diff --git a/addons/web_editor/static/src/js/editor/odoo-editor/src/OdooEditor.js b/addons/web_editor/static/src/js/editor/odoo-editor/src/OdooEditor.js index 48baaded4e1..c94e7c6592e 100644 --- a/addons/web_editor/static/src/js/editor/odoo-editor/src/OdooEditor.js +++ b/addons/web_editor/static/src/js/editor/odoo-editor/src/OdooEditor.js @@ -3922,7 +3922,20 @@ export class OdooEditor extends EventTarget { const clipboardHtml = ev.clipboardData.getData('text/html'); if (odooEditorHtml) { const fragment = parseHTML(odooEditorHtml); + + // DOMPurify.sanitize remove an attribute that contains a ">" for + // security reasons. Make an exception for `data-behavior-props`. + // Encoding it hides the character ">". + for (const el of fragment.querySelectorAll('[data-behavior-props]')) { + el.setAttribute('data-behavior-props', encodeURIComponent(el.getAttribute('data-behavior-props'))); + } + DOMPurify.sanitize(fragment, { IN_PLACE: true }); + + for (const el of fragment.querySelectorAll('[data-behavior-props]')) { + el.setAttribute('data-behavior-props', decodeURIComponent(el.getAttribute('data-behavior-props'))); + } + if (fragment.hasChildNodes()) { this.execCommand('insert', fragment); }