As a developer, it is currently impossible to have plugins set the contents of the mouse clipboard. This would be useful for plugins that automatically generate code for annoying things like WaitForChild chains. For example, I could have a plugin that lets me select an object, press a plugin button, and have that object’s absolute path with WaitForChild’s copied to my mouse that I can immediately paste into my script.
24 Likes
I think we should have Clipboard.set/get for plugins. Full support.
Possibly with prompts like “Plugin name is trying to copy this text for you! Allow this?” and “Plugin name is trying to paste from your clipboard. Allow this?”
Getting the contents of the clipboard could be a security risk if it also can see content that was copied from outside of Studio. A dodgy plugin that is able to do http requests could send away the contents of the clipboard to a third party.
Think about application secrets, passwords, webhook urls, etc. Things you may copy sometimes that you don’t want anyone else to have access to.
EDIT: it’s still bad if it has a security prompt in front of it, having extra popups is bad for usability and people are notorious for clicking through dialog windows without reading.
2 Likes
That’s why I proposed it with some sort of security prompt
1 Like
They could restrict get access to only things that were set in Studio. Otherwise, it would return nil or something.
2 Likes
I can not really agree to this suggestion; either the risk being taken without a security prompt is too great or the actual use of the feature if it has a prompt for each time it tries to override the clipboard makes it more of a nuissance than a useful utility for me.
Also @MrHistory ; the clipboard is a global environment, they would have to keep track of whatever is assigned in studio which means just encorporating a custom clipboard into studio really
Plugins can use HttpService? That’s the real security vulnerability here. Posting clipboard contents is just one of the applications.
2 Likes
Yes, if it is enabled in your game. They can’t enable it themselves. There has been a feature request to have permissions for plugins so that i.e. you could turn off a plugin’s ability to use httpservice or other kinds of resources.