Expected Findings
- Paste handler reads `text/html` from the clipboard and writes via `innerHTML`.
- Sanitizer was added once and removed for keeping styled content.
- Same handler is reused across the comments and DM surfaces.
Paste Handler
Clipboard Paste XSS
The rich-paste handler reads `clipboardData` and writes it via `innerHTML`, so a copied snippet from a malicious page can execute script in the user's session.
CWE-79
Paste here
paste a payload
Primary Flows
- Paste handler source Shows the bug
Signals
Bug
el.innerHTML = e.clipboardData.getData("text/html")