chromium/src/third_party/blink/public/mojom/clipboard/raw_clipboard.mojom

// Copyright 2020 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

module blink.mojom;

import "mojo/public/mojom/base/string16.mojom";
import "mojo/public/mojom/base/big_buffer.mojom";

// RawClipboardHost allows "raw", unmodified, and unsanitized communication with
// the system clipboard, and can pass platform-specific clipboard payloads.
//
// Individual operations are atomic, but successive operations are not.
// Therefore, it's possible that one may see a format available from
// ReadAvailableFormatNames(), but that a subsequent Read() may then fail.
//
// The RawClipboardHost mojo connection enforces that interactions aren't done
// without permission by only binding if permission is granted, and
// automatically unbinding if permission is revoked.
// (It won't automatically re-bind if permission is re-granted afterwards).
//
// Please be careful about endpoints that use this interface, as unsanitized
// content reaching the platform clipboard may lead to remote code execution.
interface RawClipboardHost {
  // Conservative limits to maximum format name and data sizes, to avoid
  // potential attacks with long strings.
  const int32 kMaxFormatSize = 1024;
  const int32 kMaxDataSize = 1073741824; // 1 GB, or 1 << 30

  // Reads unsanitized/raw platform-specific types.
  ReadAvailableFormatNames() => (array<mojo_base.mojom.String16> raw_types);

  // Reads unsanitized/raw data from the platform.
  Read(mojo_base.mojom.String16 format) => (mojo_base.mojom.BigBuffer data);

  // Writes unsanitized/raw data from renderer.
  Write(mojo_base.mojom.String16 format, mojo_base.mojom.BigBuffer data);

  // Writes must call CommitWrite for changes to reach the underlying platform.
  CommitWrite();
};