Chrome allows sites to write to the clipboard

Ο Chrome της Google επιτρέπει στους ιστότοπους να γράφουν στο πρόχειρο χωρίς την άδεια του χρήστη. Φυσικά (για όσους γνωρίζουν αυτό θα μπορούσε να αποτελέσει ένα σημαντικό κενό ασφαλείας.

How you can try it:

1. Visit the address https://webplatform.news/ in a Chromium-based browser

2. Check what your clipboard has saved (paste it somewhere)

We tried it. The image above shows the webpage and then you see the txt file I pasted for testing.

Chrome allows websites to write to the clipboard without the user's permission

The webpage uses the following JavaScript code to write to the clipboard:

try {
  let type = 'text/plain';
  let blob = new Blob(
    [
      'Hello, this message is in your clipboard because you visited the website Web Platform News in a browser that allows websites to write to the clipboard without the user's permission. Sorry for the inconvenience. For more information about this issue, see https://github.com/w3c/clipboard-apis/issues/182.',
    ],
    { type }
  );
  let item = new ClipboardItem({ [type]: blob });
  navigator.clipboard.write([item]);
} catch (err) {}

There is also the message:

Hello, this message is in your clipboard because you visited the Web Platform News site in a browser that allows sites to write to the clipboard without the user's permission. Sorry for the inconvenience. For more information about this issue, see github.com/w3c/clipboard-apis/issues/182.

The specific problem is described on GitHub. The webpage can write to the clipboard with the Chrome browser using navigator.clipboard.write() or navigator.clipboard.writeText() without the user noticing.

Στο Github αναφέρεται ότι ο Safari αλλά και ο Firefox δεν ανταποκρίνονται στο JavaScript της σελίδας.

Να αναφέρουμε ότι το συγκεκριμένο πρόβλημα παρουσιάζεται και στον Edge ή άλλους κλώνους του Chromium.