[clipboard] document.execCommand('copy') and presumably paste bypass permissions policy

w3c / webappsec-permissions-policy

A mechanism to selectively enable and disable browser features and APIs

https://w3c.github.io/webappsec-permissions-policy/

Other

399 stars 155 forks source link

[clipboard] document.execCommand('copy') and presumably paste bypass permissions policy #543

Closed williewillus closed 2 months ago

williewillus commented 9 months ago

Chromium bug https://issues.chromium.org/issues/327483127

Hi, I just noticed that the old document.execCommand('copy') call actually bypasses any permissions policy restrictions put on the clipboard, which seems like the wrong behaviour. Can anyone confirm if this is intended?

I didn't test execCommand('paste'), but I suspect it also has the same issue.

clelland commented 2 months ago

Closing this here as it's not a permissions policy spec bug; the linked chromium issue is the right forum to figure out whether that's an implementation bug.