When copying an image from a web page, browsers put both the bitmap (image/png) and an text/html fragment (<img src="https://site/…" alt="…">) on the clipboard. Verify the paste path (useFilePasteHandler + Slate's default HTML/text insertion): confirm that only the file upload happens and no <img src=…>/URL text is inserted into the composer or sent as body/formatted_body.
If any leak exists: when the clipboard contains files, preventDefault() the text/html insertion entirely. Add a unit test on the decision helper.
When copying an image from a web page, browsers put both the bitmap (`image/png`) and an `text/html` fragment (`<img src="https://site/…" alt="…">`) on the clipboard. Verify the paste path (`useFilePasteHandler` + Slate's default HTML/text insertion): confirm that only the file upload happens and no `<img src=…>`/URL text is inserted into the composer or sent as body/formatted_body.
If any leak exists: when the clipboard contains files, `preventDefault()` the text/html insertion entirely. Add a unit test on the decision helper.
jared
added this to the Features 2026-Q4 milestone 2026-09-17 16:10:05 -04:00
Verified headless: dispatched a paste into the composer with a DataTransfer carrying the PNG plustext/html<img src="https://evil.example/tracking/pic.png?utm_source=x" alt="Secret alt text">plustext/plain with that URL. Result: the upload card for image.png appeared and the composer stayed empty — no URL, no alt text; nothing but the file would be sent.
Made it explicit anyway (last commit): useFilePasteHandler now preventDefault()s whenever the clipboard carries files, so the editor's own HTML/text insertion can never run beside a file paste even if the Slate plugins change. Closing.
Verified headless: dispatched a paste into the composer with a `DataTransfer` carrying the PNG **plus** `text/html` `<img src="https://evil.example/tracking/pic.png?utm_source=x" alt="Secret alt text">` **plus** `text/plain` with that URL. Result: the upload card for `image.png` appeared and the composer stayed empty — no URL, no alt text; nothing but the file would be sent.
Made it explicit anyway (last commit): `useFilePasteHandler` now `preventDefault()`s whenever the clipboard carries files, so the editor's own HTML/text insertion can never run beside a file paste even if the Slate plugins change. Closing.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
When copying an image from a web page, browsers put both the bitmap (
image/png) and antext/htmlfragment (<img src="https://site/…" alt="…">) on the clipboard. Verify the paste path (useFilePasteHandler+ Slate's default HTML/text insertion): confirm that only the file upload happens and no<img src=…>/URL text is inserted into the composer or sent as body/formatted_body.If any leak exists: when the clipboard contains files,
preventDefault()the text/html insertion entirely. Add a unit test on the decision helper.Verified headless: dispatched a paste into the composer with a
DataTransfercarrying the PNG plustext/html<img src="https://evil.example/tracking/pic.png?utm_source=x" alt="Secret alt text">plustext/plainwith that URL. Result: the upload card forimage.pngappeared and the composer stayed empty — no URL, no alt text; nothing but the file would be sent.Made it explicit anyway (last commit):
useFilePasteHandlernowpreventDefault()s whenever the clipboard carries files, so the editor's own HTML/text insertion can never run beside a file paste even if the Slate plugins change. Closing.