fix: don't leak HTML comment content into pasted paragraph text
_parseDeltaElement's fallback branch called child.text on any non-Element DOM node, including dom.Comment (whose .text getter aliases its raw data). This let real HTML comments -- e.g. the internal tracking marker Google's AI Overview panel injects when you copy its answer text -- surface as visible garbage in the editor. Skip non-Text nodes here, matching the dom.Text check _parseElement already does one level up.
This commit is contained in:
parent
6fbe7ba442
commit
bb995825dd
2 changed files with 20 additions and 2 deletions
|
|
@ -470,9 +470,11 @@ class DocumentHTMLDecoder extends Converter<String, Document> {
|
|||
);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
delta.insert(child.text?.replaceAll(RegExp(r'\n+$'), '') ?? '');
|
||||
} else if (child is dom.Text) {
|
||||
delta.insert(child.text.replaceAll(RegExp(r'\n+$'), ''));
|
||||
}
|
||||
// other node types (e.g. dom.Comment) carry no visible content and
|
||||
// are intentionally skipped, mirroring _parseElement's handling.
|
||||
}
|
||||
|
||||
return (delta, nodes);
|
||||
|
|
|
|||
|
|
@ -41,5 +41,21 @@ void main() {
|
|||
isTrue,
|
||||
);
|
||||
});
|
||||
|
||||
test('paste text with an inline HTML comment does not leak comment text',
|
||||
() {
|
||||
// Some sites (e.g. Google Search AI Overview) inject an HTML comment
|
||||
// into copied content as an internal marker. It must not surface as
|
||||
// visible text, regardless of what the comment contains.
|
||||
const html = '''
|
||||
<p>First answer<!--TgQPHd||[]--></p>
|
||||
<p>Second answer<!-- some other internal marker --></p>
|
||||
''';
|
||||
final document = htmlToDocument(html);
|
||||
final children = document.root.children;
|
||||
|
||||
expect(children[0].delta!.toPlainText(), 'First answer');
|
||||
expect(children[1].delta!.toPlainText(), 'Second answer');
|
||||
});
|
||||
});
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue