@ckeditor/ckeditor5-core 43.0.0-alpha.5 → 43.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-core",
-  "version": "43.0.0-alpha.5",
+  "version": "43.0.0",
   "description": "The core architecture of CKEditor 5 – the best browser-based rich text editor.",
   "keywords": [
     "wysiwyg",
@@ -24,9 +24,9 @@
   "type": "module",
   "main": "src/index.js",
   "dependencies": {
-    "@ckeditor/ckeditor5-engine": "43.0.0-alpha.5",
-    "@ckeditor/ckeditor5-utils": "43.0.0-alpha.5",
-    "@ckeditor/ckeditor5-watchdog": "43.0.0-alpha.5",
+    "@ckeditor/ckeditor5-engine": "43.0.0",
+    "@ckeditor/ckeditor5-utils": "43.0.0",
+    "@ckeditor/ckeditor5-watchdog": "43.0.0",
     "lodash-es": "4.17.21"
   },
   "author": "CKSource (http://cksource.com/)",

package/src/editor/editorconfig.d.ts

@@ -805,6 +805,43 @@ export interface EditorConfig {
      * Translations to be used in the editor.
      */
     translations?: ArrayOrItem<Translations>;
+    /**
+     * Callback used to sanitize the HTML provided by the user when generating previews of it in the editor.
+     *
+     * We strongly recommend overwriting the default function to avoid XSS vulnerabilities.
+     *
+     * Read more about the security aspect of this feature in the {@glink features/html/html-embed#security "Security"} section of
+     * the {@glink features/html/html-embed HTML embed} feature guide.
+     *
+     * The function receives the input HTML (as a string), and should return an object
+     * that matches the {@link module:core/editor/editorconfig~SanitizedOutput} interface.
+     *
+     * ```ts
+     * ClassicEditor
+     * 	.create( editorElement, {
+     * 		sanitizeHtml( inputHtml ) {
+     * 		// Strip unsafe elements and attributes, e.g.:
+     * 		// the `<script>` elements and `on*` attributes.
+     * 		const outputHtml = sanitize( inputHtml );
+     *
+     * 		return {
+     * 			html: outputHtml,
+     * 			// `true` or `false` depending on whether the sanitizer stripped anything.
+     * 			hasChanged: inputHtml !== outputHtml
+     * 		};
+     *	} )
+     * 	.then( ... )
+     * 	.catch( ... );
+     * ```
+     *
+     * This function is used by following features:
+     *
+     * * {@glink features/html/html-embed HTML embed}
+     *   (when {@link module:html-embed/htmlembedconfig~HtmlEmbedConfig#showPreviews `showPreviews`} flag is set).
+     * * {@glink features/merge-fields Merge fields}
+     *   (when {@link module:merge-fields/mergefieldsconfig~MergeFieldsConfig#previewHtmlValues `previewHtmlValues`} flag is set).
+     */
+    sanitizeHtml?: (html: string) => SanitizedOutput;
 }
 /**
  * The `config.initialData` option cannot be used together with the initial data passed as the first parameter of
@@ -945,3 +982,16 @@ export interface UiConfig {
      **/
     poweredBy?: PoweredByConfig;
 }
+/**
+ * An object returned by the {@link module:core/editor/editorconfig~EditorConfig#sanitizeHtml} function.
+ */
+export interface SanitizedOutput {
+    /**
+     * An output (safe) HTML that will be inserted into the {@glink framework/architecture/editing-engine editing view}.
+     */
+    html: string;
+    /**
+     * A flag that indicates whether the output HTML is different than the input value.
+     */
+    hasChanged: boolean;
+}

package/src/index.d.ts

@@ -15,7 +15,7 @@ export { default as ContextPlugin, type ContextPluginDependencies } from './cont
 export { type EditingKeystrokeCallback } from './editingkeystrokehandler.js';
 export type { PartialBy, NonEmptyArray, HexColor } from './typings.js';
 export { default as Editor, type EditorReadyEvent, type EditorDestroyEvent } from './editor/editor.js';
-export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig } from './editor/editorconfig.js';
+export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig, SanitizedOutput } from './editor/editorconfig.js';
 export { default as attachToForm } from './editor/utils/attachtoform.js';
 export { default as DataApiMixin, type DataApi } from './editor/utils/dataapimixin.js';
 export { default as ElementApiMixin, type ElementApi } from './editor/utils/elementapimixin.js';