convert Block Editor HTML to ProseMirror JSON on save (server-side)

[hassandotcms]

What

Converts Story Block (Block Editor) field values sent as HTML to Tiptap/ProseMirror JSON server-side, on the shared content save path — completing the HTML criterion deferred from #36002. Non-interactive clients (AI agents, headless imports) no longer need a human to open and re-save the contentlet for an HTML value to read back as structured content.

How

• New TiptapHtml converter (jsoup DOM walk) — same node/mark shapes and primitive whitelist as TiptapMarkdown, so both paths produce documents the Block Editor loads identically. Sanitizes untrusted HTML: drops script/style/iframe/… subtrees, allow-lists attributes, scheme-checks href/src.
• Wired into MapToContentletPopulator: { → JSON passthrough, an HTML tag → TiptapHtml, else → TiptapMarkdown. Reuses Workflow fire: convert Block Editor Markdown to ProseMirror JSON on save (server-side) #36002's rich-content overwrite guard and never-block-the-save fallback.
• Adds org.jsoup:jsoup 1.21.1; OpenAPI fire note regenerated ("Markdown or HTML").

Behavior change

An HTML value is now converted and stored as structured JSON instead of verbatim — only when a client resends the field; stored values are never rewritten on their own. Additive and rollback-safe.

Testing

27 unit (TiptapHtmlTest) + 9 integration (StoryBlockMarkdownPopulatorTest, including HTML → GraphQL read-back and an editor-saved primitive doc updated via HTML end to end. Existing TiptapMarkdown tests unchanged.

Closes #36470

[claude]

Claude finished @hassandotcms's task in 4m 34s —— View job

---

Code Review — PR #36473

• Read the diff and changed files
• Review TiptapHtml.java (converter + sanitization)
• Review MapToContentletPopulator.java wiring
• Review pom / dependency changes
• Check test coverage
• Post review

---

This is a well-constructed PR. The converter mirrors TiptapMarkdown's node/mark shapes, the sanitization is thorough (subtree drop-list, attribute allow-listing, URL scheme + breakout-char validation), depth is capped against stack overflow, and the save-path wiring reuses #36002's overwrite guard and never-block-the-save fallback. Test coverage is strong on both legs (27 unit + integration round-trips incl. GraphQL read-back and the autolink routing regression guard).

I found no blocking (Critical/High) issues. A few non-blocking notes below.

New Issues

• 🟡 Medium: dotCMS/src/main/java/com/dotcms/rest/MapToContentletPopulator.java:326 — When an HTML value converts to an empty document (all content dropped by sanitization, e.g. <script>...</script> with no other body), the field is silently overwritten with {"type":"doc","content":[]}. The rich-content overwrite guard (line 317) only protects existing docs that are not markdown-representable; a primitive existing doc gets clobbered with an empty doc, and a client that sent "content" sees the field cleared with no warning. Consider logging (or preserving the prior value) when conversion yields an empty doc but the input was non-blank. Low severity — it's sanitization behaving correctly — but the silent clear is surprising.

• 🟡 Medium: dotCMS/src/main/java/com/dotcms/tiptap/TiptapHtml.java:595 — sanitizeUrl rejects control/quote/angle/backtick/whitespace chars but not backslash. A value like \\evil.com has no colon, so it's returned as a "relative" URL; some renderers normalize \\ → //, treating it as protocol-relative to an external host.

  • Assumption: the render surface may treat \ as /.
  • What to verify: this is not meaningfully worse than the already-intended //host protocol-relative allowance (line 602), and it's a link the user must click — not script execution (breakout chars are already rejected). Flagging only for awareness; likely acceptable given the existing //host policy.

• 🟡 Medium: dotCMS/src/main/java/com/dotcms/rest/MapToContentletPopulator.java:92 — The HTML_START regex requires an ASCII-only tag name terminated by [\s/>], so a hyphenated tag (<custom-el>, <my-widget>) fails to match and routes to the Markdown converter instead of HTML. Harmless for the primitive whitelist (Markdown treats it as raw HTML and drops the wrapper), but worth a one-line comment noting custom elements are intentionally not HTML-routed, so it doesn't read as an oversight.

Notes (non-issues, verified)

• URL scheme allow-list, tab-smuggling (java\tscript:), event-handler stripping, and depth-cap are all correctly handled and tested. ✅
• Dependency version correctly added to bom/application/pom.xml only; dotCMS/pom.xml references it without a version. ✅
• TiptapHtml.java:349 uses fully-qualified java.util.List/ArrayList despite the import java.util.List at line 14 — pure style, not flagging.
  · 36470-html-to-prosemirror-json-on-save-server-side