Re: safeguarding a live getData() against looping scripts? (was: Re: clipboard events)

On Thu, 19 May 2011 03:12:41 +0900, Daniel Cheng <dcheng@chromium.org>  
wrote:

[Added back a bit more context since I add Ian to CC]
>>>> Also, I'm not sure if we should process any HTML data on the clipboard
>>>> (including possibly adding images and embedded content to
>>>> clipboardData.items) before firing the paste event, or do so only if  
>>>> the
>>>> script calls getData('text/html') within the paste event thread.

>>> Ideally we shouldn't manipulate any data until it's been requested by  
>>> the
>>> page, since reading data off the clipboard is a potentially slow  
>>> operation.

>> What do you think about the current spec text? I've moved the section
>> http://dev.w3.org/2006/webapi/clipops/clipops.html#processing-model-for-pasting-html-datato  
>> where we prepare the paste event, because integrating this into the  
>> HTML5
>> DataTransfer stuff becomes much easier this way. (Previously I spec'ed  
>> it so
>> that this work would happen on a script calling getData('text/html') but
>> that would require some hacking around with the getData() definition in
>> HTML5.) This means we read and process the HTML part from the clipboard
>> before firing paste, but any binary/embedded data will only be read "on
>> demand".

> Shouldn't we have similar concerns about the text/html content of a drop?

Not 100% sure what you mean by "concerns" - do you mean for example if I  
drag a selection that embeds local images from my local word processing  
application to an online editor? I don't know how/if DnD handles this use  
case. CCing Ian.

-- 
Hallvord R. M. Steen, Core Tester, Opera Software
http://www.opera.com http://my.opera.com/hallvors/

Received on Wednesday, 18 May 2011 23:55:05 UTC