4 ms·
The execCommand("cut"/"copy") API is only available during a user-triggered callback, such as a click. If you try to call it at a different time, execCommand wi
by ihuman 11y ago
The execCommand("cut"/"copy") API is only available during a user-triggered callback, such as a click. If you try to call it at a different time, execCommand will return false, meaning that the command failed to execute.
Couldn't you bypass this by creating an invisible button, and then simulating a click event?
- function_seven 11y agoIf they do it right, I imagine the source of the event would be tainted, so that only an actual click received from the OS would be allowed to propagate through. I'm sure it's tricky to ensure this, though. Like pop-up blocking.
- deleted 11y ago[deleted]
- mschuster91 11y agoThe engine can walk up the call stack and detect if the command was triggered by a click event.
- joosters 11y agoThere will always be a way to hide / obfuscate the action, making it seem to the browser that it was user-initiated. I guess Mozilla have weighed up the convenience/security balance of browser control of the clipboard, and have put in a minimal protection scheme to make it clear that code should not play with it behind the user's back, but Mozilla knows that they can't really stop it.
- TazeTSchnitzel 11y ago> There will always be a way to hide / obfuscate the action, making it seem to the browser that it was user-initiated. How? This security mechanism has been used for (among other things) popups for years now, and the only way it's been worked around is by attaching click handlers to links the user is likely to click.
- joosters 11y agoPop ups still occur, even on legitimate sites. Tripadvisor creates a pop-under when you click on a search result, for instance. Basically, the user will click something at some point, the page can then unexpectedly put malicious stuff into the clipboard. No amount of protecting will stop this.
- IshKebab 11y agoThat's exactly what he just said.
- daurnimator 11y agoAnnoyingly this prevents using the result of an async operation.
- Manishearth 11y agoSimulated click events are tracked as simulated. From the Javascript point of view there's not much difference unless synthetic/authentic click activation is involved (i.e. links, form submit, etc)