Yes and no, the website can access clipboard data specifically when you're pasting as a user-triggered operation (C-v/M-v or "Paste" from a contextual menu) (that is the clipboard data is only accessible from the `paste` event).

This allows an application to access alternative representations (the clipboard can store multiple representations of the same data e.g. text and html and image and whatever, and the application can then pick the most appropriate — or all of them) and to pre-process clipboard data before inserting it programmatically. Very useful with e.g. RTE. Arbitrary clipboard access most definitely isn't allowed.

See http://www.w3.org/TR/clipboard-apis/#pasting-html-and-multi-... for security and privacy considerations.

> if yes, how can we disable this "feature"?

In firefox, probably by going to about:config and setting `dom.event.clipboardevents.enabled` to `false`. In webkit and MSIE (which have had the feature for ages) I have no idea.

    document.body.addEventListener("paste", function(e){
        console.log("paste event fired") 
    })

http://jsbin.com/odupog/1/edit

Either way, should alleviate some of the privacy concerns, as you can only get ClipboardData from elements where "paste" has a visible effect.

This is one of the ways that pasting images from your clipboard into, say, an image hosting site can work.

I had a difficult time finding fuller explanations of the capabilities - mostly because there isn't a standard API across browsers yet - but here[1] are the relevant Safari docs.

There's also a working draft[2] from the W3C for a standardized API.

[1] http://developer.apple.com/library/mac/documentation/AppleAp...

[2] http://www.w3.org/TR/clipboard-apis/