Merge pull request #1220 from AppFlowy-IO/fix/html-comment-leak-in-delta

fix: don't leak HTML comment content into pasted paragraph text

lib/src/plugins/html/html_document_decoder.dart

@@ -470,9 +470,11 @@ class DocumentHTMLDecoder extends Converter<String, Document> {
             );
           }
         }
-      } else {
+      } else if (child is dom.Text) {
-        delta.insert(child.text?.replaceAll(RegExp(r'\n+$'), '') ?? '');
+        delta.insert(child.text.replaceAll(RegExp(r'\n+$'), ''));
       }
+      // other node types (e.g. dom.Comment) carry no visible content and
+      // are intentionally skipped, mirroring _parseElement's handling.
     }
 
     return (delta, nodes);

test/customer/html_document_test.dart

@@ -41,5 +41,21 @@ void main() {
         isTrue,
       );
     });
+
+    test('paste text with an inline HTML comment does not leak comment text',
+        () {
+      // Some sites (e.g. Google Search AI Overview) inject an HTML comment
+      // into copied content as an internal marker. It must not surface as
+      // visible text, regardless of what the comment contains.
+      const html = '''
+<p>First answer<!--TgQPHd||[]--></p>
+<p>Second answer<!-- some other internal marker --></p>
+''';
+      final document = htmlToDocument(html);
+      final children = document.root.children;
+
+      expect(children[0].delta!.toPlainText(), 'First answer');
+      expect(children[1].delta!.toPlainText(), 'Second answer');
+    });
   });
 }