Re: risks of custom clipboard types

Hallvord, 
The risks is latent but it should be possible for a user to accept that a given site produces a given type. I do not think it is thinkable to avoid platform-dependent code when going to a platform specific OS. 

Everyone knows platform specific code is harder to maintain and should be avoided as much as possible, nonetheless, lots of it happens. I feel there is no chance, before everyone agrees on a mapping between clipboard flavors and media-types, that platform specific code in scripts for a rich copy and paste can be done.

I don't fear for Linux clipboards, they are almost web-like so they have a much better chance than any other OS.

Ryosuke,
why would sensitive information be readable or writable?

paul


Le 17 mai 2011 à 06:34, Hallvord R. M. Steen a écrit :

>> Some types will be predefined but the door should stay opened for others.
> 
> I think what you are asking implies that the UA should "get out of the way" and just pass the arbitrary string the script gives it to the OS.
> 
> Then you risk that script authors need to
> a) start writing platform-detection and OS-specific code
> b) be forced to handle cases like a Windows OS whose list of possible clipboard types is full
> 
> I think in particular a) is a very bad consequence. Browser sniffing is an awful failure, holding the web back, preventing compatibility and competition. We should certainly avoid specifying something that will be even worse if we can. (I see scripts detecting Windows and Macs only and not fall back to anything but broken clipboard support for other platforms if we go down this route).


Le 17 mai 2011 à 07:57, Ryosuke Niwa a écrit :

> I'm also concerned that website may access sensitive information such as local file path and user name via clipboard if we allow arbitrary format.

Received on Tuesday, 17 May 2011 07:12:33 UTC