Q1. What is the problem that you are trying to solve?
When copying a password from the browser extension, it schedules the clipboard to be cleared after its timeout. However, the clipboard is cleared unconditionally, even if its contents have changed since the password was copied.
To reproduce this:
- Copy a password from Passbolt.
- Before the timeout expires, copy unrelated text from another application.
- Wait for the Passbolt timeout.
- The unrelated text is indiscriminately removed from the clipboard.
I would expect Passbolt to clear the clipboard only if it still contains the value that Passbolt originally placed there. If the clipboard has subsequently changed, Passbolt should no longer consider itself the owner of that clipboard content, and should leave it untouched.
This preserves the intended security behaviour, while avoiding impeding user workflows.
Q2 - Who is impacted?
Any users running extension 5.14.3, but also probably anything released so far (not including any short-term release lines that disabled the feature for a short duration).
Q3 - Why is it important and/or urgent?
It makes for a fairly degraded user experience sometimes. I wouldn’t call this behaviour very… encouraging or satisfying.
Q4 - What is your proposed solution? (optional)
As mentioned, clear the clipboard only if it still contains the value that Passbolt originally placed there. Conceptually, something like:
if (currentClipboard === originallyCopiedSecret) clearClipboard();
…rather than clearing the clipboard unconditionally after the timer expires.
A workaround would be to use clipboard history (Win+V for Windows systems), or using a more feature-rich clipboard manager. I’m still exploring this route and seeing if a programmatic approach can meet in the middle without storing secrets where they should not be (medium/long-term client-side history).