first commit

apps/browser/clipboard-deny.cjs

@@ -0,0 +1,27 @@
+// Session frame preload: no page bridge, Node engine, filesystem API or clipboard payloads.
+if(process.sandboxed!==true||process.contextIsolated!==true){require('electron').ipcRenderer.send('managed:clipboard-sandbox-failure');window.stop();throw Error('Managed renderer isolation is required');}
+// Freeze the legacy command primitive in the page realm. Document.open() removes
+// DOM listeners, but cannot replace this non-configurable prototype property.
+try {
+  require('electron').contextBridge.executeInMainWorld({func:()=>{
+    const prototype=Document.prototype,existing=Object.getOwnPropertyDescriptor(prototype,'execCommand');
+    if(existing?.value?._managedClipboardGuard===true&&!existing.configurable)return;
+    const original=prototype.execCommand,apply=Reflect.apply,test=RegExp.prototype.test.bind(/^(copy|cut|paste)/i);
+    function managedClipboardCommand(command,...args){
+      if(typeof command!=='string'||test(command))return false;
+      return apply(original,this,[command,...args]);
+    }
+    Object.defineProperty(managedClipboardCommand,'_managedClipboardGuard',{value:true});
+    Object.defineProperty(prototype,'execCommand',{value:managedClipboardCommand,writable:false,configurable:false});
+    // Replacement clears security listeners; these unsupported legacy APIs fail closed.
+    const SecurityException=DOMException;
+    const denyReplacement=()=>{throw new SecurityException('Managed document replacement is disabled','SecurityError');};
+    for(const name of ['open','write','writeln'])Object.defineProperty(prototype,name,{value:denyReplacement,writable:false,configurable:false});
+  }});
+} catch {
+  require('electron').ipcRenderer.send('managed:clipboard-sandbox-failure');
+  window.stop();
+  throw Error('Managed clipboard primitive could not be protected');
+}
+for(const name of ['copy','cut','paste','dragstart','dragover','drop'])window.addEventListener(name,event=>{event.preventDefault();event.stopImmediatePropagation();},true);
+window.addEventListener('beforeinput',event=>{if(/^(insertFromPaste|insertFromDrop|deleteByCut)/.test(event.inputType||'')){event.preventDefault();event.stopImmediatePropagation();}},true);