Skip to content

Conversation

@VladaHarbour
Copy link
Contributor

Hi @harbournick!
document.execCommand("paste") was deprecated due to security issues. The recommended way to do copy/paste is the one with Clipboard API

@VladaHarbour VladaHarbour self-assigned this Feb 2, 2026
@linear
Copy link

linear bot commented Feb 2, 2026

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee04e063c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines 64 to 80
if (hasPermission && navigator.clipboard && navigator.clipboard.read) {
try {
const items = await navigator.clipboard.read();
for (const item of items) {
if (item.types.includes('text/html')) {
html = await (await item.getType('text/html')).text();
}
if (item.types.includes('text/plain')) {
text = await (await item.getType('text/plain')).text();
}
}
} catch {
try {
text = await navigator.clipboard.readText();
} catch {}
}
}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add readText fallback when clipboard.read is unsupported

In environments where navigator.clipboard.read is not implemented (e.g., Safari), this function returns empty content without attempting navigator.clipboard.readText(). Since the slash-menu paste action now relies solely on readClipboardRaw, paste will become a no-op in those browsers even though plain text reading is supported. Consider falling back to readText() when read is missing (not just when it throws) to avoid a regression in non-HTML clipboard support.

Useful? React with 👍 / 👎.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this relevant @VladaHarbour ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was fixed(marked as Outdated)

Copy link
Collaborator

@harbournick harbournick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 SD Review Bot

Non-diff Issues

🤖 [Review Bot: Major] Missing test coverage for readClipboardRaw() in clipboardUtils.test.js. The new function has multiple fallback paths (read → readText → empty) and should have tests covering:

  1. Successful HTML + text read
  2. read() fails, falls back to readText()
  3. read() unavailable, uses readText() directly
  4. All clipboard access denied (returns empty strings)

See inline comments for line-specific items.

* Reads raw HTML and text from the system clipboard (for use in paste actions).
* @returns {Promise<{ html: string, text: string }>}
*/
export async function readClipboardRaw() {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 [Review Bot: Major] This function duplicates clipboard reading logic from readFromClipboard() (lines 96-120). Both check permissions, try read() for HTML/text, and fall back to readText().

Consider refactoring readFromClipboard to use this function internally:

export async function readFromClipboard(state) {
  const { html, text } = await readClipboardRaw();
  // ... parse html/text to ProseMirror content
}

This reduces maintenance burden and ensures both paths stay in sync.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

trying out this review bot.. ignore if not helpful. seems worth looking at though

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants