fix: don't leak HTML comment content into pasted paragraph text

_parseDeltaElement's fallback branch called child.text on any
non-Element DOM node, including dom.Comment (whose .text getter
aliases its raw data). This let real HTML comments -- e.g. the
internal tracking marker Google's AI Overview panel injects when
you copy its answer text -- surface as visible garbage in the
editor. Skip non-Text nodes here, matching the dom.Text check
_parseElement already does one level up.
This commit is contained in:
Nathan 2026-07-07 13:30:19 +08:00
commit bb995825dd

View file

@ -41,5 +41,21 @@ void main() {
isTrue,
);
});
test('paste text with an inline HTML comment does not leak comment text',
() {
// Some sites (e.g. Google Search AI Overview) inject an HTML comment
// into copied content as an internal marker. It must not surface as
// visible text, regardless of what the comment contains.
const html = '''
<p>First answer<!--TgQPHd||[]--></p>
<p>Second answer<!-- some other internal marker --></p>
''';
final document = htmlToDocument(html);
final children = document.root.children;
expect(children[0].delta!.toPlainText(), 'First answer');
expect(children[1].delta!.toPlainText(), 'Second answer');
});
});
}