Re: Safe copy and paste with scripts

Jim Ley wrote:
> The bigger problem is not cancelling it's changing - so you go to copy 
> a url into an email message, and a different link ends up on the 
> clipboard.
That can only be avoided by using explicit actions such as "copy text" 
which would avoid the possibly good value the element would make as copy.
> Or if you simply happen to be on a page and the browser can look at 
> what is in your clipboard, even if it's your untrusted data, yet 
> allowing access to the content when you do want to give your clipboard 
> contents.
Well, the solution of an onCopy and onPaste handlers avoids this hole, a 
recognized hole in IE, I believe:
the idea is that they are triggered by external gestures (menu-items, 
keys...) which makes the browser call the onCopy and writes *itself* to 
the clipboard, or call the onPaste only when it feels the gesture and 
passes the clipboard along (the user should expect the clipboard to be 
read then, or??).

paul

Received on Wednesday, 1 March 2006 21:33:25 UTC