1777448 - Avoid showing the "Paste" button for `navigator.clipboard.read*()` when the user's privacy isn't affected

Status: RESOLVED FIXED

(Core :: DOM: Copy & Paste and Drag & Drop, enhancement)

Description

[Mirko Brodesser (:mbrodesser-Igalia), offline until April 25h]

Includes not showing the "Paste" button when copy-pasting within the same document/origin; see the "Security and Privacy" section of https://webkit.org/blog/10855/.

Comment 1

[Edgar Chen [:edgar]]

Currently, we show the paste contextmenu to grand user permission every time when the page tries to read clipboard data programmatically via async clipboard API, but sometimes it might be annoyed if the user only copy/paste data within the same origin, for example editing a Google Doc. Webkit has implemented two mechanisms to improve the user experience.

• If the user is explicitly triggering a paste during the gesture (for instance, using a keyboard shortcut on macOS such as ⌘V or pasting using the “Paste” action on the callout bar on iOS), WebKit will allow the page to programmatically read the contents of the clipboard.
• Programmatic clipboard access is also automatically granted in the case where the contents of the system clipboard were written by a page with the same security origin.

We would like to implement the similar behavior, too. i.e.

• Allow the page to programmatically read clipboard in paste event handler.
• Allow the page to programmatically read clipboard if the clipboard data is from the same origin. (data from external application will be treated as from different origin)

---

And here are some rough plan to implement the same-origin checks,

• In Cocoa widget, there is a clipboard cache mechanism, we cache the nsITransferable that is written to system clipboard by gecko. And if the system clipboard isn't changed by other application, we return the data stored in cached nsITransferable for the subsequent clipboard access from gecko. I plan to build the same-origin checks on the top of it.
• Apply other platforms to same clipboard cache mechanism which requires a refactoring on nsBaseClipboard (bug 1773707).
• Storing the principle that trigger the system clipboard writing in nsITransferable::requestingOrigin,
• When reading clipboard data programmatically,
  1. If there is no valid data in clipboard cache, show the paste contextmenu to grand user permission.
  2. Otherwise, check the principle stored in the cache with the requesting principle.
     2.1. if they are different origin, show the paste contextmenu to grand user permission.
     2.2. Otherwise, automatically grant the permission.

Comment 2

[Edgar Chen [:edgar]]

Attachment: Bug 1777448 - Part 1: Handle clipboard contextmenu in parent process; r?nika!

Comment 3

[Edgar Chen [:edgar]]

Attachment: Bug 1777448 - Part 1: Don't not show paste contextmenu for background tab; r=nika

Displaying the paste context menu for background tabs can be surprising and
confusing for users, so we reject the request and don't allow it being associated
with existing pending request.

Depends on D190405

Comment 4

[Edgar Chen [:edgar]]

Attachment: Bug 1777448 - Part 2: Suppress the paste context menu when the clipboard data originates from a same-origin page; r?nika

And don't allow new request being associated with existing pending request if
the requests are from different origin.

Depends on D190761

Comment 5

[Edgar Chen [:edgar]]

Attachment: Bug 1777448 - Part 4: Set requesting principal when copying is triggered by keyboard shortcut; r?nika

Depends on D190796

Comment 6

[Edgar Chen [:edgar]]

Attachment: Bug 1777448 - Part 5: Set requesting principal when copying image; r?nika

Depends on D190848

Comment 7

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=f5b310b0be281df96a0f7dbb1333f9d8b3e28c9f

Comment 8

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=f17cc85ebc5607b7cf8decb88ba2977f37054162

Comment 9

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=14c9f74b115ff3e0a51a7cb9ee186ab6de2ffaf7

Comment 10

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=cc7dcebcaa4cffd9b8f38bcba54f4578f06e2b19

Comment 11

[Edgar Chen [:edgar]]

Attachment: WIP: Bug 1777448 - Part 1: (ClipboardSecurityService) Handle clipboard contextmenu in parent process;

This patch makes the clipboard context menu trigger from the parent process rather
than the content process. A chrome-only event, MozClipboardReadPaste, is dispatched
to the chrome document to initiate paste context menu. When the paste context
menu is either clicked or dismissed, the clipboard-contextmenu-* observer is
triggered.

The behavior of handling multiple requests should remain unchanged, new tests are
added to ensure that.

Depends on D182108

Comment 12

[Edgar Chen [:edgar]]

Attachment: WIP: Bug 1777448 - Part 2: (ClipboardSecurityService) Don't not show paste contextmenu for background tab;

Displaying the paste context menu for background tabs can be surprising and
confusing for users, so we reject the request and don't allow it being associated
with existing pending request.

Depends on D192935

Comment 13

[Edgar Chen [:edgar]]

Attachment: WIP: Bug 1777448 - Part 3: (ClipboardSecurityService) Suppress the paste context menu when the clipboard data originates from a same-origin page;

And don't allow new request being associated with existing pending request if
the requests are from different origin.

Depends on D192974

Comment 14

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&revision=c1e8f7b24a2d542c6d284e8f017d98124bf2f911

Comment 15

[Phabricator Automation]

Comment on attachment 9357683 [details]
Bug 1777448 - Part 1: Handle clipboard contextmenu in parent process; r?nika!

Revision D190405 was moved to bug 1866994. Setting attachment 9357683 [details] to obsolete.

Comment 16

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&revision=4eb717d787bdc191adc11a1baff4918c23433429&group_state=expanded

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/32841cae9b3b
Part 1: Don't not show paste contextmenu for background tab; r=nika,hsivonen
https://hg.mozilla.org/integration/autoland/rev/6dee3dce64ad
Part 2: Suppress the paste context menu when the clipboard data originates from a same-origin page; r=nika

Comment 18

[Cristian Tuns]

Backed out for causing bc failures in browser_navigator_clipboard_contextmenu_suppression.js

• Backout link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | dom/events/test/clipboard/browser_navigator_clipboard_contextmenu_suppression.js | Test timed out -

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/28a38aeacd83
Part 1: Don't not show paste contextmenu for background tab; r=nika,hsivonen
https://hg.mozilla.org/integration/autoland/rev/bdca89fb71d5
Part 2: Suppress the paste context menu when the clipboard data originates from a same-origin page; r=nika

Comment 20

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/28a38aeacd83
https://hg.mozilla.org/mozilla-central/rev/bdca89fb71d5