659543 - Clipboard overwritten without asking for my agreeing — I was not OK

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[Nicolas Barbulesco]

User-Agent:       Mozilla/5.0 (Windows NT 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (Windows NT 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

Hello,

My options are set not to allow the 3 available Javascript wrongdoings.

I was on this video page:
www.dailymotion.com/video/xfo010_mylene-farmer-oui-maisy-non-clip-officiel_music

I was curious about the new "Export" feature, so I clicked on Export at the top-right of the video, and I chose "link". The link was copied without asking for my agreeing — I was not OK. This is not correct. I lost what I had kept in my clipboard for later use.

A page must not have the right to write to user's clipboard. The clipboard is system-wide and belongs to the user, not to the page.

Or at least as an option, off by default, or — same idea — after the browser has asked the user and received a yes.


Reproducible: Always

Steps to Reproduce:
See in "Details".


Actual Results:  
See in "Details".


Expected Results:  
See in "Details".


Firefox 4.0.1 Windows.

Comment 1

[Justin Dolske [:Dolske]]

Web pages don't have this ability, but Flash does (iirc, it only allows Flash apps to do this when there's an explicit UI action). Nothing we can do about this on the browser side.

Comment 2

[Nicolas Barbulesco]

Doesn't Firefox decide what he allows the plugin to do?

Comment 3

[Matthias Versen [:Matti]]

No, we have no control over the plugin.

Comment 4

[Nicolas Barbulesco]

Hello,

"Web pages don't have this ability"? Are you sure?

I encountered another occurence of the problem.
But here, no Flash, no plugin involved.

Windows XP Pro SP 2. Firefox 3.0.1.

My options are set not to allow the 5 available Javascript wrongdoings.

I put "This is my precious text that I keep for later use." in the clipboard.
I create a Firefox window. I go to www.snurl.com . I enter "http://www.getfirefox.com". I click "Snip it!".
Now the clipboard contains "http://snurl.com/sg44bgetfirefox.com". The overwriting of the clipboard occurred without asking for my agreeing — I was not OK. This is not correct. I lost what I had kept in my clipboard for later use.

A page must not have the right to write to the user's clipboard. The clipboard is system-wide and belongs to the user, not to the page.

Or at least as an option, off by default, or — same idea — after the browser has asked the user and received a yes.

Thanks for correcting this flaw,

Nicolas