Skip to content

Commit acc6789

Browse files
marin-bratanovmarin-bratanov
authored
docs(editor): paste cleanup initial (#258)
* docs(editor): paste cleanup initial * docs(editor): default values,note on content size * docs(editor): notes on pasting and behaviors * chore(editor): demo link * chore(editor): typos * chore(editor): typo * chore: typo
1 parent 8bbccdd commit acc6789

File tree

3 files changed

+140
-1
lines changed

3 files changed

+140
-1
lines changed

‎_contentTemplates/editor/general.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#app-must-sanitize-content
2+
The application must sanitize the content before passing it to the editor and, optionally, before saving it to its storage after obtaining it from the editor. It is up to the application to ensure there is no malicious content (such as input sanitization, XSS attack prevention and other security concerns).
3+
#end
4+
5+
#content-size-signalr
6+
Content in the editor can become very large. For example, the user may have pasted an entire document, or pasted content has an image that will get converted to its `base64` representation that is rather large. With a server-side Blazor application, large content can cause the SignalR connection to drop because the content might exceed its limit. To cater for such cases, you may need to increase that packet limit. You can do that with a line similar to this:
7+
8+
9+
**C#**
10+
11+
services.AddServerSideBlazor().AddHubOptions(o =>
12+
{
13+
o.MaximumReceiveMessageSize = 4 * 1024 * 1024; // 4MB
14+
});
15+
16+
#end

‎components/editor/overview.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,11 @@ You can use the following features to get or set the editor content:
9696

9797
* The `ValueChanged` [event]({%slug editor-events%}) lets you receive the value and act on it. If you use the `ValueChanged` event (no two-way binding), you can effectively cancel the user's input by not updating the view-model, or you can even alter it with something else.
9898

99-
>important The application must sanitize the content before passing it to the editor and, optionally, before saving it to its storage after obtaining it from the editor. It is up to the application to ensure there is no malicious content (such as input sanitization, XSS attack prevention and other security concerns).
99+
>important @[template](/_contentTemplates/editor/general.md#app-must-sanitize-content)
100100
101101

102+
@[template](/_contentTemplates/editor/general.md#content-size-signalr)
103+
102104
## Methods
103105

104106
The editor [reference](#component-reference) exposes the `ExecuteAsync` method which lets you call programmatically the tools and commands of the editor (such as the Bold too, or a Back Color tool, or inserting HTML).

‎components/editor/paste-cleanup.md‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
title: Paste Cleanup
3+
page_title: Editor - Paste Cleanup
4+
description: Paste Cleanup of the content of the Editor for Blazor, such as from MS Word.
5+
slug: editor-paste-cleanup
6+
tags: telerik,blazor,editor,paste,cleanup
7+
position: 70
8+
---
9+
10+
# Editor Paste Cleanup
11+
12+
The Telerik Editor component for Blazor can improve the quality of the content pasted into it by removing tags and attributes, and by fixing issues such as lists pasted from Microsoft Word.
13+
14+
#### In this article
15+
16+
17+
* [Basics](#basics)
18+
* [Paste Settings Features](#paste-settings-features)
19+
* [Notes](#notes)
20+
21+
22+
## Basics
23+
24+
To control the behavior of the editor when content is pasted, you can set the desired parameters to its `EditorPasteSettings` tag that you can find under the `EditorSettings` tag.
25+
26+
>caption Set pasting behaviors in the Telerik Editor
27+
28+
````CSHTML
29+
<p>Copy this paragraph that has some <font color="red" face="Courier New">inline font </font> and <span style="font-family:Impact, Charcoal, sans-serif;color:#ffffff;background-color:#3366ff;">inline styles</span> and <span data-id="some-metadata">paste it </span> in the Editor<!--I am a comment that will disappear-->.</p>
30+
31+
@* Some sample paste cleanup settings to showcase their usage- the first three ones are commonly used for MS Word and these are their default values *@
32+
33+
<TelerikEditor @bind-Value="@EditorValue">
34+
<EditorSettings>
35+
<EditorPasteSettings ConvertMsLists="true"
36+
RemoveMsClasses="true"
37+
RemoveMsStyles="true"
38+
RemoveHtmlComments="true"
39+
StripTags="@StripTags"
40+
RemoveAttributes="@RemoveAttributes">
41+
</EditorPasteSettings>
42+
</EditorSettings>
43+
</TelerikEditor>
44+
45+
The editor content as a string so you can see the differences with the original content above:
46+
<br />
47+
@EditorValue
48+
49+
@code {
50+
public string EditorValue { get; set; }
51+
public List<string> RemoveAttributes { get; set; } = new List<string>() { "data-id" };
52+
public List<string> StripTags { get; set; } = new List<string>() { "font" };
53+
}
54+
````
55+
56+
## Paste Settings Features
57+
58+
The following list describes the behaviors and functionality each parameter of the `EditorPasteSettings` provides:
59+
60+
* `ConvertMsList` - `bool` - If set to `true` (defaults to `true`), MS Word lists will be converted into HTML lists. By default, Word's list are paragraphs with the respective styling which is not accurate in html.
61+
62+
* `RemoveHtmlComments` - `bool` - If set to `true`, comments will be removed from the HTML.
63+
For example, `<!-- comment --> <p> content </p>` will result in `<p> content </p>`
64+
65+
* `RemoveAllAttributes` - `bool` - Determines whether all DOM attributes should be stripped. Takes precedence over `RemoveMsClasses`, `removeMsStyles`, `RemoveAttributes`.
66+
67+
* `RemoveMsClasses` - `bool` - If set to `true` (defaults to `true`), class attributes starting with `Mso` will be removed from the HTML. These are usually classes that come with content pasted from MS Word. For example, `<p class="MsoNormal">pasted from MS Word</p>` will result in `<p>pasted from MS Word</p>`.
68+
69+
* `RemoveMsStyles` - `bool`- If set to `true` (defaults to `true`), style attributes starting with `Mso` will be removed from the HTML. These are usually styles that come with content pasted from MS Word. For example, `<p><span style="color:#7C7C7C; mso-themecolor:accent3; mso-themeshade:191;">content</span></p>` will result in `<p><span style="color: #7C7C7C; background: silver;">content</span></p>`.
70+
71+
* `StripTags` - `List<string>` - Specifies a list of tags to be removed from the HTML. Child nodes of removed tags will be kept in place. For example. when `StripTags` is `{ "span" }` , pasting `<p><span lang=EN-US>content</span></p>` will result in `<p>content</p>`.
72+
73+
* `RemoveAttributes` - `List<string>` - Specifies the DOM attributes that should be removed from the HTML. For example, when set to `{ "lang" }` , pasting `<p><span lang=EN-US>content</span></p>` will result in `<p><span>content</span></p>`.
74+
75+
76+
77+
## Notes
78+
79+
This section provides information on a few key concepts and behaviors that you should be aware of:
80+
81+
* [Content Size](#content-size)
82+
* [Content Sanitization](#content-sanitization)
83+
* [Paste Text and Image from MS Word](#paste-text-and-image-from-ms-word)
84+
85+
86+
### Content Size
87+
@[template](/_contentTemplates/editor/general.md#content-size-signalr)
88+
89+
### Content Sanitization
90+
91+
>caution The content cleaning the editor performs happens on paste only. The user can still alter the HTML and if you are sending or receiving data over the wire, there is a chance such requests can be intercepted and altered maliciously if the application is not secured. Therefore, the paste cleanup functionality of the editor cannot and does not replace content sanitization according to the application's standards and logic.
92+
>
93+
> @[template](/_contentTemplates/editor/general.md#app-must-sanitize-content)
94+
95+
96+
The editor clears `<script>` tags and removes DOM event handler attributes (e.g., `<img onerror="code();" onclick="otherCode();" alt="lorem ipsum" />` will become `<img alt="lorem ipsum" />`). The user can still alter this and data can be modified during transmission as well, as explained above.
97+
98+
>tip To clean up content and ensure it is safe, before you store and reuse it, you can consider ready-made HTML sanitization libraries that are available on free package sources like nuget.org. While Telerik is not in a position to recommend particular packages, we recommend you consider such an approach.
99+
100+
### Paste Text and Image from MS Word
101+
102+
If you copy both text and an image from MS Word and paste in the Editor, the image will not get pasted as expected. This behavior is due to the security policy of the browser.
103+
104+
Instead of reading the image data and loading it as a `base64` string to the `src` attribute of the `<img> `element, the browser generates an `<img>` tag which points to the clipboard location of the file on the client machine.
105+
106+
A browser is not allowed to access such a resource, and so it throws an error and the image is not rendered which you can verify in the browser dev tools console, you will see an error such as: `"Not allowed to load local resource: <some image path>"`.
107+
108+
You can read more about this in <a href="https://stackoverflow.com/questions/39007243/cannot-open-local-file-chrome-not-allowed-to-load-local-resource" target="_blank">this StackOverflow thread</a>.
109+
110+
#### Work Around
111+
112+
To work around this browser behavior, copy only the text or a single image from the MS Word document, and paste the image in the content area of the Editor separately.
113+
114+
By default, the browser allows you to copy and paste a single image from Word in the Editor by converting its `src` to a `base64` string.
115+
116+
If you paste more images at the same time, their `src` attributes will not be converted to `base64` strings and the browser will paste them with their `http` protocol and `URL` pointing to the physical folder which will result in the error described above.
117+
118+
## See Also
119+
120+
* [Editor Overview]({%slug editor-overview%})
121+
* [Live Demo: Paste Cleanup](https://demos.telerik.com/blazor-ui/editor/paste-cleanup)

0 commit comments

Comments
 (0)