nesquena/hermes-webui

Mixed-content copy bypasses table sanitizer, preserves dark theme, and blanks headers

Open

#6,063 opened on Jul 14, 2026

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Python (1,700 forks)github user discovery
bughelp wantedrenderersprint-candidate

Repository metrics

Stars
 (13,820 stars)
PR merge metrics
 (PR metrics pending)

Description

Bug description

The fix for #4945 sanitizes an isolated full-table selection, but copying a normal assistant response containing mixed rendered content still falls back to native browser clipboard serialization.

When the selected range contains headings and one or more rendered Markdown tables, pasting into a web-based rich-text editor carries over Hermes WebUI's dark-theme presentation styling. The tables retain their rows and values, but each column-header row pastes as blank cells. This makes otherwise valid quote/report output unsuitable for direct use in external systems.

This remaining case was reported in a follow-up comment on #4945, but the closed issue was not reopened.

Steps to reproduce

  1. Generate an assistant response containing a heading and multiple Markdown tables, for example:

    ## Monthly Summary
    
    ### Example Site A
    
    | Product Name | Qty | Unit Cost | Total |
    | --- | --- | --- | --- |
    | Example Service A | 10 | $1.00 | $10.00 |
    | **Monthly Subtotal** |  |  | **$10.00** |
    
    ### Example Site B
    
    | Product Name | Qty | Unit Cost | Total |
    | --- | --- | --- | --- |
    | Example Service B | 20 | $2.00 | $40.00 |
    | **Monthly Subtotal** |  |  | **$40.00** |
    
  2. Select the complete rendered response, including the headings and both tables.

  3. Copy it from Hermes WebUI.

  4. Paste it into a web-based rich-text editor.

Actual behavior

  • Hermes WebUI dark backgrounds, text colors, borders, and spacing are preserved in the pasted content.
  • Table body rows and values are present.
  • The column-header row is rendered as empty cells. Labels such as Product Name, Qty, Unit Cost, and Total are missing.
  • The result differs from copying one complete table by itself because the mixed selection bypasses the table-only clipboard sanitizer.

Expected behavior

Copying a mixed rendered response should place clean, theme-neutral semantic HTML on the clipboard while preserving:

  • headings and paragraphs;
  • lists and emphasis;
  • complete table structure;
  • visible <th> header text;
  • bold subtotal/total cells.

Hermes-specific classes, dark-theme colors/backgrounds, borders, fonts, spacing, and interactive/sortable-header controls should not be included in clipboard HTML.

A plain-text clipboard representation should also remain available as a readable Markdown or text fallback.

Regression / scope note

#4945 was closed by the full-table-only sanitizer released in v0.51.684. The implementation deliberately keeps native copy behavior for prose and mixed prose/table selections. That leaves the common workflow of selecting an entire assistant response unresolved.

This is therefore not a report that isolated full-table copying is still broken. It is the remaining mixed-content selection case exposed by the limited scope of the original fix.

Environment

  • App: Hermes WebUI
  • Surface: browser-based WebUI
  • Source theme: dark
  • Destination: web-based rich-text editor
  • OS: Windows
  • Reproduced after the #4945 fix was released

Suggested acceptance coverage

Add clipboard regression tests for selections that contain:

  1. heading + one complete table;
  2. heading + multiple complete tables;
  3. paragraph/list + table;
  4. mixed content before and after a table.

For each case, assert that text/html is theme-neutral, table headers remain visible semantic header cells, and text/plain remains readable.

Contributor guide