Details
Description
In the QWebEngineSettings::WebAttribute enum there are two separate values relating to JS clipboard permissions:
JavascriptCanAccessClipboard - allows copying from the page to the clipboard
JavascriptCanPaste - allows reading from the clipboard into the page JS
We used to be able to set JavascriptCanPaste to false and JavascriptCanAccessClipboard to true to allow a page to fill the clipboard, but not to be able to read from it. With the recent change to permissions and addition of the clipboard permission into the grantable permissions API, this separation no long seems to work correctly.
Here's a very simple test app:
#include <QApplication> #include <QWebEngineView> #include <QUrl> #include <QWebEngineSettings> int main(int argc, char *argv[]) { QApplication app(argc, argv); QWebEngineView view; view.page()->settings()->setAttribute(QWebEngineSettings::JavascriptCanPaste, false); view.page()->settings()->setAttribute(QWebEngineSettings::JavascriptCanAccessClipboard, true); view.load(QUrl(argv[1])); view.show(); return app.exec(); }
You can open that up with this test site here and compare the behavior between 6.7 and 6.8: https://googlechrome.github.io/samples/async-clipboard/
On 6.7 the Copy button works, but the Paste button doesn't. On 6.8 neither of them work.
I think this might have something to with the new promptable clipboard related permission not having as much granularity as these two settings. It only supports granting or denying full clipboard access, so this more granular state falls through a gap somewhere. But there is some value in allowing copying from a page without allowing it to read from the clipboard.