Clipboard API and events

1. Introduction

This section is non-normative.

This specification defines how the system clipboard is exposed to web applications.

There are two general APIs described in this specification:

• Clipboard Event API - This API provides a way to hook into the common clipboard operations of cutting, copying and pasting so that web application can adjust the clipboard data as required.

• Async Clipboard API - This API provides direct access to read and write the clipboard data. Since this is considered to be a powerful feature, access to this API is controlled by a permission.

2. Use Cases

This section is non-normative.

2.1. Changing Default Clipboard Operations

There are many scenarios where it is desireable to change the default clipboard operations (cut/copy/paste). Here are a few examples:

• Metadata When copying text from a repository of documents, it can be useful for the copied text to include metadata about the source of the copied content.
• Rich content editing When copying text which contains hyperlinks or other structure, it is often useful to be able to reformat the content to preserve important information.
• Graphics with built-in semantics In order to make web applications which allow the manipulation of rich text, or of graphic content such as [SVG11], it is useful to provide a mechanism that allows for copying more than just the rendered content.
• Mathematical information With content such as mathematics, simply copying rendered text and pasting it into another application generally leads to most of the semantics being lost. MathML often needs to be transformed to be copied as plain text, for example to make sure "to the power of" is shown with the caret "^" sign in a formula plain-text input. The XML source could also be placed in the clipboard with the appropriate transformation occurring at paste time.

2.2. Remote Clipboard Synchronization

For web applications that communicate with remote devices (e.g., remote access or remote shell applications), there is often a need for the clipboard data to be kept in sync between the two devices.

One important aspect of this use case is that it requires access to the clipboard in the absense of a user gesture or interaction.

2.3. Trigger Clipboard Actions

Applications that provide an alternate interface to a user agent sometimes need to be able to trigger clipboard actions in the user agent.

As an example, consider a screen reader application that provides a more accessible interface to a standard web browser. While the reader can display content and allow the user to interact with it, actions like clipboard copy need to occur in the underlying browser to ensure that the clipboard content is set correctly (with any metadata added by the browser during copy).

3. Terminology

The term editable context means any element that is either an editing host, a textarea element, or an input element with its type attribute set to any of "text", "search", "tel", "url", "email", "password" or "number".

4. Model

The platform provides a system clipboard.

The system clipboard has a list of system clipboard items that are collectively called the system clipboard data.

Each system clipboard item has a list of system clipboard representations.

Each system clipboard representation has a name, which is a string, and data, which is a sequence of bytes.

5. Clipboard Events

5.1. Clipboard event interfaces

The ClipboardEvent interface extends the Event interface.

dictionary ClipboardEventInit : EventInit {
  DataTransfer? clipboardData = null;
};

[Exposed=Window]
interface ClipboardEvent : Event {
  constructor(DOMString type, optional ClipboardEventInit eventInitDict = {});
  readonly attribute DataTransfer? clipboardData;
};

The interface can be used to construct events. An example is given below:

var pasteEvent = new ClipboardEvent('paste');
pasteEvent.clipboardData.items.add('My string', 'text/plain');
document.dispatchEvent(pasteEvent);

Note: Synthetic clipboard events will not actually modify the clipboard or the document. In other words, while the script above will fire a paste event, the data will not be pasted into the document.

5.2. Clipboard events

5.2.1. The clipboardchange event

The clipboardchange event fires whenever the contents of the system clipboard are changed. These changes could be due to any of the following (non-exhaustive):

• User-initiated cut or copy actions

• Scripts that use the § 7 Asynchronous Clipboard API to write to the clipboard

• Actions that update the clipboard outside the user agent

If the clipboard contents are changed outside the user agent, then the clipboardchange event MUST fire when the user agent regains focus.

Since synthetic cut and copy events do not update the system clipboard, they will not trigger a "clipboardchange" event.

5.2.2. The copy event

When the user initiates a copy action, the user agent fires a clipboard event named copy.

If the event is not canceled, the currently selected data will be copied to the system clipboard. The current document selection is not affected.

The copy event bubbles, is cancelable, and is composed.

See § 8.1 The copy action for a detailed description of the processing model for this event.

A synthetic copy event can be manually constructed and dispatched, but it will not affect the contents of the system clipboard.

5.2.3. The cut event

When the user initiates a cut action, the user agent fires a clipboard event named cut.

In an editable context, if the event is not canceled the action will place the currently selected data on the system clipboard and remove the selection from the document. The cut event fires before the selected data is removed. When the cut operation is completed, the selection is collapsed.

In a non-editable context, the clipboardData will be an empty list. Note that the cut event will still be fired in this case.

The cut event bubbles, is cancelable, and is composed.

See § 8.2 The cut action for a detailed description of the processing model for this event.

A synthetic cut event can be manually constructed and dispatched, but it will not affect the contents of the document or of the system clipboard.

5.2.4. The paste event

When a user initiates a paste action, the user agent fires a clipboard event named paste. The event fires before any clipboard data is inserted into the document.

If the cursor is in an editable context, the paste action will insert clipboard data in the most suitable format (if any) supported for the given context.

The paste action has no effect in a non-editable context, but the paste event fires regardless.

The paste event bubbles, is cancelable, and is composed.

See § 8.3 The paste action for a detailed description of the processing model for this event.

A synthetic paste event can be manually constructed and dispatched, but it will not affect the contents of the document.

5.3. Integration with other scripts and events

5.3.1. Event handlers that are allowed to modify the clipboard

Event handlers may write to the clipboard if any of the following is true:

• The action which triggers the event is invoked from the user-agent’s own user interface, e.g. from a "Copy" menu entry or shortcut key.

• The action which triggers the event is invoked from a scripting thread which is allowed to show a popup.

The implementation may allow other trusted event types to modify the clipboard if the implementation authors believe that those event types are likely to express user intention. The implementation may also support configuration that trusts specific sites or apps to modify the clipboard regardless of the origin of the scripting thread.

Synthetic cut and copy events must not modify data on the system clipboard.

5.3.2. Event handlers that are allowed to read from clipboard

Event handlers may read data from the system clipboard if either of the following is true

• The action that triggers the event is invoked from the user-agent’s own user interface, e.g. a "Paste" menu entry or shortcut key.

• The script that triggers the action is running on a site which through an implementation-dependant mechanism is given permission to read data from the clipboard.

• The action that triggers the event is triggered in an app with permissions to read the clipboard.

Synthetic paste events must not give a script access to data on the real system clipboard.

5.3.3. Integration with rich text editing APIs

If an implementation supports ways to execute clipboard commands through scripting, for example by calling the document.execCommand() method with the commands "cut", "copy" and "paste", the implementation must trigger the corresponding action, which again will dispatch the associated clipboard event.

These are the steps to follow when triggering copy, cut or paste actions through a scripting API:

1. Execute the corresponding action synchronously.

2. Use the action’s return value as the return value for the API call.

Note: Copy and cut commands triggered through a scripting API will only affect the contents of the real clipboard if the event is dispatched from an event that is trusted and triggered by the user, or if the implementation is configured to allow this. Paste commands triggered through a scripting API will only fire paste events and give access to clipboard contents if the implementation is configured to allow this. How implementations can be configured to allow read or write access to the clipboard is outside the scope of this specification.

5.3.4. Interaction with other events

If the clipboard operation is triggered by keyboard input, the implementation must fire the corresponding event that initiates the clipboard operation. The event is asynchronous but must be dispatched before keyup events for the relevant keys.

The cut and paste actions may cause the implementation to dispatch other supported events, such as textInput, input, change, validation events, DOMCharacterDataModified and DOMNodeRemoved / DOMNodeInserted. Any such events are queued up to fire after processing of the cut/paste event is finished.

The implementation must not dispatch other input-related events like textInput, input, change, and validation events in response to the copy operation.

5.3.5. Event listeners that modify selection or focus

If the event listener modifies the selection or focusable area, the clipboard action must be completed on the modified selection.

6. Clipboard Event API

The Clipboard Event API allows you to override the default cut, copy and paste behavior of the user agent.

Access to the clipboard is performed using the standard DataTransfer methods to mutate the items on a ClipboardEvent's clipboardData attribute. One consequence of this is that these clipboard APIs can only access clipboard data in the context of a ClipboardEvent handler.

Note: If you need to access the clipboard outside of a clipboard event handler, see § 7 Asynchronous Clipboard API.

Note: The Clipboard Event APIs are synchronous, so they are limited in what they can do. Actions which are potentially blocking (like asking for permission or transcoding a image) are not supported by these APIs. See § 7 Asynchronous Clipboard API for a more powerful API that can support blocking or other time-consuming actions.

6.1. Overriding the copy event

To override the default copy event behavior, a copy event handler must be added and this event handler must call preventDefault() to cancel the event.

Canceling the event is required in order for the system clipboard to be updated with the data in clipboardData. If the ClipboardEvent is not canceled, then the data from the current document selection will be copied instead.

// Overwrite what is being copied to the clipboard.
document.addEventListener('copy', function(e) {
  // e.clipboardData is initially empty, but we can set it to the
  // data that we want copied onto the clipboard.
  e.clipboardData.setData('text/plain', 'Hello, world!');
  e.clipboardData.setData('text/html', '<b>Hello, world!</b>');

  // This is necessary to prevent the current document selection from
  // being written to the clipboard.
  e.preventDefault();
});

6.2. Overriding the cut event

To override the default cut event behavior, a cut event handler must be added and this event handler must call preventDefault() to cancel the event.

Canceling the event is required in order for the system clipboard to be updated with the data in clipboardData. If the ClipboardEvent is not canceled, then the data from the current document selection will be copied instead.

Note that canceling the cut event will also prevent the document from being updated (i.e., the current selection will not be removed). The event handler will need to manually update the document to remove the currently selected text.

// Overwrite what is copied to the clipboard.
document.addEventListener('cut', function(e) {
  // e.clipboardData is initially empty, but we can set it to the
  // data that we want copied onto the clipboard as part of the cut.
  // Write the data that we want copied onto the clipboard.
  e.clipboardData.setData('text/plain', 'Hello, world!');
  e.clipboardData.setData('text/html', '<b>Hello, world!</b>');

  // Since we will be canceling the cut operation, we need to manually
  // update the document to remove the currently selected text.
  deleteCurrentDocumentSelection();

  // This is necessary to prevent the document selection from being
  // written to the clipboard.
  e.preventDefault();
});

6.3. Overriding the paste event

To override the default paste event behavior, a paste event handler must be added and this event handler must call preventDefault() to cancel the event.

Canceling the event is required so that the user agent does not update the document with data from the system clipboard.

Note that canceling the paste event will also prevent the document from being updated (i.e., nothing will be pasted into the document). The event handler will need to manually paste the data into the document.

Also note that, when pasting, the drag data store mode flag is read-only, hence calling setData() from a paste event handler will not modify the data that is inserted, and not modify the data on the clipboard.

// Overwrite what is being pasted onto the clipboard.
document.addEventListener('paste', function(e) {
  // e.clipboardData contains the data that is about to be pasted.
  if (e.clipboardData.types.indexOf('text/html') > -1) {
    var oldData = e.clipboardData.getData('text/html');
    var newData = '<b>Ha Ha!</b> ' + oldData;

    // Since we are canceling the paste operation, we need to manually
    // paste the data into the document.
    pasteClipboardData(newData);

    // This is necessary to prevent the default paste action.
    e.preventDefault();
  }
});

6.4. Mandatory data types

The implementation must recognize the native OS clipboard format description for the following data types, to be able to populate the DataTransferItemList and ClipboardItem with the correct description for paste events, and set the correct data format on the OS clipboard in response to copy and cut events.

6.4.1. Reading from the clipboard

These data types must be exposed by paste events if a corresponding native type exists on the clipboard:

• text/plain

• text/html

• image/png

6.4.2. Writing to the clipboard

These data types must be placed on the clipboard with a corresponding native type description if added to a DataTransfer object during copy and cut events.

• text/plain

• text/html

• image/png

Warning! The data types that untrusted scripts are allowed to write to the clipboard are limited as a security precaution. Untrusted scripts can attempt to exploit security vulnerabilities in local software by placing data known to trigger those vulnerabilities on the clipboard.

6.5. Optional data types

The implementation MAY recognize the native OS clipboard format description for the following data types, to be able to populate the ClipboardItem with the correct description for paste events, and set the correct data format on the OS clipboard in response to copy and cut events.

These data types MAY be exposed by UAs if a corresponding native type exists on the clipboard:

• text/uri-list

• image/svg+xml

• Custom format starts with `"web "`("web" followed by U+0020 SPACE) prefix and suffix (after stripping out `"web "`) passes the parsing a MIME type check.

6.6. Unsanitized data types

These data types MUST NOT be sanitized by UAs:

• image/png

These data types MAY NOT be sanitized by UAs:

• optional unsanitized data types

Optional unsanitized data types are mime types specified by the web authors that MAY NOT be sanitized by the user agent. The valid optional unsanitized data types are listed below:

• text/html

optional unsanitized data types may not be supported by a user agent due to their privacy requirements.

7. Asynchronous Clipboard API

7.1. Navigator Interface

partial interface Navigator {
  [SecureContext, SameObject] readonly attribute Clipboard clipboard;
};

7.2. ClipboardItem Interface

typedef Promise<(DOMString or Blob)> ClipboardItemData;

[SecureContext, Exposed=Window]
interface ClipboardItem {
  constructor(record<DOMString, ClipboardItemData> items,
              optional ClipboardItemOptions options = {});

  readonly attribute PresentationStyle presentationStyle;
  readonly attribute FrozenArray<DOMString> types;

  Promise<Blob> getType(DOMString type);

  static boolean supports(DOMString type);
};

enum PresentationStyle { "unspecified", "inline", "attachment" };

dictionary ClipboardItemOptions {
  PresentationStyle presentationStyle = "unspecified";
};

clipboardItem = new ClipboardItem([items, options])

Creates a new ClipboardItem object. items denote list of representations, each representation has a mime type and a Promise to Blob or DOMString corresponding to the mime type, options can be used to fill its ClipboardItemOptions, as per the example below.

const format1 = 'text/plain';
const promise_text_blob = Promise.resolve(new Blob(['hello'], {type: format1}));
const clipboardItemInput = new ClipboardItem(
  {[format1]: promise_text_blob},
  {presentationStyle: "unspecified"});

clipboardItem.getType(type)

Returns a Promise to the Blob corresponding to the mime type type.

clipboardItem.types

Returns the list of mime types contained in the clipboard item object.

ClipboardItem.supports(type)

Returns true if type is in mandatory data types or optional data types, else, returns false.

A clipboard item is conceptually data that the user has expressed a desire to make shareable by invoking a "cut" or "copy" command. A clipboard item serves two purposes. First, it allows a website to read data copied by a user to the system clipboard. Second, it allows a website to write data to the system clipboard.

For example, if a user copies a range of cells from a spreadsheet of a native application, it will result in one clipboard item. If a user copies a set of files from their desktop, that list of files will be represented by multiple clipboard items.

Some platforms may support having more than one clipboard item at a time on the clipboard, while other platforms replace the previous clipboard item with the new one.

A clipboard item has a list of representations, each representation with an associated mime type (a MIME type), an isCustom flag, initially false, that indicates if this representation should be treated as a web custom format (as opposed to a well-known format of the system clipboard), and data (a ClipboardItemData).

A web custom format has isCustom set to true.

In the example where the user copies a range of cells from a spreadsheet, it may be represented as an image (image/png), an HTML table (text/html), or plain text (text/plain), or a web custom format (web text/csv).

Each of these MIME types describe a different representation of the same clipboard item at different levels of fidelity and make the clipboard item more consumable by target applications during paste.

Making the range of cells available as an image will allow the user to paste the cells into a photo editing app, while the text/plain format can be used by text editor apps.

A clipboard item has a presentation style (a PresentationStyle). It helps distinguish whether apps "pasting" a clipboard item should insert the contents of an appropriate representation inline at the point of paste or if it should be treated as an attachment.

Web apps that support pasting only a single clipboard item should use the first clipboard item.

write() chooses the last clipboard item.

Web apps that support pasting more than one clipboard item could, for example, provide a user interface that previews the contents of each clipboard item and allow the user to choose which one to paste. Further, apps are expected to enumerate the MIME types of the clipboard item they are pasting and select the one best-suited for the app according to some app-specific algorithm. Alternatively, an app can present the user with options on how to paste a clipboard item, e.g. "paste as image" or "paste formatted text", etc.

A ClipboardItem object has an associated clipboard item, which is a clipboard item.

A ClipboardItem object has an associated types array, which is a FrozenArray<DOMString>.

To create a ClipboardItem object, given a clipboard item clipboardItem and a Realm realm, run these steps:

1. Let clipboardItemObject be a new ClipboardItem with realm.

2. Set clipboardItemObject’s clipboard item to clipboardItem.

The new ClipboardItem(items, options) constructor steps are:

1. If items is empty, then throw a TypeError.

2. If options is empty, then set options["presentationStyle"] = "unspecified".

3. Set this's clipboard item to a new clipboard item.

4. Set this's clipboard item's presentation style to options["presentationStyle"].

5. Let types be a list of DOMString.

6. For each (key, value) in items:

   1. Let representation be a new representation.

   2. Let isCustom be false.

   3. If key starts with `"web "` prefix, then

      1. Remove `"web "` prefix and assign the remaining string to key.

      2. Set isCustom true

   4. Set representation’s isCustom flag to isCustom.

   5. Let mimeType be the result of parsing a MIME type given key.

   6. If mimeType is failure, then throw a TypeError.

   7. If this's clipboard item's list of representations contains a representation whose MIME type is mimeType and whose [representation/isCustom] is isCustom, then throw a TypeError.

   The step above prevents collision between mime-types well-known by the user agent and those that are intended by the author to be treated as a custom type. For example, it would be possible for the author’s list of items to contain representations for "text/html" as well as "web text/html".

   1. Set representation’s MIME type to mimeType.

   2. Set representation’s data to value.

   3. Append representation to this's clipboard item's list of representations.

   4. Let mimeTypeString be the result of serializing a MIME type with mimeType.

   5. If isCustom is true, prefix mimeTypeString with `"web "`.

   6. Add mimeTypeString to types.

7. Set this's types array to the result of running create a frozen array from types.

7.2.1. presentationStyle

The presentationStyle getter steps are to return this's clipboard item's presentation style.

7.2.2. types

The types getter steps are to return this's types array.

7.2.3. getType(type)

This method must run the below steps:

1. Let realm be this's relevant realm.

2. Let isCustom be false.

3. If type starts with `"web "` prefix, then:

   1. Remove `"web "` prefix and assign the remaining string to type.

   2. Set isCustom to true.

4. Let mimeType be the result of parsing a MIME type given type.

5. If mimeType is failure, then throw a TypeError.

6. Let itemTypeList be this's clipboard item's list of representations.

7. Let p be a new promise in realm.

8. For each representation in itemTypeList:

   1. If representation’s MIME type is mimeType and representation’s isCustom is isCustom, then:

      1. Let representationDataPromise be the representation’s data.

      2. React to representationDataPromise:

         1. If representationDataPromise was fulfilled with value v, then:

            1. If v is a DOMString, then follow the below steps:

               1. Let dataAsBytes be the result of UTF-8 encoding v.

               2. Let blobData be a Blob created using dataAsBytes with its type set to mimeType, serialized.

               3. Resolve p with blobData.

            2. If v is a Blob, then follow the below steps:

               1. Resolve p with v.

         2. If representationDataPromise was rejected, then:

            1. Reject p with "NotFoundError" DOMException in realm.

               Web developers might be interested in the underlying rejection reason.

      3. Return p.

9. Reject p with "NotFoundError" DOMException in realm.

10. Return p.

7.2.4. supports(type)

This method must run the below steps:

1. If type is in mandatory data types or optional data types, then return true.

2. If not, then return false.

7.3. Clipboard Interface

typedef sequence<ClipboardItem> ClipboardItems;

[SecureContext, Exposed=Window]
interface Clipboard : EventTarget {
  Promise<ClipboardItems> read(optional ClipboardUnsanitizedFormats formats = {});
  Promise<DOMString> readText();
  Promise<undefined> write(ClipboardItems data);
  Promise<undefined> writeText(DOMString data);
};

dictionary ClipboardUnsanitizedFormats {
  sequence<DOMString> unsanitized;
};

Some methods of the Clipboard interface take or return multiple ClipboardItem objects. However, not all platforms support more than one clipboard item; on such platforms, the algorithms below will ignore any ClipboardItem objects beyond the first one that are passed to write(), and read() and readText() only get one clipboard item from the OS.

A clipboard items object is a sequence of clipboard items.

A web author needs to create a data which is an array of ClipboardItems in order to write content to system clipboard using the write(data) method. read() returns a Promise to clipboard items object that represents contents of system clipboard data.

unsanitized is a sequence of DOMStrings corresponding to the mime type that the author wants to be treated as optional unsanitized data types.

The unsanitized option MAY NOT be supported by the user agent. The web authors shouldn’t assume that the content for the MIME types listed in unsanitized would be unsanitized as there could be privacy modes where this option may not be allowed.

The clipboard task source is triggered in response to reading or writing of system clipboard data.

const items = await navigator.clipboard.read();
const textBlob = await items[0].getType("text/plain");
const text = await (new Response(textBlob)).text();

navigator.clipboard.readText().then(function(data) {
  console.log("Your string: ", data);
});

var data = [new ClipboardItem({ "text/plain": Promise.resolve(new Blob(["Text data"], { type: "text/plain" })) })];
navigator.clipboard.write(data).then(function() {
  console.log("Copied to clipboard successfully!");
}, function() {
  console.error("Unable to write to clipboard. :-(");
});

await navigator.clipboard.writeText("Howdy, partner!");

8. Clipboard Actions

This section defines clipboard actions and the processing model for event dispatch.

Each clipboard action has two flags called script-triggered and script-may-access-clipboard.

The script-triggered flag is set if the action runs because of a script, for example a document.execCommand() call. Future scripting APIs that interact with the clipboard should also use these actions, and the script-triggered flag must be set accordingly.

8.1. The copy action

8.2. The cut action

8.3. The paste action

For the paste action, the script-may-access-clipboard flag depends on an implementation-specific permission mechanism for determining what sites or apps may read from the clipboard. When a paste action is triggered by a script, the implementation must not make clipboard contents available without the user’s permission. If the permission has not already been granted, the permission prompt must include the hostname of the document associated with the script thread.

9. Permissions API Integration

The [permissions] API provides a uniform way for websites to access powerful features like the clipboard. It allows websites to request permissions from users and query which permissions they have.

For the clipboard, one permission is defined: "clipboard-write"

Note: Clipboard permissions currently only apply to the Async Clipboard API. Future versions of this specification may be updated to apply this permission to other Clipboard interactions.

These clipboard permissions are powerful features permission-related algorithms and types are defined as follows:

permission descriptor type

dictionary ClipboardPermissionDescriptor : PermissionDescriptor {
  boolean allowWithoutGesture = false;
};

There are 4 clipboard permissions:

• { name: "clipboard-write", allowWithoutGesture: false }

• { name: "clipboard-write", allowWithoutGesture: true }

With the following relationships:

• { "clipboard-write" + true } is stronger than { "clipboard-write" + false }

While user agents MUST support the ClipboardPermissionDescriptor as described in this specification, they, of course, retain complete control over the default settings and how (or if) they are exposed to the user.

9.1. Clipboard read permission

9.2. Clipboard write permission

10. Security Considerations

Enabling authors to change what is copied by a user, or to make an automated copy of something that was never selected and allowing unrestricted calls to paste information can raise various security concerns.

Some example scenarios include:

• A user selects a link and copies it, but a different link is copied to the clipboard. The effect of this can range from an unexpected result on pasting to an attempted "phishing" attack.

• (Self-XSS) Shell commands or executable script can be placed in the clipboard with the intent that the user will run the pasted content.

• An image that is specially crafted to exploit bugs in the core OS image handling code can be written to the clipboard.

10.1. Pasting HTML and multi-part data

This section is non-normative.

There are certain security risks associated with pasting formatted or multi-part data.

• The user might paste hidden data without realising it is there. This may happen if, for example, the markup includes <input type="hidden"> tags or HTML comments. Such hidden data might contain sensitive information.

• The user might paste malicious JavaScript into a trusted page.

• The implementation might grant scripts access to local files the user did not intend to expose.

To determine what policies to use, the factors we consider are:

• The origin of the data being pasted

• The origin of data sub-parts such as referenced images

• The origin of the running script

This is an overview of the scenarios and the possible security policies:

Some implementations mitigate the risks associated with pasting rich text by stripping potentially malicious content such as SCRIPT elements and javascript: links by default when pasting rich text, but allow a paste event handler to retrieve and process the original, un-sanitized data.

10.2. General security policies

The implementation must not download referenced online resources, or expose their contents in the files list or DataTransferItemList.

If the data on the clipboard is not from a local application, the implementation must not give access to any referenced local files. For example, if the data contains <img src="file://localhost/example.jpg"> but the data’s origin is an online resource, the implementation must not add an entry for example.jpg to the clipboardData.items list.

10.3. Transcoding images

To prevent malicious image data from being placed on the clipboard, the image data may be transcoded to produce a safe version of the image. This prevents websites from trying to exploit security vulnerabilities in other applications.

Implementations should not transcode images being read from the clipboard. Transcoding images can lose important metadata (such as the physical resolution of an image). This is also consistent with other methods in which images can be shared with a website (such as `<input type=file>`).

10.4. Nuisance considerations

Scripts may use the DataTransfer API to annoy and confuse users by altering the data on the system clipboard from copy and cut events. This specification does not attempt to prevent such nuisances, though implementations may add additional restrictions.

Implementations must handle scripts that try to place excessive amounts of data on the clipboard gracefully.

11. Privacy Considerations

Because these APIs provide access to the user’s clipboard data, there are serious privacy concerns due to the possibility that the clipboard will contain personally-identifiable information (PII) like names, addresses, or passwords.

In general, user agents must ensure that untrusted scripts do not get uncontrolled access to a user’s clipboard data through these APIs.

11.1. Privacy and the Clipboard Event API

The Clipboard Event API allows scripts running in the context of a clipboard event handler to access a copy of the system clipboard and potentially modify the data being written to the clipboard.

User agents should be aware of the following requirements with regards to securing the data accessed by the Clipboard Event API:

• Objects implementing the DataTransfer interface to return clipboard data must not be available outside the ClipboardEvent event handler that the data is provided to.

• If a script stores a reference to an object implementing the DataTransfer interface to use from outside the ClipboardEvent event handler, all methods must be no-ops when called outside the expected context.

• Implementations must not let scripts create synthetic clipboard events to get access to real clipboard data (unless the user has configured it to do so).

Even though the Clipboard Event API is not covered by the Clipboard permission, user agents may choose to provide a method for the user to disable this API or to configure which sites are allowed to access it.

11.2. Privacy and the Asychronous Clipboard API

The Asynchronous Clipboard API is a powerful feature because it can allow access to the clipboard data from any script (access is not restricted to Clipboard Event handlers) and data can be accessed in the absence of a user provided gesture.

To help prevent abuse, this API must not be available unless the script is executing in the context of a document that has focus.

11.2.1. Privacy and Clipboard Permission

The Clipboard Permission gates access to this API, but user agents get to choose the permission defaults and which of these permission settings can be set by the user. For example, a user agent may choose to only allow access to the Asynchronous Clipboard API when a user gesture is present and always deny script requests for access without a gesture.

User agents may opt to have this permission automatically expire sometime after the user grants permission, for example, by having the permission expire:

• After a set time from when the permission was first granted

• After a set time from the user’s last visit to a site

• When the user navigates away from the page

11.3. Other Privacy Concerns

If the user agent allows clipboard data to be read using document.execCommand("paste") then the user agent must ensure that the user has explicitly allowed that access to take place.

12. Acknowledgements

This section is non-normative

The editors would like to acknowledge the contributions of the former editors who helped shepherd this specification through various meetings and mailing-list discussions to bring it to its current state.

• Hallvord R. M. Steen

The editors would also like to acknowledge their intellectual debt to the documentation of Data Transfer functionalities from Microsoft [MICROSOFT-CLIP-OP] and earlier drafts of the [HTML5] specification. We are also grateful for the draft "safe copy and paste" from Paul Libbrecht (this draft is no longer available on the Web).

And finally, we would like to acknowledge the contributions made by the following:

Adam Barth, Shawn Carnell, Daniel Cheng, Daniel Dardailler, Domenic Denicola, Al Gilman, James Graham, James Greene, Ian Hickson, Darwin Huang, Lachlan Hunt, Philip Jägenstedt, Anne van Kesteren, Marijn Kruisselbrink, Aaron Leventhal, Jim Ley, Paul Libbrecht, "Martijn", Glenn Maynard, Chris Mills, ms2ger, Ryosuke Niwa, Robert O’Callahan, Dave Poehlman, "ROBO Design", Janina Sajka, Rich Schwerdtfeger, Jonas Sicking, Maciej Stachowiak, Mihai Sucan, Dmitry Titov, Ojan Vafai, Tarquin Wilton-Jones, Tom Wlodkowski, Bo Cupp, mbrodesser and Boris Zbarsky.

Appendix A: Algorithms

write web custom formats

Input

items, a sequence<Blob>

1. Let idx be a number initialized to 0.

2. Let webCustomFormatMap be the os specific custom map name.

3. Let webCustomFormatMapString be an empty JSON string.

4. For each item in items:

   1. Let webCustomFormat be the os specific custom name.

   2. Let webCustomFormatIdx be the result of appending idx to webCustomFormat.

   3. Insert item’s type as key and webCustomFormatIdx as value into the webCustomFormatMapString using a JSON serializer.

      Note: Need a JSON writer to serialize the content into the webCustomFormatMapString.

   4. Insert the item into the system clipboard using webCustomFormatIdx as the format.

   5. Increment idx.

   6. If idx is greater than 100, then break from this loop.

5. Insert the webCustomFormatMapString into the system clipboard using webCustomFormatMap as the format.