Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Why does DevTools need permission to write to the clipboard? #32244

Open
jzombie opened this issue Jan 28, 2025 · 13 comments
Open

Why does DevTools need permission to write to the clipboard? #32244

jzombie opened this issue Jan 28, 2025 · 13 comments
Assignees
@hoxyq
Labels
Component: Developer Tools

Comments

@jzombie
Copy link

jzombie commented Jan 28, 2025 •
edited by eps1lon
Loading

React DevTools is asking for permission to read write the clipboard.

Why?

Image
@jzombie jzombie added the Status: Unconfirmed A potential issue that we haven't yet confirmed as a bug label Jan 28, 2025
@jzombie jzombie changed the title Bug: DevTools "Modify data you copy and paste" permission Why does DevTools need access to copy and pasted data? Jan 28, 2025
@YoussefKababe
Copy link

YoussefKababe commented Jan 28, 2025 •
edited
Loading

Came here to ask the same question after getting a warning from Chrome. Suspecting it's to make this copy to clipboard button work?

Image

@jzombie
Copy link
Author

jzombie commented Jan 28, 2025

Came here to ask the same question after getting a warning from Chrome. Suspecting it's to make this copy to clipboard button work?

Image

That's interesting. The tradeoff isn't worth it, though, on a personal development machine.

@kafein
Copy link

kafein commented Jan 28, 2025

I'm not going to use this extension until this permission is removed.

@tpudel
Copy link

tpudel commented Jan 28, 2025

Came here to ask the same question after getting a warning from Chrome. Suspecting it's to make this copy to clipboard button work?

Image

Feels like an absolute cop-out reason for such a security risk in my opinion. If I want to copy paste something from react dev tools (I don't believe I have ever in the past to be honest), I will simply click, drag, and CTRL+C on the text.

For a developer-centric extension like this, it makes me wonder if this was actually a planned and explicitly chosen permission or if the extension was sold off to a third party.

@eps1lon
Copy link
Collaborator

eps1lon commented Jan 28, 2025

We should probably just move these to optional_permissions.

Also keep in mind that this permission only grants write access not read access.

@eps1lon eps1lon added Component: Developer Tools and removed Status: Unconfirmed A potential issue that we haven't yet confirmed as a bug labels Jan 28, 2025
@eps1lon eps1lon changed the title Why does DevTools need access to copy and pasted data? Why does DevTools need permission to write to the clipboard? Jan 28, 2025
@hoxyq
Copy link
Contributor

hoxyq commented Jan 28, 2025 •
edited
Loading

Yes, as @eps1lon mentioned, we only use it for write access. We don't have a permission to read clipboard data, please re-read the text that you've highlighted on the screenshot.

We added it here #32077 to make it more verbose and fix Firefox extension. I think Chrome doesn't really check for this permission to allow extensions writing to clipboard.

Thanks for flagging. I will research on moving it to optional permissions, this sound like a better approach.

@niraj2477
Copy link

On my mac extension disable automatically with below error.

Image

@freakyflow

This comment has been minimized.

Sign in to view
@teremy

This comment has been minimized.

Sign in to view
@fortunamagix

This comment has been minimized.

Sign in to view
@hoxyq
Copy link
Contributor

hoxyq commented Jan 29, 2025

FYI, I am rolling back the release of 6.1.0 in Chrome extensions store. This should be replaced with previous release of 6.0.1, which will be temporarily versioned as 6.1.0.1.

Again, I want to make this clear that we don't have permissions to read from clipboard, please re-read the message from Chrome. Also, the implementation for clipboard writing has been present in the extension for years, it is just we listed this permission now to make it explicit and it fired back.

I am working on moving this permission to the list of optional ones, and then will publish a new patch version.

@leonar2zb

This comment has been minimized.

Sign in to view
@hoxyq hoxyq mentioned this issue Jan 29, 2025
Merged
@ABHISHEKABHI52

This comment has been minimized.

Sign in to view
hoxyq added a commit that referenced this issue Jan 30, 2025
@hoxyq
chore[DevTools]: make clipboardWrite optional for chromium (#32262)
221f300 
Addresses #32244.

### Chromium
We will use
[chrome.permissions](https://developer.chrome.com/docs/extensions/reference/api/permissions)
for checking / requesting `clipboardWrite` permission before copying
something to the clipboard.

### Firefox
We will keep `clipboardWrite` as a required permission, because there is
no reliable and working API for requesting optional permissions for
extensions that are extending browser DevTools:
- `chrome.permissions` is unavailable for devtools pages -
https://bugzilla.mozilla.org/show_bug.cgi?id=1796933
- You can't call `chrome.permissions.request` from background, because
this instruction has to be executed inside user-event callback,
basically only initiated by user.

I don't really want to come up with solutions like opening a new tab
with a button that user has to click.
github-actions bot pushed a commit to Umasankar15/react that referenced this issue Jan 31, 2025
@Umasankar15
chore[DevTools]: make clipboardWrite optional for chromium (facebook#…
d589d46 
…32262)

Addresses facebook#32244.

### Chromium
We will use
[chrome.permissions](https://developer.chrome.com/docs/extensions/reference/api/permissions)
for checking / requesting `clipboardWrite` permission before copying
something to the clipboard.

### Firefox
We will keep `clipboardWrite` as a required permission, because there is
no reliable and working API for requesting optional permissions for
extensions that are extending browser DevTools:
- `chrome.permissions` is unavailable for devtools pages -
https://bugzilla.mozilla.org/show_bug.cgi?id=1796933
- You can't call `chrome.permissions.request` from background, because
this instruction has to be executed inside user-event callback,
basically only initiated by user.

I don't really want to come up with solutions like opening a new tab
with a button that user has to click.

DiffTrain build for [221f300](facebook@221f300)
github-actions bot pushed a commit to Umasankar15/react that referenced this issue Jan 31, 2025
@Umasankar15
chore[DevTools]: make clipboardWrite optional for chromium (facebook#…
977b15e 
…32262)

Addresses facebook#32244.

### Chromium
We will use
[chrome.permissions](https://developer.chrome.com/docs/extensions/reference/api/permissions)
for checking / requesting `clipboardWrite` permission before copying
something to the clipboard.

### Firefox
We will keep `clipboardWrite` as a required permission, because there is
no reliable and working API for requesting optional permissions for
extensions that are extending browser DevTools:
- `chrome.permissions` is unavailable for devtools pages -
https://bugzilla.mozilla.org/show_bug.cgi?id=1796933
- You can't call `chrome.permissions.request` from background, because
this instruction has to be executed inside user-event callback,
basically only initiated by user.

I don't really want to come up with solutions like opening a new tab
with a button that user has to click.

DiffTrain build for [221f300](facebook@221f300)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hoxyq hoxyq

Labels
Component: Developer Tools
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests