@ckeditor/ckeditor5-core 43.0.0-alpha.5 → 43.0.0

package/dist/editor/editorconfig.d.ts

@@ -809,6 +809,43 @@ export interface EditorConfig {
      * Translations to be used in the editor.
      */
     translations?: ArrayOrItem<Translations>;
+    /**
+     * Callback used to sanitize the HTML provided by the user when generating previews of it in the editor.
+     *
+     * We strongly recommend overwriting the default function to avoid XSS vulnerabilities.
+     *
+     * Read more about the security aspect of this feature in the {@glink features/html/html-embed#security "Security"} section of
+     * the {@glink features/html/html-embed HTML embed} feature guide.
+     *
+     * The function receives the input HTML (as a string), and should return an object
+     * that matches the {@link module:core/editor/editorconfig~SanitizedOutput} interface.
+     *
+     * ```ts
+     * ClassicEditor
+     * 	.create( editorElement, {
+     * 		sanitizeHtml( inputHtml ) {
+     * 		// Strip unsafe elements and attributes, e.g.:
+     * 		// the `<script>` elements and `on*` attributes.
+     * 		const outputHtml = sanitize( inputHtml );
+     *
+     * 		return {
+     * 			html: outputHtml,
+     * 			// `true` or `false` depending on whether the sanitizer stripped anything.
+     * 			hasChanged: inputHtml !== outputHtml
+     * 		};
+     *	} )
+     * 	.then( ... )
+     * 	.catch( ... );
+     * ```
+     *
+     * This function is used by following features:
+     *
+     * * {@glink features/html/html-embed HTML embed}
+     *   (when {@link module:html-embed/htmlembedconfig~HtmlEmbedConfig#showPreviews `showPreviews`} flag is set).
+     * * {@glink features/merge-fields Merge fields}
+     *   (when {@link module:merge-fields/mergefieldsconfig~MergeFieldsConfig#previewHtmlValues `previewHtmlValues`} flag is set).
+     */
+    sanitizeHtml?: (html: string) => SanitizedOutput;
 }
 /**
  * The `config.initialData` option cannot be used together with the initial data passed as the first parameter of
@@ -949,3 +986,16 @@ export interface UiConfig {
      **/
     poweredBy?: PoweredByConfig;
 }
+/**
+ * An object returned by the {@link module:core/editor/editorconfig~EditorConfig#sanitizeHtml} function.
+ */
+export interface SanitizedOutput {
+    /**
+     * An output (safe) HTML that will be inserted into the {@glink framework/architecture/editing-engine editing view}.
+     */
+    html: string;
+    /**
+     * A flag that indicates whether the output HTML is different than the input value.
+     */
+    hasChanged: boolean;
+}

package/dist/index.d.ts

@@ -19,7 +19,7 @@ export { default as ContextPlugin, type ContextPluginDependencies } from './cont
 export { type EditingKeystrokeCallback } from './editingkeystrokehandler.js';
 export type { PartialBy, NonEmptyArray, HexColor } from './typings.js';
 export { default as Editor, type EditorReadyEvent, type EditorDestroyEvent } from './editor/editor.js';
-export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig } from './editor/editorconfig.js';
+export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig, SanitizedOutput } from './editor/editorconfig.js';
 export { default as attachToForm } from './editor/utils/attachtoform.js';
 export { default as DataApiMixin, type DataApi } from './editor/utils/dataapimixin.js';
 export { default as ElementApiMixin, type ElementApi } from './editor/utils/elementapimixin.js';