Stylesheets - Internet Explorer reveals "display:none" text in copy/paste

Author

Internet Explorer reveals "display:none" text in copy/paste

Stan Brown

2006-04-12, 10:45 pm

Posted by Pierre Blais in the current RISKS Digest:
http://catless.ncl.ac.uk/Risks/24.24.html#subj9

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://OakRoadSystems.com/
HTML 4.01 spec: http://www.w3.org/TR/html401/
validator: http://validator.w3.org/
CSS 2.1 spec: http://www.w3.org/TR/CSS21/
validator: http://jigsaw.w3.org/css-validator/
Why We Won't Help You:
http://diveintomark.org/archives/20...e_wont_help_you

VidTheKid

2006-04-14, 6:44 am

Actually that kind of makes sense to me. When you copy stuff from a
web page to the clipboard, one format that it's copied in is plain text
without formatting. Apparently, in this case, "display: none" counts
as formatting.

Perhaps the truly "correct" thing to do would be to, when copying text
to the clipboard, apply whatever CSS styling would apply to the
relevant media group(s) (maybe we need a new "media=plaintext"?) before
placing the text on the clipboard.

Of course, this behavior is only a problem if the content set to
"display:none" is sensitive information, but it would be revealed when
the client views the source anyway. So the moral is, if you don't want
information to be known, then don't send it to the client, even if the
client is instructed not to reveal it to the user.

--
Vid the Kid

frederick@southernskies.co.uk

2006-04-14, 6:46 pm

VidTheKid wrote:
> Of course, this behavior is only a problem if the content set to
> "display:none" is sensitive information
Would someone really be daft enough to do this?!

Alright, I do know the answer to that question!

--
AGw.

Schraalhans Keukenmeester

2006-04-14, 10:42 pm

Stan Brown wrote:
> Posted by Pierre Blais in the current RISKS Digest:
> http://catless.ncl.ac.uk/Risks/24.24.html#subj9
>
It's not limited to Internet Explorer. Firefox 1.0.7 on FC4 Linux
behaves in the same manner. Konqueror does not by the way. Haven't
checked other browsers.

My $.02

Sh.

PS. I think most common (mis)use of the display:none feature besides
leftover trial and error editing is by dufuses trying to get high search
engine rankings by hiding a lot of trash terms in their pages. Would be
kind of funny if their gramps decided to cut and paste grandson's nice
handiwork and found.... ;-)