Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
org.webjars.npm:clipboard-polyfill
Advanced tools
clipboard-polyfill
Make copying on the web as easy as:
clipboard.writeText("hello world");
As of October 2017, this library is a polyfill for the modern Promise
-based asynchronous clipboard API.
(Note: the core library doesn't modify global objects, so it's actually a ponyfill.)
If you use npm
, install:
npm install clipboard-pollyfill
Sample app that writes text:
// Using the `clipboard/text` build saves code size.
// This is recommended if you only need to copy text.
import * as clipboard from "clipboard-polyfill/text";
function handler() {
clipboard.writeText("This text is plain.").then(
function() { console.log("success!"); },
function() { console.log("error!"); }
);
}
window.addEventListener("DOMContentLoaded", function() { const button = document.createElement("button"); button.textContent = "Copy"; button.addEventListener("click", handler); document.body.appendChild(button); });
Notes:
import * as clipboard from "clipboard-polyfill/text";
// Async/await syntax.
async function handler() {
// Read text from the clipboard, if present.
// Works in: IE 9-11, Chrome 65+, Safari 13.1+
console.log("Previous clipboard text:", await clipboard.readText());
await clipboard.writeText("This text is plain.");
}
window.addEventListener("DOMContentLoaded", function() { const button = document.createElement("button"); button.textContent = "Copy"; button.addEventListener("click", handler); document.body.appendChild(button); });
import * as clipboard from "clipboard-polyfill";
async function handler() {
// Read a list of `ClipboardItem`s.
// Works in: IE 9-11, Chrome 65+, Safari 13.1+
console.log("Previous clipboard contents:", await clipboard.read());
// Chrome 83 supports: `text/plain`, `image/png`
// Sfari 13.1 supports: `text/plain`, `text/html`, `text-uri-list`, `image/png`
const item = new clipboard.ClipboardItem({
"text/html": new Blob(["<i>Markup</i> <b>text</b>. Paste me into a rich text editor."], { type: "text/html" }),
"text/plain": new Blob(["Fallback markup text. Paste me into a rich text editor."], { type: "text/plain" })
});
await clipboard.write([item]);
}
window.addEventListener("DOMContentLoaded", function() { const button = document.createElement("button"); button.textContent = "Copy"; button.addEventListener("click", handler); document.body.appendChild(button); });
Check the Clipboard API specification for more details.
Notes:
async
functions for the await
syntax.text/plain
and text/html
are the only data types that can be written to the clipboard across most browsers.read()
may only return a subset of supported data types, even if the clipboard contains more data types. There is no way to tell if there were more data types.overwrite-globals
versionIf you want the library to overwrite the global clipboard API with its implementations, import clipboard-polyfill/overwrite-globals
. This will turn the library from a ponyfill into a proper polyfill, so you can write code as if the async clipboard API were already implemented in your browser:
import "clipboard-polyfill/overwrite-globals";
async function handler() {
const item = new window.ClipboardItem({
"text/html": new Blob(["<i>Markup</i> <b>text</b>. Paste me into a rich text editor."], { type: "text/html" }),
"text/plain": new Blob(["Fallback markup text. Paste me into a rich text editor."], { type: "text/plain" })
});
navigator.clipboard.write([item]);
}
window.addEventListener("DOMContentLoaded", function() { const button = document.createElement("button"); button.textContent = "Copy"; button.addEventListener("click", handler); document.body.appendChild(button); });
This approach is not recommended, because it may break any other code that interacts with the clipboard API globals, and may be incompatible with future browser implementations.
Promise
includedIf you need to grab a version that "just works", download clipboard-polyfill.promise.js
and include it using a <script>
tag:
<script src="./clipboard-polyfill.promise.js"></script>
<button onclick="copy()">Copy text!</button>
<script>
// `clipboard` is defined on the global `window` object.
function copy() {
clipboard.writeText("hello world!");
}
</script>
clipboard-polyfill
?Browsers have implemented several clipboard APIs over time, and writing to the clipboard without triggering bugs in various old and current browsers is fairly tricky. In every browser that supports copying to the clipboard in some way, clipboard-polyfill
attempts to act as close as possible to the async clipboard API. (See above for disclaimers and limitations.)
See this presentation for for a longer history of clipboard access on the web.
If you only need to copy text, try this gist for a simpler solution.
Some compatibility caveats for older browsers:
window.Promise
if you want the library to work.clipboard-polyfill
will always report success in this case.ClipoardItem
constructor.text/html
data type is not written using the expected CF_HTML
format. clipboard-polyfill
does not try to work around this, since 1) it would require fragile browser version sniffing, 2) users of Edge are not generally stuck on version < 17, and 3) the failure mode for other browsers would be that invalid clipboard HTML is copied. (Edge Bug #14372529, #73)clipboard-polyfill
uses a variety of heuristics to work around compatibility bugs. Please let us know if you are running into compatibility issues with any of the browsers listed above.
FAQs
WebJar for clipboard-polyfill
We found that org.webjars.npm:clipboard-polyfill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.