tinymce-rails 7.9.1.1 → 7.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b49e3f36469d42bdc6483759e11910ca9cf56b22686c9e5a9466ee34ab9ddb7c
-  data.tar.gz: 02a204926b72fb8ef9d4e3053ad9e89ed600b655cc618bfbd08bd22aaacd7991
+  metadata.gz: b265667eeaa79635f2e02fde8eb2579d21f6796c621c75de8a064bd66558092d
+  data.tar.gz: 2e1ff29553128d99b49e66985722acb42b1937c347f1ba2fe874d15bee72cb9e
 SHA512:
-  metadata.gz: eac37a89e727fb4801e4c3b76428105100c902cb14ab71ecd1e7fb6452c91f0e1e13f5b2eb6889ae1894b4ec99aa13d39b4cc382fb56ae95bc660207b43d7546
-  data.tar.gz: 0ab4b376c13cb54bc9c170910910975a60206ea2034a4183b2686f2e28ddd6cfe308f6294fef46c3446857646b7f4d96edb40f679cacedb36131e139c41cb4c5
+  metadata.gz: 2cecffda46035a1c9201bdda4c4238d4a91a5c17b355ebe234988b1213b88fa8eefc85050bf666226aafd868261e24f6b8fc2f0ee2c53c40c5252ced97c9a331
+  data.tar.gz: afb0606a8f6d8860684f6d30f0110aeca1236825099d048e30db94da26d3f86d9c1e1707ed85cd79b5de740b2a22aa31a1bdbf3a71fcb05114cf100d180f5132

data/README.md

@@ -6,7 +6,7 @@ The `tinymce-rails` gem integrates the [TinyMCE](https://www.tiny.cloud/) editor
 This gem is compatible with Rails 5.1 and higher.
 
 This is the branch for **TinyMCE 7**.<br />
-Please see alternate branches for [TinyMCE 6](https://github.com/spohlenz/tinymce-rails/tree/tinymce-6), [TinyMCE 5](https://github.com/spohlenz/tinymce-rails/tree/tinymce-5), [TinyMCE 4](https://github.com/spohlenz/tinymce-rails/tree/tinymce-4) & [TinyMCE 3.5.x](https://github.com/spohlenz/tinymce-rails/tree/tinymce-3).
+Please see the [`main`](https://github.com/spohlenz/tinymce-rails) branch for TinyMCE 8, and alternate branches for [TinyMCE 6](https://github.com/spohlenz/tinymce-rails/tree/tinymce-6), [TinyMCE 5](https://github.com/spohlenz/tinymce-rails/tree/tinymce-5), [TinyMCE 4](https://github.com/spohlenz/tinymce-rails/tree/tinymce-4) & [TinyMCE 3.5.x](https://github.com/spohlenz/tinymce-rails/tree/tinymce-3).
 
 > [!IMPORTANT]
 > Please note that as of version 7, TinyMCE (and therefore this project) is now licensed under the GPL.

data/app/assets/source/tinymce/tinymce.js

@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 7.9.1 (2025-05-29)
+ * TinyMCE version 7.9.2 (2026-02-11)
  */
 
 (function () {
@@ -5574,7 +5574,8 @@
         webkitMovementX: true,
         webkitMovementY: true,
         keyIdentifier: true,
-        mozPressure: true
+        mozPressure: true,
+        mozInputSource: true,
     };
     // Note: We can't rely on `instanceof` here as it won't work if the event was fired from another window.
     // Additionally, the constructor name might be `MouseEvent` or similar so we can't rely on the constructor name.
@@ -9976,6 +9977,11 @@
             processor: 'boolean',
             default: false
         });
+        // TINY-11900: Set to default to `true` to avoid changing existing TinyMCE 7 behaviour
+        registerOption('allow_html_in_comments', {
+            processor: 'boolean',
+            default: true
+        });
         registerOption('allow_script_urls', {
             processor: 'boolean',
             default: false
@@ -18434,6 +18440,9 @@
         };
     };
 
+    const encodeData = (data) => data.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    const decodeData$1 = (data) => data.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+
     const removeAttrs = (node, names) => {
         each$e(names, (name) => {
             node.attr(name, null);
@@ -18804,7 +18813,7 @@
         }
     };
 
-    /*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
+    /*! @license DOMPurify 3.2.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.6/LICENSE */
 
     const {
       entries,
@@ -18864,6 +18873,9 @@
      */
     function unapply(func) {
       return function (thisArg) {
+        if (thisArg instanceof RegExp) {
+          thisArg.lastIndex = 0;
+        }
         for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
           args[_key - 1] = arguments[_key];
         }
@@ -19005,7 +19017,7 @@
     const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm); // eslint-disable-line unicorn/better-regex
     const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
     const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
-    const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
+    const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
     );
     const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
     const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
@@ -19102,7 +19114,7 @@
     function createDOMPurify() {
       let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
       const DOMPurify = root => createDOMPurify(root);
-      DOMPurify.version = '3.2.4';
+      DOMPurify.version = '3.2.6';
       DOMPurify.removed = [];
       if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
         // Not running in a browser, provide a factory function
@@ -19341,8 +19353,8 @@
         URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
         DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
         FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
-        FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
-        FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
+        FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
+        FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
         USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
         ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
         ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
@@ -19707,7 +19719,7 @@
           allowedTags: ALLOWED_TAGS
         });
         /* Detect mXSS attempts abusing namespace confusion */
-        if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
+        if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
           _forceRemove(currentNode);
           return true;
         }
@@ -19859,8 +19871,8 @@
             value: attrValue
           } = attr;
           const lcName = transformCaseFunc(name);
-          let value = name === 'value' ? attrValue : stringTrim(attrValue);
-          const initValue = value;
+          const initValue = attrValue;
+          let value = name === 'value' ? initValue : stringTrim(initValue);
           /* Execute a hook if present */
           hookEvent.attrName = lcName;
           hookEvent.attrValue = value;
@@ -19886,7 +19898,6 @@
           if (hookEvent.forceKeepAttr) {
             continue;
           }
-          /* Remove attribute */
           /* Did the hooks approve of the attribute? */
           if (!hookEvent.keepAttr) {
             _removeAttribute(name, currentNode);
@@ -19940,7 +19951,9 @@
               } else {
                 arrayPop(DOMPurify.removed);
               }
-            } catch (_) {}
+            } catch (_) {
+              _removeAttribute(name, currentNode);
+            }
           }
         }
         /* Execute a hook if present */
@@ -20567,9 +20580,14 @@
         var _a, _b, _c, _d;
         const validate = settings.validate;
         const specialElements = schema.getSpecialElements();
-        // Pad conditional comments if they aren't allowed
-        if (node.nodeType === COMMENT && !settings.allow_conditional_comments && /^\[if/i.test((_a = node.nodeValue) !== null && _a !== void 0 ? _a : '')) {
-            node.nodeValue = ' ' + node.nodeValue;
+        if (node.nodeType === COMMENT) {
+            // Pad conditional comments if they aren't allowed
+            if (!settings.allow_conditional_comments && /^\[if/i.test((_a = node.nodeValue) !== null && _a !== void 0 ? _a : '')) {
+                node.nodeValue = ' ' + node.nodeValue;
+            }
+            if (settings.sanitize && settings.allow_html_in_comments && isString(node.nodeValue)) {
+                node.nodeValue = encodeData(node.nodeValue);
+            }
         }
         const lcTagName = (_b = evt === null || evt === void 0 ? void 0 : evt.tagName) !== null && _b !== void 0 ? _b : node.nodeName.toLowerCase();
         if (scope !== 'html' && schema.isValid(scope)) {
@@ -20706,8 +20724,6 @@
             // body is also allowed due to the DOMPurify checking the root node before sanitizing
             ALLOWED_TAGS: ['#comment', '#cdata-section', 'body'],
             ALLOWED_ATTR: [],
-            // TINY-11332: New settings for dompurify 3.1.7
-            SAFE_FOR_XML: false
         };
         const config = { ...basePurifyConfig };
         // Set the relevant parser mimetype
@@ -20856,7 +20872,7 @@
      * @version 3.4
      */
     const makeMap = Tools.makeMap, extend$1 = Tools.extend;
-    const transferChildren = (parent, nativeParent, specialElements, nsSanitizer) => {
+    const transferChildren = (parent, nativeParent, specialElements, nsSanitizer, decodeComments) => {
         const parentName = parent.name;
         // Exclude the special elements where the content is RCDATA as their content needs to be parsed instead of being left as plain text
         // See: https://html.spec.whatwg.org/multipage/parsing.html#parsing-html-fragments
@@ -20882,11 +20898,14 @@
                     child.raw = true;
                 }
             }
-            else if (isComment(nativeChild) || isCData(nativeChild) || isPi(nativeChild)) {
+            else if (isComment(nativeChild)) {
+                child.value = decodeComments ? decodeData$1(nativeChild.data) : nativeChild.data;
+            }
+            else if (isCData(nativeChild) || isPi(nativeChild)) {
                 child.value = nativeChild.data;
             }
             if (!isNonHtmlElementRootName(child.name)) {
-                transferChildren(child, nativeChild, specialElements, nsSanitizer);
+                transferChildren(child, nativeChild, specialElements, nsSanitizer, decodeComments);
             }
             parent.append(child);
         }
@@ -21041,6 +21060,7 @@
             validate: true,
             root_name: 'body',
             sanitize: true,
+            allow_html_in_comments: true,
             ...settings
         };
         const parser = new DOMParser();
@@ -21202,7 +21222,7 @@
             updateChildren(schema, element);
             // Create the AST representation
             const rootNode = new AstNode(rootName, 11);
-            transferChildren(rootNode, element, schema.getSpecialElements(), sanitizer.sanitizeNamespaceElement);
+            transferChildren(rootNode, element, schema.getSpecialElements(), sanitizer.sanitizeNamespaceElement, defaultedSettings.sanitize && defaultedSettings.allow_html_in_comments);
             // This next line is needed to fix a memory leak in chrome and firefox.
             // For more information see TINY-9186
             element.innerHTML = '';
@@ -33604,13 +33624,14 @@
             editor.on('mousedown', (e) => {
                 lift2(Optional.from(e.clientX), Optional.from(e.clientY), (clientX, clientY) => {
                     const caretPos = editor.getDoc().caretPositionFromPoint(clientX, clientY);
-                    if (caretPos && isEditableImage(caretPos.offsetNode)) {
-                        const rect = caretPos.offsetNode.getBoundingClientRect();
+                    const img = (caretPos === null || caretPos === void 0 ? void 0 : caretPos.offsetNode.childNodes[caretPos.offset - (caretPos.offset > 0 ? 1 : 0)]) || (caretPos === null || caretPos === void 0 ? void 0 : caretPos.offsetNode);
+                    if (img && isEditableImage(img)) {
+                        const rect = img.getBoundingClientRect();
                         e.preventDefault();
                         if (!editor.hasFocus()) {
                             editor.focus();
                         }
-                        editor.selection.select(caretPos.offsetNode);
+                        editor.selection.select(img);
                         if (e.clientX < rect.left || e.clientY < rect.top) {
                             editor.selection.collapse(true);
                         }
@@ -34092,6 +34113,7 @@
             allow_svg_data_urls: getOption('allow_svg_data_urls'),
             allow_html_in_named_anchor: getOption('allow_html_in_named_anchor'),
             allow_script_urls: getOption('allow_script_urls'),
+            allow_html_in_comments: getOption('allow_html_in_comments'),
             allow_mathml_annotation_encodings: getOption('allow_mathml_annotation_encodings'),
             allow_unsafe_link_target: getOption('allow_unsafe_link_target'),
             convert_unsafe_embeds: getOption('convert_unsafe_embeds'),
@@ -37762,14 +37784,14 @@
          * @property minorVersion
          * @type String
          */
-        minorVersion: '9.1',
+        minorVersion: '9.2',
         /**
          * Release date of TinyMCE build.
          *
          * @property releaseDate
          * @type String
          */
-        releaseDate: '2025-05-29',
+        releaseDate: '2026-02-11',
         /**
          * Collection of language pack data.
          *

data/lib/tinymce/rails/version.rb

@@ -1,6 +1,6 @@
 module TinyMCE
   module Rails
-    VERSION = "7.9.1.1"
-    TINYMCE_VERSION = "7.9.1"
+    VERSION = "7.9.2"
+    TINYMCE_VERSION = "7.9.2"
   end
 end

data/vendor/assets/javascripts/tinymce/notices.txt

@@ -1,10 +1,10 @@
 Below is a list of third party libraries that this software uses:
 ----------------------------------------------------------------
 
-dompurify - Patched by Tiny
+dompurify
 owner: Mario Heiderich
 repo: https://github.com/cure53/DOMPurify
-version: 3.2.4
+version: 3.2.6
 license: MPL-2.0 OR Apache-2.0
 
 prismjs