启用复制并粘贴到HTML字段

Question

I come across some extremely paranoid financial websites that are too stupid to think that disabling copy and paste on their login forms somehow makes them secure. In my case, it is annoying beyond comprehension, since I almost never type in a password, and instead always copy and paste them from KeePass. Since these are long generated password, it is very inconvenient to type them in. Over the years, I cooked up the below bookmarklet that worked very well:

javascript:it = document.evaluate('//input[string-length(@onpaste)!=0]' , document, null, XPathResult.ANY_TYPE , null ); t = it.iterateNext(); while (t) {t.onpaste=undefined; t.oncopy=undefined; t.onfocus=undefined; t.onblur=undefined; t.onkeydown=undefined; t.onkeypress=undefined; t.ondrag=undefined; t.ondrop=undefined; t.onclick=undefined; t.onkeydown = undefined; t.onkeyup = undefined; t.onmousemove = undefined; t.onmouseout = undefined; t.onmouseover = undefined;  t.onchange = undefined; it = it.iterateNext(); }

Lately, I am hitting new and redesigned websites where this is no longer working. I spent some time on one such website and confirmed that the script is in deed iterating through all the relevant input fields and setting the corresponding event handlers to undefined , but for some reason it doesn't take effect. After running the bookmarklet, if I inspect the element, I can still see the events that effectively disable the paste operations.

To reproduce, please visit this website and click on "Continue Login" and try to use the above bookmarklet. You would notice that it enables copy and paste on the username field, but not on the password field. I don't know what sort of JS black magic they are using, but could someone help me figure it out?

Answer 1

After trying out the bookmarketlet on Firefox, I got a useful error message that helped me find a typo and get it working correctly. I then noticed that Chrome was also giving me an error, but it wasn't descriptive enough, so it was misleading and I didn't pay attention to it. The typo was the final statement in which the iterator is advanced, which should have been t = it.iterateNext() and instead it was written as it = it.iterateNext() . Due to this typo, the loop bails out with an error after processing the very first text field. Though I have been using this bookmarketlet for a very long time, I didn't notice the typo because I didn't encounter sites that had more than one such fields. I am now maintaining an improved version of this bookmarklet in a gist .

This bookmarklet does two things:

• Search for text and password fields with the event listener attributes that are commonly used to block pasting
• Remove all these event listener attributes
• Set a paste handler that sets the target value to what is in the clipboard. This extra step helps on some stubborn websites that take additional steps (which I don't currently comprehend) for blocking the paste.