14

Is it possible to tweak Safari to ensure command key combinations like ⌘H or ⌘L go to Safari as opposed to Safari's window contents?

This comes up for me most often on this site because the editor window (like where I'm typing right now) captures these keystrokes to make headings and links, but in general, it seems like a security hole to allow sites to capture command keystrokes.

Please note that I'm looking for a way to do this without disabling JavaScript altogether.

For whatever it's worth, I'm running Mountain Lion.

Improve this question
4
  • 4
    You can use NinjaKit to disable the shortcuts used on Stack Exchange sites. See apple.stackexchange.com/questions/60587 and meta.stackexchange.com/questions/2980.
    – Lri
    Commented Jul 1, 2013 at 14:09
  • 1
    That's awesome, @LauriRanta, and it helps with this specific problem, but as a general security hole, I'd love for a way to prevent malicious websites from trapping ⌘W or ⌘Q without simply disabling JavaScript.
    – Daniel ♦
    Commented Jul 1, 2013 at 17:02
  • I added the security tag. Because to know which part of an application is reading (listening to) the keyboard is a basic security feature. If any keyboard listener change was displayed by the menu bar, many attacks based on sniffers would do as coackroaches when you turn on the light.
    – athena
    Commented Jul 15, 2013 at 14:51
  • @DanielLawson Would this open source Safari extension help javascript-blocker.toggleable.com
    – Simon
    Commented Aug 27, 2013 at 20:12

1 Answer 1

Reset to default
2

The only surefire way to avoid having JavaScript trap keyboard input is to disable JavaScript in the browser.

I understand you'd like to leave JavaScript on, but it is designed to pass near total control of raw key presses to the browser and not to the app once the OS hands it input data. This means you would need a specific code solution for each implementation of keyboard filtering on potentially each individual page/site to ensure arbitrary key chords like Command H get sent to Safari instead of JavaScript.

See these links for an overview of how key presses are handled:

The last link is a tester to show you the raw events and you will see that even a brief ⌘Q can be trapped by JavaScript if the website developer wishes to do so.

Improve this answer
2
  • The keyboard driver is part of the OS, so the OS passes the keystrokes to the browser, which passes the keystrokes to web content, which apparently then gets to decide which keystrokes to pass back to the browser and/or OS…
    – Daniel ♦
    Commented Aug 26, 2013 at 20:07
  • It's probably even more complicated than that with kernel space / user space / API and framework complexities.
    – bmike ♦
    Commented Aug 27, 2013 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .