Thursday, January 15th, 2009

Seeding the clipboard in Flash10 with Zero Clipboard

Category: Flash, Library, Security

>Following the bombshell of Adobe announcing that Flash 10 will not support unsolicited clipboard access from Flash and JavaScript as malicious flash ads flooded clipboards a lot of developers were wondering how to make the “copy to clipboard” still work without having to do it in Flash itself.

An interesting and also slightly creepy approach to the problem is the JavaScript library Zero Clipboard:

The Zero Clipboard library provides an easy way to copy text to the clipboard using an invisible Adobe Flash movie, and a JavaScript interface. The “Zero” signifies that the library is invisible and the user interface is left entirely up to you.

This library is fully compatible with Flash Player 10, which requires that the clipboard copy operation be initiated by a user click event inside the Flash movie. This is achieved by automatically floating the invisible movie on top of a DOM element of your choice. Standard mouse events are even propagated out to your DOM element, so you can still have rollover and mouse down effects.

So in other words, zero clipboard is a legitimate use of the clickjacking trick to cover an element with a transparent element that provides another functionality.

There are detailed instructions how to use the library on the homepage.

I don’t know about you, but somehow “copy to clipboard” buttons seem a bit redundant to me and by keeping this functionality working cause more security holes than usability benefits.

Posted by Chris Heilmann at 9:21 pm
5 Comments

++++-
4.4 rating from 14 votes

5 Comments »

Comments feed TrackBack URI

Thank, I was boring this problem with Flash 10, too

Comment by KKFC — January 15, 2009

Ha, yes, ZeroClipboard does work great. Unfortunately it’s a bit limited when you want to bind many instances of the tool to multiple text nodes. I posted a question on Stack Overflow just yesterday about this particular problem, but I’ve yet to find a better solution.

Here’s the code to use multiple text nodes with ZeroClipboard. As you can see, the code is quite redundant.

Comment by nicksergeant — January 15, 2009

I just want to give my kudos to Joe for writing this library. We now use it on Yamli.com, and he’s probably saved me a couple of days of tearing my hair out.

It’s unfortunate that we have to resort to these methods to access the clipboard. It would be nice if the browsers did allow writing to the clipboard directly, perhaps as in Flash 10 only in response to a user click.

– Imad

Comment by imad — January 15, 2009

I can think of one legitimate use for copy to clipboard and that is creating wysiwyg / word processor / application like interfaces where people are used to having copy and paste buttons.

Comment by newz2000 — January 16, 2009

Works great! I had to tweak it a bit to work with my buttons, but that was easy enough.

Comment by MattCoz — January 19, 2009

Leave a comment

You must be logged in to post a comment.