12 ms·
execCommand[0] has a "paste" option, which pastes the content of the clipboard at the current insertion point. This allows for "reading" of the clipboard. Thi
by dsp1234 11y ago
execCommand[0] has a "paste" option, which pastes the content of the clipboard at the current insertion point. This allows for "reading" of the clipboard.
This article doesn't mention "paste" specifically, but the footnote[1] in the "paste" section says:
"[1] Before Firefox 41, clipboard capability needed to be enabled in the user.js preference file. See A brief guide to Mozilla preferences for more information. In Firefox 41 and later, clipboard capability are enabled by default in any event handler that is able to pop-up a window (semi-trusted scripts)."
This footnote is not attached to any other command, and thus "paste" is singled out. This could just be a documentation error, or maybe they didn't want to highlight that paste was also being enabled. I don't have a FF v41 in order to test what the actual behavior is.
[0] - https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand https://developer.mozilla.org/en-US/docs/Web/API/Document/ex...
- linksbro 11y ago"paste" is not enabled for non-trusted scripts on FF 41+. A extensions' scripts can use "paste" since they are trusted scripts; but a webpage's script cannot. I believe that footnote is a doc error, since copy/cut are enabled w/o user.js override on FF 41+. I don't know if there is any current plans to make "paste" available for all scripts - I don't think there would be because of the obvious concerns.
- mystor 11y agoThere are no plans to make "paste" available to scripts. User's clipboards can contain too much sensitive information.
- JoshTriplett 11y agoIn theory, Firefox could track if the current clipboard data was put there by the same origin, and allow paste if and only if so. That might be useful.