I'm not against considering more formats to be dangerous. =) In particular: JS: I'm not support what context we'd ever want to support this, since we go out of our way to try prevent XSS in HTML pastes. XML: I wouldn't mind getting rid of this. XML parsers seem to have RCE bugs on a semi-regular basis.
Daniel On Tue, Jun 9, 2015 at 12:01 PM Olli Pettay <o...@pettay.fi> wrote: > On 06/09/2015 09:39 PM, Daniel Cheng wrote: > > Currently, the Clipboard API [1] mandates support for a number of > formats. Unfortunately, we do not believe it is possible to safely support > writing a > > number of formats to the clipboard: > > - image/png > > - image/jpg, image/jpeg > > - image/gif > > > > If these types are supported, malicious web content can trivially write > a malformed GIF/JPG/PNG to the clipboard and trigger code execution when > > pasting in a program with a vulnerable image decoder. This provides a > trivial way to bypass the sandbox that web content is usually in. > > > > Given this, I'd like to propose that we remove the above formats from > the list of mandatory data types, and avoid adding support for any more > complex > > formats. > > > > Daniel > > > > [1] http://www.w3.org/TR/clipboard-apis/#mandatory-data-types-1 > > > Why would text/html, application/xhtml+xml, image/svg+xml, > application/xml, text/xml, application/javascript > be any safer if the program which the data is pasted to has vulnerable > html/xml/js parsing? > > > -Olli > >