User.js: middlemouse.paste & autoScroll & clipboardevents [1528289]

[gwarser]

You already have clipboard covered, but I think this pref and it's side effects is worth knowing about.

https://bugzilla.mozilla.org/show_bug.cgi?id=1528289

[gwarser]

On Linux it's true.

[gwarser]

And does setting it to false prevent the leak?

Yes.

middlemouse.contentLoadURL

This is false on my side in 67.

dom.event.clipboardevents.enabled also prevents this, and you already have it set to false

[gwarser]

middlemouse.contentLoadURL probably disabled here: https://bugzilla.mozilla.org/show_bug.cgi?id=366945 I did not read it all.

[crssi]

^^ user_pref("clipboard.autocopy", false);

[Thorin-Oakenpants]

@gwarser -> https://trac.torproject.org/projects/tor/ticket/32766

[gwarser]

Leaking on Tor Browser 20190402030101 Manjaro KDE. Middle clicking on imgur.com shows "Sorry, URL failed to upload." bubble.

Both dom.event.clipboardevents.enabled and middlemouse.paste are true

[rusty-snake]

FWIW

/* 6904: enable middlemouse paste and disable autoScroll
 * The middlemouse paste clipboard leaking in 2403 occurs only
 * after autoScroll, so disabling autoScroll is an alternative fix. ***/
user_pref("middlemouse.paste", true); // 2403
user_pref("general.autoScroll", false);

[rusty-snake]

@Thorin-Oakenpants yes. I assume that it says window/mac because the default for linux is false. https://dxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js#197-201

[rusty-snake]

Linux: bug occurs only if user set general.autoScroll = true.
Windows: bug occurs only if user set middlemouse.paste = true ??

I think the default for these values just follow the platform defaults. Therefore its a workflow decision what the best solution is.

why do we need to do anything here?

Since autoScroll has a GUI and the user may not know (and never assume) that it can leak the clipboard, it should be there as an information. But we can maybe comment it.

enforcing "middlemouse.paste", false breaks a typical linux workflow, while enforcing "general.autoScroll", false breaks a typical window workflow.

[Thorin-Oakenpants]

Windows: bug occurs only if user ...

Wait! So when did this become a windows bug, because that changes things? I was under the impression it was a Linux only one (not that I have followed it). I'll go read the bugzilla top to bottom (edit: ok, no idea why I got the impression this was linux only)

But what also changes things (now that I have a clearer picture) is that Linux users have to flip autoScroll, and windows users have to flip middlemouse ... and both as user.js users have to override clipboard ..