News for hackers. Stuff that matters.

A comment on Chrome allows websites to write to the clipboard without the user’s permission. Parent comment

Re:Chrome allows websites to write to the clipboard without ... by lolinder on Saturday August 27, 2022 @12:47AM (#32615808)
It's worth pointing out that the commit that did this was made by a Microsoft employee who has been working on the clipboard API, not a Google employee.

At a glance and without very much context, it looks to me like this engineer was working on implementing Web Custom formats for the clipboard API [0], but broke the Google doodle sharing while doing so. It appears they were trying to restore old behavior as a temporary measure, but ended up breaking the checks altogether.

Their commit's comment[1] claims that the added variable should only be true if reading/writing a web custom format, but that obviously isn't the case (anymore?).

EDIT: Here is their original commit, which broke the doodle sharing: [2]. It extends the interaction requirement to custom formats, which wasn't true before. Their followup was meant to just undo that part of this commit, but appears to have done much more.

[0] https://chromestatus.com/feature/5649558757441536

[1] https://chromium.googlesource.com/chromium/src/+/4d7b74b051a...

[2] https://chromium.googlesource.com/chromium/src/+/a3b96a459cf...

[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by Jenk on Saturday August 27, 2022 @05:40AM (#32617348)
that feels like a rather fragile process for something that is underpinning the internet to permit such mistakes occur so easily.
[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by lolinder on Saturday August 27, 2022 @10:54AM (#32619693)
Yes. For one thing, it looks like there was an automated test that warned the doodle was broken, but no such test for clipboard security features.
[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by bdougherty on Sunday August 28, 2022 @07:51PM (#32633347)
And underpinning an increasing amount of desktop software now as well.
[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by ohgodplsno on Saturday August 27, 2022 @10:30AM (#32619407)
Cool cool cool, we're breaking browsers because Google has complained that their daily doodle can't be copied. Not worrying at all.
[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by letssecure on Sunday August 28, 2022 @12:58PM (#32629908)
All changes are approved by chromium devs.
[ Parent | on HN ]
Re:Chrome allows websites to write to the clipboard without ... by de6u99er on Saturday August 27, 2022 @03:19AM (#32616637)
This should be the top comment!
[ Parent | on HN ]