[Bug]: Can't paste non url text when url bar is empty

[Timshel]

Steps to reproduce

1. Select some text to copy
2. Ensure that the url is empty
3. Ensure that the you are not editing the url bar field (keyboard is closed)
4. Long press on the url bar
5. If activated the phone will vribrate

Expected behaviour

The paste option should appear.

Actual behaviour

Nothing is displayed, you can't paste.

Device name

Google Pixel 4a (5G) on CalyxOS

Android version

Android 12

Firefox release type

Firefox

Firefox version

105.1.0

Device logs

No response

Additional information

I don't know if initially the feature was supposed to support only url but I believe this is confusing / a bug because :

1. The field combine search and urlbar and is labelled : Search or enter address
2. If there is already an url then both option appear : Copy and Paste
3. The phone give a vibrating feedback (an OS notification might appear If I long-press on URL bar with an externally-copied URL in my clipboard, Android spams a notification "Firefox pasted from your clipboard" which is confusing and covers up the actual "paste" option #26564) but there is no change visible to the user.

┆Issue is synchronized with this Jira Task

[LaurentiuApahideanSV]

I can confirm the issue is reproducible on Fenix Nightly 107.0a1 2022-10-05 using the steps mentioned in the description.

Devices used:

• Google Pixel 6 (Android 13)
• Samsung Galaxy S22 Ultra (Android 12)

[jonalmeida]

We are intentional with not pasting from the clipboard if the contents are not a URL because it has security implications, if I recall correctly. This is in keeping with other browsers as well.

cc: @LaurentiuApahideanSV for reference.

[Timshel]

@jonalmeida could you give more details on the security implications ?

Because I find it surprising since :

• As I mentioned if there is text in the urlbar then it's possible to paste, is this a bug ? or is there different security concerns if we already have an url present ?
• If I select the url bar itself then it's possible to paste since the handling is done by the OS I believe

[Mugurell]

Work around this was done in #22271. Maybe @Amejia481 has more context.

[Timshel]

It appears at the time the Paste option was available only when there was an url but later on in #24294 it was made possible to paste non-url content.

[Timshel]

Since I rewrote a significant part of the logic when fixing #26564 i included it in #27351

[Amejia481]

Work around this was done in #22271. Maybe @Amejia481 has more context.

👋🏽
Sorry, I don't have context around this bug 😅 , the work on #22271 was more to address an issue on Android 12.

[jonalmeida]

If I select the url bar itself then it's possible to paste since the handling is done by the OS I believe

Correct. We want to be careful about what we hint to the user should be copied to the clipboard. There are more nuanced reasons that the security team has more details on.

In general, we want to hint to our users to paste a URL because we can evaluate that safely and not recommend that they paste anything in their clipboard which might end up being a password or login details.

[Timshel]

Hi, as I mentioned I would be interested in those details :). I can understand being cautious about the clipboard if we were in the context of a login/password form but it's not the case here.

Unless I misunderstood, the point of this functionality is to facilitate interaction with the awesome bar. The bar itself is named Search or enter address and when selected allow to paste any content. With the Search part being mentioned first not supporting pasting non-url would seem a strange ux choice that as I user I do not understand.

Additionally the bug is not about adding the paste feature it's already present, it's about it not being possible when the field is empty. For security I see no reason for the differentiation and from an ux point of view it's even less understandable.

From what I can see :

• allowing to paste was initially supported 0f0aee5
• changed introduced in 94a543a made it available only for url but I see no mention of security reason in the associated issue Try to use getPrimaryClipDescription on Android 12  #22271 and the author @Amejia481 do not recall any.
• Allowing pasting non-url text was brought back in For #23697: Fix up paste and paste-go handling for certain types of clipboard items #24294 there is no mention of a specific requirement to paste only if the field is non empty, I believe the case was just missed and the short circuit if (!copyVisible && clipboardUrl == null) return which prevent it was not modified.

[Timshel]

Hey,
I would be interested on some feedback on my latest comment and the associated PR I created :).

[Timshel]

Ping

[Timshel]

Pong

[Timshel]

Ping

[cpeterso]

Moved to bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1810044

Change performed by the Move to Bugzilla add-on.

[cpeterso]

QA is not needed.