1603092 - A website shouldn't be able to alter clipboard contents as a response to a copy event

Status: RESOLVED DUPLICATE of bug 1591698

(Core :: DOM: Selection, defect)

Description

[Martin]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

1. Go to a website which messes with the clipboard (such as https://economictimes.indiatimes.com/news/economy/policy/part-panglossian-part-practical-governor-shaktikanta-das-soldiers-on/articleshow/72472727.cms)
2. Select text (for example the phrase "The career bureaucrat-turned-central banker")
3. Copy with ctrl+c or right click -> copy

Actual results:

My clipboard ends up containing this garbage:

The career bureaucrat-turned-central banker

Read more at:
//economictimes.indiatimes.com/articleshow/72472727.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst

Expected results:

My clipboard should only contain the text I selected, "The career bureaucrat-turned-central banker"

I'm aware that this is an issue which it's impossible to solve 100%; it will always be possible to make the text the user sees look different from the text Firefox thinks is there through various tricks. However, I think it should be possible to prevent websites from appending their own text to the text the user wanted to copy.

I think the APIs for interacting with the clipboard should be disabled in a "copy" event, because that's explicitly when the user wanted copy the text they selected, and putting something else in their clipboard is both dangerous and user hostile. The APIs for interacting with the clipboard should obviously still work in a click event handler, but it might make sense to discuss restrictions on putting stuff in the user's clipboard as a response to a click right after the user copied something themselves.

Here's a jsfiddle which demonstrates the issue: https://jsfiddle.net/50138pgo/ - Select "Try to copy this text", hit ctrl+c, and your clipboard will be filled with "This is not what you want to copy".

Comment 1

[Clara Guerrero ( Need Info Brindusa Tot Please)]

Hi,

Thanks for the details. I was able to reproduce on Ubuntu 18.04.3 LTS on Firefox Nightly version 73.0a1 (2020-01-02) (64-bit), Release 71.0 (64-bit) and Beta 72.0b5 (64-bit) on both links provided https://jsfiddle.net/50138pgo/ and https://economictimes.indiatimes.com/news/economy/policy/part-panglossian-part-practical-governor-shaktikanta-das-soldiers-on/articleshow/72472727.cms

I've chosen a component so that the issue is reviewed.

Best regards, Clara.

Comment 2

[Hsin-Yi Tsai (she/her)[:hsinyi]]

Thanks for reporting. This is the duplication of bug 1591698.