Unexpected HTML escape character translation errors during pasting and source code switching

[letsbug]

📝 Provide detailed reproduction steps (if any)

1. Copy a link string that contains HTML escape characters, such as “https://example.com/about?param=1&timestamp=times”
2. Paste this link into any of CKEditor's builds

✔️ Expected result

What I want is the original link I copied.

❌ Actual result

But i got the following result:
https://example.com/about?param=1xtamp=times

❓ Possible solution

If you have ideas, you can list them here. Otherwise, you can delete this section.

📃 Other details

• Browser: …
• OS: …
• First affected CKEditor version: …
• Installed CKEditor plugins: …

---

If you'd like to see this fixed sooner, add a 👍 reaction to this post.

[Reinmar]

Also, as a link's href:

Works for me. Unless you mean some other use case?

[letsbug]

I'm not sure what triggers it, here is a screen recording of my actions：

[Witoso]

We still cannot reproduce it. Please check with the bare browser with no extensions (e.g, incognito). It's possible that somehow your clipboard content was changed by something.

[letsbug]

It's fine on just one device, but what confuses me is that I have the same problem on other devices. I recorded this using incognito mode on another device：

ps: I've tried it with a previously installed virtual machine, and it's the same problem. No other software is installed, using a built-in browser.

[letsbug]

Here are the results from another device:

[Witoso]

I recommend checking the clipboard's content, I, personally, use Pasteboard viewer.

[letsbug]

This is the result of checking with Pasteboard viewer

[Witoso]

I reproduced this on the latest Safari/Chrome when using the option "Copy Link Address".

[Witoso]

This is interesting, is it possible that the & char is joined with a few more chars, and produce a new one, like x (unicode addition?)

Another example:

https://github.com/ckeditor/ckeditor5/issues/15036#issuecomment-1754653408?param1=asd&param2=gdfg

Creates after pasting:

https://github.com/ckeditor/ckeditor5/issues/15036#issuecomment-1754653408?param1=asd¶m2=gdfg

@niegowski any thoughts?

[niegowski]

Looks like plainTextToHtml() should escape all & characters but currently it does not.

ckeditor5/packages/ckeditor5-clipboard/src/utils/plaintexttohtml.ts

Lines 16 to 31 in 70d7593

	export default function plainTextToHtml( text: string ): string {
	text = text
	// Encode <>.
	.replace( /</g, '&lt;' )
	.replace( />/g, '&gt;' )
	// Creates a paragraph for each double line break.
	.replace( /\r?\n\r?\n/g, '</p><p>' )
	// Creates a line break for each single line break.
	.replace( /\r?\n/g, '<br>' )
	// Replace tabs with four spaces.
	.replace( /\t/g, '&nbsp;&nbsp;&nbsp;&nbsp;' )
	// Preserve trailing spaces (only the first and last one – the rest is handled below).
	.replace( /^\s/, '&nbsp;' )
	.replace( /\s$/, '&nbsp;' )
	// Preserve other subsequent spaces now.
	.replace( /\s\s/g, ' &nbsp;' );