actiontext 7.1.2 → 7.1.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36fe5f0d6a4925ffa34abf90f51c05fdb81bfc69eefdf180162759e46f9c1200
-  data.tar.gz: e1359ff60168b2cabac94d064d6f13433d7cd44ab55a6a569ae4bd6112675a4d
+  metadata.gz: d51a41ff03b550ac428a52ce89ee785539d2ac0b386c5597f4c06b763070d054
+  data.tar.gz: 85028cdc38e4448c321e17190924c602f7bd940588307ef42206c7e0842ba31a
 SHA512:
-  metadata.gz: d832139704222aeb74ed6fd21dbec6fa18bf004902072fe5a9cfbb71c1008ef89745cc3587609c4809d7adcf110510957868f3aa20875f41928a6f472c5259a6
-  data.tar.gz: d990facfb05949e439b853bded6a9fd75517cbd475493cdb5c39606e6e6ea915a905a9ab4382a12c8ea688dd43789a5b4e5d2fcea8780652ab390e5e5bd42fc9
+  metadata.gz: 417dec3ad3e197b566e52b5b42356481d6a5f54e1a792b5f16c7eeaa45137b2a4bdeeb32e83fd890d884fc60864e7d6062ebe25115710a40de06df3c93812c95
+  data.tar.gz: ab1691bf97b79a8f2b644b6bf324c06fc663fd8ca2ba4641a906fcf7062a4c4acb4103b25b405561fc21e81198ce7b7541a9d02921d137ae14de6eb75d01b1c7

data/CHANGELOG.md

@@ -1,18 +1,46 @@
+## Rails 7.1.3.4 (June 04, 2024) ##
+
+*   Sanitize ActionText HTML ContentAttachment in Trix edit view
+    [CVE-2024-32464]
+
+
+## Rails 7.1.3.3 (May 16, 2024) ##
+
+*   Upgrade Trix to 1.3.2 to fix [CVE-2024-34341](https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99).
+
+    *Rafael Mendonça França*
+
+
+## Rails 7.1.3.2 (February 21, 2024) ##
+
+*   No changes.
+
+
+## Rails 7.1.3.1 (February 21, 2024) ##
+
+*   No changes.
+
+
+## Rails 7.1.3 (January 16, 2024) ##
+
+*   No changes.
+
+
 ## Rails 7.1.2 (November 10, 2023) ##
 
-*   Compile ESM package that can be used directly in the browser as actiontext.esm.js
+*   Compile ESM package that can be used directly in the browser as `actiontext.esm.js`.
 
     *Matias Grunberg*
 
-*   Fix using actiontext.js with Sprockets
+*   Fix using actiontext.js with Sprockets.
 
     *Matias Grunberg*
 
-*   Upgrade Trix to 2.0.7
+*   Upgrade Trix to 2.0.7.
 
     *Hartley McGuire*
 
-*   Fix using Trix with Sprockets
+*   Fix using Trix with Sprockets.
 
     *Hartley McGuire*
 

data/app/assets/javascripts/actiontext.esm.js

@@ -771,9 +771,9 @@ function start() {
 }
 
 function didClick(event) {
-  const {target: target} = event;
-  if ((target.tagName == "INPUT" || target.tagName == "BUTTON") && target.type == "submit" && target.form) {
-    submitButtonsByForm.set(target.form, target);
+  const button = event.target.closest("button, input");
+  if (button && button.type === "submit" && button.form) {
+    submitButtonsByForm.set(button.form, button);
   }
 }
 

data/app/assets/javascripts/actiontext.js

@@ -753,9 +753,9 @@
     }
   }
   function didClick(event) {
-    const {target: target} = event;
-    if ((target.tagName == "INPUT" || target.tagName == "BUTTON") && target.type == "submit" && target.form) {
-      submitButtonsByForm.set(target.form, target);
+    const button = event.target.closest("button, input");
+    if (button && button.type === "submit" && button.form) {
+      submitButtonsByForm.set(button.form, button);
     }
   }
   function didSubmitForm(event) {

data/app/assets/javascripts/trix.js

@@ -1,6 +1,6 @@
 /*
-Trix 2.0.7
-Copyright © 2023 37signals, LLC
+Trix 2.1.1
+Copyright © 2024 37signals, LLC
  */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
@@ -9,7 +9,7 @@ Copyright © 2023 37signals, LLC
 })(this, (function () { 'use strict';
 
   var name = "trix";
-  var version = "2.0.7";
+  var version = "2.1.1";
   var description = "A rich text editor for everyday writing";
   var main = "dist/trix.umd.min.js";
   var module = "dist/trix.esm.min.js";
@@ -17,6 +17,7 @@ Copyright © 2023 37signals, LLC
   var files = [
   	"dist/*.css",
   	"dist/*.js",
+  	"dist/*.map",
   	"src/{inspector,trix}/*.js"
   ];
   var repository = {
@@ -130,6 +131,7 @@ Copyright © 2023 37signals, LLC
     code: {
       tagName: "pre",
       terminal: true,
+      htmlAttributes: ["language"],
       text: {
         plaintext: true
       }
@@ -1215,7 +1217,7 @@ $\
       no-useless-escape,
   */
   const normalizeSpaces = string => string.replace(new RegExp("".concat(ZERO_WIDTH_SPACE), "g"), "").replace(new RegExp("".concat(NON_BREAKING_SPACE), "g"), " ");
-  const normalizeNewlines = string => string.replace(/\r\n/g, "\n");
+  const normalizeNewlines = string => string.replace(/\r\n?/g, "\n");
   const breakableWhitespacePattern = new RegExp("[^\\S".concat(NON_BREAKING_SPACE, "]"));
   const squishBreakableWhitespace = string => string
   // Replace all breakable whitespace characters with a space
@@ -2144,20 +2146,28 @@ $\
       }
     }
     createContainerElement(depth) {
-      let attributes, className;
+      const attributes = {};
+      let className;
       const attributeName = this.attributes[depth];
       const {
-        tagName
+        tagName,
+        htmlAttributes = []
       } = getBlockConfig(attributeName);
       if (depth === 0 && this.block.isRTL()) {
-        attributes = {
+        Object.assign(attributes, {
           dir: "rtl"
-        };
+        });
       }
       if (attributeName === "attachmentGallery") {
         const size = this.block.getBlockBreakPosition();
         className = "".concat(css$1.attachmentGallery, " ").concat(css$1.attachmentGallery, "--").concat(size);
       }
+      Object.entries(this.block.htmlAttributes).forEach(_ref => {
+        let [name, value] = _ref;
+        if (htmlAttributes.includes(name)) {
+          attributes[name] = value;
+        }
+      });
       return makeElement({
         tagName,
         className,
@@ -5828,28 +5838,29 @@ $\
   class Block extends TrixObject {
     static fromJSON(blockJSON) {
       const text = Text.fromJSON(blockJSON.text);
-      return new this(text, blockJSON.attributes);
+      return new this(text, blockJSON.attributes, blockJSON.htmlAttributes);
     }
-    constructor(text, attributes) {
+    constructor(text, attributes, htmlAttributes) {
       super(...arguments);
       this.text = applyBlockBreakToText(text || new Text());
       this.attributes = attributes || [];
+      this.htmlAttributes = htmlAttributes || {};
     }
     isEmpty() {
       return this.text.isBlockBreak();
     }
     isEqualTo(block) {
       if (super.isEqualTo(block)) return true;
-      return this.text.isEqualTo(block === null || block === void 0 ? void 0 : block.text) && arraysAreEqual(this.attributes, block === null || block === void 0 ? void 0 : block.attributes);
+      return this.text.isEqualTo(block === null || block === void 0 ? void 0 : block.text) && arraysAreEqual(this.attributes, block === null || block === void 0 ? void 0 : block.attributes) && objectsAreEqual(this.htmlAttributes, block === null || block === void 0 ? void 0 : block.htmlAttributes);
     }
     copyWithText(text) {
-      return new Block(text, this.attributes);
+      return new Block(text, this.attributes, this.htmlAttributes);
     }
     copyWithoutText() {
       return this.copyWithText(null);
     }
     copyWithAttributes(attributes) {
-      return new Block(this.text, attributes);
+      return new Block(this.text, attributes, this.htmlAttributes);
     }
     copyWithoutAttributes() {
       return this.copyWithAttributes(null);
@@ -5866,6 +5877,12 @@ $\
       const attributes = this.attributes.concat(expandAttribute(attribute));
       return this.copyWithAttributes(attributes);
     }
+    addHTMLAttribute(attribute, value) {
+      const htmlAttributes = Object.assign({}, this.htmlAttributes, {
+        [attribute]: value
+      });
+      return new Block(this.text, this.attributes, htmlAttributes);
+    }
     removeAttribute(attribute) {
       const {
         listAttribute
@@ -5962,7 +5979,8 @@ $\
     toJSON() {
       return {
         text: this.text,
-        attributes: this.attributes
+        attributes: this.attributes,
+        htmlAttributes: this.htmlAttributes
       };
     }
 
@@ -6325,6 +6343,11 @@ $\
       const range = this.getRangeOfAttachment(attachment);
       return this.removeAttributeAtRange(attribute, range);
     }
+    setHTMLAttributeAtPosition(position, name, value) {
+      const block = this.getBlockAtPosition(position);
+      const updatedBlock = block.addHTMLAttribute(name, value);
+      return this.replaceBlock(block, updatedBlock);
+    }
     insertBlockBreakAtRange(range) {
       let blocks;
       range = normalizeRange(range);
@@ -6793,9 +6816,9 @@ $\
     return attributes;
   };
 
-  const DEFAULT_ALLOWED_ATTRIBUTES = "style href src width height class".split(" ");
+  const DEFAULT_ALLOWED_ATTRIBUTES = "style href src width height language class".split(" ");
   const DEFAULT_FORBIDDEN_PROTOCOLS = "javascript:".split(" ");
-  const DEFAULT_FORBIDDEN_ELEMENTS = "script iframe form".split(" ");
+  const DEFAULT_FORBIDDEN_ELEMENTS = "script iframe form noscript".split(" ");
   class HTMLSanitizer extends BasicObject {
     static sanitize(html, options) {
       const sanitizer = new this(html, options);
@@ -6923,15 +6946,21 @@ $\
   };
   const blockForAttributes = function () {
     let attributes = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+    let htmlAttributes = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
     const text = [];
     return {
       text,
-      attributes
+      attributes,
+      htmlAttributes
     };
   };
   const parseTrixDataAttribute = (element, name) => {
     try {
-      return JSON.parse(element.getAttribute("data-trix-".concat(name)));
+      const data = JSON.parse(element.getAttribute("data-trix-".concat(name)));
+      if (data.contentType === "text/html" && data.content) {
+        data.content = HTMLSanitizer.sanitize(data.content).getHTML();
+      }
+      return data;
     } catch (error) {
       return {};
     }
@@ -7027,8 +7056,9 @@ $\
       } else if (element === this.containerElement || this.isBlockElement(element)) {
         var _this$currentBlock;
         const attributes = this.getBlockAttributes(element);
+        const htmlAttributes = this.getBlockHTMLAttributes(element);
         if (!arraysAreEqual(attributes, (_this$currentBlock = this.currentBlock) === null || _this$currentBlock === void 0 ? void 0 : _this$currentBlock.attributes)) {
-          this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element);
+          this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element, htmlAttributes);
           this.currentBlockElement = element;
         }
       }
@@ -7039,9 +7069,10 @@ $\
       if (elementIsBlockElement && !this.isBlockElement(element.firstChild)) {
         if (!this.isInsignificantTextNode(element.firstChild) || !this.isBlockElement(element.firstElementChild)) {
           const attributes = this.getBlockAttributes(element);
+          const htmlAttributes = this.getBlockHTMLAttributes(element);
           if (element.firstChild) {
             if (!(currentBlockContainsElement && arraysAreEqual(attributes, this.currentBlock.attributes))) {
-              this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element);
+              this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element, htmlAttributes);
               this.currentBlockElement = element;
             } else {
               return this.appendStringWithAttributes("\n");
@@ -7129,8 +7160,9 @@ $\
     // Document construction
 
     appendBlockForAttributesWithElement(attributes, element) {
+      let htmlAttributes = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
       this.blockElements.push(element);
-      const block = blockForAttributes(attributes);
+      const block = blockForAttributes(attributes, htmlAttributes);
       this.blocks.push(block);
       return block;
     }
@@ -7235,6 +7267,17 @@ $\
       }
       return attributes$1.reverse();
     }
+    getBlockHTMLAttributes(element) {
+      const attributes$1 = {};
+      const blockConfig = Object.values(attributes).find(settings => settings.tagName === tagName(element));
+      const allowedAttributes = (blockConfig === null || blockConfig === void 0 ? void 0 : blockConfig.htmlAttributes) || [];
+      allowedAttributes.forEach(attribute => {
+        if (element.hasAttribute(attribute)) {
+          attributes$1[attribute] = element.getAttribute(attribute);
+        }
+      });
+      return attributes$1;
+    }
     findBlockElementAncestors(element) {
       const ancestors = [];
       while (element && element !== this.containerElement) {
@@ -7830,6 +7873,15 @@ $\
         return this.notifyDelegateOfCurrentAttributesChange();
       }
     }
+    setHTMLAtributeAtPosition(position, attributeName, value) {
+      var _getBlockConfig;
+      const block = this.document.getBlockAtPosition(position);
+      const allowedHTMLAttributes = (_getBlockConfig = getBlockConfig(block.getLastAttribute())) === null || _getBlockConfig === void 0 ? void 0 : _getBlockConfig.htmlAttributes;
+      if (block && allowedHTMLAttributes !== null && allowedHTMLAttributes !== void 0 && allowedHTMLAttributes.includes(attributeName)) {
+        const newDocument = this.document.setHTMLAttributeAtPosition(position, attributeName, value);
+        this.setDocument(newDocument);
+      }
+    }
     setTextAttribute(attributeName, value) {
       const selectedRange = this.getSelectedRange();
       if (!selectedRange) return;
@@ -7877,10 +7929,10 @@ $\
       return ((_this$getBlock = this.getBlock()) === null || _this$getBlock === void 0 ? void 0 : _this$getBlock.getNestingLevel()) > 0;
     }
     canIncreaseNestingLevel() {
-      var _getBlockConfig;
+      var _getBlockConfig2;
       const block = this.getBlock();
       if (!block) return;
-      if ((_getBlockConfig = getBlockConfig(block.getLastNestableAttribute())) !== null && _getBlockConfig !== void 0 && _getBlockConfig.listAttribute) {
+      if ((_getBlockConfig2 = getBlockConfig(block.getLastNestableAttribute())) !== null && _getBlockConfig2 !== void 0 && _getBlockConfig2.listAttribute) {
         const previousBlock = this.getPreviousBlock();
         if (previousBlock) {
           return arrayStartsWith(previousBlock.getListItemAttributes(), block.getListItemAttributes());
@@ -8521,6 +8573,11 @@ $\
       return this.composition.removeCurrentAttribute(name);
     }
 
+    // HTML attributes
+    setHTMLAtributeAtPosition(position, name, value) {
+      this.composition.setHTMLAtributeAtPosition(position, name, value);
+    }
+
     // Nesting level
 
     canDecreaseNestingLevel() {
@@ -10941,8 +10998,12 @@ $\
       });
     },
     insertReplacementText() {
-      return this.insertString(this.event.dataTransfer.getData("text/plain"), {
-        updatePosition: false
+      const replacement = this.event.dataTransfer.getData("text/plain");
+      const domRange = this.event.getTargetRanges()[0];
+      this.withTargetDOMRange(domRange, () => {
+        this.insertString(replacement, {
+          updatePosition: false
+        });
       });
     },
     insertText() {
@@ -11064,7 +11125,7 @@ $\
         return this.toggleDialog(actionName);
       } else {
         var _this$delegate2;
-        return (_this$delegate2 = this.delegate) === null || _this$delegate2 === void 0 ? void 0 : _this$delegate2.toolbarDidInvokeAction(actionName);
+        return (_this$delegate2 = this.delegate) === null || _this$delegate2 === void 0 ? void 0 : _this$delegate2.toolbarDidInvokeAction(actionName, element);
       }
     }
     didClickAttributeButton(event, element) {
@@ -11509,8 +11570,8 @@ $\
         });
       }
     }
-    toolbarDidInvokeAction(actionName) {
-      return this.invokeAction(actionName);
+    toolbarDidInvokeAction(actionName, invokingElement) {
+      return this.invokeAction(actionName, invokingElement);
     }
     toolbarDidToggleAttribute(attributeName) {
       this.recordFormattingUndoEntry(attributeName);
@@ -11579,10 +11640,11 @@ $\
         return !!((_this$actions$actionN = this.actions[actionName]) !== null && _this$actions$actionN !== void 0 && (_this$actions$actionN = _this$actions$actionN.test) !== null && _this$actions$actionN !== void 0 && _this$actions$actionN.call(this));
       }
     }
-    invokeAction(actionName) {
+    invokeAction(actionName, invokingElement) {
       if (this.actionIsExternal(actionName)) {
         return this.notifyEditorElement("action-invoke", {
-          actionName
+          actionName,
+          invokingElement
         });
       } else {
         var _this$actions$actionN2;

data/app/assets/stylesheets/trix.css

@@ -334,7 +334,9 @@ trix-editor .attachment__metadata {
     white-space: nowrap; }
 
 .trix-content {
-  line-height: 1.5; }
+  line-height: 1.5;
+  overflow-wrap: break-word;
+  word-break: break-word; }
   .trix-content * {
     box-sizing: border-box;
     margin: 0;

data/app/helpers/action_text/content_helper.rb

@@ -14,6 +14,15 @@ module ActionText
       sanitize_action_text_content(render_action_text_attachments(content))
     end
 
+    def sanitize_content_attachment(content_attachment)
+      sanitizer.sanitize(
+        content_attachment,
+        tags: sanitizer_allowed_tags,
+        attributes: sanitizer_allowed_attributes,
+        scrubber: scrubber,
+      )
+    end
+
     def sanitize_action_text_content(content)
       sanitizer.sanitize(
         content.to_html,

data/app/helpers/action_text/tag_helper.rb

@@ -66,15 +66,11 @@ module ActionView::Helpers
     # * <tt>[:data][:blob_url_template]</tt> - Defaults to <tt>rails_service_blob_url(":signed_id", ":filename")</tt>.
     #
     # ==== Example
-    #   form_with(model: @message) do |form|
-    #     form.rich_text_area :content
-    #   end
+    #   rich_text_area :message, :content
     #   # <input type="hidden" name="message[content]" id="message_content_trix_input_message_1">
     #   # <trix-editor id="content" input="message_content_trix_input_message_1" class="trix-content" ...></trix-editor>
     #
-    #   form_with(model: @message) do |form|
-    #     form.rich_text_area :content, value: "<h1>Default message</h1>"
-    #   end
+    #   rich_text_area :message, :content, value: "<h1>Default message</h1>"
     #   # <input type="hidden" name="message[content]" id="message_content_trix_input_message_1" value="<h1>Default message</h1>">
     #   # <trix-editor id="content" input="message_content_trix_input_message_1" class="trix-content" ...></trix-editor>
     def rich_text_area(object_name, method, options = {})

data/lib/action_text/content.rb

@@ -20,7 +20,7 @@ module ActionText
   #   body.to_s # => "<h1>Funny times!</h1>"
   #   body.to_plain_text # => "Funny times!"
   class Content
-    include Rendering, Serialization
+    include Rendering, Serialization, ContentHelper
 
     attr_reader :fragment
 
@@ -94,6 +94,7 @@ module ActionText
 
     def render_attachments(**options, &block)
       content = fragment.replace(ActionText::Attachment.tag_name) do |node|
+        node["content"] = sanitize_content_attachment(node["content"])
         block.call(attachment_for_node(node, **options))
       end
       self.class.new(content, canonicalize: false)

data/lib/action_text/gem_version.rb

@@ -9,8 +9,8 @@ module ActionText
   module VERSION
     MAJOR = 7
     MINOR = 1
-    TINY  = 2
-    PRE   = nil
+    TINY  = 3
+    PRE   = "4"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rails/actiontext",
-  "version": "7.1.2",
+  "version": "7.1.3-4",
   "description": "Edit and display rich text in Rails applications",
   "module": "app/assets/javascripts/actiontext.esm.js",
   "main": "app/assets/javascripts/actiontext.js",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actiontext
 version: !ruby/object:Gem::Version
-  version: 7.1.2
+  version: 7.1.3.4
 platform: ruby
 authors:
 - Javan Makhmali
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-11-10 00:00:00.000000000 Z
+date: 2024-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -18,56 +18,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
 - !ruby/object:Gem::Dependency
   name: activestorage
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.2
+        version: 7.1.3.4
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -163,10 +163,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.1.2/actiontext/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.1.2/
+  changelog_uri: https://github.com/rails/rails/blob/v7.1.3.4/actiontext/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.1.3.4/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.1.2/actiontext
+  source_code_uri: https://github.com/rails/rails/tree/v7.1.3.4/actiontext
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -183,7 +183,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.18
+rubygems_version: 3.3.27
 signing_key:
 specification_version: 4
 summary: Rich text framework.