Skip to content

Pasting an embedded-content attachment may destroy it - #1337

Open
jorgemanrubia wants to merge 2 commits into
mainfrom
fix-data-trix-attributes-safe-for-xml
Open

Pasting an embedded-content attachment may destroy it#1337
jorgemanrubia wants to merge 2 commits into
mainfrom
fix-data-trix-attributes-safe-for-xml

Conversation

@jorgemanrubia

Copy link
Copy Markdown
Member

Pasting (or otherwise inserting) an attachment whose data-trix-attachment value contains </style>, </title>, </textarea>, --> or ]> destroys the attachment: the figure and the attachment are gone, and the content lands as flattened text. Embedded email content is the common case — a <style> block, or an Outlook conditional comment ending in <![endif]-->.

Trix already declares the intent to protect its own attributes with an uponSanitizeAttribute hook that sets forceKeepAttr for /^data-trix-/. The hook never takes effect: DOMPurify checks the attribute value against SAFE_FOR_XML and continues — dropping the attribute — before it reaches the forceKeepAttr guard. That order is deliberate upstream (DOMPurify fa542df7, shipped in 3.1.6, "safer hooks"), and it is unchanged through the current release, so forceKeepAttr is the wrong lever here rather than something a version bump fixes.

Only Composition#insertHTML passes SAFE_FOR_XML: true, which is why loading a document keeps the attachment while pasting the same markup loses it.

So instead of relying on forceKeepAttr, stash the data-trix-* values in uponSanitizeAttribute and restore them in afterSanitizeAttributes, once DOMPurify has finished with the node. Nothing else is rescued: every other attribute still loses these values under SAFE_FOR_XML, and data-trix-serialized-attributes is still stripped.

Copilot AI balanced review requested due to automatic review settings August 21, 2026 10:07

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Preserves Trix attachment attributes containing XML-sensitive markup during sanitization.

Changes:

  • Stashes and restores data-trix-* attributes.
  • Continues stripping serialized and non-Trix unsafe attributes.
  • Adds unit, parser, and paste regression tests.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
src/trix/models/html_sanitizer.js Restores permitted Trix attributes after DOMPurify sanitization.
src/test/unit/html_sanitizer_test.js Tests attribute preservation and removal.
src/test/unit/html_parser_test.js Tests parsing embedded attachment markup.
src/test/system/pasting_test.js Tests pasting embedded HTML attachments.
action_text-trix/app/assets/javascripts/trix.js Updates the bundled sanitizer implementation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +25 to +29
DOMPurify.addHook("afterSanitizeAttributes", function (node) {
stashedAttributes.forEach(([ name, value ]) => {
if (value !== null && !node.hasAttribute(name)) {
node.setAttribute(name, value)
}
jeremy pushed a commit that referenced this pull request Aug 28, 2026
rails/rails main's yarn.lock now pulls errorstacks@2.4.2, which declares
node >= 24, so `yarn install --frozen-lockfile` in the Rails clone fails
on Node 18 before any test runs. Same fix as #1337.
jeremy pushed a commit that referenced this pull request Aug 28, 2026
Ferrum::ProcessTimeoutError ("Browser did not produce websocket url
within 10 seconds") fails the Action Text matrix intermittently on loaded
runners. Same fix as #1337.
@jeremy
jeremy force-pushed the fix-data-trix-attributes-safe-for-xml branch from 2f6cd63 to 438aa12 Compare August 30, 2026 04:29
DOMPurify removes an attribute whose value contains `</style>`, `</title>`,
`</textarea>`, `-->` or `]>` before it honors `forceKeepAttr`, so the hook that
protects `data-trix-*` never takes effect under `SAFE_FOR_XML`. Stash those
values and restore them in `afterSanitizeAttributes` instead.
Ferrum's 10 second default process_timeout is too tight on loaded CI
runners, where Chrome intermittently fails to publish its websocket
URL in time and the whole matrix cell errors before running.
@jeremy
jeremy force-pushed the fix-data-trix-attributes-safe-for-xml branch from 438aa12 to 976f806 Compare August 30, 2026 04:59
jeremy added a commit that referenced this pull request Aug 30, 2026
#1337 stashed every data-trix-* attribute DOMPurify's SAFE_FOR_XML pass
dropped and restored it in afterSanitizeAttributes. The escaping added here
makes that unnecessary: sanitizeElement escapes the angle brackets in the
JSON attachment attributes before DOMPurify runs, so SAFE_FOR_XML never
drops them and forceKeepAttr keeps them. The blanket restore's only
remaining effect was re-admitting malformed or non-JSON data-trix-* values
the pass deliberately dropped, so remove it and the module-global stash and
rely on escaping. Non-JSON attachment attributes are unusable on read
anyway. Full suite green.
jeremy added a commit that referenced this pull request Aug 30, 2026
#1337 stashed every data-trix-* attribute DOMPurify's SAFE_FOR_XML pass
dropped and restored it in afterSanitizeAttributes. The escaping added here
makes that unnecessary: sanitizeElement escapes the angle brackets in the
JSON attachment attributes before DOMPurify runs, so SAFE_FOR_XML never
drops them and forceKeepAttr keeps them. The blanket restore's only
remaining effect was re-admitting malformed or non-JSON data-trix-* values
the pass deliberately dropped, so remove it and the module-global stash and
rely on escaping. Non-JSON attachment attributes are unusable on read
anyway. Full suite green.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants