Pasting from browser toolbar menu bypasses paste filters

[Arne]

1. Go to demo page
   

2. Paste some content (i.e. from MS Word) by choosing 'Edit' -> 'Paste' from the browser toolbar.
   

3. Switch to source mode and observe the garbage HTML.

Tested in WinXP (FF 3.6.15, IE8)

Seems nothing is listening to the document paste event.

[Wiktor Walc]

Looks similar to #7304

[Garry Yao]

Can you verify the bug is fixed on trunk?

[Arne]

Just pointing out that this relates to using the browser toolbar, not the editor toolbar, so in that it differs from #7304 it seems.

[Wiktor Walc]

Indeed, using "Edit -> Paste" from the browser toolbar makes the difference here. Confirmed in IE8 / Win 7.

[Garry Yao]

Link 2.x bug #756.

[Jakub Ś]

Looks to me like quite a critical issue.

There are 3 ways to bypass filters.

1. Using "Edit -> Paste"
2. Using Native browser Menu - just use CRTL + Right-click.
3. Using Drag and Drop from word directly to CKEditor.

All of those cases produce garbage HTML.

Issue has been reproducible in all browsers from CKEditor 3.0.

[Piotrek Koszuliński]

Fix for Firefox&IE

[Garry Yao]

7366.patch fails the following case:

1. Click "Paste" from browser toolbar menu;
2. On clipboard security popup choose "Allow";
   • Actual: Paste dialog opened;
   • Expected: Pasted succeed without dialog;

Besides, the patch is over-complicated, considering all we need is to invoke the editor paste command, providing a simplified one.

[Piotrek Koszuliński]

Patch 7366_2.patch doesn't work for me (tested on IE8 & Fx):

1. For quickly repeated ctrl+v IE throws security alert.
2. For native context menu and native menu bar it doesn't filter MSWord stuff.
3. Additionally - line endings differ from these in original plugin.js, so I had a problem with applying patch on Linux.

The way I'm testing (for v4 we've got playground and there it's easily visible if pasted content was handled by us, but for v3 we don't have it):

1. Set editor data to: <p>This is more <strong class="MsoNormal">sample text</strong>.</p>
2. Copy this in wysiwyg mode.
3. Paste into the editor.
4. Check in source mode if MsoNormal class was removed by filter.

[Piotrek Koszuliński]

7366.patch works for me, but it was missing one thing. For declined security alert opened by pasting from native context menu or menu bar it wasn't opening paste dialog. This is fixed by 7366_3.patch.

However I've checked now that this patch doesn't work with latest trunk version for pasting from menu bar. It throws some error related probably to dialog.

But with revision 7364 it works perfectly fine - all features are ok.

[Garry Yao]

The trunk is right now unstable to review this ticket, #8843 and #8849 need to be reviewed before hand.

[Garry Yao]

But anyway 7366_3 is still too drastic a change for v3, since it changes the paste event used for other browsers as well, my intention is to provide a dedicated patch only for the toolbar menu paste issue, so a simplified patch must be considered.

[Piotrek Koszuliński]

I believe there's another solution for all clipboard's problem. But I'm not sure it will be any simpler. The problem is caused by the fact that all browsers behave differently when they fire (before)paste events.

Anyway, I'm keeping finger crossed for you :)

[Garry Yao]

Ok, I come with a latest patch that fixes the above tcs while it need to be reviewed along with changes proposed in #8843 and #8849 (in order to have correct cursor positon).

[Piotrek Koszuliński]

I've checked 7366_4.patch and it seems to work correctly (I wasn't checking against #8843 and #8849). It stripped some features, but not critical ones. And it's definitely shorter :>. Gr8 job.

[Garry Yao]

Since it's almost reviewed, let's consider it for the release.

[spoutnik]

7366_4 is working like a charm (ubuntu ff11, winxp ff11, winxp ie8, win7 ie9, win7 ff10)

[Garry Yao]

The patch forces the paste dialog on Fx and Webkit which can be avoided.

[Garry Yao]

New patch should have exactly the same code path for IE (so it doesn't have to be retested on IE ) while fix the above mentioned issue.

[Piotrek Koszuliński]

I've found an issue on IE8.

1. click edit->paste (in native menu bar)
2. IE throws security alert
3. accept it
4. paste dialog will open
5. click edit->paste again
6. content will be pasted correctly

The same happens for ckeditor's context menu.

Maybe this is caused by ckeditor's commands which still fires the same native events than before, when now IE listens for different one. Note that in my patch I moved event name to the mainPasteEvent variable.

[Jakub Ś]

#8867 was marked as duplicate

[Frederico Caldeira Knabben]

Other than the above, I've noticed that CTRL+RIGHT-CLICK is not opening the security alert on IE9, which seems to be wrong (considering that we're not able to grab the "paste" event in time with IE).

[Garry Yao]

I'm unable to reproduce the tc in comment 22 with a ​default IE security configuration.

[Garry Yao]

Fixed with [7453].