Re: [w3c/clipboard-apis] Make async clipboard APIs (read/write) to sanitize interoperably with setData/getData for text/html (#150)

> […] Local file path that you referred to in your earlier response is a temporary folder exposed by Office native apps to support image pasting

After some quick testing, this is a snippet of the raw markup saved to NSPasteboard after copying from Microsoft Word for Mac (version 16.53):

```
<html xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:w="urn:schemas-microsoft-com:office:word"
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 15">
<meta name=Originator content="Microsoft Word 15">
<link rel=File-List
href="file:////Users/whsieh/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_filelist.xml">
<link rel=Edit-Time-Data
href="file:////Users/whsieh/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_editdata.mso">
<!--[if !mso]>
```

First, it looks like this (at a minimum) leaks the name of the user's home directory.
Secondly, it looks like the name of this temporary folder (`UBF8T346G9` in my case) persists, even after closing and relaunching Word and copying text again.

The combination of these two pieces of information alone seems like it might uniquely identify a user.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/clipboard-apis/issues/150#issuecomment-973325665

Received on Thursday, 18 November 2021 22:30:32 UTC