479298 - Copy/Paste Could Allow URL spoofing.

Status: RESOLVED DUPLICATE of bug 57770

(Firefox :: General, defect)

Description

[Gareth Latty]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009021207 GranParadiso/3.0.6
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009021207 GranParadiso/3.0.6

I don't know if this quite classes as a bug, whether it's fixable, or whether indeed, it should be 'fixed', but I'll go ahead and explain.

It is possible to place text-off screen in such a way as to add text in when a block of text (such as a URL) is copy/pasted as Firefox appears to select text based on the code, not on-screen location.

In the day and age when people are told to copy/paste links to sites to avoid fake links, this is a pretty easy way to falsify a link. It's not entirely effective, as it's easy to spot when you paste, and doesn't help with security certificates, but if one uses a long URL and masks it cleverly, it could be an effective tactic.

Check the link for an example.

Reproducible: Always

Steps to Reproduce:
1. Create a page in which text has an element inside, which is positioned off-screen.
2. Copy this text.
3. Paste.
Actual Results:  
Off-screen text is pasted as well.

Expected Results:  
Only what you see selected should be pasted, one would presume.

Comment 1

[Tyler Downer [He/Him]]

I see how this could be bad, but not sure if we should lose copy paste functionality because someone could make a link that points to an attack site. Even just making it copy visible parts of the selection still is a loss in function. Will leave for the devs to decide wither to WONTFIX or not, but just my 2 cents.

Comment 2

[Jesse Ruderman]

I don't think it's possible to fix this without breaking everything.  I use Cmd+A Cmd+C to copy an entire web page, and I'll be unhappy if the "off-screen" parts are omitted.

If there are specific cases that affect well-behaved forums or plain-text email, maybe we can fix those, but for arbitrary web pages I think this is WONTFIX / CANTFIX.

Comment 3

[Tyler Downer [He/Him]]

Reporter, are you still seeing this issue with Firefox 3.6.13 or later in safe mode or a fresh profile? If not, please close. These links can help you in your testing.
http://support.mozilla.com/kb/Safe+Mode
http://support.mozilla.com/kb/Managing+profiles

You may also wish to try with the latest Firefox 4 beta, http://www.mozilla.com/en-US/firefox/all-beta.html.