Web Custom formats for Async Clipboard API

[svoisen]

Request for position on an emerging web specification

Information about the spec

• Spec Title: Web Custom formats for Async Clipboard API
• Spec URL: Add Web Custom format w3c/clipboard-apis#175
• GitHub repository: https://github.com/w3c/editing
• Explainer: https://github.com/w3c/editing/blob/gh-pages/docs/clipboard-pickling/explainer.md

Design reviews and vendor positions

• TAG Design Review:
• Mozilla standards-positions issue: Pickling for Async Clipboard API  mozilla/standards-positions#525

Bugs tracking this feature

• WebKit Bugzilla:
• Radar:

Anything else we need to know

Previous request for position in webkit-dev: https://lists.webkit.org/pipermail/webkit-dev/2021-May/031855.html

Web custom formats for Async Clipboard API aims to web applications read and write custom, unsanitized, web-originated payloads from the clipboard using a standardized web custom format. Support for this is important for allowing native applications to exchange data with web applications outside the standardized formats.

I'm filing this request because Adobe is interested in this API for supporting copy/paste interop between our web and native applications using our own formats.

[tomayac]

Thanks for filing this, @svoisen! Apple folks: developer-facing documentation for this feature can be found on Chrome Developers.

[annevk]

I discussed this with colleagues and we have concerns about clipboard data that has not been sanitized by WebKit (which will be true for all custom formats) moving between different origins or origins and apps. We could see making an exception for the latter when the app has claimed the origin through associated domains and could therefore be considered "same origin" from the end user's perspective.

From discussion in the Editing WG it's unclear if such a limitation is workable as it could prevent competition between applications so we're a bit unsure about this feature.

#144 is related here.

[benjamind]

Would it be possible to consider this API through the lens of an installed PWA? If the user has trusted the app for install, could it then get access to custom formats and delayed clipboard rendering? That would limit the potential for abuse in that the user trusted the app, while still keeping competition open?

[annevk]

I don't think "installation" conveys trust. It's essentially a bookmark, an easy way to get back to something. I might install a game, but that doesn't mean I trust the developer. I just like the game and would like to play it somewhat regularly.