Clear credentials from clipboard after 60 seconds (#141)

The clipboard is cleared 60 seconds after a username or password is
copied, if the content of the clipboard is still equal to the copied
string.

README.md

@@ -141,17 +141,17 @@ If you want to intentionally disable phishing attack protection and search the e
 
 Note: If the cursor is located in the search input field, every shortcut that works on the selected entry will be applied on the first entry in the popup list.
 
-| Shortcut                                             | Action                                          |
+| Shortcut                                             | Action                                                |
-| ---------------------------------------------------- | ------------------------------------------------ |
+| ---------------------------------------------------- | ----------------------------------------------------- |
-| <kbd>Ctrl+Shift+L</kbd>                              | Open Browserpass popup                           |
+| <kbd>Ctrl+Shift+L</kbd>                              | Open Browserpass popup                                |
-| <kbd>Ctrl+Shift+F</kbd>                              | Fill the form with the best matching credentials |
+| <kbd>Ctrl+Shift+F</kbd>                              | Fill the form with the best matching credentials      |
-| <kbd>Enter</kbd>                                     | Submit form with currently selected credentials  |
+| <kbd>Enter</kbd>                                     | Submit form with currently selected credentials       |
-| Arrow keys and <kbd>Tab</kbd> / <kbd>Shift+Tab</kbd> | Navigate popup list                              |
+| Arrow keys and <kbd>Tab</kbd> / <kbd>Shift+Tab</kbd> | Navigate popup list                                   |
-| <kbd>Ctrl+C</kbd>                                    | Copy password to clipboard                       |
+| <kbd>Ctrl+C</kbd>                                    | Copy password to clipboard (will clear in 60 seconds) |
-| <kbd>Ctrl+Shift+C</kbd>                              | Copy username to clipboard                       |
+| <kbd>Ctrl+Shift+C</kbd>                              | Copy username to clipboard (will clear in 60 seconds) |
-| <kbd>Ctrl+G</kbd>                                    | Open URL in the current tab                      |
+| <kbd>Ctrl+G</kbd>                                    | Open URL in the current tab                           |
-| <kbd>Ctrl+Shift+G</kbd>                              | Open URL in the new tab                          |
+| <kbd>Ctrl+Shift+G</kbd>                              | Open URL in the new tab                               |
-| <kbd>Backspace</kbd> (with no search text entered)   | Search passwords in the entire password store    |
+| <kbd>Backspace</kbd> (with no search text entered)   | Search passwords in the entire password store         |
 
 ### Password matching and sorting
 
@@ -273,7 +273,9 @@ Browserpass extension requests the following permissions:
 | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `debugger`           | Only used for "auto-submit" functionality: if all attepts to locate a "Submit" button failed, Browserpass will put focus inside the login form and issue an <kbd>Enter</kbd> keypress. This is only available in Chromium-based browsers, and sadly this permission [cannot be specified as optional](https://developer.chrome.com/apps/permissions) |
 | `activeTab`          | To get URL of the current tab, used for example to determine which passwords to show you by default in the popup                                                                                                                                                                                                                                     |
+| `alarms`             | To set a timer for clearing the clipboard 60 seconds after credentials are copied                                                                                                                                                                                                                                                                    |
 | `tabs`               | To get URL of a given tab, used for example to set count of the matching passwords for a given tab                                                                                                                                                                                                                                                   |
+| `clipboardRead`      | To ensure only copied credentials and not other content is cleared from the clipboard after 60 seconds                                                                                                                                                                                                                                         |
 | `clipboardWrite`     | For "Copy password" and "Copy username" functionality                                                                                                                                                                                                                                                                                                |
 | `nativeMessaging`    | To allow communication with the native app                                                                                                                                                                                                                                                                                                           |
 | `notifications`      | To show browser notifications on install or update                                                                                                                                                                                                                                                                                                   |

src/background.js

@@ -28,6 +28,9 @@ var defaultSettings = {
 
 var authListeners = {};
 
+// the last text copied to the clipboard is stored here in order to be cleared after 60 seconds
+let lastCopiedText = null;
+
 chrome.browserAction.setBadgeBackgroundColor({
     color: "#666"
 });
@@ -80,6 +83,16 @@ chrome.commands.onCommand.addListener(async command => {
     }
 });
 
+// handle fired alarms
+chrome.alarms.onAlarm.addListener(alarm => {
+    if (alarm.name === "clearClipboard") {
+        if (readFromClipboard() === lastCopiedText) {
+            copyToClipboard("", false);
+        }
+        lastCopiedText = null;
+    }
+});
+
 chrome.runtime.onInstalled.addListener(onExtensionInstalled);
 
 //----------------------------------- Function definitions ----------------------------------//
@@ -127,14 +140,15 @@ async function updateMatchingPasswordsCount(tabId) {
 }
 
 /**
- * Copy text to clipboard
+ * Copy text to clipboard and optionally clear it from the clipboard after one minute
  *
- * @since 3.0.0
+ * @since 3.2.0
  *
  * @param string text Text to copy
+ * @param boolean clear Whether to clear the clipboard after one minute
  * @return void
  */
-function copyToClipboard(text) {
+function copyToClipboard(text, clear = true) {
     document.addEventListener(
         "copy",
         function(e) {
@@ -144,6 +158,31 @@ function copyToClipboard(text) {
         { once: true }
     );
     document.execCommand("copy");
+
+    if (clear) {
+        lastCopiedText = text;
+        chrome.alarms.create("clearClipboard", { delayInMinutes: 1 });
+    }
+}
+
+/**
+ * Read plain text from clipboard
+ *
+ * @since 3.2.0
+ *
+ * @return string The current plaintext content of the clipboard
+ */
+function readFromClipboard() {
+    const ta = document.createElement("textarea");
+    // these lines are carefully crafted to make paste work in both Chrome and Firefox
+    ta.contentEditable = true;
+    ta.textContent = "";
+    document.body.appendChild(ta);
+    ta.select();
+    document.execCommand("paste");
+    const content = ta.value;
+    document.body.removeChild(ta);
+    return content;
 }
 
 /**
@@ -1069,6 +1108,7 @@ function onExtensionInstalled(details) {
         }
     } else if (details.reason === "update") {
         var changelog = {
+            3002000: "New permissions added to clear copied credentials after 60 seconds.",
             3000000:
                 "New major update is out, please update the native host app to v3.\n" +
                 "Instructions here: https://github.com/browserpass/browserpass-native"

src/manifest-chromium.json

@@ -29,7 +29,9 @@
     "permissions": [
         "debugger",
         "activeTab",
+        "alarms",
         "tabs",
+        "clipboardRead",
         "clipboardWrite",
         "nativeMessaging",
         "notifications",

src/manifest-firefox.json

@@ -26,7 +26,9 @@
     },
     "permissions": [
         "activeTab",
+        "alarms",
         "tabs",
+        "clipboardRead",
         "clipboardWrite",
         "nativeMessaging",
         "notifications",