allo- / ffprofile

A tool to create firefox profiles with personalized defaults.
GNU Affero General Public License v3.0
755 stars 56 forks source link

Privacy -> Disable the clipboardevents breaks copy paste functionality in certain sites #241

Open Pxartist opened 2 years ago

Pxartist commented 2 years ago

Certain websites, such as Discord, Messenger, Google Forms, etc utilize clipboardevents for parsing text inputs.

In cases such as Discord and Messenger, disabling clipboardevents voids all paste functionality. The clipboard will still be able to copy text within the sites, but pasting will produce no output whatsoever - including text both copied within and outside the site.

Under normal operation, Google Forms will split text input for carriage returns / new line characters onto multiple lines when pasting text into a multiple choice question. This does not occur when clipboardevents is disabled.

It is my view that a warning should be included under Privacy -> Disable the clipboardevents. option indicating that copy-paste functionality may be affected on certain websites.

allo- commented 2 years ago

Sounds reasonable. Would you like to suggest a new description, that covers both the uses and risks?

Pxartist commented 2 years ago

I'm not the most well versed in web based development / applications, but the description for the setting certainly does suggest that it can be quite exploitative.

It might be just me, but I think that displaying the path of each of the settings in about:config prior to the finish step might be desirable. I guess you could add in an expert / verbose mode.

Is there anyway to easily toggle the setting quickly without having to constantly jump into about:config besides having another browser / firefox profile?

allo- commented 2 years ago

This is one of the features, which are great to build webapps that can behave more like native apps and aren't confined to rely on simple textareas for pasting text and so on. On the other hand it can mess with what you copy and what you insert.

There may be addons, but as addons cannot access settings directly anymore they would require Mozilla to provide an API for changing these settings. Otherwise I think some addons patch the functions used by the websites.

For the preview: On the last page with the download buttons you should see a preview of the generated profile. The lines with the user_pref prefix are what the about:config entries look like in the prefs.js file.

Pxartist commented 2 years ago

The settings in the profile maker do not necessarily match the results in pref.js file.

For instance, Browser Features -> Save Screenshots Locally is user_pref("extensions.screenshots.upload-disabled", true); Furthermore, certain settings are much more obfuscated, such as user_pref("toolkit.telemetry.updatePing.enabled", false);

As a more sophisticated end user, it is my preference to be informed on what each setting does. The fact that much of the settings do not fully correlate with the pref.js file concerns me. An additional description or note such as: sets extensions.screenshots.upload-disabled to true would add additional clarity to the setting. This could be shown if the user decides to use a "verbose" or "expert" setting for the website.

I would also like to add that user_pref("extensions.screenshots.upload-disabled", true); is now obsolete, as suggested here: https://blog.mozilla.org/futurereleases/2019/01/24/clarifying-the-future-of-firefox-screenshots/. As of now the "Save" button is no longer present and upon testing two different profiles with the setting enabled and disabled, I recognize no difference between the UIs.

allo- commented 2 years ago

The settings in the profile maker do not necessarily match the results in pref.js file.

The preview and the config files are generated in the same way from the same data.

For instance, Browser Features -> Save Screenshots Locally is user_pref("extensions.screenshots.upload-disabled", true);

This is the setting. Have a look at the source.

Furthermore, certain settings are much more obfuscated, such as user_pref("toolkit.telemetry.updatePing.enabled", false);

I don't see what's obfuscated about this one. Firefox has some much more obfuscated settings which, for example, take integers for different modi and one only knows what the number means when looking up the documentation. This setting has a readable name and a simple boolean value.

An additional description or note such as: sets extensions.screenshots.upload-disabled to true would add additional clarity to the setting.

If you want to help, have a look at #38

I would also like to add that user_pref("extensions.screenshots.upload-disabled", true); is now obsolete, as suggested here: https://blog.mozilla.org/futurereleases/2019/01/24/clarifying-the-future-of-firefox-screenshots/.

That's something you can make an own issue for. Settings get useless or deprecated or even replaced by other ones and one needs to keep track of such changes. Any help is welcome.

ajleitzke commented 1 year ago

Also had an issue with this breaking copy and paste on a number of sites needed for my courses, if possible, would appreciate a revised description for this item.

allo- commented 1 year ago

@ajleitzke What do you have in mind? I've looked and it seem that we added in October a short warning: https://github.com/allo-/firefox-profilemaker/commit/6aa372460180b0d4b23332deedffae237ac584b7

And can you specify what breaks in addition to images? I am not sure how to phrase the appropriate warning.

ajleitzke commented 1 year ago

I had issues with both copy and paste on the code editor on Cengage and Oracle APEX. It added extra whitespace on each line, even when pasting to desktop applications such as VSCode or PyCharm.

Pasting with clipboardevents disabled:

Screenshot 2023-04-05 at 1 37 07 PM

Pasting with clipboardevents enabled:

Screenshot 2023-04-05 at 1 36 15 PM

From what I understand, it seems to mess with the formatting when copying/pasting. I would revise "This can break pasting copied images." to something along the lines of "This can break pasting copied images and formatted text on sites."

allo- commented 1 year ago

Looks like the editors handles the raw paste as it were typed and idents automatically. It should have some easy to understand description what clipboard events really mean, but I think the concept is hard to understand as a person who is not a developer even when the effect of missing clipboard events is obvious.

I would say your SQL statements are not even formatted text (as in rich text), but only text for which the editors needs to know that it was pasted and not typed.