Headings sizes not allowed can be pasted from the clipboard

[FreakeyPlays]

Describe the Bug

As seen in the video, my RichText only allows headings of type h2, h3 and h4 to be added. But when pasting some content from, like, a different site, the styles are getting copied too, and the RichText bypasses the validation and creates headings of type h1, h5 and h6. This also does not throw an error when publishing the page and allows users to create pages with forbidden content. Any ideas on how to handle this? I was thinking about a beforePaste hook that parses the content or strips it from its copied styles.

20250801-1051-37.0175416.mp4

Link to the code that reproduces this issue

https://playground.lexical.dev/

Reproduction Steps

1. Create a RichText field in any collection or Block
2. Enable some headings but not all (e.g. h2, h3 and h4 )
3. Go to w3 schools HTML Headings and copy all headings from the preview with crrl + c. (This will also copy the styling on Windows at least)
4. Go to the Collection or Block and paste the copied content in the RichText Field.
   4.1. If drafts are enabled, publish the collection entry.
   4.2. If needed, rebuild the page.
5. Go to the page with the RichText content and see headings of all types.

Here an example richText Field config:

//...
            {
              name: 'content',
              type: 'richText',
              editor: lexicalEditor({
                features: ({ rootFeatures }) => {
                  return [
                    ...rootFeatures,
                    HeadingFeature({ enabledHeadingSizes: ['h2', 'h3', 'h4'] }),
                    FixedToolbarFeature(),
                  ]
                },
              }),
              label: false,
              required: true,
            },
//...

Which area(s) are affected? (Select all that apply)

plugin: richtext-lexical

Environment Info

Binaries:
  Node: 20.10.0
  npm: 10.2.3
  Yarn: N/A
  pnpm: 9.15.0
Relevant Packages:
  payload: 3.54.0
  next: 15.5.2
  @payloadcms/db-postgres: 3.54.0
  @payloadcms/email-nodemailer: 3.54.0
  @payloadcms/graphql: 3.54.0
  @payloadcms/live-preview: 3.54.0
  @payloadcms/live-preview-react: 3.54.0
  @payloadcms/next/utilities: 3.54.0
  @payloadcms/plugin-redirects: 3.54.0
  @payloadcms/plugin-search: 3.54.0
  @payloadcms/plugin-seo: 3.54.0
  @payloadcms/richtext-lexical: 3.54.0
  @payloadcms/translations: 3.54.0
  @payloadcms/ui/shared: 3.54.0
  react: 19.1.1
  react-dom: 19.1.1
Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Pro
  Available memory (MB): 32507
  Available CPU cores: 8

[github-actions]

Please add a reproduction in order for us to be able to investigate.

Depending on the quality of reproduction steps, this issue may be closed if no reproduction is provided.

Why was this issue marked with the invalid-reproduction label?

To be able to investigate, we need access to a reproduction to identify what triggered the issue. We prefer a link to a public GitHub repository created with create-payload-app@latest -t blank or a forked/branched version of this repository with tests added (more info in the reproduction-guide).

To make sure the issue is resolved as quickly as possible, please make sure that the reproduction is as minimal as possible. This means that you should remove unnecessary code, files, and dependencies that do not contribute to the issue. Ensure your reproduction does not depend on secrets, 3rd party registries, private dependencies, or any other data that cannot be made public. Avoid a reproduction including a whole monorepo (unless relevant to the issue). The easier it is to reproduce the issue, the quicker we can help.

Please test your reproduction against the latest version of Payload to make sure your issue has not already been fixed.

I added a link, why was it still marked?

Ensure the link is pointing to a codebase that is accessible (e.g. not a private repository). "example.com", "n/a", "will add later", etc. are not acceptable links -- we need to see a public codebase. See the above section for accepted links.

Useful Resources

• Reproduction Guide
• Contributing to Payload

[ravichoudharystartbit]

@FreakeyPlays for raising that issue, I noticed that too.

[github-actions]

🚀 This is included in version v3.57.0