7

Apparently websites can overwrite the clipboard using the JavaScript Clipboard API without any notification to the user — as discussed in this Reddit thread — which is a little scary.

Is there a way to disable programmatic clipboard access unless the user grants permission, through an extension or perhaps some config setting? Ideally I'm looking for something like how websites need permission to autoplay or access audio or the camera. But if that's not possible, a JavaScript Greasemonkey/Violentmonkey script that blocks clipboard access and notifies me of any clipboard access attempts could also work.

In the Firefox documentation for “MDN Clipboard API” it states:

“Access to the contents of the clipboard is gated behind the Permissions API: The clipboard-write permission is granted automatically to pages when they are in the active tab. The clipboard-read permission must be requested, which you can do by trying to read data from the clipboard.”

Disabling the Clipboard API access doesn't make it safe to copy-paste commands into the shell, as you can still have the user copy unexpected text using CSS, but it's a start.

1 Answer 1

10

Firefox has an about:config setting called dom.event.clipboardevents.enabled, which allows Firefox to emit oncopy, oncut, and onpaste events which websites can use to modify the clipboard. You can set it to false to disable access to the Clipboard API across all websites; you can't use it to give websites access on a case-by-case basis. Setting this to false breaks some functionality such as pasting images on Discord.

Further, websites can use the deprecated Document.execCommand() copy and cut commands. Support for this can be disabled by setting the about:config preference dom.allow_cut_copy to false.

There is also the about:config setting dom.events.asyncClipboard.dataTransfer, which is disabled by default. If enabled, it grants websites to asynchronously read the clipboard (after receiving permission from the user), and to write to the clipboard at any time, without having to wait for an oncopy/oncut/onpaste event.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .