1211191 - document.queryCommandSupported('cut'/'copy') also returns true for not user-initiated code

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Garrett Robinson [:grobinson]]

Attachment: test_query_command_supported_copy.html

According to the current MDN docs on document.queryCommandSupported [0], "The 'cut' and 'copy' commands returns true only from user-initiated or privileged code." I've attached a test case that allows you to test the return value for document.queryCommandSupported('copy') from both non-user-initiated and user-initiated actions.

On Firefox 41.0.1, document.queryCommandSupported('copy') returns "true" from *both* user-initiated and non-user-initiated actions. This is actually preferable from a developer's perspective, since it allows them to configure their UI (e.g. add or remove a "Copy to Clipboard" button) without requiring the user to interact with the page first. It also appears to be the intention of Bug 1162952. However, it is inconsistent with the documentation on MDN.

Additionally, it is inconsistent with the behavior of Chrome (tested: 45.0.2454.101). In Chrome, document.queryCommandSupported('copy') only returns "True" if the action is user-initiated.

[0] https://developer.mozilla.org/en-US/docs/Web/API/Document/queryCommandSupported

Comment 1

[Garrett Robinson [:grobinson]]

Adding "blocks 1162952" by request of Aryx on #developers.

Comment 2

[Hallvord R. M. Steen [:hallvors]]

Chrome is wrong. The idea and logic we're currently aiming for is this:

* queryCommandSupported() should return true since the command is implemented
* queryCommandEnabled() should return true in contexts where the command actually *is* enabled (i.e. in user-initiated threads or scripts that have special permissions in some other implementation-specific way, i.e. IE's site whitelisting).

https://code.google.com/p/chromium/issues/detail?id=476508
https://code.google.com/p/chromium/issues/detail?id=475868

I will fix MDN.

Comment 3

[Jean-Yves Perrier [:teoli]]

Hallvord: thx a lot!