Belén Albeza 577cbe43e4

🐛 Validate the text payload before pasting it (#12612) ...

Text copied in Penpot carries its content in a data attribute of the
clipboard HTML, which plugins and other apps can rewrite. The v3 editor
and canvas paste used it as is, so bad data could reach WASM and the
file and break the shape.

The payload is now dropped, and the paste falls back to plain text in
the caret style, unless its content passes the text shape schema, its
span geometry holds only safe numbers and its file and team ids are
uuids. Payloads in HTML over the paste size limit are not decoded.

Copied text shapes pasted into the editor get the same checks, plus a
numeric position; when they fail, nothing is pasted.

Closes #12167

AI-assisted-by: claude-opus-5-5

2026-10-26 12:36:13 +01:00

..

frontend_tests

🐛 Validate the text payload before pasting it (#12612)

2026-10-26 12:36:13 +01:00