REVIEWS CLIPBOARD MASTER HOW TO
REVIEWS CLIPBOARD MASTER TRIAL

Raw clipboard access opens up a similar surface as Downloads, where data may touch legacy native surfaces without sanitization. That said, pickling is probably worth pursuing in parallel to address separate use cases, but we currently find it to be lower priority, and the raw clipboard access API design shouldn’t preclude pickling. Pickling unfortunately does not meet these compatibility requirements with legacy native applications ( explainer section). Re: security concerns and native exploits ( seen significant user and developer demand on the web for interoperability with native applications’ clipboards, and would like to provide a safe mechanism to do so. I’ll also place some responses in the tagged issues. That said, there are several use cases ( remote desktop applications and custom context menus) that would break with a user activation requirement, so we think it would be overly restrictive to require this. The Chrome team has been actively investigating mentioned mitigations, including an expiring/ephemeral permission and user activation requirements, and has implemented and helped specify the document focus requirement. Re: privacy concerns via user activation ( we have discussed user activation requirements, and recognize that user activation could lock down that abuse case. W3c/clipboard-apis#78 Explicitly require current focused document check in algorithmĬonsidering that the raw clipboard access adds additional power to the clipboard API, and that these privacy and security issues remain unresolved in the clipboard API itself, it seems even more important that those issues are resolved and that the types of data leakage that I've outline above are locked down. W3c/clipboard-apis#51 Clipboard Permission W3c/clipboard-apis#52 User gesture requirement for Clipboard API access The feedback from that review was registered in clipboard API in a few issues there that are still open: I think we raised this and similar issues in our review of Async Clipboard (see comment from #222 (comment)).

This text in the pasteboard (the URL) is now available to the web application running in this tab - the application harvests this data and adds it to the user profile and proceeds to spin ads to the user based on the contents of that URL.

Later, the user returns to a tab where clipboard access permission had already been granted (user activation).

User copies some text (say a URL) in order to paste it into another application.

One concern we see is the following (ab)use case: Major concerns here with the privacy and security aspects of this and possibly with async clipboard API #222 as well. We are discussing in a TAG breakout with and me today.

REVIEWS CLIPBOARD MASTER HOW TO

¹ For background, see our explanation of how to write a good explainer. Google document), please make sure anyone with the link can access the document. In particular, if anything links to a URL which requires authentication (e.g. Please preview the issue and check that the links work before submitting.

leave review feedback as a comment in this issue and.

open a single issue in our GitHub repo for the entire review.

open issues in our GitHub repo for each point of feedback.

We'd prefer the TAG provide feedback as (please select one): The previous TAG review for the Async Clipboard API, which this is built on is here. Links to major unresolved issues or opposition with this specification:.

Links to major pieces of multi-stakeholder review or discussion of this specification:.On top of the usual information expected in the explainer, it is strongly recommended to add: We recommend the explainer to be in Markdown.

The group where the work on this specification is: Editing TF.

I have reviewed the TAG's API Design Principles.

I have read and filled out the Self-Review Questionnare on Security and Privacy.

REVIEWS CLIPBOARD MASTER TRIAL

We also plan to Origin Trial M79 Oct 17, 2019.

Relevant time constraints or deadlines: We'd like to discuss this at TPAC (Sept 16, 2019), so getting TAG review in early Sept before TPAC would be great, so that we can iterate before TPAC.Primary contacts (and their relationship to the specification): details:.GitHub issues (if you prefer feedback filed there):.Explainer (containing user needs and example code)¹:.Specification URL: (Note that this API's contents are not yet in this spec, but this spec is where it will end up).

Reviews clipboard master