Bugzilla

GDocs is using `document.execCommand('paste')`  when using "Paste" and "Paste special" from the top/context menu.

I've created a [codepen testcase](https://codepen.io/ksy36/pen/MWxJQwv) that illustrates the behaviour (pasting with `execCommand` doesn't work in Firefox and works in Chrome only if I install the google docs offline extension)

The extension code is mostly not being used at all for this functionality, however it looks like `content_capabilities` from manifest.json is what makes `document.execCommand('paste')` work in Chrome:

```json
  "content_capabilities": {
    "matches": [
      "https://docs.google.com/*",
      "https://drive.google.com/*",
      "https://drive-autopush.corp.google.com/*",
      "https://drive-daily-0.corp.google.com/*",
      "https://drive-daily-1.corp.google.com/*",
      "https://drive-daily-2.corp.google.com/*",
      "https://drive-daily-3.corp.google.com/*",
      "https://drive-daily-4.corp.google.com/*",
      "https://drive-daily-5.corp.google.com/*",
      "https://drive-daily-6.corp.google.com/*",
      "https://drive-preprod.corp.google.com/*",
      "https://drive-staging.corp.google.com/*",
    ],
    "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ]
  },
```
I've attached a simple manifest.json containing `content_capabilities`. It makes the pasting testcase work in Chrome, but only works in non-stable channels, i.e. Chrome Canary as this property is [whitelisted only to 6 verified extensions](https://source.chromium.org/chromium/chromium/src/+/main:extensions/common/api/_manifest_features.json;l=94;drc=97603850ad2a25641316e970e23c691860b83420) in stable channels.

GDocs is using `document.execCommand('paste')`  when using "Paste" and "Paste special" from the top/context menu.

I've created a [codepen testcase](https://codepen.io/ksy36/pen/MWxJQwv) that illustrates the behaviour (pasting with `execCommand` doesn't work in Firefox and works in Chrome only if I install the modified google docs offline extension - more on that below)

The extension code is mostly not being used at all for this functionality, however it looks like `content_capabilities` from manifest.json is what makes `document.execCommand('paste')` work in Chrome:

```json
  "content_capabilities": {
    "matches": [
      "https://docs.google.com/*",
      "https://drive.google.com/*",
      "https://drive-autopush.corp.google.com/*",
      "https://drive-daily-0.corp.google.com/*",
      "https://drive-daily-1.corp.google.com/*",
      "https://drive-daily-2.corp.google.com/*",
      "https://drive-daily-3.corp.google.com/*",
      "https://drive-daily-4.corp.google.com/*",
      "https://drive-daily-5.corp.google.com/*",
      "https://drive-daily-6.corp.google.com/*",
      "https://drive-preprod.corp.google.com/*",
      "https://drive-staging.corp.google.com/*",
    ],
    "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ]
  },
```
I've attached a simple manifest.json containing `content_capabilities`. It makes the pasting testcase work in Chrome, but only works in non-stable channels, i.e. Chrome Canary as this property is [whitelisted only to 6 verified extensions](https://source.chromium.org/chromium/chromium/src/+/main:extensions/common/api/_manifest_features.json;l=94;drc=97603850ad2a25641316e970e23c691860b83420) in stable channels.

GDocs is using `document.execCommand('paste')`  when using "Paste" and "Paste special" from the top/context menu.

I've created a [codepen testcase](https://codepen.io/ksy36/pen/MWxJQwv) that illustrates the behaviour (pasting with `execCommand` doesn't work in Firefox and works in Chrome only if I install the modified google docs offline extension - more on that below)

The extension code is mostly not being used at all for this functionality, however it looks like `content_capabilities` from manifest.json is what makes `document.execCommand('paste')` work in Chrome:

```json
  "content_capabilities": {
    "matches": [
      "https://docs.google.com/*",
      "https://drive.google.com/*",
      "https://drive-autopush.corp.google.com/*",
      "https://drive-daily-0.corp.google.com/*",
      "https://drive-daily-1.corp.google.com/*",
      "https://drive-daily-2.corp.google.com/*",
      "https://drive-daily-3.corp.google.com/*",
      "https://drive-daily-4.corp.google.com/*",
      "https://drive-daily-5.corp.google.com/*",
      "https://drive-daily-6.corp.google.com/*",
      "https://drive-preprod.corp.google.com/*",
      "https://drive-staging.corp.google.com/*",
    ],
    "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ]
  },
```
I've attached a simple manifest.json containing `content_capabilities`. It makes the pasting testcase work in Chrome, (with added "https://codepen.io/*" and "https://cdpn.io/*" to the list of matches). It only works in non-stable channels, i.e. Chrome Canary as this property is [whitelisted only to 6 verified extensions](https://source.chromium.org/chromium/chromium/src/+/main:extensions/common/api/_manifest_features.json;l=94;drc=97603850ad2a25641316e970e23c691860b83420) in stable channels.

GDocs is using `document.execCommand('paste')`  when using "Paste" and "Paste special" from the top/context menu.

I've created a [codepen testcase](https://codepen.io/ksy36/pen/MWxJQwv) that illustrates the behaviour (pasting with `execCommand` doesn't work in Firefox and works in Chrome only if I install the modified google docs offline extension - more on that below)

The extension code is mostly not being used at all for this functionality, however it looks like `content_capabilities` + `permissions` from manifest.json is what makes `document.execCommand('paste')` work in Chrome:

```json
  "content_capabilities": {
    "matches": [
      "https://docs.google.com/*",
      "https://drive.google.com/*",
      "https://drive-autopush.corp.google.com/*",
      "https://drive-daily-0.corp.google.com/*",
      "https://drive-daily-1.corp.google.com/*",
      "https://drive-daily-2.corp.google.com/*",
      "https://drive-daily-3.corp.google.com/*",
      "https://drive-daily-4.corp.google.com/*",
      "https://drive-daily-5.corp.google.com/*",
      "https://drive-daily-6.corp.google.com/*",
      "https://drive-preprod.corp.google.com/*",
      "https://drive-staging.corp.google.com/*",
    ],
    "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ]
  },
```
I've attached a simple manifest.json containing `content_capabilities`. It makes the pasting testcase work in Chrome, (with added "https://codepen.io/*" and "https://cdpn.io/*" to the list of matches). It only works in non-stable channels, i.e. Chrome Canary as this property is [whitelisted only to 6 verified extensions](https://source.chromium.org/chromium/chromium/src/+/main:extensions/common/api/_manifest_features.json;l=94;drc=97603850ad2a25641316e970e23c691860b83420) in stable channels.