Re: Clipboard API: remove dangerous formats from mandatory data types

My 2c inline below:

On 27 July 2015 at 12:03, Hallvord Reiar Michaelsen Steen <
hsteen@mozilla.com> wrote:

> On Tue, Jun 9, 2015 at 8:39 PM, Daniel Cheng <dcheng@google.com> wrote:
>
>> Currently, the Clipboard API [1] mandates support for a number of
>> formats. Unfortunately, we do not believe it is possible to safely support
>> writing a number of formats to the clipboard:
>> - image/png
>> - image/jpg, image/jpeg
>> - image/gif
>>
>
> Hi Daniel,
> I've been pondering this a bit and I think a first step is to split the
> list of "mandatory data types" into two: one list for types you must
> support reading from the clipboard, and one (smaller) for types you must
> support writing to the clipboard. So PNG, JPG et al go in the "support
> reading from clipboard" list, and the "support writing" starts out with
> text/plain, text/html and text/uri-list - although it would be nice if CSV
> was also considered safe enough.
>

Do we want to make the distinction between the formats the UA must allow
content to pass-through directly to/from the local clipboard, versus the
ones that it must support setting/getting, but may transcode from/to some
preferred format for? e.g. a UA might support content setting BMP, JPEG,
GIF, etc but only actually place an HBITMAP on the Windows clipboard, and
rely on the OS and/or peer applications to do any necessary conversions
from that?


> It would also be good if we could come up with an API for safely writing
> images to the clipboard. Just playing:
> event.clipboardData.addImageFromCanvas(canvasElm, 'image/png')
>

This seems like a good idea to me, though we then get into the fun game of
what the mandatory formats for this API are, too. :D  And what about a
getImageToCanvas() API?

Hot or not?
>
> -Hallvord R.
>
>