Figures aren't stripped when pasting content, even with pasteImages false and removing the figure tag from pasteBlockTags

[thijskaspers]

Description

Figures aren't stripped when pasting content, even with pasteImages set to false and removing the figure tag from pasteBlockTags.

We use the config below:

{
    "description": "Full editor including formatting options with headings",
    "buttons": [
        "format",
        "bold",
        "italic",
        "underline",
        "lists",
        "link",
        "file",
        "html"
    ],
    "formatting": [
        "p",
        "h2",
        "h3",
        "h4"
    ],
    "plugins": [
        "fullscreen"
    ],
    "toolbarFixed": true,
    "linkNewTab": true,
    "pasteImages": false,
    "autoparseImages": false,
    "autoparseVideo": false,
    "pasteInlineTags": [
        "a", "br", "strong", "del" ,"sup", "sub", "small", "b", "u", "em", "i"
    ],
    "pasteBlockTags": [
        "h2", "h3", "h4", "h5", "h6", "table", "tbody", "thead", "tfoot", "th", "tr", "td", "ul", "ol", "li", "p"
    ]
}

It works perfectly for pasting img tags, they are stripped/cleaned, but a <figure> tag with an <img> inside isn't. Even classes and inline styles on the <figure> tag aren't stripped.

Is this a Redactor bug or does it have something to do with Craft's implementation of Redactor?

The Redactor config has the pasteBlockTags option, as explained here: https://imperavi.com/redactor/docs/settings/paste/#s-pasteblocktags. Figure is one of the tags that can be removed, but it doesn't work. To test if pasteBlockTags is working, we've removed all tags with [] and see that everything is stripped just fine, except for the figure.

The only thing that does work is setting pastePlainText to true; then figures are stripped somehow in combination with pasteImages and autoparseImages both set to false. However, pastePlainText on true is very inconvenient for clients. It will remove headings and doesn't paste paragraphs correctly, so if you want a single line changed into a paragraph, it will turn the entire textarea into a heading. You'd have to work your way through the content to give a hard enter/newline before/after each heading to fix this.

Steps to reproduce

1. Use the config as shown above
2. Paste content with a element into a rich text Redactor field

Additional info

• Craft version: 4.3.0
• PHP version: 8.1.11
• Database driver & version: MySQL 10.6.10 (MariaDB 10.6)
• Plugins & versions: Redactor 3.0.2