Bug 263724

Summary: document.execCommand("paste") has a different behavior in browsers
Product: WebKit Reporter: Karl Dubost <karlcow>
Component: HTML EditingAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: annevk, webkit-bug-importer, wenson_hsieh
Priority: P2 Keywords: BrowserCompat, InRadar
Version: Safari 17   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=263590
Bug Depends on:    
Bug Blocks: 263725    

Description Karl Dubost 2023-10-26 08:38:04 PDT 
In Bug 263590, a Quirk has been created to handle a double paste issue with the Tableau application.

Some background for document.queryCommandSupported("paste")
https://www.w3.org/2017/09/05-editing-minutes.html#item02
https://bugs.chromium.org/p/chromium/issues/detail?id=757140
https://bugzilla.mozilla.org/show_bug.cgi?id=1161721

The specification is not in a good place.
https://w3c.github.io/editing/docs/execCommand/

Kind of related specs too.
https://w3c.github.io/clipboard-apis/#clipboard-event-paste
and https://w3c.github.io/input-events/#event-order-when-using-insertfrompaste

According to this test, paste is supported in privileged context in Firefox.
https://github.com/mozilla/gecko-dev/blob/df57c7356a3a2465412b76a403a7b24a46c369a4/dom/tests/mochitest/general/test_bug1161721.html#L22

And probably in Chromium (to find out)
Comment 1 Radar WebKit Bug Importer 2023-10-26 08:38:16 PDT 
<rdar://problem/117535610>
Comment 2 Karl Dubost 2023-10-26 09:18:09 PDT 
In Bug 263590 where the Quirk was created for Tableau app, see the commit message from Wenson:

==========
In Tableau's analytics tool, pressing ⌘V to paste in any focused editable areas pastes content twice after showing a Paste menu item, if the user clicks "Paste" on this item. This is because Tableau's script does something akin to the following:

```
textField.addEventListener("keydown", event => {
    if (event.key === "v" && event.metaKey)
        document.execCommand("Paste");
});
```

... which triggers a programmatic paste upon `keydown`, without preventing default. This means that if the programmatic DOM paste is accepted, we'll end up triggering two paste commands: 

  (1) due to the `execCommand`, and 
  (2) due to the default behavior of ⌘V.

While this is ostensibly a website bug, it works fine in other browsers (Firefox, Chrome) because they don't support DOM paste at all, so we just end up silently failing the programmatic paste before performing the real paste.
==========

Firefox, and Chrome seems to support paste but they do not expose it to the Web or only under certain circumstances.

Firefox
https://searchfox.org/mozilla-central/source/dom/base/Document.cpp#5404-5409