Merge branch 'fix/webkitgtk-clipboard-image-paste' into 'main'

fix: paste images copied from a browser on WebKitGTK

Closes #245

See merge request ArkHost/HelixNotes!5

README.md

@@ -1,7 +1,7 @@
 # HelixNotes
 
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-blue.svg)](https://gitlab.com/ArkHost/HelixNotes/-/blob/main/LICENSE)
-[![Latest Release](https://img.shields.io/badge/release-v1.3.4-green)](https://gitlab.com/ArkHost/HelixNotes/-/releases/v1.3.4)
+[![Latest Release](https://img.shields.io/badge/release-v1.3.5-green)](https://gitlab.com/ArkHost/HelixNotes/-/releases/v1.3.5)
 [![Website](https://img.shields.io/badge/web-helixnotes.com-purple)](https://helixnotes.com)
 [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20macOS%20%7C%20Android-lightgrey)]()
 
@@ -10,7 +10,7 @@ A local markdown note-taking app built with Tauri, SvelteKit, and Rust.
 Your notes are stored as standard Markdown files on your local filesystem.
 No cloud, no lock-in.
 
-## Download (v1.3.4)
+## Download (v1.3.5)
 
 ### Linux
 
@@ -18,7 +18,7 @@ No cloud, no lock-in.
 
 The AppImage works only on Fedora 43+, Arch Linux, and openSUSE Tumbleweed (x86_64).
 
-[Download AppImage](https://download.helixnotes.com/releases/v1.3.4/HelixNotes_1.3.4_amd64.AppImage)
+[Download AppImage](https://download.helixnotes.com/releases/v1.3.5/HelixNotes_1.3.5_amd64.AppImage)
 
 #### Distro-specific packages
 
@@ -108,26 +108,28 @@ sudo eopkg it helixnotes
 
 #### Manual package downloads
 
-- [.deb](https://download.helixnotes.com/releases/v1.3.4/HelixNotes_1.3.4_amd64.deb) (Ubuntu 22.04+)
-- [.rpm](https://download.helixnotes.com/releases/v1.3.4/HelixNotes-1.3.4-1.x86_64.rpm)
+- [.deb](https://download.helixnotes.com/releases/v1.3.5/HelixNotes_1.3.5_amd64.deb) (Ubuntu 22.04+)
+- [.rpm](https://download.helixnotes.com/releases/v1.3.5/HelixNotes-1.3.5-1.x86_64.rpm)
 
 ### Windows
 
-[Download Installer](https://download.helixnotes.com/releases/v1.3.4/HelixNotes_1.3.4_x64-setup.exe) (Windows 10/11)
+[Download Installer](https://download.helixnotes.com/releases/v1.3.5/HelixNotes_1.3.5_x64-setup.exe) (Windows 10/11)
 
 ### macOS
 
-[Download .dmg (Apple Silicon)](https://download.helixnotes.com/releases/v1.3.4/HelixNotes_1.3.4_aarch64.dmg) (M-series Macs)
+[Download .dmg (Apple Silicon)](https://download.helixnotes.com/releases/v1.3.5/HelixNotes_1.3.5_aarch64.dmg) (M-series Macs)
 
-> **"HelixNotes is damaged and can't be opened"?** The app isn't damaged. The macOS build isn't notarized by Apple yet, so Gatekeeper blocks it on Apple Silicon. Run this once in Terminal, then open it normally (you'll need to redo it after each update):
->
-> ```bash
-> xattr -cr /Applications/HelixNotes.app
-> ```
+[Download .dmg (Intel)](https://download.helixnotes.com/releases/v1.3.5/HelixNotes_1.3.5_x64.dmg)
+
+The Apple Silicon build is signed and notarized by Apple. The Intel build may still trigger a Gatekeeper warning. If macOS reports that the Intel build is damaged, run this once after installing or updating it:
+
+```bash
+xattr -cr /Applications/HelixNotes.app
+```
 
 ### Android
 
-[Download APK](https://download.helixnotes.com/releases/v1.3.4/HelixNotes_1.3.4_android.apk)
+[Download APK](https://download.helixnotes.com/releases/v1.3.5/HelixNotes_1.3.5_android.apk)
 
 ---
 

src/lib/components/Editor.svelte

@@ -5629,17 +5629,20 @@
 			}
 			return true;
 		}
-		// WebKitGTK fallback (bug #218519): older WebKitGTK versions return
-		// empty DataTransferItemList for image pastes. Detect this and read
-		// the image directly from the system clipboard via Rust/arboard.
-		if (items.length === 0) {
-			const hasText = event.clipboardData!.getData('text/plain');
-			const hasHtml = event.clipboardData!.getData('text/html');
-			if (!hasText && !hasHtml) {
-				event.preventDefault();
-				insertClipboardImage();
-				return true;
-			}
+		// WebKitGTK fallback (bug #218519): WebKitGTK never exposes a clipboard image
+		// through DataTransfer, so the loop above cannot fire on Linux and this is the
+		// only path that can work there. The guard used to also require an empty
+		// DataTransferItemList and no text/html, which no real image copy satisfies:
+		// Chromium's "Copy image" writes an <img> HTML fragment alongside the bitmap
+		// (but no text/plain), so the image was dropped and its remote URL pasted
+		// instead. Key off text/plain, and accept HTML that is just an <img>.
+		const hasText = event.clipboardData!.getData('text/plain');
+		const html = event.clipboardData!.getData('text/html');
+		const htmlIsBareImage = /^\s*(?:<meta[^>]*>\s*)?<img\b[^>]*>\s*$/i.test(html);
+		if (!hasText && (!html || htmlIsBareImage)) {
+			event.preventDefault();
+			insertClipboardImage();
+			return true;
 		}
 		return false;
 	}