Copy and pasting from a document into the title field is including hidden html tags

[mikeyott]

As the title describes, if you copy and paste from a (Word) document and into the title field of a new or existing post, hidden html tags come along for the ride.

How to replicate

• Open a Word document that contains text with formatting. For example, italic text.
• Highlight and copy the italicised text to the clipboard.
• Create a new page.
• Paste into the title field.
• Click Publish.

You will now see the confirmation dialogue read something like this...

<em>The page title here</em> is now live.

...yes, with the actual html tags visible.

When you view the All Pages screen, you will also see the title has the <em> opening and closing tags as well. The only way to remove them is to click Quick Edit and do it manually.

I'm not sure if this has any security implications (maybe someone with that expertise can chime in here) but I do wonder how it would behave if someone was copy/pasting content from a website if the content contained a (malicious) <script> tag.

Note: I was able to replicate this issue with all plugins disabled, running the latest version of Twenty Twenty-Three theme and latest version of WordPress 6.1.1 (latest at time of this bug report).

[audrasjb]

Hello and thank you for opening this ticket,

I think it is an intended behavior: some (inline) HTML tags are allowed in the post title so they are not stripped.

But all HTML tags are not allowed. <script>, for exemple, is of course automatically stripped :)

[audrasjb]

Related: Ticket #57265 suggests to strip tags from the Post list table screen.

[danielbachhuber]

Thanks for the report, @mikeyott !

@audrasjb I think this was fixed in Gutenberg 14.6? ​https://github.com/WordPress/gutenberg/pull/35825

It doesn't look like 14.6 has been included in a release yet: ​https://developer.wordpress.org/block-editor/contributors/versions-in-wordpress/

[audrasjb]

Oh great, thanks for the info @danielbachhuber!
This is indeed already scheduled for 6.2, which is perfect.

We can close this ticket as reported-upstream when this change gets merged into core.
Thanks everyone 🙌

[mikeyott]

Awse - thanks for the update. I'll consider this matter closed.

[ironprogrammer]

Following up on comment:4, closing this ticket as reported-upstream since 6.2 has already shipped a fix.