Flash-Free Clipboard for the Web

https://hacks.mozilla.org/2015/09/flash-free-clipboard-for-the-web/

by smacktoward • 11 years ago

167 58 11 years ago

hacks.mozilla.org

zserge3• 11 years ago

I was so disappointed that every color picker website nowadays uses flash/zeroclipboard to only copy HEX color value (6 letters!). It's so slow and inefficient. I ended up making my own one using this clipboard API - http://0xrgb.com

Glad to see that FF now supports this API, too!

M4v3R• 11 years ago

It fails silently on Safari, though.

zserge3• 11 years ago

Sorry, I don't have a Mac here to test, could you please file an issue here: https://github.com/zserge/palette (yes, 0xrgb.com is open source).

By "fails" - you mean it doesn't select/highlight the color string, nor it does copy it to clipboard?

ck23• 11 years ago

Yup it wipes out whatever important info I was saving in my clipboard without warning me what-so-ever

I guess I could put a megabytes into anyone's clipboard now when they click on any link on a website.

anjanb• 11 years ago

No, you can't do that. from the mozilla link, "Google Chrome and Internet Explorer both also support this API. Chrome uses the same restriction as Firefox (that it must be run in a user-initiated callback). Internet Explorer allows it to be called at any time, except it first prompts the user with a dialog, asking for permission to access the clipboard."

tyho2• 11 years ago

I prefer

    window.prompt("Press Ctrl-C then Enter", text);

I don't want sites to be able to randomly clear my clipboard.

JoshTriplett3• 11 years ago

I don't mind sites being able to send data to the clipboard, as long as 1) they have explicit permission, and 2) they can only do so in response to a user action.

ploxiln• 11 years ago

But if 2 is the only restriction, they could trick you into clicking something (anything anywhere on the page), and then silently access your clipboard.

lukifer2• 11 years ago

I consider it an OS-level deficiency that clipboard copy is destructive by default. The fact that no major OS has multi-clipboard out of the box in 2015 is shameful.

giancarlostoro• 11 years ago

By major you mean Windows and Mac? I know Linux has had tools to do this for a long time (as far back as I can remember ever using KDE). Indeed it's very sad that Windows and Mac can't do what my cell phone can.

_lce0• 11 years ago

If you're on linux, there's Diodon, which can handle a list of your last 25 clipboard copies

https://en.wikipedia.org/wiki/Diodon_%28software%29

jfb• 11 years ago

I consider it an OS-level deficiency that no OS supports a kill-ring as a global service.

jongalloway2• 11 years ago

On Windows, I've been using Ditto for years (http://ditto-cp.sourceforge.net/ / https://chocolatey.org/packages/ditto). It's amazing how differently you work when you can copy multiple things, then paste them all rather than copy-paste copy-paste copy-paste. Makes it nice to not have to worry about your clipboard being lost.

tomphoolery• 11 years ago

Even with multiple registers in Vim, I still can't get my mind to think that way. I just link everything with the system clipboard because it's easier to deal with. How do you comprehend all of that hidden information in memory? To me, it seems like a useful feature if you do or can use it, but for most users it's just extra complexity.

joosters4• 11 years ago

Actually I'm glad that the clipboard throws stuff away. Otherwise it'd make me hesitant to use it for any sensitive.

TazeTSchnitzel2• 11 years ago

Microsoft Office has had multi-clipboard for a while.

moron4hire2• 11 years ago

Anything involving modal dialogs is bad UX these days, especially considering the variety of platforms web code needs to run on. You don't have "CTRL+C" on a smartphone or tablet.

y0ghur7_xxx• 11 years ago

KDE has this out of the box, so I think you may refer to windows. I am using this with great pleasure http://www.outertech.com/en/clipboard-history :)

Raed667• 11 years ago

I really appreciate this, as I had to jump through a lot of loops to do so a few years ago. But I think that the browser should display a small alert when this API is called (like the webcam, or microphone).

artursapek• 11 years ago

I suggested this two years ago! I'm glad it's happening. I do agree that a permission dialog might be appropriate.

http://stackoverflow.com/questions/14472526/will-there-ever-...

steveklabnik• 11 years ago

  > Google Chrome and Internet Explorer both also support this API. Chrome uses
  > the same restriction as Firefox (that it must be run in a user-initiated
  > callback). Internet Explorer allows it to be called at any time, except it
  > first prompts the user with a dialog, asking for permission to access the
  > clipboard.

Seems like IE does what you want.

hobarrera• 11 years ago

Seems like IE does what you want.

It makes me feel very confused that this is actually true.

moron4hire2• 11 years ago

I make a text editor that runs in a texture on a 3D object in the browser. I have a text area hidden in the background that technically holds focus and all clipboard operations go through it.

I was hoping this would let me get rid of that crufty text area. It's a serious quality and performance liability, and in certain special cases even ruins the UX. But it looks like that is not the case. Le sigh.

ihuman• 11 years ago

The execCommand("cut"/"copy") API is only available during a user-triggered callback, such as a click. If you try to call it at a different time, execCommand will return false, meaning that the command failed to execute.

Couldn't you bypass this by creating an invisible button, and then simulating a click event?

function_seven• 11 years ago

If they do it right, I imagine the source of the event would be tainted, so that only an actual click received from the OS would be allowed to propagate through.

I'm sure it's tricky to ensure this, though. Like pop-up blocking.

mschuster91• 11 years ago

The engine can walk up the call stack and detect if the command was triggered by a click event.

joosters4• 11 years ago

There will always be a way to hide / obfuscate the action, making it seem to the browser that it was user-initiated.

I guess Mozilla have weighed up the convenience/security balance of browser control of the clipboard, and have put in a minimal protection scheme to make it clear that code should not play with it behind the user's back, but Mozilla knows that they can't really stop it.

daurnimator• 11 years ago

Annoyingly this prevents using the result of an async operation.

Manishearth• 11 years ago

Simulated click events are tracked as simulated. From the Javascript point of view there's not much difference unless synthetic/authentic click activation is involved (i.e. links, form submit, etc)

ck23• 11 years ago

Can't this be used to poison the clipboard with bad code that once pasted in the wrong place will execute?

Vexs• 11 years ago

Just as much as the existing flash-based methods can.

ck23• 11 years ago

Well I haven't used flash in years.

But Mozilla just re-enabled this exploit and I don't think it can be turned off.

rhelmer• 11 years ago

Websites should not be able to overwrite the clipboard unless the action is user-initiated, from the blog post: The execCommand("cut"/"copy") API is only available during a user-triggered callback, such as a click. If you try to call it at a different time, execCommand will return false, meaning that the command failed to execute.

TheLoneWolfling• 11 years ago

And? That still leaves a website open to doing that sort of thing on a click. (I can see it now: "like <website X> on Facebook today!" or somesuch copied to your clipboard every time you visit a site)

User-initiated != user-approved, at least not unless the user is specifically asked. (Like by, say, prompting allow/allowalways / deny / denyalways)

ibrad• 11 years ago

Thank you developers and all, but I don't think I had much trouble copying text before. On the contrary, when I click on a field and it force select everything for me I get frustrated.

Trust me, selecting text is not a problem. I haven't seen a place where click to select was a life savior.

Flash-Free Clipboard for the Web

Related Stories