3 ms·

Relevant commit: https://chromium.googlesource.com/chromium/src/+/4d7b74b051abfe5945f418601fdc2ffc8ce3072c https://chromium.googlesource.com/chromium/src/+/4d7

by oefrha 4y ago

Relevant commit: https://chromium.googlesource.com/chromium/src/+/4d7b74b051abfe5945f418601fdc2ffc8ce3072c https://chromium.googlesource.com/chromium/src/+/4d7b74b051a... commit 4d7b74b051abfe5945f418601fdc2ffc8ce3072c Author: Anupam Snigdha <snianu@microsoft.com> Date: Tue Jun 07 16:36:28 2022 [Clipboard API] Remove user gesture requirement for read/writeText. Adding user gesture requirement for readText and writeText APIs breaks NTP doodle sharing. We are relaxing this check for now, but we should fix this for sites to not rely on these APIs to be called without a user gesture. See NewTabPageDoodleShareDialogFocusTest.All test for more details.

nextaccountic 4y ago
What is a NTP doodle? Is this related to chrome-search://local-ntp/doodles.js? (I can't see because I don't use chrome) But chrome-search://local-ntp/doodles.js is served from a chrome-search:// url, chrome could give it permissions without giving for every web page
- llacb47 4y ago
  New tab page google doodle
  - SturgeonsLaw 4y ago
    Imagine introducing a security risk in order to make it easier for people to share some silly cartoon picture. Who's reviewing these decisions?
    - lolinder 4y ago
      It looks like a Microsoft engineer accidentally broke some Google code while implementing an unrelated feature. They tried to restore the old behavior but ended up actually breaking the interaction checks altogether. If you look at the commit comment, it indicates that they understood they were only disabling the checks for the new clipboard feature they were working on, not for all clipboard actions.
      - nextaccountic 4y ago
        but it makes no sense to do this for all webpages and not just for webpages on the chrome-search:// scheme
userbinator 4y ago
This is an excellent example of why attributing individual small contributions to your real-life identity online is not a good idea.
RunSet 4y ago
Why is the headline about writing to the clipboard when reading FROM the clipboard without permission is much worse? Clipboard should exist at the OS level and web browsers should be unable to distinguish it from keyboard input.
- oefrha 4y ago
  Because despite what the commit message seems to imply to someone unfamiliar with the Clipboard API, navigator.clipboard.readText triggers the clipboard permission prompt. writeText is different in that there's no permission to grant to begin with, it was only gated behind user interaction, which was lifted.

by oefrha 4y ago

nextaccountic 4y ago

What is a NTP doodle? Is this related to chrome-search://local-ntp/doodles.js? (I can't see because I don't use chrome) But chrome-search://local-ntp/doodles.js is served from a chrome-search:// url, chrome could give it permissions without giving for every web page

llacb47 4y ago
New tab page google doodle
- SturgeonsLaw 4y ago
  Imagine introducing a security risk in order to make it easier for people to share some silly cartoon picture. Who's reviewing these decisions?
  - lolinder 4y ago
    It looks like a Microsoft engineer accidentally broke some Google code while implementing an unrelated feature. They tried to restore the old behavior but ended up actually breaking the interaction checks altogether. If you look at the commit comment, it indicates that they understood they were only disabling the checks for the new clipboard feature they were working on, not for all clipboard actions.
    - nextaccountic 4y ago
      but it makes no sense to do this for all webpages and not just for webpages on the chrome-search:// scheme

userbinator 4y ago

This is an excellent example of why attributing individual small contributions to your real-life identity online is not a good idea.

RunSet 4y ago

Why is the headline about writing to the clipboard when reading FROM the clipboard without permission is much worse? Clipboard should exist at the OS level and web browsers should be unable to distinguish it from keyboard input.

oefrha 4y ago
Because despite what the commit message seems to imply to someone unfamiliar with the Clipboard API, navigator.clipboard.readText triggers the clipboard permission prompt. writeText is different in that there's no permission to grant to begin with, it was only gated behind user interaction, which was lifted.