Proposal: Privileged navigator.clipboard for content scripts

[erosman]

Preamble

References > Web APIs > Clipboard

Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.

Understandable for a website using the Web API

Mozilla > Add-ons > Browser Extensions > Interact with the clipboard

The Clipboard API writes arbitrary data to the clipboard from your extension. Using the API requires the permission "clipboardRead" or "clipboardWrite" in your manifest.json file. As the API is only available to Secure Contexts, it cannot be used from a content script running on http:-pages, only https:-pages.

The API access should differentiate between a webpage and an extensions with the necessary permissions.

There are already some differences implemented between the webpage context and content context in Firefox e.g.

Firefox only supports reading the clipboard in browser extensions, using the "clipboardRead" extension permission.

Consequence

The status quo provides no additional security in extensions with the necessary permissions. All it does. is creating extra unnecessary processes (for the extension & the browser) to send the data back (and forth) to the background script to perform the exact same function.

Furthermore, it increases the reliance on background script processing where a reduction is desired (especially for MV3).

Proposal

In a content script with the necessary permissions ,navigator.clipboard should be able to function on all pages supported for content scripts (e.g. http/https/file/about:blank).

---

Footnote

Testing navigator.clipboard.writeText() on Firefox

Content Script

• Works on https | file
• Does not work on http | about:blank
• No error

UserScript

UserScript context is mentioned for reference to #279 (USER_SCRIPT Execution World)

• Does not work on http | https | file | about:blank
• Error DOMException: Clipboard write was blocked due to lack of user activation.