New issue
Advanced search Search tips

Issue 827675 link

Starred by 5 users

Issue metadata

Status: Available
Owner: ----
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Add an option to disable middle-click pasting

Reported by u.to.str...@gmail.com, Mar 30 2018

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.119 Safari/537.36

Steps to reproduce the problem:
1. With JavaScript enabled, open https://htmlpreview.github.io/?https://pastebin.com/raw/SZ0V4H8d
2. Select text with the mouse to add it to X11's PRIMARY clipboard
3. Middle-click the links

What is the expected behavior?
The page's JavaScript should not observe the `paste` event.

What went wrong?
The page's JavaScript's `paste` event listener was triggered and presented with the PRIMARY clipboard's content.

Did this work before? N/A 

Chrome version: 64.0.3282.119  Channel: n/a
OS Version: 
Flash Version: 

Chromium pastes the PRIMARY clipboard when the user middle-clicks a non-link element.
Maliciously crafted or poorly designed page components can be mistaken for links.
Middle-clicking such elements will result in the user's PRIMARY clipboard being pasted. Attempting to middle-click a real link, but missing, or scrolling with a mouse wheel and accidentally issuing a middle-click, will result in a paste.
JavaScript can receive the pasted data and do with it as it pleases, e.g. submit it to a server.
As demonstrated in the example page ("Functional bait-and-switch link"), JavaScript can retrieve the paste data without interrupting the expected result of middle-clicking a link; a new tab is still opened.

This behaviour is surprising to me as I am using GNOME, and have disabled the "Middle-click Paste" setting in the GNOME Tweak Tool.
This appears to be the relevant documentation for this property:
https://developer.gnome.org/gtk3/stable/GtkSettings.html#GtkSettings--gtk-enable-primary-paste

I am unfamiliar with development using GTK+, but my guess is that it's reasonable to expect Chromium to honour this property, or at least acknowledge it, by defaulting an option to the appropriate state.

I think that some users want to use middle-click as paste and only paste, and never middle-click links to open them in new tabs. However, I would like to disable this middle-click pasting functionality. So, an option to disable middle-click pasting should satisfy both stances.

Although I haven't tested it, it appears that disabling this behaviour in Firefox can be achieved by changing the values for some of its preferences:
- `middlemouse.paste` - `false`
- `middlemouse.contentLoadURL` - `false`

http://kb.mozillazine.org/Middlemouse.paste
http://kb.mozillazine.org/Middlemouse.contentLoadURL

Workarounds currently available to users:
1. Disable JavaScript
2. Stop middle-clicking links; only middle-click if you want to paste
3. Use third-party software to clear the PRIMARY clipboard before every middle-click
 
Labels: Needs-Triage-M64
Labels: -Needs-Triage-M64 Needs-Milestone
Components: Blink>DataTransfer
Labels: Triaged-ET M-67 Target-67 FoundIn-67
Status: Untriaged (was: Unconfirmed)
Able to reproduce the issue on Ubuntu 14.04 using chrome stable version #65.0.3325.181 and latest canary #67.0.3390.0. 
This is a non-regression issue as it is observed from M60 old builds. 

Hence, marking it as untriaged to get more inputs from dev team.

Thanks...!!

Comment 4 by jsb...@chromium.org, Apr 13 2018

Status: Available (was: Untriaged)

Comment 5 by jsb...@chromium.org, Apr 13 2018

Labels: -Pri-2 Pri-3

Sign in to add a comment