Re: Windows Security Flaw - The Clipboard

From: Jeff Bramwell (jbramwell@---)
Date: 12/23/02 

From: "Jeff Bramwell" <jbramwell@--- no sp@m please ---cox.net>
Date: Sun, 22 Dec 2002 23:27:50 -0600

That's very true, but it is also very easy for a client-side JavaScript
function to grab the clipboard contents, append it to a URL as a parameter
(e.g. http://www.somedomain.com?secretclipboardcontents=xxxxx), and then
open that URL in the current browser window, a hidden frame, or possibly a
new window. The JavaScript could also store the clipboard contents as a
cookie and then refresh the current page. In any of these cases the server
would be able to read the contents.

Interesting.

  --- Jeff

"Robert Moir" <bofh@mvps.org> wrote in message
news:Ow2frZiqCHA.1848@TK2MSFTNGP09...
> Jeff Bramwell wrote:
> > Not exactly, but they do prove that JavaScript code can read your
> > clipboard contents. So, if your browser can run JavaScript, then it
> > would be very easy for a web site to retrieve your clipboard's
> > contents.
>
> Client side and server side script ain't the same.
>
>

Relevant Pages

  • Re: Graphing/plotting with embedded webserver?
    ... >> Is there a way to use client-side Javascript to do the actual ... >> but I could probably get away with Javascript. ... on a machine with decent graphics capabilities. ... Are you asking about the client side or the server side? ...
    (comp.arch.embedded)
  • Re: Dynamic TextField Drop Down Pre-fill
    ... with just plain Javascript and CSS? ... If you mean client-side javascript then the problem is the data from ... throw up AJAX on Tomcat/iPlanet web servers? ... The server is doing nothing more than a server ...
    (comp.lang.javascript)
  • Re: advantage of document.write
    ... Of course using a programming language to generate your HTML makes only ... Sow would you create a button that can only be used if Javascript is enabled? ... How would you add a button that copies text to the clipboard? ... How would you add the current date - according to my system clock - with server side code? ...
    (comp.lang.javascript)
  • Re: How to get the contnet of clipboard
    ... >Simply turning off Javascript ... having your clipboard read by a web page is a security risk. ... > Simply turning off Javascript ... >> If you have the CB text you can invoke a post to the server. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to get the contnet of clipboard
    ... > I wonder how ASP.NET reacts:) ... can function as efficiently without client-side Javascript as with it. ... having your clipboard read by a web page is a security risk. ... >> That lands us right back into the server scenario again, where it simply can't be done. ...
    (microsoft.public.dotnet.framework.aspnet)