@37signals/lexxy 0.9.29 → 0.9.30

package/dist/lexxy.esm.js

@@ -15,7 +15,7 @@ import { HistoryExtension } from '@lexical/history';
 import { $isCodeNode, CodeHighlightNode, PrismTokenizer, $isCodeHighlightNode, $createCodeNode, $createCodeHighlightNode, CodeNode, registerCodeHighlighting, normalizeCodeLang, CODE_LANGUAGE_FRIENDLY_NAME_MAP } from '@lexical/code';
 import { TRANSFORMERS, registerMarkdownShortcuts } from '@lexical/markdown';
 import { INSERT_TABLE_COMMAND, $getTableCellNodeFromLexicalNode, TableCellNode, TableNode, TableRowNode, setScrollableTablesActive, registerTablePlugin, registerTableSelectionObserver, TableCellHeaderStates, $insertTableRowAtSelection, $insertTableColumnAtSelection, $deleteTableRowAtSelection, $deleteTableColumnAtSelection, $findTableNode, $getTableRowIndexFromTableCellNode, $getTableColumnIndexFromTableCellNode, $findCellNode, $getElementForTableNode } from '@lexical/table';
-import { marked } from 'marked';
+import { Marked } from 'marked';
 import { $insertDataTransferForRichText } from '@lexical/clipboard';
 import 'prismjs';
 import 'prismjs/components/prism-clike';
@@ -67,6 +67,22 @@ function styleFilterHook(_currentNode, hookEvent) {
 
 DOMPurify.addHook("uponSanitizeAttribute", styleFilterHook);
 
+const FORBIDDEN_STIMULUS_ATTRIBUTES = [ "data-controller", "data-action" ];
+
+// Stimulus behavior attributes must never survive sanitization, whatever an
+// extension's allowedElements declares. FORBID_ATTR alone isn't enough: in
+// DOMPurify 3.x the functional ADD_ATTR — which Lexxy builds from the public
+// allowedElements API — is evaluated ahead of FORBID_ATTR, so an extension that
+// listed one of these on a tag would otherwise reinstate it. This hook drops
+// them unconditionally, keeping the class-level prohibition config-independent.
+function stimulusAttributeFilterHook(_currentNode, hookEvent) {
+  if (FORBIDDEN_STIMULUS_ATTRIBUTES.includes(hookEvent.attrName)) {
+    hookEvent.keepAttr = false;
+  }
+}
+
+DOMPurify.addHook("uponSanitizeAttribute", stimulusAttributeFilterHook);
+
 DOMPurify.addHook("uponSanitizeElement", (node, data) => {
   if (data.tagName === "strong" || data.tagName === "em") {
     node.removeAttribute("class");
@@ -90,7 +106,12 @@ function buildConfig(allowedElements ) {
     ALLOWED_ATTR: ALLOWED_HTML_ATTRIBUTES,
     ADD_ATTR: (attribute, tag) => tagAttributes[tag]?.includes(attribute),
     ADD_URI_SAFE_ATTR: [ "caption", "filename" ],
-    SAFE_FOR_XML: false // So that it does not strip attributes that contains serialized HTML (like content)
+    SAFE_FOR_XML: false, // So that it does not strip attributes that contains serialized HTML (like content)
+    // Stimulus behavior attributes must never survive sanitization: they let stored content
+    // wire up arbitrary controllers/actions in the viewer's session. FORBID_ATTR wins over
+    // ALLOWED_ATTR/ADD_ATTR/ALLOW_DATA_ATTR in DOMPurify, so this holds even though other
+    // data-* attributes (data-language, data-trix-*, etc.) are otherwise allowed through.
+    FORBID_ATTR: [ "data-controller", "data-action" ]
   }
 }
 
@@ -6348,7 +6369,7 @@ class Contents {
   insertText(text, { tag } = {}) {
     this.editor.update(() => {
       const paragraph = $createParagraphNode();
-      text.split("\n").forEach((line, index) => {
+      text.split(/\r\n|\r|\n/).forEach((line, index) => {
         if (index > 0) paragraph.append($createLineBreakNode());
         paragraph.append($createTextNode(line));
       });
@@ -6990,6 +7011,12 @@ class Contents {
   }
 }
 
+// Markdown reads any line indented by a tab or four spaces as a code block. Pasted
+// plain text is full of incidental indentation — outlines, notes, logs — and nobody
+// indents a note meaning "this is code"; they fence it. Keep fences, drop the
+// indentation rule.
+const pastedMarkdown = new Marked({ breaks: true }).use({ tokenizer: { code: () => undefined } });
+
 class Clipboard {
   #listeners = new ListenerBin()
 
@@ -7176,7 +7203,7 @@ class Clipboard {
   }
 
   #pasteMarkdown(text) {
-    const html = marked(text, { breaks: true });
+    const html = pastedMarkdown.parse(text);
     const doc = parseHtml(html);
 
     if (this.#isPlainTextWithoutMarkdown(doc)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@37signals/lexxy",
-  "version": "0.9.29",
+  "version": "0.9.30",
   "description": "Lexxy - A modern rich text editor for Rails.",
   "module": "dist/lexxy.esm.js",
   "type": "module",