From 0a2f976376ddd772e500e8abc8af37584d599aaa Mon Sep 17 00:00:00 2001
From: waterWang <waterWang@users.noreply.github.com>
Date: Wed, 12 Aug 2026 03:14:41 +0800
Subject: [PATCH] fix: respect tool's sanitize config when building paste
 sanitizer rules

When pasting HTML content, the editor's paste module builds sanitizer
configuration from pasteConfig.tags, but ignored the tool's static
sanitize() configuration. This caused style attributes (and other
allowed attributes) to be stripped from paste elements before reaching
the tool's onPaste handler.

Fix:
1. In processDataTransfer (first sanitization pass): when building the
   per-tag sanitizer config, fall back to the tool's sanitizeConfig
   for that tag if no explicit pasteConfig sanitization is provided.
2. In processHTML (second sanitization pass): same fallback logic, and
   use tool.sanitizeConfig (which includes the tool's own sanitize()
   rules) instead of tool.baseSanitizeConfig (which only includes
   inline tools and tunes config).

Fixes #2984
---
 src/components/modules/paste.ts | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/src/components/modules/paste.ts b/src/components/modules/paste.ts
index 6a8378c41..b8e35f0f6 100644
--- a/src/components/modules/paste.ts
+++ b/src/components/modules/paste.ts
@@ -204,11 +204,26 @@ export default class Paste extends Module {
 
     /** Add all tags that can be substituted to sanitizer configuration */
     const toolsTags = Object.keys(this.toolsTags).reduce((result, tag) => {
+      const tagLowerCase = tag.toLowerCase();
+
       /**
        * If Tool explicitly specifies sanitizer configuration for the tag, use it.
-       * Otherwise, remove all attributes
+       * Otherwise, check if the tool's sanitize config has rules for this tag.
+       * If not, remove all attributes.
        */
-      result[tag.toLowerCase()] = this.toolsTags[tag].sanitizationConfig ?? {};
+      const sanitizationConfig = this.toolsTags[tag].sanitizationConfig;
+
+      if (sanitizationConfig !== null) {
+        result[tagLowerCase] = sanitizationConfig;
+      } else {
+        const toolSanitizeConfig = this.toolsTags[tag].tool.sanitizeConfig;
+
+        if (toolSanitizeConfig?.[tagLowerCase]) {
+          result[tagLowerCase] = toolSanitizeConfig[tagLowerCase];
+        } else {
+          result[tagLowerCase] = {};
+        }
+      }
 
       return result;
     }, {});
@@ -656,15 +671,16 @@ export default class Paste extends Module {
           const tags = this.collectTagNames(tagOrSanitizeConfig);
 
           tags.forEach((tag) => {
+            const tagLowerCase = tag.toLowerCase();
             const sanitizationConfig = _.isObject(tagOrSanitizeConfig) ? tagOrSanitizeConfig[tag] : null;
 
-            result[tag.toLowerCase()] = sanitizationConfig || {};
+            result[tagLowerCase] = sanitizationConfig ?? tool.sanitizeConfig[tagLowerCase] ?? {};
           });
 
           return result;
         }, {});
 
-        const customConfig = Object.assign({}, toolTags, tool.baseSanitizeConfig);
+        const customConfig = Object.assign({}, toolTags, tool.sanitizeConfig);
 
         /**
          * A workaround for the HTMLJanitor bug with Tables (incorrect sanitizing of table.innerHTML)