12 ms·
I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean:
by loxias 3y ago
I'm embarrassed that I'm confused enough (ignorance about how webpages and javascript modern things, etc work) to not answer this on my own, but does this mean:
1) Beware! any site you visit can, via javascript, inject whatever it wants into your clipboard (write access)
2) Beware! any site you visit can, via javascript, do whatever it wants with your clipboard (READ and write access) <-- this would freak me out and require immediate opsec change on my part
3) some combination of the above.
4) something different.
I use exclusively Firefox (as opposed to any browser) and haven't touched wayland. I also only type on keyboards with a trackpoint and a middle click button, and have for the past few decades. Hence, I'm sure I make heavy use of all the various methods of accessing clipboards..
(I'm guessing it's closer to #1 than #2, I think I once saw a crypto address in my clipboard unexpectedly on a VM...)
- codedokode 3y agoWebsites cannot read clipboard unless you press Ctrl + V, if I remember correctly. The same should apply to any Wayland application.
- tuetuopay 3y agoFrom what I gathered in the article, it's #1. Usually webpages cannot read the clipboard, and instead rely on the browser/os/whatever sending them its contents when the user ctrl+v or right-click-paste. It would then be received as a javascript event.
- loxias 3y agoOk, thanks. That matches my model of the world. You said "usually", are there any particular exceptions you have in mind?
- tuetuopay 3y agoI said "usually" as an abundance of caution, I cannot say there isn't a browser out there that lets you read the clipboard. Or some kind of flaw. Or electron.
- deathanatos 3y agoIt's #1, but it's the primary selection, not the clipboard. On Linux, there's the clipboard, which is the Ctrl+C/Ctrl+V that most people are familiar with. There's also the "primary selection", which is the currently highlighted text. That selection can be pasted into a different app or text box with middle click. So you can really quickly do highlight, middle-click, highlight, middle click. The primary selection is stored separately from the clipboard too, so it won't overwrite the contents of such. But, because setting the primary selection is just selecting text, if JS selects text, then it sets the primary selection. Compare with the clipboard: JS cannot normally set the clipboard except in certain contexts (the OP goes into these).
- loxias 3y agoAh, whew. Write only. I used to make use of the difference between clipboard and cut buffer, intentionally using them both, but for a long time now I just run autocutsel in the background which keeps them in sync -- makes it easier to copy a region in emacs and move it into firefox, or vice versa.
- dsissitka 3y agoIt's one but for your primary instead of your clipboard. The JavaScript forces your selection so it affects the output of your Shift + Insert and middle click.
- arp242 3y agoIt's the first, but only for PRIMARY (which you paste with middle-click). CLIPBOARD (Ctrl+C/Ctrl+V) is unaffected. (Well, technically, it doesn't actually "inject" anything, it just changes the selection, and arguably it's "working as intended").