Pasting an embedded-content attachment may destroy it - #1337
Open
jorgemanrubia wants to merge 3 commits into
Open
Pasting an embedded-content attachment may destroy it#1337jorgemanrubia wants to merge 3 commits into
jorgemanrubia wants to merge 3 commits into
Conversation
DOMPurify removes an attribute whose value contains `</style>`, `</title>`, `</textarea>`, `-->` or `]>` before it honors `forceKeepAttr`, so the hook that protects `data-trix-*` never takes effect under `SAFE_FOR_XML`. Stash those values and restore them in `afterSanitizeAttributes` instead.
There was a problem hiding this comment.
Pull request overview
Preserves Trix attachment attributes containing XML-sensitive markup during sanitization.
Changes:
- Stashes and restores
data-trix-*attributes. - Continues stripping serialized and non-Trix unsafe attributes.
- Adds unit, parser, and paste regression tests.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
src/trix/models/html_sanitizer.js |
Restores permitted Trix attributes after DOMPurify sanitization. |
src/test/unit/html_sanitizer_test.js |
Tests attribute preservation and removal. |
src/test/unit/html_parser_test.js |
Tests parsing embedded attachment markup. |
src/test/system/pasting_test.js |
Tests pasting embedded HTML attachments. |
action_text-trix/app/assets/javascripts/trix.js |
Updates the bundled sanitizer implementation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+25
to
+29
| DOMPurify.addHook("afterSanitizeAttributes", function (node) { | ||
| stashedAttributes.forEach(([ name, value ]) => { | ||
| if (value !== null && !node.hasAttribute(name)) { | ||
| node.setAttribute(name, value) | ||
| } |
Rails' yarn.lock now pulls errorstacks 2.4.2, which declares node >= 24. The Configure Rails step has been failing on every PR since, before reaching any test.
Ferrum's 10 second default process_timeout is too tight on loaded CI runners, where Chrome intermittently fails to publish its websocket URL in time and the whole matrix cell errors before running.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pasting (or otherwise inserting) an attachment whose
data-trix-attachmentvalue contains</style>,</title>,</textarea>,-->or]>destroys the attachment: the figure and the attachment are gone, and the content lands as flattened text. Embedded email content is the common case — a<style>block, or an Outlook conditional comment ending in<![endif]-->.Trix already declares the intent to protect its own attributes with an
uponSanitizeAttributehook that setsforceKeepAttrfor/^data-trix-/. The hook never takes effect: DOMPurify checks the attribute value againstSAFE_FOR_XMLandcontinues — dropping the attribute — before it reaches theforceKeepAttrguard. That order is deliberate upstream (DOMPurifyfa542df7, shipped in 3.1.6, "safer hooks"), and it is unchanged through the current release, soforceKeepAttris the wrong lever here rather than something a version bump fixes.Only
Composition#insertHTMLpassesSAFE_FOR_XML: true, which is why loading a document keeps the attachment while pasting the same markup loses it.So instead of relying on
forceKeepAttr, stash thedata-trix-*values inuponSanitizeAttributeand restore them inafterSanitizeAttributes, once DOMPurify has finished with the node. Nothing else is rescued: every other attribute still loses these values underSAFE_FOR_XML, anddata-trix-serialized-attributesis still stripped.