Bug 246842 – Clipboard sanitization corrupting visible contents

• Component: DOM
• Status: RESOLVED CONFIGURATION CHANGED

[Jamie Birch]

Created attachment 463132 [details]
HTML file reproducing the issue.

STR:

1: Open the attachment via the file system (or, if hosting it online, make sure that the copy and paste actions are performed on separate domains, in order to trigger clipboard sanitisation): clipboard_sanitisation_corrupting_visible_contents.html

2. Follow the instructions to write to, and read from, the clipboard.

3. Read the validation message.

Expected results:
A green message saying "Valid!" should appear, indicating that the structure of a <ruby> element side-by-side with a <span>Skytree</span> element has been preserved.

Actual results:
A red message appears, indicating that the <span>Skytree</span> element has been erroneously appended into the <ruby> element due to the </ruby> closing tag being lost. The result is that the visible contents are corrupted.

Cause:
The presence of the <rp> elements (being non-visible elements) seems to trigger this loss of the </ruby> closing tag. That is to say, if the <rp> elements are removed from the initial input, then the </ruby> closing tag survives.

Relevant WebCore code:
https://searchfox.org/wubkat/rev/2231e02d13486d2d164b219751b6316ef9502b30/Source/WebCore/editing/markup.cpp#1005

Chrome 106.0.5249.119 and Firefox 106.0.1 (with the dom.events.asyncClipboard.clipboardItem preference set to true) both produce the expected result.

[Karl Dubost]

Created attachment 463139 [details]
rendering in Safari, chrome, firefox

```
Validation result: Expected document.body.firstElementChild.nextSibling to be <span>Skytree</span>, but instead it was: null. <span>Skytree</span> was erroneously appended into the <ruby> element.
```

[Radar WebKit Bug Importer]

<rdar://problem/101662525>

[Ahmad Saleem]

Just checked in WebKit ToT (263978@main), we are getting 'Valid!' similar to other browsers. (Used Mini-browser). Even Safari Technology Preview 169 works.

Marking this as "RESOLVED CONFIGURATION CHANGED". Thanks!