codex-team / codex-team/editor.js

pasteConfig ignores tool's sanitize rules - style attributes stripped before onPaste receives element

Open
#2,984 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
31.9k
Forks
2.2k
Avg merge
1d 1h
Merged PRs (30d)
1

Description

When pasting HTML content, the sanitizer strips attributes from elements before they reach the tool's onPaste method, even when the tool's static get sanitize() explicitly allows those attributes.

**Steps to reproduce:**

1. Create a custom Block Tool with pasteConfig for P tags and sanitize rules to preserve style:

```javascript
class MyTool {
static get pasteConfig() {
return {
tags: ['P', 'DIV']
};
}

static get sanitize() {
return {
p: {
style: true
}
};
}

static get pasteConfig() {
return {
tags: ['P', 'DIV', 'SPAN', 'PRE', 'CODE', 'BR']
};
}

onPaste(event) {
if (event.type === 'tag') {
const element = event.detail.data;
console.log('Received element:', element.outerHTML);
console.log('Style attribute:', element.getAttribute('style'));
}
}
}
```

2. Sanitizer rules at Editor config level:
```javascript
sanitizer: {
br: true,
b: true,
i: true,
a: {
href: true
}
}
```
2. Copy content from Google Docs that has paragraph indentation (which comes as CSS text-indent: 36pt or margin-left: 36pt in the clipboard HTML)

3. Paste into Editor.js

**Expected behavior:**
```javascript

Lorem ipsum...


```

**Actual behavior**
```javascript

Lorem ipsum...


```

Version: "@editorjs/editorjs": "^2.29.0",

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.