actiontext 7.1.3.2 → 7.1.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce8b2b2628c11a9dd67e83a7ba948df06d10e616756d6ce8e509c96b356e060c
-  data.tar.gz: 1ac97fa71f50ac3e568f81a5c57f05a3d81387a47233104e7a16ea823830a296
+  metadata.gz: 2c64b902311d318e3166ecc33e11d36f3b489b173941df779cac70e5523037e9
+  data.tar.gz: 262303fcd96805d2739cff5ace1eddeb35daa5d2205677cf18ab858abbd3b9b2
 SHA512:
-  metadata.gz: 919197c2541430986c06da4c8d5fd069d6007092e73ed051af06452ceda46a4e807d6a877fb4e4338d2c9fc42fada5881e5a45317e8dba69a381e2e538718269
-  data.tar.gz: 2012b4fc3f3fd5f725e1ffecdb050be22555ac3a67136bc0a10dabe5f41559784d69983085041a6fb2a71cbdd82bfd45d5e29b64cd821df55eb3a676d31c17ac
+  metadata.gz: '0192e5197f027ad24a0acb6a79deef6f380ad816de72058d5cac1804e8bd25a7bdeaf898479fd1080ddcc15cbe4e1fd35da2af292ba681a2683f9bc60aa983e7'
+  data.tar.gz: 2045ea65d4bfc311886aa9b53f0cae50a1c8921d64cf8437ccf7e99ca53a1decb10e50b210507b744417af1aa29b184ed7b7103e046f319af57e7114db49a92c

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Rails 7.1.3.3 (May 16, 2024) ##
+
+*   Upgrade Trix to 1.3.2 to fix [CVE-2024-34341](https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99).
+
+    *Rafael Mendonça França*
+
+
 ## Rails 7.1.3.2 (February 21, 2024) ##
 
 *   No changes.

data/app/assets/javascripts/trix.js

@@ -1,6 +1,6 @@
 /*
-Trix 2.0.7
-Copyright © 2023 37signals, LLC
+Trix 2.1.1
+Copyright © 2024 37signals, LLC
  */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
@@ -9,7 +9,7 @@ Copyright © 2023 37signals, LLC
 })(this, (function () { 'use strict';
 
   var name = "trix";
-  var version = "2.0.7";
+  var version = "2.1.1";
   var description = "A rich text editor for everyday writing";
   var main = "dist/trix.umd.min.js";
   var module = "dist/trix.esm.min.js";
@@ -17,6 +17,7 @@ Copyright © 2023 37signals, LLC
   var files = [
   	"dist/*.css",
   	"dist/*.js",
+  	"dist/*.map",
   	"src/{inspector,trix}/*.js"
   ];
   var repository = {
@@ -130,6 +131,7 @@ Copyright © 2023 37signals, LLC
     code: {
       tagName: "pre",
       terminal: true,
+      htmlAttributes: ["language"],
       text: {
         plaintext: true
       }
@@ -1215,7 +1217,7 @@ $\
       no-useless-escape,
   */
   const normalizeSpaces = string => string.replace(new RegExp("".concat(ZERO_WIDTH_SPACE), "g"), "").replace(new RegExp("".concat(NON_BREAKING_SPACE), "g"), " ");
-  const normalizeNewlines = string => string.replace(/\r\n/g, "\n");
+  const normalizeNewlines = string => string.replace(/\r\n?/g, "\n");
   const breakableWhitespacePattern = new RegExp("[^\\S".concat(NON_BREAKING_SPACE, "]"));
   const squishBreakableWhitespace = string => string
   // Replace all breakable whitespace characters with a space
@@ -2144,20 +2146,28 @@ $\
       }
     }
     createContainerElement(depth) {
-      let attributes, className;
+      const attributes = {};
+      let className;
       const attributeName = this.attributes[depth];
       const {
-        tagName
+        tagName,
+        htmlAttributes = []
       } = getBlockConfig(attributeName);
       if (depth === 0 && this.block.isRTL()) {
-        attributes = {
+        Object.assign(attributes, {
           dir: "rtl"
-        };
+        });
       }
       if (attributeName === "attachmentGallery") {
         const size = this.block.getBlockBreakPosition();
         className = "".concat(css$1.attachmentGallery, " ").concat(css$1.attachmentGallery, "--").concat(size);
       }
+      Object.entries(this.block.htmlAttributes).forEach(_ref => {
+        let [name, value] = _ref;
+        if (htmlAttributes.includes(name)) {
+          attributes[name] = value;
+        }
+      });
       return makeElement({
         tagName,
         className,
@@ -5828,28 +5838,29 @@ $\
   class Block extends TrixObject {
     static fromJSON(blockJSON) {
       const text = Text.fromJSON(blockJSON.text);
-      return new this(text, blockJSON.attributes);
+      return new this(text, blockJSON.attributes, blockJSON.htmlAttributes);
     }
-    constructor(text, attributes) {
+    constructor(text, attributes, htmlAttributes) {
       super(...arguments);
       this.text = applyBlockBreakToText(text || new Text());
       this.attributes = attributes || [];
+      this.htmlAttributes = htmlAttributes || {};
     }
     isEmpty() {
       return this.text.isBlockBreak();
     }
     isEqualTo(block) {
       if (super.isEqualTo(block)) return true;
-      return this.text.isEqualTo(block === null || block === void 0 ? void 0 : block.text) && arraysAreEqual(this.attributes, block === null || block === void 0 ? void 0 : block.attributes);
+      return this.text.isEqualTo(block === null || block === void 0 ? void 0 : block.text) && arraysAreEqual(this.attributes, block === null || block === void 0 ? void 0 : block.attributes) && objectsAreEqual(this.htmlAttributes, block === null || block === void 0 ? void 0 : block.htmlAttributes);
     }
     copyWithText(text) {
-      return new Block(text, this.attributes);
+      return new Block(text, this.attributes, this.htmlAttributes);
     }
     copyWithoutText() {
       return this.copyWithText(null);
     }
     copyWithAttributes(attributes) {
-      return new Block(this.text, attributes);
+      return new Block(this.text, attributes, this.htmlAttributes);
     }
     copyWithoutAttributes() {
       return this.copyWithAttributes(null);
@@ -5866,6 +5877,12 @@ $\
       const attributes = this.attributes.concat(expandAttribute(attribute));
       return this.copyWithAttributes(attributes);
     }
+    addHTMLAttribute(attribute, value) {
+      const htmlAttributes = Object.assign({}, this.htmlAttributes, {
+        [attribute]: value
+      });
+      return new Block(this.text, this.attributes, htmlAttributes);
+    }
     removeAttribute(attribute) {
       const {
         listAttribute
@@ -5962,7 +5979,8 @@ $\
     toJSON() {
       return {
         text: this.text,
-        attributes: this.attributes
+        attributes: this.attributes,
+        htmlAttributes: this.htmlAttributes
       };
     }
 
@@ -6325,6 +6343,11 @@ $\
       const range = this.getRangeOfAttachment(attachment);
       return this.removeAttributeAtRange(attribute, range);
     }
+    setHTMLAttributeAtPosition(position, name, value) {
+      const block = this.getBlockAtPosition(position);
+      const updatedBlock = block.addHTMLAttribute(name, value);
+      return this.replaceBlock(block, updatedBlock);
+    }
     insertBlockBreakAtRange(range) {
       let blocks;
       range = normalizeRange(range);
@@ -6793,9 +6816,9 @@ $\
     return attributes;
   };
 
-  const DEFAULT_ALLOWED_ATTRIBUTES = "style href src width height class".split(" ");
+  const DEFAULT_ALLOWED_ATTRIBUTES = "style href src width height language class".split(" ");
   const DEFAULT_FORBIDDEN_PROTOCOLS = "javascript:".split(" ");
-  const DEFAULT_FORBIDDEN_ELEMENTS = "script iframe form".split(" ");
+  const DEFAULT_FORBIDDEN_ELEMENTS = "script iframe form noscript".split(" ");
   class HTMLSanitizer extends BasicObject {
     static sanitize(html, options) {
       const sanitizer = new this(html, options);
@@ -6923,15 +6946,21 @@ $\
   };
   const blockForAttributes = function () {
     let attributes = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+    let htmlAttributes = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
     const text = [];
     return {
       text,
-      attributes
+      attributes,
+      htmlAttributes
     };
   };
   const parseTrixDataAttribute = (element, name) => {
     try {
-      return JSON.parse(element.getAttribute("data-trix-".concat(name)));
+      const data = JSON.parse(element.getAttribute("data-trix-".concat(name)));
+      if (data.contentType === "text/html" && data.content) {
+        data.content = HTMLSanitizer.sanitize(data.content).getHTML();
+      }
+      return data;
     } catch (error) {
       return {};
     }
@@ -7027,8 +7056,9 @@ $\
       } else if (element === this.containerElement || this.isBlockElement(element)) {
         var _this$currentBlock;
         const attributes = this.getBlockAttributes(element);
+        const htmlAttributes = this.getBlockHTMLAttributes(element);
         if (!arraysAreEqual(attributes, (_this$currentBlock = this.currentBlock) === null || _this$currentBlock === void 0 ? void 0 : _this$currentBlock.attributes)) {
-          this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element);
+          this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element, htmlAttributes);
           this.currentBlockElement = element;
         }
       }
@@ -7039,9 +7069,10 @@ $\
       if (elementIsBlockElement && !this.isBlockElement(element.firstChild)) {
         if (!this.isInsignificantTextNode(element.firstChild) || !this.isBlockElement(element.firstElementChild)) {
           const attributes = this.getBlockAttributes(element);
+          const htmlAttributes = this.getBlockHTMLAttributes(element);
           if (element.firstChild) {
             if (!(currentBlockContainsElement && arraysAreEqual(attributes, this.currentBlock.attributes))) {
-              this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element);
+              this.currentBlock = this.appendBlockForAttributesWithElement(attributes, element, htmlAttributes);
               this.currentBlockElement = element;
             } else {
               return this.appendStringWithAttributes("\n");
@@ -7129,8 +7160,9 @@ $\
     // Document construction
 
     appendBlockForAttributesWithElement(attributes, element) {
+      let htmlAttributes = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
       this.blockElements.push(element);
-      const block = blockForAttributes(attributes);
+      const block = blockForAttributes(attributes, htmlAttributes);
       this.blocks.push(block);
       return block;
     }
@@ -7235,6 +7267,17 @@ $\
       }
       return attributes$1.reverse();
     }
+    getBlockHTMLAttributes(element) {
+      const attributes$1 = {};
+      const blockConfig = Object.values(attributes).find(settings => settings.tagName === tagName(element));
+      const allowedAttributes = (blockConfig === null || blockConfig === void 0 ? void 0 : blockConfig.htmlAttributes) || [];
+      allowedAttributes.forEach(attribute => {
+        if (element.hasAttribute(attribute)) {
+          attributes$1[attribute] = element.getAttribute(attribute);
+        }
+      });
+      return attributes$1;
+    }
     findBlockElementAncestors(element) {
       const ancestors = [];
       while (element && element !== this.containerElement) {
@@ -7830,6 +7873,15 @@ $\
         return this.notifyDelegateOfCurrentAttributesChange();
       }
     }
+    setHTMLAtributeAtPosition(position, attributeName, value) {
+      var _getBlockConfig;
+      const block = this.document.getBlockAtPosition(position);
+      const allowedHTMLAttributes = (_getBlockConfig = getBlockConfig(block.getLastAttribute())) === null || _getBlockConfig === void 0 ? void 0 : _getBlockConfig.htmlAttributes;
+      if (block && allowedHTMLAttributes !== null && allowedHTMLAttributes !== void 0 && allowedHTMLAttributes.includes(attributeName)) {
+        const newDocument = this.document.setHTMLAttributeAtPosition(position, attributeName, value);
+        this.setDocument(newDocument);
+      }
+    }
     setTextAttribute(attributeName, value) {
       const selectedRange = this.getSelectedRange();
       if (!selectedRange) return;
@@ -7877,10 +7929,10 @@ $\
       return ((_this$getBlock = this.getBlock()) === null || _this$getBlock === void 0 ? void 0 : _this$getBlock.getNestingLevel()) > 0;
     }
     canIncreaseNestingLevel() {
-      var _getBlockConfig;
+      var _getBlockConfig2;
       const block = this.getBlock();
       if (!block) return;
-      if ((_getBlockConfig = getBlockConfig(block.getLastNestableAttribute())) !== null && _getBlockConfig !== void 0 && _getBlockConfig.listAttribute) {
+      if ((_getBlockConfig2 = getBlockConfig(block.getLastNestableAttribute())) !== null && _getBlockConfig2 !== void 0 && _getBlockConfig2.listAttribute) {
         const previousBlock = this.getPreviousBlock();
         if (previousBlock) {
           return arrayStartsWith(previousBlock.getListItemAttributes(), block.getListItemAttributes());
@@ -8521,6 +8573,11 @@ $\
       return this.composition.removeCurrentAttribute(name);
     }
 
+    // HTML attributes
+    setHTMLAtributeAtPosition(position, name, value) {
+      this.composition.setHTMLAtributeAtPosition(position, name, value);
+    }
+
     // Nesting level
 
     canDecreaseNestingLevel() {
@@ -10941,8 +10998,12 @@ $\
       });
     },
     insertReplacementText() {
-      return this.insertString(this.event.dataTransfer.getData("text/plain"), {
-        updatePosition: false
+      const replacement = this.event.dataTransfer.getData("text/plain");
+      const domRange = this.event.getTargetRanges()[0];
+      this.withTargetDOMRange(domRange, () => {
+        this.insertString(replacement, {
+          updatePosition: false
+        });
       });
     },
     insertText() {
@@ -11064,7 +11125,7 @@ $\
         return this.toggleDialog(actionName);
       } else {
         var _this$delegate2;
-        return (_this$delegate2 = this.delegate) === null || _this$delegate2 === void 0 ? void 0 : _this$delegate2.toolbarDidInvokeAction(actionName);
+        return (_this$delegate2 = this.delegate) === null || _this$delegate2 === void 0 ? void 0 : _this$delegate2.toolbarDidInvokeAction(actionName, element);
       }
     }
     didClickAttributeButton(event, element) {
@@ -11509,8 +11570,8 @@ $\
         });
       }
     }
-    toolbarDidInvokeAction(actionName) {
-      return this.invokeAction(actionName);
+    toolbarDidInvokeAction(actionName, invokingElement) {
+      return this.invokeAction(actionName, invokingElement);
     }
     toolbarDidToggleAttribute(attributeName) {
       this.recordFormattingUndoEntry(attributeName);
@@ -11579,10 +11640,11 @@ $\
         return !!((_this$actions$actionN = this.actions[actionName]) !== null && _this$actions$actionN !== void 0 && (_this$actions$actionN = _this$actions$actionN.test) !== null && _this$actions$actionN !== void 0 && _this$actions$actionN.call(this));
       }
     }
-    invokeAction(actionName) {
+    invokeAction(actionName, invokingElement) {
       if (this.actionIsExternal(actionName)) {
         return this.notifyEditorElement("action-invoke", {
-          actionName
+          actionName,
+          invokingElement
         });
       } else {
         var _this$actions$actionN2;

data/app/assets/stylesheets/trix.css

@@ -334,7 +334,9 @@ trix-editor .attachment__metadata {
     white-space: nowrap; }
 
 .trix-content {
-  line-height: 1.5; }
+  line-height: 1.5;
+  overflow-wrap: break-word;
+  word-break: break-word; }
   .trix-content * {
     box-sizing: border-box;
     margin: 0;

data/lib/action_text/gem_version.rb

@@ -10,7 +10,7 @@ module ActionText
     MAJOR = 7
     MINOR = 1
     TINY  = 3
-    PRE   = "2"
+    PRE   = "3"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rails/actiontext",
-  "version": "7.1.3-2",
+  "version": "7.1.3-3",
   "description": "Edit and display rich text in Rails applications",
   "module": "app/assets/javascripts/actiontext.esm.js",
   "main": "app/assets/javascripts/actiontext.js",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actiontext
 version: !ruby/object:Gem::Version
-  version: 7.1.3.2
+  version: 7.1.3.3
 platform: ruby
 authors:
 - Javan Makhmali
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-02-21 00:00:00.000000000 Z
+date: 2024-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -18,56 +18,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
 - !ruby/object:Gem::Dependency
   name: activestorage
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.2
+        version: 7.1.3.3
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -163,10 +163,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.1.3.2/actiontext/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.1.3.2/
+  changelog_uri: https://github.com/rails/rails/blob/v7.1.3.3/actiontext/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.1.3.3/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.1.3.2/actiontext
+  source_code_uri: https://github.com/rails/rails/tree/v7.1.3.3/actiontext
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -183,7 +183,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
+rubygems_version: 3.5.10
 signing_key:
 specification_version: 4
 summary: Rich text framework.