Chrome allows websites to write to the clipboard without the user’s permission

Works on mine (macOS Brave).

Worked in Brave for me. Using a Mac.

Same here.

    Brave is up to date

    Version 1.42.97 Chromium: 104.0.5112.102 (Official Build) (arm64)

Works for me (also Windows)

Version 1.42.97 Chromium: 104.0.5112.102 (Official Build) (64-bit)

Almost as bad as running code is if there is a way to read the clipboard.

This could be very fun on those websites that give you a code snippet to copy and paste and install oh-my-zsh and friends.

Imagine you highlight a command and copy, but Js in the background replaces it with a malicious command.

Yes, it can be exploited - which is why terminals are adding confirmation steps to pasted multiline text (to avoid running the commands without user even seeing them).

According to the commit message, yes.

So if you have a password manager, your password could be leaked if you forgot to un-copy it after pasting?

It shouldn’t. Notice how in google docs you can copy via the right click menu but you can’t paste. For paste the app tells you to use the keyboard shortcut as JS doesn’t have access to reading the clipboard.

Writing to it is super common for things like share links where clicking the button puts them in the clipboard.

One thing that should be done is a user setting to configure this capability. If it is disabled then their copying to clipboard does not have any effect (this is not detectable by the web page), except if you push the key combinations (or menu items) to normally do so while the text is selected in which case only that text is copied to the clipboard. This also would affect which text can be selected, too, not only the clipboard. Disabling fonts also can be possible, etc.

(On my computer I usually disable the scripts so that it will not do such a things, but even if scripts are enabled, you might want to configure that feature too.)

    dom.event.clipboardevents.enabled

> Don't you hate when news sites add a "- from XYZ" to your clipboard?

And then there's the "clever" sites that replace the text I copied with a message like "haha you thought you could copy this? think again sucker".

    window.addEventListener('copy', function copyintercept(e) {
      console.log(copyintercept.caller, 'copy action initiated');
      e.stopImmediatePropagation();
    }, true)
    
    document.addEventListener("contextmenu", bringBackDefault, true);
    
    function bringBackDefault(event) { event.returnValue = true;
                                      (typeof event.stopPropagation === 'function') && event.stopPropagation();
                                      (typeof event.cancelBubble === 'function') && event.cancelBubble();
                                     }

This is why a web and ad giant shouldn’t be in charge of the world’s most popular browser as well as the world’s most popular web engine. Huge conflict of interest.

Chrome should be spun off into a non-profit that is barred from Google/Alphabet influence.

> Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible.

I opened a bug with chromium when I first encountered that behavior ~10 years ago since it was an obvious security and privacy concern to me. Needless to say, the chromium devs didn't think it's an issue.

You would think browsers would ask permission for sites to do things like modify your clipboard, see when you copy/paste, track your mouse movements and text selections, etc. but google obviously isn't going to care about protecting the user from such things.

> Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed.

There are browser extensions. For example, my own StopTheMadness on macOS and iOS:

https://underpassapp.com/StopTheMadness/

I'm going to work on this navigator.clipboard issue, because I find it unsettling, and I use Chrome quite a bit.

Disclaimer: I am a Chrome developer, who formerly worked on the clipboard.

For a long time, Chrome did not allow pages on the open web to use document.execCommand('copy') or document.execCommand('cut'), and there was a fairly steady stream of requests from web developers to enable this. Eventually, Chrome did expose this gated behind a user gesture: https://chromestatus.com/feature/5223997243392000

> So instead of changing their new tab page to require a gesture like all other sites... they decided to allow any website to copy text into the clipboard. Nice.

Ownership of the clipboard features has moved around a bit, and sometimes historical context around things like the user gesture requirement are lost. Here, the NTP doesn't actually need this to work without a user gesture. The correct fix here is to fix the NTP tests to correctly simulate a user gesture, not to allow writing to the clipboard without a user gesture.

> I think copying into the clipboard needs an overhaul—even with a gesture. Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed.

This is a difficult problem to fix. There are absolutely websites that abuse this. But there are also pages that do use the legacy clipboard API events in non-abusive ways (e.g. rich text editors), and blocking this outright would break legitimate uses as well.

Maybe something like a "copy as plain text" option would make sense...

  > Maybe something like a "copy as plain text" option would make sense

  #!/bin/bash
  while true ; do xclip -sel primary -o | perl -pe 'chomp if eof' | xclip -sel primary ; sleep 1 ; done

A long time ago I developed a way to append that text you’re talking about as an in house feature so we didn’t have to use that service whose name is escaping me right now. Probably spent two weeks making it cross browser. It was fairly simple at the end of the day and didn’t require any exploits to the clipboard api, just some really good assumptions to and timing it just right to flip some selection. The hard part was restoring the users original selection without making it obvious. I still hate that I did this.

Google search could put an end to that practice by having crawlers select and copy some text, and penalizing sites which gunk up the results.

Will they? Hah.

What is a NTP doodle? Is this related to chrome-search://local-ntp/doodles.js? (I can't see because I don't use chrome)

But chrome-search://local-ntp/doodles.js is served from a chrome-search:// url, chrome could give it permissions without giving for every web page

This is an excellent example of why attributing individual small contributions to your real-life identity online is not a good idea.

Why is the headline about writing to the clipboard when reading FROM the clipboard without permission is much worse?

Clipboard should exist at the OS level and web browsers should be unable to distinguish it from keyboard input.

it's nothing but chromium all the way down ;)

It can be a pain but this is how I traverse the internet. I get really annoyed with sites where I have to enable JavaScript to view text. I'm like both noscript and ublock advanced (not together), but much preferred umatrix when it was in development.

I'm also a bit confused by that. Websites can already do just as many malicious things when you interact anywhere else with JS enabled, so I don't see the security argument. They can also quite trivially insert invisible text if they for some reason want you to copy something different than what's displayed.

The main reasons I use built-in copy buttons are: A) I don't end up with bits of whitespace at the start and end of the text if it wasn't formatted well on the website. B) Normal copy-paste in a browser will also copy a bunch of HTML formatting data, which I almost never want in a code snippet. I don't want to have to install an extension just to get plaintext.

The title is kinda misleading. "[W]ith user's permission" probably should be "with user's action" instead.

By default, you can copy to clipboard in all the major browsers when user takes an action, like click some buttons or links. So all these "copy code" buttons won't stop working. What does not in Firefox (and shouldn't in Chrome) is to do so without user's action.

Note: I have no idea what the rigid definition of "user's action" is. But clicking a button counts.

Yes that's why you shouldn't run curl | sh commands without double or tripple checking. Even without this exploit. Check the scripts that are being downloaded and check if this script you download is really the same as for example in the git repo.

Even better!: You can refresh the clipboard regularly, for as long as the user is on the page! That way, they'll get access to important notifications about our cool products, while they are coding or handling text in other ways!

Because almost zero percent of cryptocurrency users blindly paste addresses into clients without at least double-checking it was actually the address they wanted to paste. Most of them are conditioned not to trust anything, and double-verify. If you're sending a large amount, you first send a small amount, verify it arrived to the correct address and then send the proper amount.

Verifying the "string of garbage" (which is actually a hash) is simply a matter of checking the first and last four characters, can be done in 10 seconds easily.

This is why you don't break abstractions. If I'm a user I expect the clipboard to only change when I press ctrl+c or right click -> copy. These should be authoritatively controlled mechanisms that untrusted programs cannot override.

Going further, I want whatever I copy to be whatever I see when I hit copy. Which of course isn't possible in the interactive web.

But unfortunately devs for the last few decades think they can just leave everything undefined and change its meaning for their ad-hoc purposes every minute then claim computing is hard.