Intent To Prototype: Clipboard API: Svg

[Dylan Sleeper]

Contact emails

dsl...@google.com

Explainer

https://docs.google.com/document/d/1qGpql7OxFQT9JLTZW9rOKwcXvpXeLDY2pB6xRnhJHbI/edit#heading=h.d86ucna8g4c5

Design docs

https://docs.google.com/document/d/1jq8QSCQRdNy99rnPusmW8is62c22PVuq-Sk-tMT2tRk/edit

Summary

The current implementation of the async clipboard API only supports text/plain, image/png, and text/html. SVG images are popular due to their ability to encode images in a space efficiently and their ability to maintain image quality even when zooming in. This feature adds image/svg+xml support to the async clipboard api. We initially want to enable this feature behind a flag.

Motivation

The SVG image format is becoming more common for the creation of icons and other images. This format can be used by: -Programs such as Inkscape, Adobe Illustrator, and other vector graphics editors -Sites that support SVG that may want to copy SVG images across websites such as Figma and Photopea By adding this format, we enable interoperability between chrome and these other programs.

Risks

Interoperability and Compatibility

There is some interoperability risk because chrome will be the first browser to support the SVG format on the clipboard. There haven't been any public signals from other browsers but there also haven't been any negative signals.

Gecko: No signal

WebKit: No signal

Web developers: No signals

Ergonomics

The risk is no higher than any of the other formats in the Clipboard API.

Activation

The feature is relatively easy to access. All one must do is specify the new format type as an argument.

Security

Similarly to HTML, SVG can contain malicious content. SVG is an XML based format, so it can contain javascript. We use the same sanitizer that HTML uses to remove script tags and other javascript that can be embedded in other elements.

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes

Is this feature fully tested by web-platform-tests?

Yes The tests test equivalent structure after a write and read. They also test the removal of javascript elements. https://chromium-review.googlesource.com/c/chromium/src/+/2315220

Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5125790490427392

This intent message was generated by Chrome Platform Status.

--

	Dylan Sleeper Software Engineering Intern careers.google.com

[Thomas Steiner]

On Sat 8. Aug 2020 at 03:56 'Dylan Sleeper' via blink-dev <blin...@chromium.org> wrote:

Contact emails

dsl...@google.com

Explainer

https://docs.google.com/document/d/1qGpql7OxFQT9JLTZW9rOKwcXvpXeLDY2pB6xRnhJHbI/edit#heading=h.d86ucna8g4c5

Design docs

https://docs.google.com/document/d/1jq8QSCQRdNy99rnPusmW8is62c22PVuq-Sk-tMT2tRk/edit

Summary

The current implementation of the async clipboard API only supports text/plain, image/png, and text/html. SVG images are popular due to their ability to encode images in a space efficiently and their ability to maintain image quality even when zooming in. This feature adds image/svg+xml support to the async clipboard api. We initially want to enable this feature behind a flag.

Motivation

The SVG image format is becoming more common for the creation of icons and other images. This format can be used by: -Programs such as Inkscape, Adobe Illustrator, and other vector graphics editors -Sites that support SVG that may want to copy SVG images across websites such as Figma and Photopea By adding this format, we enable interoperability between chrome and these other programs.

Risks

Interoperability and Compatibility

There is some interoperability risk because chrome will be the first browser to support the SVG format on the clipboard. There haven't been any public signals from other browsers but there also haven't been any negative signals.

Gecko: No signal

WebKit: No signal

Web developers: No signals

I wrote about SVGs specifically: 

https://blog.tomayac.com/2020/03/20/multi-mime-type-copying-with-the-async-clipboard-api/#multi-mime-type-copying. Full disclosure in case people don’t check the `from:` field: I work for Google, apart from also being a Web developer. 

Ergonomics

The risk is no higher than any of the other formats in the Clipboard API.

Activation

The feature is relatively easy to access. All one must do is specify the new format type as an argument.

Security

Similarly to HTML, SVG can contain malicious content. SVG is an XML based format, so it can contain javascript. We use the same sanitizer that HTML uses to remove script tags and other javascript that can be embedded in other elements.

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

Yes

Is this feature fully tested by web-platform-tests?

Yes The tests test equivalent structure after a write and read. They also test the removal of javascript elements. https://chromium-review.googlesource.com/c/chromium/src/+/2315220

Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5125790490427392

This intent message was generated by Chrome Platform Status.

--

	Dylan Sleeper Software Engineering Intern careers.google.com

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAHR0hu%2B6khFuK6eQnFdYSx5ncbg8iPrE8q-Lg_RvqNt%3DnTMC6Q%40mail.gmail.com.

--

Thomas Steiner, PhD—Developer Advocate (https://blog.tomayac.com, https://twitter.com/tomayac)

Google Germany GmbH, ABC-Str. 19, 20354 Hamburg, Germany
Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.23 (GNU/Linux)

iFy0uwAntT0bE3xtRa5AfeCheCkthAtTh3reSabiGbl0ck0fjumBl3DCharaCTersAttH3b0ttom.hTtPs://xKcd.cOm/1181/
-----END PGP SIGNATURE-----

[一丝]

Does not currently support SVG copy and paste it into another program(Adobe illustrator, Sketch...) there? Demo: https://async-clipboard-api-svg.glitch.me/

[Thomas Steiner]

On Tue, Sep 1, 2020 at 8:45 AM 一丝 <yio...@gmail.com> wrote:

Does not currently support SVG copy and paste it into another program(Adobe illustrator, Sketch...) there? Demo: https://async-clipboard-api-svg.glitch.me/

Try it on Chrome 86 (the current Canary) with the chrome://flags/#raw-clipboard flag set. Your demo works like a charm there.

[一丝]

Google Chrome 87.0.4250.0 canary (x86_64)

I have turned it on, but it doesn't work.

In addition, all <style> tags are currently deleted, right? I understand that SVG disinfection should need to turn them into inline style, right?

[一丝]

The style tag is missing after pasting.

[Thomas Steiner]

The clipboard sanitizer does some style manipulation to prevent pasted styles from "leaking" into the surrounding document. See https://crbug.com/1110511 for details. 

[一丝]

https://bugs.chromium.org/p/chromium/issues/detail?id=1110511#c8