Clipboard default setting requests broader permission than necessary
Version info:
qutebrowser v3.7.0
Git commit:
Backend: QtWebEngine 6.11.1
based on Chromium 140.0.7339.225
with security patches up to 148.0.7778.96 (plus any distribution patches)
(source: api)
Qt: 6.11.1Does the bug happen if you start with --temp-basedir?:
yes
Description
On Qt 6.8+, qutebrowser defaults content.javascript.clipboard to ask.
For normal navigator.clipboard.write() / writeText() calls, this triggers Qt's broad ClipboardReadWrite permission, so users must grant read access just to copy text. This is undesirable in almost all cases.
qutebrowser already has a narrower mode:
'access': {
JavascriptCanAccessClipboard: True,
JavascriptCanPaste: False,
}Source: qutebrowser/browser/webengine/webenginesettings.py
Proposal: change the qutebrowser default from ask to access.
The documentation should also be corrected: access is currently described as allowing “reading from and writing to the clipboard”, but qutebrowser maps it to JavascriptCanPaste=False. It should instead describe access as the narrower write capability, with access-paste additionally permitting clipboard reads/paste.
This would make ordinary Copy buttons work by default without exposing existing clipboard contents.
How to reproduce Visit any website with a copy button and click it. Observe the unexpected prompt asking for clipboard read and write permissions.
Source: qutebrowser/qutebrowser