Ready for Trial: Align clipboard async API read/write HTML format with DataTransfer API

Skip to first unread message

Ana Sollano Kim

Mar 30, 2023, 10:31:30 PM3/30/23
to, Sanket Joshi (EDGE), Anupam Snigdha

Contact emails



Design docs


This proposal aligns the sanitization requirement of the HTML format from read/write async API with the setData/getData DataTransfer APIs. Currently, when we read/write text/html MIME types using the async API, the sanitizer is invoked to strip out contents from the HTML markup due to security concerns, and styles are inlined in the HTML, which leads to a bloated HTML payload and loss of fidelity of HTML content when read by web authors or native apps. Currently, Firefox provides access to unsanitized HTML via DataTransfer APIs, which matches Chromium's behavior, and Safari only allows access to unsanitized HTML if it's being read within the same origin.

Blink component


Search tags

unsanitized htmlasync apiclipboard

TAG review

There is no desire to standardize this behavior as discussed in Also, Webkit was opposed to any change in behavior since their implementation of Async API interops with DataTransfer API (

TAG review status

Not applicable


Interoperability and Compatibility

This is a Chromium-only feature (see discussion in, so adding a dictionary as an argument in read will be ignored in non-Chromium browsers and the HTML read might be sanitized. As this change aligns the sanitization behavior of the DataTransfer API and the Clipboard Async API, existing paste targets that support DataTransfer APIs unsanitized HTML don't need to make updates on how they handle HTML if they decide to transition to the Clipboard Async API.

Gecko: Neutral (

WebKit: Negative (

Web developers: Positive Positive signals from Excel Online.


The spec'd read method doesn't accept any arguments. With this feature, we have overloaded the read method in order to add a dictionary argument, where web authors will explicitly request for the unsanitization of the HTML.


The current Clipboard Async API read method as specified in isn't affected by the introduction of this feature, the behavior is validated through existing web tests.


The legacy DataTransfer APIs already allow access to unsanitized HTML content, so we don't think this will create any additional security loopholes. Moreover, sites have to explicitly opt into reading unsanitized HTML content via the "unsanitized" option, so any sites that don't have that option would get the default, sanitized HTML content.

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?


Goals for experimentation

Gather feedback from web developers.


No specific DevTools changes are required. This feature is treated like any other JS method.

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?


No platform restrictions.

Is this feature fully tested by web-platform-tests?


DevTrial instructions

Flag name


Requires code in //chrome?


Tracking bug

Estimated milestones

DevTrial on desktop



DevTrial on Android




Link to entry on the Chrome Platform Status

This intent message was generated by Chrome Platform Status.



Reply all
Reply to author
0 new messages