Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Hallvord, The risks is latent but it should be possible for a user to accept that a given site produces a given type. I do not think it is thinkable to avoid platform-dependent code when going to a platform specific OS. Everyone knows platform specific code is harder to maintain and should be

Re: risks of custom clipboard types

2011-05-17 Thread Ryosuke Niwa
On Tue, May 17, 2011 at 12:11 AM, Paul Libbrecht p...@activemath.orgwrote: Ryosuke, why would sensitive information be readable or writable? Because it has been available through clipboard. e.g. a popular productivity application puts a local file path in link elements whenever you copy

Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Le 17 mai 2011 à 09:21, Ryosuke Niwa a écrit : On Tue, May 17, 2011 at 12:11 AM, Paul Libbrecht p...@activemath.org wrote: Ryosuke, why would sensitive information be readable or writable? Because it has been available through clipboard. e.g. a popular productivity application puts a

Re: risks of custom clipboard types

2011-05-17 Thread Ryosuke Niwa
On Tue, May 17, 2011 at 12:26 AM, Paul Libbrecht p...@activemath.orgwrote: I agree it's a risk but since it's only when the user pastes intentionally, I don't think it is a risk to be excluded. I don't think it's okay. I didn't even save the file and file path was invisible to a user. As a

Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Le 17 mai 2011 à 18:20, Ryosuke Niwa a écrit : On Tue, May 17, 2011 at 12:26 AM, Paul Libbrecht p...@activemath.org wrote: I agree it's a risk but since it's only when the user pastes intentionally, I don't think it is a risk to be excluded. I don't think it's okay. I didn't even save

Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Le 17 mai 2011 à 18:39, Boris Zbarsky a écrit : On my mac, as far as I know, this can only happen if I copied the the file explicitly (as a file, not as a content). Pasting in some web-page means I want to transmit the information of the clipboard to the page. You want to transmit the file

Re: risks of custom clipboard types

2011-05-17 Thread Boris Zbarsky
On 5/17/11 12:50 PM, Paul Libbrecht wrote: So you (Mozilla) would not accept to include URL-list as acceptable flavor to be read from the clipboard at paste time if that URL-list contains file URLs. Correct? I believe this is correct, yes. -Boris

Re: risks of custom clipboard types

2011-05-17 Thread Daniel Cheng
On Tue, May 17, 2011 at 09:27, Paul Libbrecht p...@activemath.org wrote: On my mac, as far as I know, this can only happen if I copied the the file explicitly (as a file, not as a content). Pasting in some web-page means I want to transmit the information of the clipboard to the page. paul

Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Le 17 mai 2011 à 19:14, Daniel Cheng a écrit : I actually did implement reading arbitrary types from the clipboard/drop at one point on Linux just to see how it'd work. When I copied a file in Nautilus, the full path to the file was available in several different flavors from the

Re: risks of custom clipboard types

2011-05-17 Thread Daniel Cheng
On Tue, May 17, 2011 at 10:18, Paul Libbrecht p...@hoplahup.net wrote: Le 17 mai 2011 à 19:14, Daniel Cheng a écrit : I actually did implement reading arbitrary types from the clipboard/drop at one point on Linux just to see how it'd work. When I copied a file in Nautilus, the full path to

Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Le 17 mai 2011 à 19:31, Daniel Cheng a écrit : On Tue, May 17, 2011 at 10:18, Paul Libbrecht p...@hoplahup.net wrote: Le 17 mai 2011 à 19:14, Daniel Cheng a écrit : I actually did implement reading arbitrary types from the clipboard/drop at one point on Linux just to see how it'd work.

Re: risks of custom clipboard types

2011-05-17 Thread Ryosuke Niwa
Ryosuke Niwa Software Engineer Google Inc. On Tue, May 17, 2011 at 10:48 AM, Paul Libbrecht p...@hoplahup.net wrote: This was certainly at least copied in plain-text as well, or? The risk is here today then already, correct? (even with traditional forms and a quick onchange that makes it

Re: risks of custom clipboard types

2011-05-17 Thread Paul Libbrecht
Le 17 mai 2011 à 20:05, Ryosuke Niwa a écrit : So file-flavour is something special that should be always filtered?? (in DnD or in CnP), which should be warned against in the spec? Ryosuke, can you confirm this is the only risk you were talking about? No. There are some applications