Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Interoperability issue: navigator.clipboard.write() and navigator.clipboard.writeText() user gesture requirement #182

Closed
tomayac opened this issue Aug 11, 2022 · 18 comments

Comments

@tomayac
Copy link

tomayac commented Aug 11, 2022

(This was brought up in the context of @simevidas' tweet.)

When attempting to write to the clipboard via either of navigator.clipboard.write() or navigator.clipboard.writeText() , both Safari 馃毇 and Firefox 馃毇 require a user gesture:

image

In contrast, and this is the interoperability issue I guess, Chrome 鉁 happily proceeds. Brave, based on Chromium, considered disabling this behavior (brave/brave-browser#16890).

One use case requiring a user gesture would break is that of remote clipboard synchronization, which is explicitly mentioned in the spec. Maybe Capability Delegation could be the answer here?!

Here's a test page for write() courtesy of 艩ime, and here's a test page for writeText() (based on 艩ime's).

@snianu
Copy link
Contributor

snianu commented Aug 26, 2022

@tomayac Is this on the latest 104 stable build? I added the transient user activation requirement for write() method but not writeText() because of some internal site breakage where they are currently relying on this behavior. We have bugs to fix this crbug.com/1334203

@tomayac
Copy link
Author

tomayac commented Aug 26, 2022

I tested on 104.0.5112.101, yes.

@Naleksuh

This comment was marked as off-topic.

@NabiKAZ
Copy link

NabiKAZ commented Sep 1, 2022

Version 105.0.5195.54 (Official Build) (64-bit)
There is still a bug.

@raydleemsc
Copy link

Tested on Version 1.42.97 Chromium: 104.0.5112.102 (Official Build) (64-bit) - silent fail - no error, but no effect on clipboard as well

@simevidas
Copy link

It should be noted that Chromium-based browsers do have some restrictions for writing text to the clipboard:

  • Secure context (https)
  • Chome is current app
  • Script is running in the active tab

(https://groups.google.com/a/chromium.org/g/blink-dev/c/epeaao7l13M/m/b8ewAH5uBwAJ)

So if a web page is loaded into a background tab, it won鈥檛 be able to write to the clipboard.

@simevidas
Copy link

Some developments in the Brave browser: brave/brave-core#14901

@evanstade
Copy link

As of this commit, Chromium requires either user activation (at the time of the write) or an explicit permission grant (which is durable across many reads/writes) for writing to the clipboard. As noted in the spec, there are known use cases which rely on the permission grant flow as opposed to the user gesture.

@HolgerJeromin
Copy link

@evanstade your link is missing the protocol (https)

@tomayac
Copy link
Author

tomayac commented Sep 8, 2022

(Corrected link for #182 (comment): https://crrev.com/10300ac7da93a7e322274f1e.)

Are people fine with me closing the Issue as completed?

@sunder11
Copy link

Perhaps I am stupid. Is this related to cve-2022-3075. If so I was under the impression this was patched. if I go to webplatfoem.news it continues to write to my clipboard. My chrome is: 106.0.5249.119, My Vivaldi is 5.5.2805.38, and Opera
is 91.0.4516.65.

@gsnedders
Copy link

#52 and #75 are both related?

@simevidas
Copy link

There has been a recent change in Chromium: In Chrome 107, attempting to write to the clipboard on page load now triggers a permission prompt. I have removed the code from webplatform.news to not bother my visitors.

Screenshot 2022-12-05 at 06 07 10

@HolgerJeromin
Copy link

HolgerJeromin commented Dec 5, 2022

@simevidas
You wrote about "writing to clipboard". The screenshot shows a dialog about "read from clipboard".
This is constantly mixed (at least in the media about this topic).

My code navigator.clipboard.writeText() works without any dialog or console log in chrome 108 (after user activation).
Edit: Sorry, you are right. The code and dialog text are not matching. 8-(
Tested with https://fluoridated-showy-fog.glitch.me

@evanstade
Copy link

Attempting to write to the clipboard should only trigger a prompt if there's no user action attached.

Yes, Chromium reuses the same permission for both gesture-less reads and writes. The text was not updated because reading is considered more powerful than writing.

@HolgerJeromin
Copy link

Telling not the truth in such dialogs is IMO a very bad move.
I would reject reading my clipboard on most pages, but writing is often useful (perhaps not without user gesture, but still).

@evanstade
Copy link

It is the truth in that the same underlying permission is used for both actions. Granting this permission will affect reading. To avoid permission fatigue, we try to avoid creating too many distinct permissions.

@snianu
Copy link
Contributor

snianu commented Dec 7, 2022

This issue is creating unnecessary noise in the clipboard repo. The original issue has already been addressed, so if there are any concerns/bugs, please open bugs in the chromium bug database. I'm going to close this issue.

@snianu snianu closed this as completed Dec 7, 2022
marabesi added a commit to marabesi/json-tool that referenced this issue Dec 9, 2022
It also disables one test that writes in the clipboard due lack of support in the clipboard api

refs cypress-io/cypress#2752 w3c/clipboard-apis#182 w3c/clipboard-apis#52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

10 participants