That sounds like a potential attack vector. Similar to copy/pasting commands from web pages. I'm surprised it's allowed, but I suppose it's also very tricky to fix.