Re: [w3c/editing] Universal interface to modify content in a JS editor from unrelated JS code. (Issue #551)

GaurangTandon left a comment (w3c/editing#551)

Firstly, to update this thread: Slate is now accepting untrusted beforeinput events as before (https://github.com/ianstormtaylor/slate/pull/6198). This incident reinforces my earlier position that an in-built browser API is the only path that ensures reliable text manipulation across the entire web. Any other approach such as relying on untrusted events can break silently for our end users overnight.

> That way they could discriminate against specific, badly behaving extensions rather than doing a blanket ban on all extensions.

I would strongly push back on this. I don't see any precedent or reasoning for why the page scripts should be able to identify which browser extension used which DOM API, not just the text manipulation API.



-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/editing/issues/551#issuecomment-6123108169
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/editing/issues/551/6123108169@github.com>