Pasting an embedded-content attachment may destroy it - #1337
Open
jorgemanrubia wants to merge 2 commits into
Open
Pasting an embedded-content attachment may destroy it#1337jorgemanrubia wants to merge 2 commits into
jorgemanrubia wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Preserves Trix attachment attributes containing XML-sensitive markup during sanitization.
Changes:
- Stashes and restores
data-trix-*attributes. - Continues stripping serialized and non-Trix unsafe attributes.
- Adds unit, parser, and paste regression tests.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
src/trix/models/html_sanitizer.js |
Restores permitted Trix attributes after DOMPurify sanitization. |
src/test/unit/html_sanitizer_test.js |
Tests attribute preservation and removal. |
src/test/unit/html_parser_test.js |
Tests parsing embedded attachment markup. |
src/test/system/pasting_test.js |
Tests pasting embedded HTML attachments. |
action_text-trix/app/assets/javascripts/trix.js |
Updates the bundled sanitizer implementation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+25
to
+29
| DOMPurify.addHook("afterSanitizeAttributes", function (node) { | ||
| stashedAttributes.forEach(([ name, value ]) => { | ||
| if (value !== null && !node.hasAttribute(name)) { | ||
| node.setAttribute(name, value) | ||
| } |
jeremy
pushed a commit
that referenced
this pull request
Aug 28, 2026
rails/rails main's yarn.lock now pulls errorstacks@2.4.2, which declares node >= 24, so `yarn install --frozen-lockfile` in the Rails clone fails on Node 18 before any test runs. Same fix as #1337.
jeremy
pushed a commit
that referenced
this pull request
Aug 28, 2026
Ferrum::ProcessTimeoutError ("Browser did not produce websocket url
within 10 seconds") fails the Action Text matrix intermittently on loaded
runners. Same fix as #1337.
jeremy
force-pushed
the
fix-data-trix-attributes-safe-for-xml
branch
from
August 30, 2026 04:29
2f6cd63 to
438aa12
Compare
DOMPurify removes an attribute whose value contains `</style>`, `</title>`, `</textarea>`, `-->` or `]>` before it honors `forceKeepAttr`, so the hook that protects `data-trix-*` never takes effect under `SAFE_FOR_XML`. Stash those values and restore them in `afterSanitizeAttributes` instead.
Ferrum's 10 second default process_timeout is too tight on loaded CI runners, where Chrome intermittently fails to publish its websocket URL in time and the whole matrix cell errors before running.
jeremy
force-pushed
the
fix-data-trix-attributes-safe-for-xml
branch
from
August 30, 2026 04:59
438aa12 to
976f806
Compare
jeremy
added a commit
that referenced
this pull request
Aug 30, 2026
#1337 stashed every data-trix-* attribute DOMPurify's SAFE_FOR_XML pass dropped and restored it in afterSanitizeAttributes. The escaping added here makes that unnecessary: sanitizeElement escapes the angle brackets in the JSON attachment attributes before DOMPurify runs, so SAFE_FOR_XML never drops them and forceKeepAttr keeps them. The blanket restore's only remaining effect was re-admitting malformed or non-JSON data-trix-* values the pass deliberately dropped, so remove it and the module-global stash and rely on escaping. Non-JSON attachment attributes are unusable on read anyway. Full suite green.
jeremy
added a commit
that referenced
this pull request
Aug 30, 2026
#1337 stashed every data-trix-* attribute DOMPurify's SAFE_FOR_XML pass dropped and restored it in afterSanitizeAttributes. The escaping added here makes that unnecessary: sanitizeElement escapes the angle brackets in the JSON attachment attributes before DOMPurify runs, so SAFE_FOR_XML never drops them and forceKeepAttr keeps them. The blanket restore's only remaining effect was re-admitting malformed or non-JSON data-trix-* values the pass deliberately dropped, so remove it and the module-global stash and rely on escaping. Non-JSON attachment attributes are unusable on read anyway. Full suite green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pasting (or otherwise inserting) an attachment whose
data-trix-attachmentvalue contains</style>,</title>,</textarea>,-->or]>destroys the attachment: the figure and the attachment are gone, and the content lands as flattened text. Embedded email content is the common case — a<style>block, or an Outlook conditional comment ending in<![endif]-->.Trix already declares the intent to protect its own attributes with an
uponSanitizeAttributehook that setsforceKeepAttrfor/^data-trix-/. The hook never takes effect: DOMPurify checks the attribute value againstSAFE_FOR_XMLandcontinues — dropping the attribute — before it reaches theforceKeepAttrguard. That order is deliberate upstream (DOMPurifyfa542df7, shipped in 3.1.6, "safer hooks"), and it is unchanged through the current release, soforceKeepAttris the wrong lever here rather than something a version bump fixes.Only
Composition#insertHTMLpassesSAFE_FOR_XML: true, which is why loading a document keeps the attachment while pasting the same markup loses it.So instead of relying on
forceKeepAttr, stash thedata-trix-*values inuponSanitizeAttributeand restore them inafterSanitizeAttributes, once DOMPurify has finished with the node. Nothing else is rescued: every other attribute still loses these values underSAFE_FOR_XML, anddata-trix-serialized-attributesis still stripped.