1982308 - Copied text might not match displayed text

Status: RESOLVED DUPLICATE of bug 504748

(Core :: DOM: Copy & Paste and Drag & Drop, defect)

Description

[Michel Le Bihan]

1. Go to a malicious website that displays a command and has a copy button (please use the attached example)
2. The website shows a useful harmless command and a handy button to copy it
3. The website does:

const textarea = document.createElement('textarea');
textarea.value = "Very evil command";
textarea.setAttribute('readonly', '');
document.body.appendChild(textarea);
textarea.select();
document.execCommand('copy');
document.body.removeChild(textarea);

that copies a different text than the displayed one
4. The user pastes the command in the terminal and out of habit presses enter before realizing that the copied command does not match the command that he saw before.

I think that Firefox should ensure that textarea is displayed for a minimum of X seconds or on page load before allowing doing copy on it

Comment 1

[Michel Le Bihan]

Attachment: Example