复制& 在火狐浏览器中粘贴
在使用所见即所得编辑器时，我遇到了 Firefox 限制访问剪贴板的问题（尚未测试 Webkit）。
有人可以解释为什么复制到剪贴板受到限制吗？
我只是想不出一种可以恶意使用它的方法，并且缺乏“复制”支持的用例比比皆是。
事实上，zeroClipboard 等整个库只是为了方便实现此功能。
（我理解 - 但不同意 - 允许读取访问剪贴板可能会造成一个漏洞，尽管弹出窗口可以解决这个问题。）是否有任何好的黑客/方法可以给我一个'粘贴'按钮？ 我见过一些帖子提到“文本区域技巧”等，但没有解释它们是如何工作的。
是否有一个术语来形容这种非常常见的情况，即合法用户的生产受到“安全预防措施”的阻碍，而“坏人”使用黑客手段[如 ZeroClip]，使安全感完全虚假？
我知道，如果我签署我的脚本，可以使用一种复杂的“官方”方法。[我没有知识或资源]，但即使这样，每当我使用它时也会生成一个弹出窗口。
While working on a wysiwyg editor, I hit the wall of Firefox restricting access to the clipboard (haven't yet tested Webkit).
Can someone explain WHY copying to the clipboard is restricted?
I just cannot think of a single way that this can be used nefariously, and use-cases abound where lack of 'copy' support is a problem.
In fact, whole libraries such as zeroClipboard are there just to facilitate this function.(I understand - but disagree - that allowing read access to the clipboard can create a hole, though a popup would solve that.)
Are there any good hacks/methods that would give me a 'paste' button? I have seen posts refer to 'textarea trick' among others, without explanation of how they work.
Is there a term for the all-too-common scenario where production by legitimate users is hampered by 'security precautions', and the 'bad guys' use hacks [like zeroClip] that render the secure feeling completely false?
I am aware that there is a convoluted 'official' method that is available if I sign my scripts.. [which I do not have the knowledge or resources to do], but that even that would generate a popup whenever I use it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
同样的原因，站点脚本不能只更改书签或写出对本地文件的更改：这些文件属于用户，并且允许脚本修改它们也允许恶意脚本写出恶意内容或删除有价值的数据。
是的，我们通常认为剪贴板数据“不太重要”，因为它是暂时的。 但它仍然属于用户，而不是任何打开的页面。 想象一下一个脚本，出于某种误导性的希望来防止侵犯版权, 清除剪贴板 每 100 毫秒一次！ 或者复制危险的系统命令，希望少数用户将它们粘贴到终端中而不首先仔细检查...
FWIW，截至 版本 10，Flash 还收紧了对修改剪贴板的限制：现在此类修改必须作为用户交互的直接结果发生。
Same reason site scripts can't just change your bookmarks or write out changes to local files: those belong to the user, and allowing scripts to modify them also allows malicious scripts to write out malicious content or erase valuable data.
Yes, we generally consider clipboard data to be "less important", in that it is transient. But it still belongs to the user, not whatever page happens to be open. Imagine a script that, out of some misguided hope to prevent copyright violation, cleared out your clipboard every 100 milliseconds! Or one that copied dangerous system commands, hoping that a small number of users would paste them into a terminal without double-checking first...
FWIW, as of version 10, Flash has also tightened up restrictions on modifying the clipboard: such modifications now must happen as a direct result of user interaction.
我认为安全问题是网站从剪贴板读取内容。 站点可以有一个脚本，它只是被动地读取每个访问者的剪贴板并保存数据。 在用户不知情的情况下，该网站可能会收集电子邮件地址、密码、信用卡号、社会保险号等。
I think the security issue is a site reading from the clipboard. A site could have a script that just passively reads each visitor's clipboard and saves the data. Without the knowledge of the user, the site could potentially gather email addresses, passwords, credit card numbers, social security numbers, etc.
您可能从不支持撤消的应用程序中剪切了某些内容，或者将某些内容粘贴到其他地方。 如果允许自动修改剪贴板，您可能会丢失已剪切的数据。
You might have cut something from an application that doesn't support undo or something to paste somewhere else. If it was allowed to modified the clipboard automatically, you could have lost the data you had cut.