Copy & Paste in Firefox

Question

While working on a wysiwyg editor, I hit the wall of Firefox restricting access to the clipboard (haven't yet tested Webkit).

1. Can someone explain WHY copying to the clipboard is restricted?
   
   I just cannot think of a single way that this can be used nefariously, and use-cases abound where lack of 'copy' support is a problem.
   In fact, whole libraries such as zeroClipboard are there just to facilitate this function.
   
   (I understand - but disagree - that allowing read access to the clipboard can create a hole, though a popup would solve that.)

2. Are there any good hacks/methods that would give me a 'paste' button? I have seen posts refer to 'textarea trick' among others, without explanation of how they work.

3. Is there a term for the all-too-common scenario where production by legitimate users is hampered by 'security precautions', and the 'bad guys' use hacks [like zeroClip] that render the secure feeling completely false?

I am aware that there is a convoluted 'official' method that is available if I sign my scripts.. [which I do not have the knowledge or resources to do], but that even that would generate a popup whenever I use it.

Answer 1

You might have cut something from an application that doesn't support undo or something to paste somewhere else. If it was allowed to modified the clipboard automatically, you could have lost the data you had cut.

Answer 2

Same reason site scripts can't just change your bookmarks or write out changes to local files: those belong to the user, and allowing scripts to modify them also allows malicious scripts to write out malicious content or erase valuable data.

Yes, we generally consider clipboard data to be "less important", in that it is transient. But it still belongs to the user, not whatever page happens to be open. Imagine a script that, out of some misguided hope to prevent copyright violation, cleared out your clipboard every 100 milliseconds! Or one that copied dangerous system commands, hoping that a small number of users would paste them into a terminal without double-checking first...

FWIW, as of version 10, Flash has also tightened up restrictions on modifying the clipboard: such modifications now must happen as a direct result of user interaction.

Answer 3

I think the security issue is a site reading from the clipboard. A site could have a script that just passively reads each visitor's clipboard and saves the data. Without the knowledge of the user, the site could potentially gather email addresses, passwords, credit card numbers, social security numbers, etc.