://github.com/w3c/clipboard-apis/issues/182 https://github.com/w3c/clipboard-apis/issues/182.
- mey 4y agoLooks like this "works" on Android 13 Chrome as well. Had the nice little clipboard popup when something gets put on the clipboard with the expected message contents. Doesn't happen on Firefox as expected.
- entropie 4y agoSeems not to work in brave. Edit: to clarify, that is Version 1.42.97 Chromium: 104.0.5112.102 (Official Build) (64-bit) Windows
- behnamoh 4y agoWorks on mine (macOS Brave).
- truekojo 4y agoWorked in Brave for me. Using a Mac.
- Turing_Machine 4y agoSame here. Brave is up to date Version 1.42.97 Chromium: 104.0.5112.102 (Official Build) (arm64)
- filiphorvat 4y agoWorks for me (also Windows) Version 1.42.97 Chromium: 104.0.5112.102 (Official Build) (64-bit)
- anotheraccount9 4y agoIt's a bidirectional networked clipboard.
- basicplus2 4y agoChromium as part A of malware
- deleted 4y ago[deleted]
- behnamoh 4y agoCan clipboard content be exploited to run code? Something like a special OS string that escapes clipboard? Also, is there a way to patch this Chrome "feature"?
- deleted 4y ago[deleted]
- SoftTalker 4y agoAlmost as bad as running code is if there is a way to read the clipboard.
- bombcar 4y agoThis could be very fun on those websites that give you a code snippet to copy and paste and install oh-my-zsh and friends.
- b0ner_t0ner 4y agoOr on crypto DEXes where you paste in one address, the compromised exchange website shows you what you pasted with a CSS overlay but in reality, the real input field underneath has already been replaced with a Tornado Cash address, so when you submit the form, it's crypto go bye bye.
- deleted 4y ago[deleted]
- behnamoh 4y agomaybe we need a clipboard manager that blocks Chrome in such situations.
- zeroclip 4y agoThis is not even a clipboard problem. If the site is compromised, they can display the correct value in the input form, but submit the malicious value in the code that triggers the wallet transaction. The user’s wallet software can detect these by warning the user that the contract address is unknown or never before seen by them.
- armchairhacker 4y agoCan websites read the clipboard without permission? That would be much worse
- harrisi 4y agoAccording to the commit message, yes.
- chii 4y agoSo if you have a password manager, your password could be leaked if you forgot to un-copy it after pasting?
- number6 4y agoMost Managers have the Option to uncopy after a few seconds.
- Gigachad 4y agoIt shouldn’t. Notice how in google docs you can copy via the right click menu but you can’t paste. For paste the app tells you to use the keyboard shortcut as JS doesn’t have access to reading the clipboard. Writing to it is super common for things like share links where clicking the button puts them in the clipboard.
- zebracanevra 4y agoFrom the chrome bug[0] it seems like this was changed to work without a gesture because the new tab page needs to copy text for a Google Doodle... So instead of changing their new tab page to require a gesture like all other sites... they decided to allow any website to copy text into the clipboard. Nice. I think copying into the clipboard needs an overhaul—even with a gesture. Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed. [0] crbug.com/1334203
- zzo38computer 4y agoOne thing that should be done is a user setting to configure this capability. If it is disabled then their copying to clipboard does not have any effect (this is not detectable by the web page), except if you push the key combinations (or menu items) to normally do so while the text is selected in which case only that text is copied to the clipboard. This also would affect which text can be selected, too, not only the clipboard. Disabling fonts also can be possible, etc. (On my computer I usually disable the scripts so that it will not do such a things, but even if scripts are enabled, you might want to configure that feature too.)
- BeefWellington 4y agoFirefox does this via the setting: dom.event.clipboardevents.enabled
- matheusmoreira 4y ago> Don't you hate when news sites add a "- from XYZ" to your clipboard? And then there's the "clever" sites that replace the text I copied with a message like "haha you thought you could copy this? think again sucker".
- zebracanevra 4y agoI feel like if you've selected some text, then pressing copy should always copy that text and nothing else. But then: what's to stop websites from detecting you've selected text, unselecting it, and copying the bad text in, and then reselecting it... There are so many loopholes I can imagine to get around these restrictions :(
- _8j50 4y agoA notice when it happens would be nice but I would be granting a lot of permissions if this was off until allowed.
- oefrha 4y agoRelevant commit: https://chromium.googlesource.com/chromium/src/+/4d7b74b051abfe5945f418601fdc2ffc8ce3072c https://chromium.googlesource.com/chromium/src/+/4d7b74b051a... commit 4d7b74b051abfe5945f418601fdc2ffc8ce3072c Author: Anupam Snigdha <snianu@microsoft.com> Date: Tue Jun 07 16:36:28 2022 [Clipboard API] Remove user gesture requirement for read/writeText. Adding user gesture requirement for readText and writeText APIs breaks NTP doodle sharing. We are relaxing this check for now, but we should fix this for sites to not rely on these APIs to be called without a user gesture. See NewTabPageDoodleShareDialogFocusTest.All test for more details.
- nextaccountic 4y agoWhat is a NTP doodle? Is this related to chrome-search://local-ntp/doodles.js? (I can't see because I don't use chrome) But chrome-search://local-ntp/doodles.js is served from a chrome-search:// url, chrome could give it permissions without giving for every web page
- llacb47 4y agoNew tab page google doodle
- SturgeonsLaw 4y agoImagine introducing a security risk in order to make it easier for people to share some silly cartoon picture. Who's reviewing these decisions?
- lolinder 4y agoIt looks like a Microsoft engineer accidentally broke some Google code while implementing an unrelated feature. They tried to restore the old behavior but ended up actually breaking the interaction checks altogether. If you look at the commit comment, it indicates that they understood they were only disabling the checks for the new clipboard feature they were working on, not for all clipboard actions.
- xlaacid 4y agoto no one's surprise it also does it in chromium- Hello, this message is in your clipboard because you visited the website Web Platform News in a browser that allows websites to write to the clipboard without the user’s permission. Sorry for the inconvenience. For more information about this issue, see https://github.com/w3c/clipboard-apis/issues/182 https://github.com/w3c/clipboard-apis/issues/182.
- jmcgough 4y agoit's nothing but chromium all the way down ;)
- userbinator 4y agoYet more vindication for those who disable JS and whitelist it only for a small subset of trusted sites. I should not need to run arbitrary code from a site just to be able to view text, images, and interact with forms. I remember not long ago I got some confused looks from others for not using the "copy to clipboard" buttons that some sites (which I did trust enough to allow JS on) have around code blocks and the like. They were just as confused why I was not using that "useful feature" as I was why they didn't seem to realise that selection is a built-in feature of the browser that behaves (mostly) predictably and is available everywhere. I'd rather select the text myself than click a button that claims to do it for me.
- account-5 4y agoIt can be a pain but this is how I traverse the internet. I get really annoyed with sites where I have to enable JavaScript to view text. I'm like both noscript and ublock advanced (not together), but much preferred umatrix when it was in development.
- Am4TIfIsER0ppos 4y agoYou might already be aware of this but use the developer tools of the browser to check for "display: none" or "visibility: hidden" or "opacity: 0" style attributes on some html element (sometimes the <body> element) Fucking web designers man!
- account-5 4y agoHaha, yeah it's a pain, I've a bookmarklet for looping through some of this CSS stuff to make it visible on desktop. Neither much use on mobile though.
- cmeacham98 4y agoIf the text really is there (and is just hidden by CSS), may I suggest Firefox reader mode?
- jcparkyn 4y ago
- mamoriamohit 4y agoDoes changing it to require permission would mean that every "Copy Code" button will need a pop-up? I am torn between the usability vs security of this issue.
- thrdbndndn 4y agoThe title is kinda misleading. "[W]ith user's permission" probably should be "with user's action" instead. By default, you can copy to clipboard in all the major browsers when user takes an action, like click some buttons or links. So all these "copy code" buttons won't stop working. What does not in Firefox (and shouldn't in Chrome) is to do so without user's action. Note: I have no idea what the rigid definition of "user's action" is. But clicking a button counts.
- quickthrower2 4y agoStyle the button to be “Reject All” of a cookie notice or a “X” of a marketing popup.
- quickthrower2 4y agoAnd this means you can copy a curl | sh … type thing and hope someone pastes that into their terminal.
- jonas-w 4y agoYes that's why you shouldn't run curl | sh commands without double or tripple checking. Even without this exploit. Check the scripts that are being downloaded and check if this script you download is really the same as for example in the git repo.
- unixbane 4y agoPasting anything what so ever in the shell is a vuln if you are on a system where untrusted programs can set the clipboard. Even typing "echo <ctrl+shift+v>". And no, it's not detectable either.
- pedrovhb 4y agoI'm sure this is harmless. It's not like anyone just copies code from webpages and just pastes it into their code editor or shell, right?
- codedokode 4y agoThis has a great potential for advertising. Everyone likes to get unique offers delivered into theirclipboards. I think that copy/paste in browser should only be done with hotkeys like Ctrl + C/V or using menu. Sites should not have access to clipboard on click/tap because it is easy to misuse.
- zelphirkalt 4y agoEven better!: You can refresh the clipboard regularly, for as long as the user is on the page! That way, they'll get access to important notifications about our cool products, while they are coding or handling text in other ways!
- noisy_boy 4y agotail -f clipboard
- phyzome 4y agoAt one point I recall a website that would quietly paste a Bitcoin address into the user's clipboard on every interaction. I'm sure this worked reasonably well for them -- who can tell that they've pasted the wrong string of garbage into a transaction UI?
- capableweb 4y agoBecause almost zero percent of cryptocurrency users blindly paste addresses into clients without at least double-checking it was actually the address they wanted to paste. Most of them are conditioned not to trust anything, and double-verify. If you're sending a large amount, you first send a small amount, verify it arrived to the correct address and then send the proper amount. Verifying the "string of garbage" (which is actually a hash) is simply a matter of checking the first and last four characters, can be done in 10 seconds easily.
- phyzome 4y agoYou have a great deal more faith in the competence, rigor, and patience of the average user than I do. (Let alone the 10th percentile user, which is who would be more likely hit.)
- unixbane 4y agoThis is why you don't break abstractions. If I'm a user I expect the clipboard to only change when I press ctrl+c or right click -> copy. These should be authoritatively controlled mechanisms that untrusted programs cannot override. Going further, I want whatever I copy to be whatever I see when I hit copy. Which of course isn't possible in the interactive web. But unfortunately devs for the last few decades think they can just leave everything undefined and change its meaning for their ad-hoc purposes every minute then claim computing is hard.
- real_jiakai 4y agoI hope Google will remove this feature. I don't like strange website writes something balabalabala to my clipboard without my permission!