1646270 - Add Clipboard Feature Policy

Status: NEW

(Core :: DOM: Copy & Paste and Drag & Drop, enhancement)

Description

[Marcos Caceres [:marcosc]]

Clipboard should be controlled by "clipboard-read" and "clipboard-write" feature policy.

Comment 1

[Anne (:annevk)]

I don't think we have any intention of supporting -read and it's a bit unclear how that ended up in the specification. Are there two implementations?

Comment 2

[Marcos Caceres [:marcosc]]

I think this got landed before I became chair and we started enforcing the two implementer rule in WebAppsWG:
https://github.com/w3c/clipboard-apis/commit/aa1f8ac45ffc3ff9035fa64519c5c822ab28469c

There is also more history here:
https://github.com/w3c/permissions/issues/175#issuecomment-645071745

I'm still not sure who owns the Clipboard implementation from the DOM team. I don't mind tracking the spec if no one does, but would like to have someone that can have input on the implementation side of things.

Comment 3

[Thayne]

I don't think we have any intention of supporting -read

Does that mean no intention to support clipboard read access at all, just not the current specificatioo that includes support for read access without a user gesture? I'm not sure what a legitimate use case for reading the clipboard without a gesture would be. But users of web-aps expect to be able to paste into rich documents using app menus (including custom context menus). As I understand it, currently the only way to do this is with a browser plugin, and maybe showing a dialogue to the user prompting them to install the plugin or use the browser keyboard shortcut.

Comment 4

[Darwin Huang]

Also, is there any intention to use feature policy to allow sites to restrict use of the Clipboard API in their iframes?

I'm unsure if the disagreement is with just a feature policy name of "clipboard-read"/"clipboard-write", or also with the use of feature policy overall.

Comment 5

[Anne (:annevk)]

Sorry for the slow follow-up here, I forgot to cc myself on the bug. I don't think we intent to support clipboard-write and clipboard-read could be supported with inline UI, similar to how Safari does it, at which point there does not really seem like a need for Permissions Policy to be involved.