Re: Clipboard API: remove dangerous formats from mandatory data types

I'm not against considering more formats to be dangerous. =)

In particular:
JS: I'm not support what context we'd ever want to support this, since we
go out of our way to try prevent XSS in HTML pastes.
XML: I wouldn't mind getting rid of this. XML parsers seem to have RCE bugs
on a semi-regular basis.

Daniel

On Tue, Jun 9, 2015 at 12:01 PM Olli Pettay <olli@pettay.fi> wrote:

> On 06/09/2015 09:39 PM, Daniel Cheng wrote:
> > Currently, the Clipboard API [1] mandates support for a number of
> formats. Unfortunately, we do not believe it is possible to safely support
> writing a
> > number of formats to the clipboard:
> > - image/png
> > - image/jpg, image/jpeg
> > - image/gif
> >
> > If these types are supported, malicious web content can trivially write
> a malformed GIF/JPG/PNG to the clipboard and trigger code execution when
> > pasting in a program with a vulnerable image decoder. This provides a
> trivial way to bypass the sandbox that web content is usually in.
> >
> > Given this, I'd like to propose that we remove the above formats from
> the list of mandatory data types, and avoid adding support for any more
> complex
> > formats.
> >
> > Daniel
> >
> > [1] http://www.w3.org/TR/clipboard-apis/#mandatory-data-types-1
>
>
> Why would text/html, application/xhtml+xml, image/svg+xml,
> application/xml, text/xml, application/javascript
> be any safer if the program which the data is pasted to has vulnerable
> html/xml/js parsing?
>
>
> -Olli
>
>