Re: [w3c/clipboard-apis] Standardize Clipboard Source url, aka the URL from which the content has been copied from (Issue #244)

evilpie left a comment (w3c/clipboard-apis#244)

To help mitigate the increasing amount of ClickFix style attacks using the clipboard we have decided to quickly extend/change the implementation of `text/x-moz-url-priv` in Firefox. This MIME type was seemingly not motivated as a security measure, but we also don’t want to unnecessarily delay things while standardization can proceed in parallel.

We made the following decisions while [implementing this feature](https://bugzilla.mozilla.org/show_bug.cgi?id=2067254):

- We will not include the whole URL as source information, instead we strip it down to just the origin, e.g. `http://example.org`
- We intentionally do not provide source information for pastes coming from Firefox or and installed extensions’ user interface
- In private browsing mode we censor the URL and use `about:internet` no matter which website actually initiates the clipboard write

We also changed our implementation to more consistently provide the provenance information, e.g. for `clipboard.write` or `document.execCommand("copy")`.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/clipboard-apis/issues/244#issuecomment-5693406824
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/clipboard-apis/issues/244/5693406824@github.com>