Browser copy function overridden silently, is this security risk?

Question

I came across a site which overrides copy functionality and injects current page url as paste value. I was trying to select couple of words and instead it copied the page link. Simple developer tools inspection showed event getting overridden with following function

 window.addEventListener("copy", event=>{
    const selection = document.getSelection();
    event.clipboardData.setData("text/plain", window.location.href),
    event.preventDefault()
}

While in this case, it's annoying but harmless, I'm wondering if it's good idea to allow user intentions changed without any warnings to the user. Even the test code from mdn copy event allowed me to change to random text without any warning. Basically I'm trying to copy "abcd" to clipboard and browser does copy "wxyz"

Wondering if hackers can takeover this functionality and copy their choice of links or data on clipboard especially when browsers did not seem to be warning you that text you selected and tried to copy has been modified.

I have tried this on latest versions of Firefox and Chromium available on Ubuntu 18.04 and none of the browsers warned me anything.

Answer 1

Could it be misused? Yes. But I also know of many websites for which modifying this behavior is required. For example, websites that don't want you to copy paste anything from them. In those cases I've also seen them notify users with a popup like "This website does not allow copy pasting functionalities". And whether a website decides to do this or not is up to the developers. But yes, in general if someone is modifying the natural behavior of something, it's important to let the user know, imo.

Now if you ask can it be misused by hackers, yes it can, but how? If it's a compromised website, then maybe they modify this function to always have you copy a malicious URL, use it for spreading XSS, or launch CSRF attacks. From a hackers point of view, I would assume using it to launch URL based attacks is the best (mis)use case with highest chance of success. Alternatively, imagine if it had a permanent "rm -rf /n" , that'd be devastating because paste would trigger it automatically in a terminal and if you're running root, you'll understand the hard way why you should never run as root by default.

If it's the hacker's own website, then you have bigger things to worry about and shouldn't be on that website at all. End of the day, they are modifying a copy function, but they have no control over the paste part of it (in browsers atleast?)

Regarding browsers notifying users of modified copy functions -- it does sound like a good idea, but whether it should be implemented directly into the browser is a call the browser devs have to take. I would think this would be a good functionality for a browser extension to have although I've not seen any that do this.