Cancel the default paste when Trix handles a paste as a file paste

action_text-trix/app/assets/javascripts/trix.js

@@ -13484,6 +13484,7 @@ $\
         };
       } else if (processableFilePaste(this.event)) {
         var _this$delegate22;
+        this.event.preventDefault();
         paste.type = "File";
         paste.file = dataTransfer.files[0];
         (_this$delegate22 = this.delegate) === null || _this$delegate22 === void 0 || _this$delegate22.inputControllerWillPaste(paste);

src/test/system/level_2_input_test.js

@@ -205,6 +205,25 @@ testGroup("Level 2 Input", testOptions, () => {
     expectDocument(`${OBJECT_REPLACEMENT_CHARACTER}\n`)
   })
 
+  test("pasting a file alongside HTML cancels the browser's default paste", async () => {
+    const file = await createFile()
+    const dataTransfer = createDataTransfer({
+      "text/html": "<img src=x data-trix-serialized-attributes='{\"onerror\":\"alert(1)\"}'>",
+      "text/plain": "x",
+      Files: [ file ],
+    })
+
+    const inputEvent = createEvent("beforeinput", { inputType: "insertFromPaste", dataTransfer })
+    const notPrevented = document.activeElement.dispatchEvent(inputEvent)
+    await delay(60)
+
+    assert.notOk(notPrevented, "the default paste must be canceled so the browser cannot insert the clipboard HTML")
+
+    const attachments = getDocument().getAttachments()
+    assert.equal(attachments.length, 1, "the pasted file is inserted as an attachment")
+    assert.notOk(getEditorElement().value.includes("onerror"), "no attribute from the clipboard HTML survives")
+  })
+
   // "insertFromPaste InputEvent missing pasted files in dataTransfer"
   // - https://bugs.webkit.org/show_bug.cgi?id=194921
   test("pasting a file in Safari", async () => {

src/trix/controllers/level_2_input_controller.js

@@ -403,6 +403,7 @@ export default class Level2InputController extends InputController {
           return this.delegate?.inputControllerDidPaste(paste)
         }
       } else if (processableFilePaste(this.event)) {
+        this.event.preventDefault()
         paste.type = "File"
         paste.file = dataTransfer.files[0]
         this.delegate?.inputControllerWillPaste(paste)