Re: [w3c/clipboard-apis] Standardize Clipboard Source url, aka the URL from which the content has been copied from (Issue #244)

johanneswilm left a comment (w3c/clipboard-apis#244)

TPAC 2025:
> Rohan
The proposal is to have a new MIME type whenever a site copies data to the clipboard
This origin information will help antivirus software
If the application is not trusted, if the app is not trusted, then it can help try and block malicious data that would have been transferred.
Antivirus software rely on these MIME types 
The proposal is to standardize this URL to make it easier for this software to work.
Rakesh
What was the question?
I wanted to add a couple of thoughts
Standardizing this is also proposed by Firefox: 
https://bugzilla.mozilla.org/show_bug.cgi?id=1965323
Antivirus and antimalware software are using these
Chromium is writing to a different MIME type
I’m not sure if Safari is writing it or not
The motivation is to standardize this that way we are doing
This in general should help these applications
ClickFix attacks blog: https://textslashplain.com/2025/04/15/vibe-coding-for-security/
Johannes
The negative of this is that browsers would change this and then the antivirus software wouldn’t know about the new work
Smaug
This seems like we added this to firefox many years ago and not touched since.
Johannes
Is this a particular pain that there are different ones.
Rohan
Yes we were contacted by these software developers
Smaug
We need to standardize what this actually means, source origin
Where is that said and what the value actually is.
Johannes
Where should this land? What is actually proposed here.
Rohan
Probably in the editing spec somewhere
Smaug
In Firefox this is about the exec command would we need to support that case as well?
Johannes
So something in the exec command document and something in the async.
Does this have to go several places?
Smaug
Can it just be in once place?
This can be talking about a generic place to 
Rohan
Even if you copy from the address bar, not just the content.
If you right click or control-c
Smaug
I think defining this is the clipboard spec, maybe that’s enough.
Rakesh
I think maybe we are ok with that.
Johannes
So general support from Firefox.
We don’t know what Safari is doing.
So we need a little bit more research on that, but not direct opposition so far.
And then we take this up on the next call
Rohan
And then we will come up with a new spec PR.
Xq
We need to nominate a new editor.
Johannes
Reads the current editors of the specs.
I got a message that Dan will be an editor for Edit Context, but also Requish.
Action: Rohan to submit a PR and update the editor’s list, add new editors and move names to former editor list


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/clipboard-apis/issues/244#issuecomment-3642429603
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/clipboard-apis/issues/244/3642429603@github.com>