Clipboard API and events: SVG as optional data type #579
Description
WebKittens
Title of the proposal
Clipboard API and events: SVG support
URL to the spec
https://w3c.github.io/clipboard-apis/#optional-data-types-x
URL to the spec's repository
https://github.com/w3c/clipboard-apis
Issue Tracker URL
No response
Explainer URL
No response
TAG Design Review URL
No response
Mozilla standards-positions issue URL
No response
WebKit Bugzilla URL
https://bugs.webkit.org/show_bug.cgi?id=280726
Radar URL
No response
Description
Clipboard API is supported by WebKit for plain text but not for optional data types. This position request is specifically about the optional SVG data type.
Why SVG as optional data type?
For desktop to web client data transfer there is only plain text today. Speaking for Adobe Illustrator (Ai), the majority of content getting transferred is vector graphics. SVG is the de-facto-standard interchange format for vector graphics.
At the moment, to transfer vector content to Safari, Ai has to use plain text.
This limits Ai as is needs to switch between content generated for the clipboard. Ai always has to anticipate what to put on the clipboard.
- Currently, if the selection in Ai has text, Ai copies the (selected) text only.
- Otherwise, Ai generates SVG regardless of the requirements of the consumer.
Having a dedicated data type would allow Ai to always generate SVG on request. Even if the selection contains text.
Sanitized vs Non-Sanitized SVG content
The WebKit bugs assumption and specification text seem to have diverged: The specification does not require sanitization. In fact, SVG consuming web applications (Figma, Adobe Express and others) already do their own sanitization.
Sanitization is not required.
Technical implementation requirements
The specification only states
These data types MAY be exposed by UAs if a corresponding native type exists on the clipboard
For Windows, the MIME type image/svg+xml has been established. On macOS, Apple introduced public.svg-image. Chrome-based browsers make use of these MIME-types/UTIs.
Security/privacy concerns
Safari does support plain text as data type and all applications are actively using this format as a workaround to transfer SVG. W/o sanitization requirements, there are no additional security or privacy concerns to the common practice today.