Question

I was about to get started on implementing a copy/paste feature in my web app but I found out that it’s apparently not allowed. I am not too concerned with how to do it since it was an optional feature, but I was curious about what really makes it a security concern. If someone could explain, I would really appreciate it.

Answer 1

It’s also quite obnoxious when sites used to copy stuff to your clipboard without your action, thus clearing the other stuff you had in your clipboard. Some sites used to do that to try to prevent right-click copying of images and, in the process, they wrecked general usage of the clipboard. This isn’t a security issue so much as a denial-of-service attack on your clipboard.

It probably isn’t a security issue if only plain text could be put on the clipboard, but modern operating systems can put all sorts of things on the clipboard, some of which can be pretty powerful objects. The scope of how a receiving application might interact with random internet content put on the clipboard without the consent of the viewer is far too complicated to easily defend against all possible interactions.

As for the other way around, it’s no business of a random web-site to know what is on my clipboard. Web pages should clearly NOT be able to read content from the clipboard without the user’s consent.