391050 - Possible to write to clipboard from a webpage using Flash

Status: RESOLVED WONTFIX

(Core Graveyard :: Plug-ins, defect)

Description

[Biju]

* this info may be public, so security flag may not be needed
* also re-classify Component if needed

Clipboard access for a webpage
Recently I am seeing http://snipurl.com/ is able access my clipboard, to copy clipped URL.
I was in an impression that my clipboard contents are safe when I am surfing web with firefox.

Googling web I found these to pages

http://www.jeffothy.com/weblog/clipboard-copy/
http://spaces.live.com/editorial/rayozzie/demo/liveclip/liveclipsample/clipboardexample.html

As above page said, if this is done using Adobe Flash plugin, mozilla.org should discus with Adobe to find a mechanism to stop it.

If this is a new feature then I need an about:config item to stop this from happening.

NB: even if just "copy" operation is possible, a site can trouble user when/by.
1. I copy something from a page, then the site copy a single space which erase what ever I copied from clipboard.
2. A site want to disable users capability of copy, it run a setInterval timer every second to copy a space to clipboard.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007080505 Minefield/3.0a8pre

Comment 1

[:Gavin Sharp [email: [e-mail]]]

snipurl seems to use the flash trick described at http://www.jeffothy.com/weblog/clipboard-copy/ .

The second link seems seems to use an invisible input hack to allow normal user-triggered clipboard operations to succeed on non-inputs, so I don't think it's related to this bug.

Comment 2

[Jesse Ruderman]

I've been complaining to Flash/Adobe people for a while, including in comments in public blog posts, so this doesn't need to be security-sensitive.

Comment 3

[Biju]

Flash is great tool for making a multimedia demo apps.

but using it for this and also for ads it is an abuse of technology.

we have pref "security.enable_java" for java 
why we are not having "security.enable_flash" ?

also if we can have 
"security.allow_copy_sites" and
"security.allow_paste_sites" 
which white list clipboard accessible sites, 
nobody will try to find a way around current security system

Comment 4

[:Gavin Sharp [email: [e-mail]]]

We already have prefs that allow sites to access the clipboard via document.execCommand (which is part of the rich text editing API, I think, see http://developer.mozilla.org/en/docs/Rich-Text_Editing_in_Mozilla and http://kb.mozillazine.org/Granting_JavaScript_access_to_the_clipboard )

Comment 5

[Benjamin Smedberg]

We can't change this now, but we've implemented similar APIs in HTML and we're marking Flash as click-to-play by default soon, so I don't think there's anything left to do here.