Skip to content

fix: don't leak HTML comment content into pasted paragraph text#1221

Merged
appflowy merged 1 commit into
fix/korean_imefrom
cherry/comment-leak-onto-korean-ime
Jul 7, 2026
Merged

fix: don't leak HTML comment content into pasted paragraph text#1221
appflowy merged 1 commit into
fix/korean_imefrom
cherry/comment-leak-onto-korean-ime

Conversation

@appflowy

@appflowy appflowy commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

Cherry-pick of the fix already merged to main via #1220, onto fix/korean_ime since AppFlowy-Premium's pubspec.yaml pins appflowy_editor to this branch (it carries commits not yet on main).

  • _parseDeltaElement's fallback branch called child.text on any non-Element DOM node, including dom.Comment (whose .text getter aliases its raw data). A real HTML comment embedded inline in pasted content — e.g. the internal tracking marker Google's Search AI Overview panel injects when you copy its answer text — would surface as visible garbage text in the editor instead of being silently dropped.
  • Fix mirrors the pattern _parseElement already uses one level up: only extract text from dom.Text nodes; other node types are skipped.
  • Cherry-picked cleanly from main (bb99582), no conflicts — only one other commit on this branch touches the same file and it edits an unrelated region.

Test plan

  • flutter test test/customer/html_document_test.dart — new regression test passes
  • Confirmed identical hang in test/render/image/image_upload_widget_test.dart pre-exists on fix/korean_ime even without this commit (unrelated pre-existing issue, not a regression from this change)

🤖 Generated with Claude Code

https://claude.ai/code/session_014Nps55LWFpd6VBJkPX5cap

_parseDeltaElement's fallback branch called child.text on any
non-Element DOM node, including dom.Comment (whose .text getter
aliases its raw data). This let real HTML comments -- e.g. the
internal tracking marker Google's AI Overview panel injects when
you copy its answer text -- surface as visible garbage in the
editor. Skip non-Text nodes here, matching the dom.Text check
_parseElement already does one level up.
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@appflowy appflowy merged commit a056137 into fix/korean_ime Jul 7, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants