FireFox 1.5 & clipboard access & controlling insert/overwrite mode

[PMA]

Hi all,

I am porting a web application from IE 6.0 to FireFox 1.5. I have
solved almost all compatibility issues (quite a lot but not too bad)
except two of them :

1) Clipboard access thru' JavaScript (programmatical copy and
paste actions)
2) Monitoring and driving Insert/Overwrite mode on input fields

Any help appreciated.

Philippe

[Randy Webb]

PMA said the following on 4/13/2006 6:04 AM:

Hi all,

I am porting a web application from IE 6.0 to FireFox 1.5. I have
solved almost all compatibility issues (quite a lot but not too bad)
except two of them :

1) Clipboard access thru' JavaScript (programmatical copy and
paste actions)
Can't programatically access the Clipboard in Firefox. It's an IE-only
security flaw - err - feature.
2) Monitoring and driving Insert/Overwrite mode on input fields

If memory serves me correctly, that can't be done in FF either.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq & newsgroup weekly
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[PMA]

OK

Thanks

But why do you consider access to clipboard thru' JS is a sec flaw ? I
really wonder why ...

[Csaba Gabor]

PMA wrote:

OK

Thanks

But why do you consider access to clipboard thru' JS is a sec flaw ? I
really wonder why ...

Many times the word security flaw is used, especially when no scenario
is described, it means annoyance. Nevertheless, in this particular
instance, it can lead to data loss for the user. Consider that you are
editing something in Word and you do a cut. Along comes a
window.setTimeo ut from an open browser which decides it wants to write
to the clipboard and, poof, you don't get back what you cut.

It might be that there is an option or security setting that allows you
to bypass this restriction (not sure on that). Also, if your app is
for an intranet where you can dictate requirements, then this is
possible if you can require your users to have an extension to Firefox,
such as GreaseMonkey.

Csaba Gabor from Vienna

[Erwin Moller]

Csaba Gabor wrote:

PMA wrote:

OK

Thanks

But why do you consider access to clipboard thru' JS is a sec flaw ? I
really wonder why ...
Many times the word security flaw is used, especially when no scenario
is described, it means annoyance. Nevertheless, in this particular
instance, it can lead to data loss for the user. Consider that you are
editing something in Word and you do a cut. Along comes a
window.setTimeo ut from an open browser which decides it wants to write
to the clipboard and, poof, you don't get back what you cut.

I would say that is one of the least serious problems.
What about a webapp in the background that send all clipboardconten t to some
badguy's server nonstop?

And I think we saw reasons enough last years to consider IE a security flaw
on it's own behalf, not to mention the time Microsoft needs to patch their
own shit and release the patch.
Regards,
Erwin Moller

It might be that there is an option or security setting that allows you
to bypass this restriction (not sure on that). Also, if your app is
for an intranet where you can dictate requirements, then this is
possible if you can require your users to have an extension to Firefox,
such as GreaseMonkey.

Csaba Gabor from Vienna

[Lasse Reichstein Nielsen]

"Csaba Gabor" <da*****@gmail. com> writes:

Many times the word security flaw is used, especially when no scenario
is described, it means annoyance. Nevertheless, in this particular
instance, it can lead to data loss for the user.

It can also lead to compromise of secret data:
<URL:http://tom.me.uk/clipboard/>
Since I use an application for storing my passwords, I will have them
in the clipboard at times. Were I to have IE open on a malicious page
at the time, that password could be sent to the bad guy.

A simple example of what can get captured:
---
<textarea id="store" rows="50" cols="80"></textarea>
<script type="text/javascript">
(function loot() {
var store = document.getEle mentById("store ");
var last = "";
setInterval(
function(){
var now = window.clipboar dData.getData(" Text");
if (now != last) {
store.value += now;
last = now;
}
}, 250);
})()
</script>
---
Have this running in the background for a while and come back and see.
Then remember that this could all have been sent to somewhere using a
XMLHTTPRequest.

/L
--
Lasse Reichstein Nielsen - lr*@hotpop.com
DHTML Death Colors: <URL:http://www.infimum.dk/HTML/rasterTriangleD OM.html>
'Faith without judgement merely degrades the spirit divine.'

[PMA]

Gotcha,

However, when inside some intranet apps (in fact we are just using Web
technologies for making applications that are NOT connected to the
Internet and where security issues are monitored thru' a lot of
securities guys, anti virus, anti-spyware, anti-trojan anti-...,
firewalls (many, many, many of them) it is in a way strange that no
configuration is provided to release some features like the one I need
in FF.

Thanx
Philippe

[Erwin Moller]

PMA wrote:

Gotcha,

However, when inside some intranet apps (in fact we are just using Web
technologies for making applications that are NOT connected to the
Internet and where security issues are monitored thru' a lot of
securities guys, anti virus, anti-spyware, anti-trojan anti-...,
firewalls (many, many, many of them) it is in a way strange that no
configuration is provided to release some features like the one I need
in FF.
Well, you 3 options:

1) you can always code them yourself.
Firefox is an Open Source initiative after all.

2) Search for a plugin that enables clipboardmanipu lation.
Google for "plugin firefox clipboard"
Three link that might interest you:
http://extensionroom.mozdev.org/main.php/Firefox
https://addons.mozilla.org/extension...cation=firefox
http://www.quickonlinetips.com/archi...power-surfing/

I didn't check any of them myself, but I think that if you look into how the
plugins work, you can maybe make your own.
I am unsure if you can make a link to Javascript, as you asked in your
original question.

3) Or you can ask the developers of Firefox if they want to implement it.
It is technically not difficult.

Regards,
Erwin Moller


Thanx
Philippe

[Julian Turner]

PMA wrote:

Hi all,

I am porting a web application from IE 6.0 to FireFox 1.5. I have
solved almost all compatibility issues (quite a lot but not too bad)
except two of them :

1) Clipboard access thru' JavaScript (programmatical copy and
paste actions)
2) Monitoring and driving Insert/Overwrite mode on input fields

Any help appreciated.

Philippe

Take a look at:-

<URL:http://xulplanet.com/references/xpcomref/group_Clipboard .html>
<URL:http://xulplanet.com/references/xpcomref/group_Selection .html>

Regards

Julian Turner

[PMA]

Thanx very much ...

I would not like to go to a specific dev for that feature. In a way I
prefer to "limit" the application users than telling IT departement
(there are not far from 15,000 users !) that they have to
"re-masterize" 15,000 Workstations ...

Best regards
Philippe