Hacker News Reader

Is this dangerous if the link is able to inject Bash commands as the value of JS_ARG? If so, that's RCE and that's bad.

Is it possible to do this using the HTML5 clipboard functions instead?

JS_ARG here is coming from the user - `:cp [search term]` would be typed interactively into our iframe which pages don't have access to.

Tridactyl provides a `:shellescape` function for sanitising untrusted input but I don't think it is needed in this case.

Maybe, but I'm pretty sure browsers block the clipboard functions unless they were triggered via user input. I don't know if a page load counts as a valid trigger.

`document.execCommand("copy")` works without user input - https://developer.mozilla.org/en-US/docs/Web/API/Document/ex....

Nope.

> Conditions of having this behavior enabled vary from one browser to another, and have evolved over time.

If you're not running based on a click event, you'll certainly fail.

Perhaps extension code gets different rules. This code works in Firefox without needing interaction from the user: https://github.com/tridactyl/tridactyl/blob/5e8f94ff06bd5f14...

Extensions get different rules.

Reply on news.ycombinator.com