We try our best to keep ClipAndFile secure but there are some rules that you should consider following to keep your site safe.

For the existing configuration options available for security, see Configuration Options.

Basically, if an attacker gets access to the main window/global object via an XSS exploit, it's pretty much an instant "GAME OVER" unless ALL of the following are true:

1. The ClipAndFile object itself is not globally accessible.
2. The ClipAndFile.prototype object itself is not globally accessible.
3. No ClipAndFile instances are globally accessible.
4. No callback functions for dispatched ClipAndFile events are globally accessible.
5. If a variable is used to set the path to the SWF via ClipAndFile.config, that variable must not be globally accessible.
6. The DOM is not accessible (due to built-in support for data-clipboard-text and data-clipboard-target attributes).

1. Having ClipAndFile instances globally accessible (versus encapsulated in a closure). This allows an attacker to manually call a client's setText method and inject their own text.
2. As with all globally accessible functions in JavaScript, any globally accessible callback functions (hooked to events) can be overridden by an attacker. This isn't terribly dangerous but could be annoying.
3. Overriding any of the ClipAndFile or ClipAndFile.prototype properties or methods, if globally accessible.
4. Adding data-clipboard-text or data-clipboard-target attributes to every element in the DOM.

If you find any security holes that you believe can be patched, please submit a pull request or file an issue. We will be very appreciative!