sanitize dynamic document attributes

2026-07-25 15:28:46 +03:00
parent 8830e03cf3
commit 99ac349ecc
3 changed files with 39 additions and 5 deletions
@@ -646,9 +646,7 @@ export default {
        return
      }

-      const container = document.createElement('div')
-
-      container.innerHTML = clipboardHtml
+      const container = new DOMParser().parseFromString(clipboardHtml, 'text/html').body

      const fieldNodes = [...container.querySelectorAll('dynamic-field[data-field][data-area]')]