The StarDict package available in the Debian Testing repository (the upcoming Debian 13 release) features a search interface for dictionaries, but it has a privacy issue—by default, the application sends the selected text (x11 PRIMARY selection) that is automatically copied to the clipboard to external servers. Simply highlighting a piece of text in any application immediately sends it unencrypted via HTTP to the Chinese online dictionary servers dict.youdao.com and dict.cn. This problem only occurs when working in environments based on the X11 protocol; using Wayland applies clipboard isolation by default.
The accompanying StarDict package in Debian stated that this behavior is standard. By default, StarDict has automatic dictionary search enabled for highlighted text and both local and external dictionaries activated. The servers dict.youdao.com and dict.cn provide English-Chinese dictionaries, accessed through plugins that are enabled by default when installing the stardict-plugin package, which is a recommended dependency for the stardict-gtk package. Users who are not comfortable with this behavior are advised to disable network dictionaries or the automatic search function in their settings.
A user who noted the issue argued that this behavior should never be activated by default as it leads to information leakage. Users may highlight text with confidential content in applications, such as passwords and personal information. Consequently, this information not only potentially gets logged on dict.youdao.com and dict.cn and is visible to their administrators but also becomes susceptible to traffic interception due to the use of HTTP instead of HTTPS. servers 911565 write(16, "GET HTTP://dict.youdao.com/fsearch?q=highlighted+text HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)\r\nAccept: */*\r\nHost: dict.youdao.com\r\nConnection: close\r\n\r\n", 171) = 171 911565 write(17, "GET HTTP://dict.cn/ws.php?utf8=true&q=highlighted+text HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)\r\nAccept: */*\r\nHost: dict.cn\r\nConnection: close\r\n\r\n", 164) = 164
Notably, in 2009, similar behavior in StarDict was acknowledged as a vulnerability (CVE-2009-2260), and access to network dictionaries was disabled by default. Now this functionality has been restored.
Source: opennet.ru
