Sichere Zwischenablage

Clipboard & Content Sanitization

Use this skill when implementing copy, cut, paste, or external content ingestion in visual and block editors.

Security First: Strict Allowlist Sanitization

1. Never Insert Unsanitized HTML or Active Content:
   • External clipboard data (text/html, text/uri-list) is untrusted user input.
   • Parse pasted HTML in an inert context (DOMParser or a strict sanitizer such as DOMPurify) and map it through an explicit schema allowlist before constructing editor nodes:
     • Strip all active/executable elements: <script>, <iframe>, <object>, <embed>, <svg onload>, <form>, <style>, <meta>, <link>.
     • Strip all inline event handlers and dangerous attributes: onerror, onload, onclick, style expressions that break editor layout (position: fixed/absolute, negative margins, z-index hijacking).
     • Validate URLs: Only allow safe URL schemes (https:, http:, mailto:, tel:, or approved relative paths) on links and media; reject javascript:, vbscript:, and untrusted data:text/html URIs.

Multi-Format Paste Resolution Pipeline

Inspect clipboardData in priority order and transform into valid schema transactions:

1. Internal Editor Slice (application/x-editor-slice or custom data attribute):
   • Preserve full block fidelity when copying and pasting within the editor.
   • Always regenerate block/node IDs on paste and remap internal links within the pasted slice so pasting never creates duplicate IDs in the document.
2. External Rich HTML (text/html from web pages, Word, Google Docs, Notion):
   • Normalize foreign wrapper noise (<meta>, MsoNormal, <b style="font-weight:normal">, inline font families) into semantic editor blocks and marks (headings, lists, tables, bold, italic, links).
3. Plain Text (text/plain):
   • Support plain-text paste (Cmd/Ctrl + Shift + V) and fallback when text/html is absent.
   • Convert paragraph breaks into blocks or preserve line breaks inside code blocks, and optionally parse safe URLs or Markdown patterns when appropriate.
4. Pasted / Dropped Files & Images (clipboardData.files):
   • Route pasted images/files through the project's validated upload pipeline (showing an upload placeholder/progress state and replacing with the permanent asset reference on completion, rather than persisting multi-megabyte base64 data: URLs directly inside the document JSON).

Checklist

• Is all pasted HTML parsed inertly and filtered through a strict schema allowlist (blocking <script>, javascript: URLs, event handlers, and layout-breaking inline styles)?
• Does copying and pasting blocks within the editor mint fresh unique IDs for all pasted nodes?
• Does plain-text paste (Cmd/Ctrl+Shift+V) work cleanly across single-line and multi-paragraph selections?
• Are pasted images/files uploaded through the storage pipeline instead of bloating the document with raw base64 strings?