Add setting to allow pasting from clipboard

Closes #5256
Supersedes and closes #6315

7 files changed, 71 insertions, 22 deletions

diff --git a/doc/changelog.asciidoc b/doc/changelog.asciidoc
index f5e91a340..8455826d8 100644
--- a/doc/changelog.asciidoc
+++ b/doc/changelog.asciidoc
@@ -49,6 +49,11 @@ Changed
   resource system (rather than compiling them into a Qt resource file).
   Packagers are advised to use `misc/Makefile` if possible, which has been
   updated with the new paths.
+- The `content.javascript.can_access_clipboard` setting got renamed to
+  `content.javascript.clipboard` and now understands three different values
+  rather than being a boolean: `none` (formerly `false`), `access` (formerly
+  `true`) and `access-paste` (additionally allows pasting content, needed for
+  websites like Photopea or GitHub Codespaces).
 
 [[v2.5.1]]
 v2.5.1 (unreleased)
diff --git a/doc/faq.asciidoc b/doc/faq.asciidoc
index 503893b66..4b3596285 100644
--- a/doc/faq.asciidoc
+++ b/doc/faq.asciidoc
@@ -354,9 +354,9 @@ There is a total of four possible approaches to get dark websites:
   of the Dark Reader extension. This is mostly untested, though.
 
 How do I make copy to clipboard buttons work?::
-You can `:set content.javascript.can_access_clipboard true`, or
-`:set -u some.domain content.javascript.can_access_clipboard true` if you want to limit
-the setting to `some.domain`.
+You can `:set content.javascript.clipboard access` to allow this globally (not
+recommended!), or `:set -u some.domain content.javascript.clipboad access` if
+you want to limit the setting to `some.domain`.
 
 
 == Troubleshooting
diff --git a/doc/help/settings.asciidoc b/doc/help/settings.asciidoc
index 2f60525f4..f43548629 100644
--- a/doc/help/settings.asciidoc
+++ b/doc/help/settings.asciidoc
@@ -167,9 +167,9 @@
 |<<content.hyperlink_auditing,content.hyperlink_auditing>>|Enable hyperlink auditing (`<a ping>`).
 |<<content.images,content.images>>|Load images automatically in web pages.
 |<<content.javascript.alert,content.javascript.alert>>|Show javascript alerts.
-|<<content.javascript.can_access_clipboard,content.javascript.can_access_clipboard>>|Allow JavaScript to read from or write to the clipboard.
 |<<content.javascript.can_close_tabs,content.javascript.can_close_tabs>>|Allow JavaScript to close tabs.
 |<<content.javascript.can_open_tabs_automatically,content.javascript.can_open_tabs_automatically>>|Allow JavaScript to open new tabs without user interaction.
+|<<content.javascript.clipboard,content.javascript.clipboard>>|Allow JavaScript to read from or write to the clipboard.
 |<<content.javascript.enabled,content.javascript.enabled>>|Enable JavaScript.
 |<<content.javascript.log,content.javascript.log>>|Log levels to use for JavaScript console logging messages.
 |<<content.javascript.modal_dialog,content.javascript.modal_dialog>>|Use the standard JavaScript modal dialog for `alert()` and `confirm()`.
@@ -2333,17 +2333,6 @@ Type: <<types,Bool>>
 
 Default: +pass:[true]+
 
-[[content.javascript.can_access_clipboard]]
-=== content.javascript.can_access_clipboard
-Allow JavaScript to read from or write to the clipboard.
-With QtWebEngine, writing the clipboard as response to a user interaction is always allowed.
-
-This setting supports link:configuring{outfilesuffix}#patterns[URL patterns].
-
-Type: <<types,Bool>>
-
-Default: +pass:[false]+
-
 [[content.javascript.can_close_tabs]]
 === content.javascript.can_close_tabs
 Allow JavaScript to close tabs.
@@ -2366,6 +2355,23 @@ Type: <<types,Bool>>
 
 Default: +pass:[false]+
 
+[[content.javascript.clipboard]]
+=== content.javascript.clipboard
+Allow JavaScript to read from or write to the clipboard.
+With QtWebEngine, writing the clipboard as response to a user interaction is always allowed.
+
+This setting supports link:configuring{outfilesuffix}#patterns[URL patterns].
+
+Type: <<types,String>>
+
+Valid values:
+
+ * +none+: Disable access to clipboard.
+ * +access+: Allow reading from and writing to the clipboard.
+ * +access-paste+: Allow accessing the clipboard and pasting clipboard content.
+
+Default: +pass:[none]+
+
 [[content.javascript.enabled]]
 === content.javascript.enabled
 Enable JavaScript.
diff --git a/qutebrowser/browser/webengine/webenginesettings.py b/qutebrowser/browser/webengine/webenginesettings.py
index 0b25726c0..d7b840734 100644
--- a/qutebrowser/browser/webengine/webenginesettings.py
+++ b/qutebrowser/browser/webengine/webenginesettings.py
@@ -117,8 +117,6 @@ class WebEngineSettings(websettings.AbstractSettings):
             Attr(QWebEngineSettings.JavascriptEnabled),
         'content.javascript.can_open_tabs_automatically':
             Attr(QWebEngineSettings.JavascriptCanOpenWindows),
-        'content.javascript.can_access_clipboard':
-            Attr(QWebEngineSettings.JavascriptCanAccessClipboard),
         'content.plugins':
             Attr(QWebEngineSettings.PluginsEnabled),
         'content.hyperlink_auditing':
@@ -199,6 +197,21 @@ class WebEngineSettings(websettings.AbstractSettings):
         QWebEngineSettings.FantasyFont: QFont.Fantasy,
     }
 
+    _JS_CLIPBOARD_SETTINGS = {
+        'none': {
+            QWebEngineSettings.WebAttribute.JavascriptCanAccessClipboard: False,
+            QWebEngineSettings.WebAttribute.JavascriptCanPaste: False,
+        },
+        'access': {
+            QWebEngineSettings.WebAttribute.JavascriptCanAccessClipboard: True,
+            QWebEngineSettings.WebAttribute.JavascriptCanPaste: False,
+        },
+        'access-paste': {
+            QWebEngineSettings.WebAttribute.JavascriptCanAccessClipboard: True,
+            QWebEngineSettings.WebAttribute.JavascriptCanPaste: True,
+        },
+    }
+
     def set_unknown_url_scheme_policy(
             self, policy: Union[str, usertypes.Unset]) -> bool:
         """Set the UnknownUrlSchemePolicy to use.
@@ -215,9 +228,22 @@ class WebEngineSettings(websettings.AbstractSettings):
             self._settings.setUnknownUrlSchemePolicy(new_value)
         return old_value != new_value
 
+    def _set_js_clipboard(self, value: Union[str, usertypes.Unset]) -> None:
+        attr_access = QWebEngineSettings.WebAttribute.JavascriptCanAccessClipboard
+        attr_paste = QWebEngineSettings.WebAttribute.JavascriptCanPaste
+
+        if isinstance(value, usertypes.Unset):
+            self._settings.resetAttribute(attr_access)
+            self._settings.resetAttribute(attr_paste)
+        else:
+            for attr, attr_val in self._JS_CLIPBOARD_SETTINGS[value].items():
+                self._settings.setAttribute(attr, attr_val)
+
     def _update_setting(self, setting, value):
         if setting == 'content.unknown_url_scheme_policy':
             return self.set_unknown_url_scheme_policy(value)
+        elif setting == 'content.javascript.clipboard':
+            return self._set_js_clipboard(value)
         return super()._update_setting(setting, value)
 
     def init_settings(self):
diff --git a/qutebrowser/browser/webkit/webkitsettings.py b/qutebrowser/browser/webkit/webkitsettings.py
index cac6236ce..1348c849b 100644
--- a/qutebrowser/browser/webkit/webkitsettings.py
+++ b/qutebrowser/browser/webkit/webkitsettings.py
@@ -57,8 +57,9 @@ class WebKitSettings(websettings.AbstractSettings):
             Attr(QWebSettings.JavascriptCanOpenWindows),
         'content.javascript.can_close_tabs':
             Attr(QWebSettings.JavascriptCanCloseWindows),
-        'content.javascript.can_access_clipboard':
-            Attr(QWebSettings.JavascriptCanAccessClipboard),
+        'content.javascript.clipboard':
+            Attr(QWebSettings.JavascriptCanAccessClipboard,
+                 converter=lambda val: val != "none"),
         'content.plugins':
             Attr(QWebSettings.PluginsEnabled),
         'content.webgl':
diff --git a/qutebrowser/config/configdata.yml b/qutebrowser/config/configdata.yml
index 771cf0493..2ccb520b3 100644
--- a/qutebrowser/config/configdata.yml
+++ b/qutebrowser/config/configdata.yml
@@ -869,9 +869,14 @@ content.javascript.alert:
   type: Bool
   desc: Show javascript alerts.
 
-content.javascript.can_access_clipboard:
-  default: false
-  type: Bool
+content.javascript.clipboard:
+  default: none
+  type:
+    name: String
+    valid_values:
+      - none: Disable access to clipboard.
+      - access: Allow reading from and writing to the clipboard.
+      - access-paste: Allow accessing the clipboard and pasting clipboard content.
   supports_pattern: true
   desc: >-
     Allow JavaScript to read from or write to the clipboard.
diff --git a/qutebrowser/config/configfiles.py b/qutebrowser/config/configfiles.py
index d97771fad..f2651d1cd 100644
--- a/qutebrowser/config/configfiles.py
+++ b/qutebrowser/config/configfiles.py
@@ -422,6 +422,12 @@ class YamlMigrations(QObject):
             false_value='load-insecurely',
             ask_value='ask',
         )
+        self._migrate_renamed_bool(
+            old_name='content.javascript.can_access_clipboard',
+            new_name='content.javascript.clipboard',
+            true_value='access',
+            false_value='none',
+        )
 
         for setting in ['colors.webpage.force_dark_color_scheme',
                         'colors.webpage.prefers_color_scheme_dark']: