fix(editor): Prevent clipboard xss injection

[r00gm]

Summary

There is no need for the extra sanitization of the clipboard data, since it's already done in the composable that renders the html.

It also fixes the issue of HTML NODE code

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/SEC-119/xss-vulnerability-when-pasting-into-canvas#comment-3c30c988

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[tomi]

🚀

[github-actions]

✅ All Cypress E2E specs passed

[cypress]

n8n    Run #6965

Run Properties:   Passed #6965  •  809b4b2ba7: 🌳 🖥️ browsers:node18.12.0-chrome107 🤖 r00gm 🗃️ e2e/*

Project	n8n
Branch Review	prevent-clpiboard-xss-injection
Run status	Passed #6965
Run duration	04m 45s
Commit	809b4b2ba7: 🌳 🖥️ browsers:node18.12.0-chrome107 🤖 r00gm 🗃️ e2e/*
Committer	r00gm
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	430
View all changes introduced in this branch ↗︎

[janober]

Got released with n8n@1.59.4

[z00z00z00]

Hello @janober @r00gm
May I have confirmation there is no issue ?
On 180fc4b, fix seems to be introduced ; but few minutes later fix is roll backed via
24a1fa9

Is there an issue or not ?

[tomi]

@z00z00z00 the change in commit 180fc4b didn't actually fix all the cases and it introduced other issues. That's why it was reverted. The actual fix is in commit 809b4b2

[z00z00z00]

Thanks @tomi for your reply.
However, this commit does not seem to be part of both releases 1.59.4 & 1.60.1 (or untagged yet ?)
https://github.com/n8n-io/n8n/compare/n8n@1.60.0...n8n@1.60.1
https://github.com/n8n-io/n8n/compare/n8n@1.59.3...n8n@1.59.4

[tomi]

@z00z00z00 Because of how our PR merge & patch release process works, the commit hashes don't match. PRs are squash merged, so all the commits in the PR are squashed into a single commit, which gets its own commit hash. For patch releases we cherry-pick the commits we want to introduce to the patch release, which also results in a separate hashes. The commits that include the fix are:

• b1cff1f for 1.60.1
• 20a99b9 for 1.59.4

Hope this clarifies the situation.