Re: [w3ctag/design-reviews] Pickling for Async Clipboard API (#636)

Just a small update. We addressed few security concerns raised by internal security reviews as described below:
1. Changed `direct` keyword to `unsanitized` to be more explicit about the content being read/written.
2. Added [transient](https://html.spec.whatwg.org/multipage/interaction.html#transient-activation) user activation for reading and writing into the clipboard.
3. Format names are also [mangled ](https://github.com/w3c/editing/blob/gh-pages/docs/clipboard-pickling/explainer.md#os-interaction-format-naming) while writing into the clipboard so it's clear to the consumer of those formats that the content is unsanitized and written from the browser. e.g. format names are prefixed with "Web" on Windows

The explainer has been updated and moved to editing working group repo: https://github.com/w3c/editing/blob/gh-pages/docs/clipboard-pickling/explainer.md#pickling-for-async-clipboard-api

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/636#issuecomment-869792053