@37signals/lexxy 0.9.6-beta → 0.9.7-beta

package/README.md

@@ -3,7 +3,7 @@
 A modern rich text editor for Rails.
 
 > [!IMPORTANT]
-> This is an early beta. It hasn't been battle-tested yet. Please try it out and report any issues you find.
+> This is a beta. It hasn't been battle-tested yet. Please try it out and report any issues you find.
 
 **[Try it out!](https://basecamp.github.io/lexxy/try-it)**
 
@@ -26,7 +26,7 @@ Visit the **[documentation site](https://basecamp.github.io/lexxy)**.
 
 ## Roadmap
 
-This is an early beta. Here's what's coming next:
+This is a beta. Here's what's coming next:
 
 - [x] Configurable editors in Action Text: Choose your editor like you choose your database.
 - [x] More editing features:

package/dist/lexxy.esm.js

@@ -72,7 +72,7 @@ DOMPurify.addHook("uponSanitizeElement", (node, data) => {
   }
 });
 
-function buildConfig(allowedElements) {
+function buildConfig(allowedElements ) {
   const tagAttributes = {};
 
   for (const element of allowedElements) {
@@ -1172,15 +1172,12 @@ var Lexxy = {
   }
 };
 
-function sanitize(html, allowedElements) {
-  return DOMPurify.sanitize(html, buildConfig(allowedElements))
+function setSanitizerConfig(allowedTags) {
+  DOMPurify.clearConfig();
+  DOMPurify.setConfig(buildConfig(allowedTags));
 }
 
-// Sanitize HTML for custom attachment content (mentions, cards, etc.).
-// Uses DOMPurify defaults to strip XSS vectors (scripts, event handlers)
-// while preserving the richer tag set that server-rendered attachment
-// content legitimately uses (e.g. <span>, <div>, <img>).
-function sanitizeAttachmentContent(html) {
+function sanitize(html) {
   return DOMPurify.sanitize(html)
 }
 
@@ -1276,7 +1273,7 @@ class CustomActionTextAttachmentNode extends DecoratorNode {
   createDOM() {
     const figure = createElement(this.tagName, { "content-type": this.contentType, "data-lexxy-decorator": true });
 
-    figure.insertAdjacentHTML("beforeend", sanitizeAttachmentContent(this.innerHtml));
+    figure.insertAdjacentHTML("beforeend", sanitize(this.innerHtml));
 
     const deleteButton = createElement("lexxy-node-delete-button");
     figure.appendChild(deleteButton);
@@ -6734,7 +6731,7 @@ class LexicalEditorElement extends HTMLElement {
   get value() {
     if (!this.cachedValue) {
       this.editor?.getEditorState().read(() => {
-        this.cachedValue = sanitize($generateHtmlFromNodes(this.editor, null), this.#allowedElements);
+        this.cachedValue = sanitize($generateHtmlFromNodes(this.editor, null));
       });
     }
 
@@ -6793,6 +6790,7 @@ class LexicalEditorElement extends HTMLElement {
     this.#registerFocusEvents();
     this.#attachDebugHooks();
     this.#attachToolbar();
+    this.#configureSanitizer();
     this.#loadInitialValue();
     this.#resetBeforeTurboCaches();
   }
@@ -7069,6 +7067,10 @@ class LexicalEditorElement extends HTMLElement {
     }
   }
 
+  #configureSanitizer() {
+    setSanitizerConfig(this.#allowedElements);
+  }
+
   get #allowedElements() {
     return this.#importableTags.concat(this.extensions.allowedElements)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@37signals/lexxy",
-  "version": "0.9.6-beta",
+  "version": "0.9.7-beta",
   "description": "Lexxy - A modern rich text editor for Rails.",
   "module": "dist/lexxy.esm.js",
   "type": "module",