From 79de2a382223e00d7a736f71058b4d7e690a308e Mon Sep 17 00:00:00 2001 From: Anupam Snigdha Date: Tue, 24 Oct 2023 14:57:49 -0700 Subject: [PATCH] Add privacy-security doc. --- docs/clipboard-unsanitized/explainer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/clipboard-unsanitized/explainer.md b/docs/clipboard-unsanitized/explainer.md index ff89f6b..af1f668 100644 --- a/docs/clipboard-unsanitized/explainer.md +++ b/docs/clipboard-unsanitized/explainer.md @@ -238,7 +238,7 @@ This feature introduces an `unsanitized` option that has unsanitized `text/html` Websites or native apps are already reading unsanitized content via DataTransfer APIs using `setData()` & `getData()` methods. In this proposal, web authors are required to explicitly specify `unsanitized` option in the async clipboard `read()` method to access the raw `text/html` content from the clipboard. This feature uses async clipboard API that already has a [user gesture requirement](https://w3c.github.io/clipboard-apis/#check-clipboard-read-permission) on top of [existing](https://github.com/dway123/clipboard-pickling/blob/main/explainer.md#permissions) async clipboard API security measures to mitigate security and privacy concerns. -For more details see the [security-privacy](https://github.com/MicrosoftEdge/MSEdgeExplainers/blob/main/ClipboardPickle/tag-security-privacy.md) doc. +For more details see the [security-privacy](https://github.com/MicrosoftEdge/MSEdgeExplainers/blob/main/ClipboardAPI/tag-security-privacy-clipboard-unsanitized-read.md) doc. ### User Gesture Requirement On top of Async Clipboard API requirements for focus, secure context, and permission, use of this API will require a [transient user activation](https://html.spec.whatwg.org/multipage/interaction.html#transient-activation), so that the site will not be able to silently read or write clipboard information.