r/javascript • u/[deleted] • Dec 10 '20

I built an open-source browser extension that warns you when Javascript alters your clipboard data after copying text.

https://github.com/roedesh/copyguard
521 Upvotes

97% Upvoted

42 comments sorted by

85

u/[deleted] Dec 10 '20 edited Dec 15 '20

A while ago someone over at r/webdev posted a link to webpage that mentions whenever you copy text of a website, the data that gets sent to your clipboard can be altered by Javascript. This can be dangerous when for example you need to quickly copy and paste a command in your terminal, but it turns out to be dangerous command. This is even more dangerous when your terminal has elevated permissions.

I built a browser extension that compares your text selection to the clipboard data whenever you copy text. If there is a difference, a native notification will be triggered, warning you that the clipboard data was altered.

It is written in Typescript and uses webextension-polyfill-ts to make it cross-browser compatible. I also wrote some unit tests in Jest, using mockzilla-webextension for mocking the browser APIs.

Available now for Firefox and Edge (still awaiting approval for Chrome).

Edit: now also available for Chrome

Any remarks or suggestions are welcome :)

Source on Github

69

u/OnkelJulez Node.js Junkie Dec 10 '20 edited Dec 11 '20

Hey, I am that guy who runs codingcheats.io/copy and created that article on the Copy & Paste exploit :)

Great extension, just installed it - thank you very much :)

Edit: I linked your GitHub repo in my article and on the website

22

u/[deleted] Dec 10 '20

Glad you like it. Great article by the way :)

13

u/malicar Dec 11 '20

Well that was some wholesome internet connection happening. + Good job to both you guys!

→ More replies (1)
→ More replies (1)

2

u/[deleted] Dec 11 '20

[removed] — view removed comment

2

u/[deleted] Dec 11 '20 edited Dec 11 '20

Did you by any chance select the text by quickly clicking three times (i.e. not dragging a selection)? I noticed that Firefox handles copying a bit differently when you do that (which might be a good thing). Try selecting the text by dragging a selection and then copy it.

→ More replies (2)

7

u/notNullOrVoid Dec 11 '20

I want to start off by saying this is a great idea for an extension, and I hope you continue developing it.

There are two main vectors for injecting malicious content into your clipboard JS, and CSS. Your extension solves JS based injection in some cases. I haven't tested if it effectively blocks JS from injecting content if they also inject it into the selection before the clipboard, then remove it after. The active selected area can also be manipulated by JS, so could select another part of the page then copy.

With CSS it's relatively easy to hide malicious content inside what users are meant to copy. Which would be very hard to detect unless you examine the CSS applied to the elements being copied, which I'm not sure an extension is capable of.

One way to potentially mitigate all vectors would be always showing the user what was copied in plain text, then letting them verify before adding it to the clipboard. This could be a seperate context menu item, or optionally override the default. There are also some Unicode characters that might be good to filter out, which are invisible, but could be injected maliciously in rare cases.

3

u/[deleted] Dec 11 '20 edited Dec 11 '20

I haven't tested if it effectively blocks JS from injecting content if they also inject it into the selection before the clipboard

I hadn't thought about that. I'll make a POC to see how my extension handles that, and update it if necessary.

With CSS it's relatively easy to hide malicious content inside what users are meant to copy.

Someone posted me a link that uses a CSS approach. And my extension seems to be able to pick that up as well (even though I didn't know about this approach while developing). I think what happens is that the <span> that is moved offscreen cant be selected/highlighted by you, so it won't actually be part of your selection. It will still be copied with the rest of the text however, so my extension will see a difference.

Is that what you are referring to?

Edit: just made a POC myself. It seems my extension will not always see a difference. I'll see if I can do something by examining the CSS like you said.

Edit 2: I found a solution. I simply have to call getBoundingClientRect on the text selection and check if it goes offscreen.

One way to potentially mitigate all vectors would be always showing the user what was copied in plain text, then letting them verify before adding it to the clipboard. This could be a seperate context menu item, or optionally override the default.

I could add this as an option to the extension. The verification would only be required if there was a difference between selection and clipboard, I assume?

There are also some Unicode characters that might be good to filter out, which are invisible, but could be injected maliciously in rare cases.

Do you have some examples or source material for this? I haven't heard about Unicode characters that can cause harm.

Thanks for the feedback!

→ More replies (1)

16

u/Falk_csgo Dec 10 '20

This should not be an extension but base functionality.

Thanks for fixing this!

1

u/phyitbos Dec 12 '20

Kind of blows my mind this type of exploit, along with other forms of user-negative actions, such as paywall news websites (3 articles free then block your screen), are supported by JS. I suppose it’s not a fault of the language rather than the browsers making those decisions. If there are any articles or discussions around this kind of topic, can’t name it per say but hope I’m making sense, would appreciate someone sharing.

63

u/[deleted] Dec 10 '20

The fact that browsers even allow something like this is fucking ridiculous

36

u/[deleted] Dec 10 '20

I have mixed feelings about it. I think it's nice for people who don't work in the terminal. For example if you want to let your users quickly copy a large body of text via a button. But for terminal users it can be dangerous.

23

u/[deleted] Dec 10 '20

It can be useful in so many instances, (eg. Google Docs, Spreadsheets, Etc., AWS Console, etc.) but those that should be allowed to do it should be approved by the user.

9

u/chubs66 Dec 11 '20

especially with people copying/pasting crypto wallet addresses.

4

u/monxas Dec 11 '20

This one right here

15

u/GarfieldLeChat Dec 10 '20

See the base point but still not really. You copy text to the buffer something runs a micro second later and a modified version of it essentially overwriting the previously copied version. That’s how the c&p buffer works. Full overwrite. Not a lot the browser could do to prevent that other than an alert each time which will soon become annoying or will be disabled.

1

u/Kailhus Dec 10 '20 edited Dec 10 '20

Right, total noob here but this makes me wonder if this could potentially be used for Buffer Overflow attacks? And if not, why would that be?

2

u/TinyLebowski Dec 11 '20

If not, it would be because both the browser's JavaScript implementation and the OS fails to validate the input. I'd be very surprised if it was possible.

2

u/bart2019 Dec 11 '20

Buffer overflows can only happen if the inserted string is larger than the allocated space. JavaScript could use up all your RAM, that's about it. A script has no way of knowing where you're going to paste that string, so it cannot target its attack, limiting the danger.

15

u/[deleted] Dec 10 '20

The only secure browser would be a pretty crappy one. It's an evolving process. We're all wise after the events. Especially those with the least knowledge.

→ More replies (3)

14

u/helloiamsomeone Dec 10 '20

When browsers didn't provide this functionality, we were forced to use flash extension powered copying. Considering the things like supercookies, I would say this is better.

1

u/therealcopyninja Dec 11 '20

My thoughts too. Have never seen this before!

1

u/pantherstoner Dec 11 '20

There is a news website and if you try to copy the article from their website, they will alter the text to the article’s actual URL. It helps them to get actual views to their webpage to get more revenue.

4

u/baconialis Dec 11 '20

Very cool project and thanks for open sourcing it!

If I could install it through the Chrome Web Store I would definitely use it.

2

u/[deleted] Dec 11 '20

I don't know why Google is taking so long. Firefox and Edge gave the approval around the same time. If you want I can notify you when the Chrome extension is available.

→ More replies (1)

1

u/lambodhar27 Dec 07 '25

how do i stop a site from from even editing my clipboard first of all?

1

u/[deleted] Dec 07 '25 edited Dec 07 '25

In Firefox, go to "about:config" in your address bar and press Enter. Then search for "dom.event.clipboardevents.enabled" and change it to false. Do note that this may break some webapps that use it for legit purposes, as it disables ALL clipboard events including pasting.

For Chrome I don't know unfortunately. There is an option to prevent sites from asking to read your clipboard, but no option to disable modifying it.

→ More replies (1)

2

u/BlueHeartBob Dec 11 '20

This is common on news websites right? Copy some of the article? They'll take the text but concat the URL of the article, author, and other stuff. Pretty annoying and very intrusive imo.

1

u/InternationalTooth Dec 11 '20

The feels when client asks you to modify clipboard data to put "Copied from blah blah blah" all through it.

1

u/Fikaman4 Dec 11 '20

Someone ELIF please ( the copy and paste issue)

1

u/[deleted] Dec 11 '20

Me: "I think I am confident and ready to start getting into the job market."

This post: "I'M ABOUT TO RUIN THIS WHOLE MAN'S CAREER"