Mixed-content copy bypasses table sanitizer, preserves dark theme, and blanks headers
#6,063 opened on Jul 14, 2026
Repository metrics
- Stars
- (13,820 stars)
- PR merge metrics
- (PR metrics pending)
Description
Bug description
The fix for #4945 sanitizes an isolated full-table selection, but copying a normal assistant response containing mixed rendered content still falls back to native browser clipboard serialization.
When the selected range contains headings and one or more rendered Markdown tables, pasting into a web-based rich-text editor carries over Hermes WebUI's dark-theme presentation styling. The tables retain their rows and values, but each column-header row pastes as blank cells. This makes otherwise valid quote/report output unsuitable for direct use in external systems.
This remaining case was reported in a follow-up comment on #4945, but the closed issue was not reopened.
Steps to reproduce
-
Generate an assistant response containing a heading and multiple Markdown tables, for example:
## Monthly Summary ### Example Site A | Product Name | Qty | Unit Cost | Total | | --- | --- | --- | --- | | Example Service A | 10 | $1.00 | $10.00 | | **Monthly Subtotal** | | | **$10.00** | ### Example Site B | Product Name | Qty | Unit Cost | Total | | --- | --- | --- | --- | | Example Service B | 20 | $2.00 | $40.00 | | **Monthly Subtotal** | | | **$40.00** | -
Select the complete rendered response, including the headings and both tables.
-
Copy it from Hermes WebUI.
-
Paste it into a web-based rich-text editor.
Actual behavior
- Hermes WebUI dark backgrounds, text colors, borders, and spacing are preserved in the pasted content.
- Table body rows and values are present.
- The column-header row is rendered as empty cells. Labels such as
Product Name,Qty,Unit Cost, andTotalare missing. - The result differs from copying one complete table by itself because the mixed selection bypasses the table-only clipboard sanitizer.
Expected behavior
Copying a mixed rendered response should place clean, theme-neutral semantic HTML on the clipboard while preserving:
- headings and paragraphs;
- lists and emphasis;
- complete table structure;
- visible
<th>header text; - bold subtotal/total cells.
Hermes-specific classes, dark-theme colors/backgrounds, borders, fonts, spacing, and interactive/sortable-header controls should not be included in clipboard HTML.
A plain-text clipboard representation should also remain available as a readable Markdown or text fallback.
Regression / scope note
#4945 was closed by the full-table-only sanitizer released in v0.51.684. The implementation deliberately keeps native copy behavior for prose and mixed prose/table selections. That leaves the common workflow of selecting an entire assistant response unresolved.
This is therefore not a report that isolated full-table copying is still broken. It is the remaining mixed-content selection case exposed by the limited scope of the original fix.
Environment
- App: Hermes WebUI
- Surface: browser-based WebUI
- Source theme: dark
- Destination: web-based rich-text editor
- OS: Windows
- Reproduced after the #4945 fix was released
Suggested acceptance coverage
Add clipboard regression tests for selections that contain:
- heading + one complete table;
- heading + multiple complete tables;
- paragraph/list + table;
- mixed content before and after a table.
For each case, assert that text/html is theme-neutral, table headers remain visible semantic header cells, and text/plain remains readable.