@ckeditor/ckeditor5-core 43.1.0-alpha.7 → 43.1.0

package/dist/editor/editorconfig.d.ts

@@ -809,43 +809,6 @@ export interface EditorConfig {
      * Translations to be used in the editor.
      */
     translations?: ArrayOrItem<Translations>;
-    /**
-     * Callback used to sanitize the HTML provided by the user when generating previews of it in the editor.
-     *
-     * We strongly recommend overwriting the default function to avoid XSS vulnerabilities.
-     *
-     * Read more about the security aspect of this feature in the {@glink getting-started/setup/html-security "HTML security"}
-     * guide.
-     *
-     * The function receives the input HTML (as a string), and should return an object
-     * that matches the {@link module:core/editor/editorconfig~SanitizedOutput} interface.
-     *
-     * ```ts
-     * ClassicEditor
-     * 	.create( editorElement, {
-     * 		sanitizeHtml( inputHtml ) {
-     * 		// Strip unsafe elements and attributes, e.g.:
-     * 		// the `<script>` elements and `on*` attributes.
-     * 		const outputHtml = sanitize( inputHtml );
-     *
-     * 		return {
-     * 			html: outputHtml,
-     * 			// `true` or `false` depending on whether the sanitizer stripped anything.
-     * 			hasChanged: inputHtml !== outputHtml
-     * 		};
-     *	} )
-     * 	.then( ... )
-     * 	.catch( ... );
-     * ```
-     *
-     * This function is used by following features:
-     *
-     * * {@glink features/html/html-embed HTML embed}
-     *   (when {@link module:html-embed/htmlembedconfig~HtmlEmbedConfig#showPreviews `showPreviews`} flag is set).
-     * * {@glink features/merge-fields Merge fields}
-     *   (when {@link module:merge-fields/mergefieldsconfig~MergeFieldsConfig#previewHtmlValues `previewHtmlValues`} flag is set).
-     */
-    sanitizeHtml?: HtmlSanitizationCallback;
     /**
      * Label text for the `aria-label` attribute set on editor editing area. Used by assistive technologies
      * to tell apart multiple editor instances (editing areas) on the page. If not set, a default
@@ -1027,17 +990,3 @@ export interface UiConfig {
      **/
     poweredBy?: PoweredByConfig;
 }
-/**
- * An object returned by the {@link module:core/editor/editorconfig~EditorConfig#sanitizeHtml} function.
- */
-export interface SanitizedOutput {
-    /**
-     * An output (safe) HTML that will be inserted into the {@glink framework/architecture/editing-engine editing view}.
-     */
-    html: string;
-    /**
-     * A flag that indicates whether the output HTML is different than the input value.
-     */
-    hasChanged: boolean;
-}
-export type HtmlSanitizationCallback = (html: string) => SanitizedOutput;

package/dist/index.d.ts

@@ -19,7 +19,7 @@ export { default as ContextPlugin, type ContextPluginDependencies } from './cont
 export { type EditingKeystrokeCallback } from './editingkeystrokehandler.js';
 export type { PartialBy, NonEmptyArray, HexColor } from './typings.js';
 export { default as Editor, type EditorReadyEvent, type EditorDestroyEvent } from './editor/editor.js';
-export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig, SanitizedOutput } from './editor/editorconfig.js';
+export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig } from './editor/editorconfig.js';
 export { default as attachToForm } from './editor/utils/attachtoform.js';
 export { default as DataApiMixin, type DataApi } from './editor/utils/dataapimixin.js';
 export { default as ElementApiMixin, type ElementApi } from './editor/utils/elementapimixin.js';

package/dist/index.js

@@ -2,7 +2,7 @@
  * @license Copyright (c) 2003-2024, CKSource Holding sp. z o.o. All rights reserved.
  * For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license
  */
-import { ObservableMixin, insertToPriorityArray, EmitterMixin, CKEditorError, Config, Locale, Collection, KeystrokeHandler, logWarning, setDataInElement } from '@ckeditor/ckeditor5-utils/dist/index.js';
+import { ObservableMixin, insertToPriorityArray, EmitterMixin, CKEditorError, Config, Locale, Collection, KeystrokeHandler, setDataInElement } from '@ckeditor/ckeditor5-utils/dist/index.js';
 import { Model, StylesProcessor, DataController, EditingController, Conversion } from '@ckeditor/ckeditor5-engine/dist/index.js';
 import { EditorWatchdog, ContextWatchdog } from '@ckeditor/ckeditor5-watchdog/dist/index.js';
 import { isFunction } from 'lodash-es';
@@ -1826,6 +1826,15 @@ const DEFAULT_GROUP_ID = 'common';
 	 * @param config The editor configuration.
 	 */ constructor(config = {}){
         super();
+        if ('sanitizeHtml' in config) {
+            /**
+			 * Configuration property `config.sanitizeHtml` was removed in CKEditor version 43.1.0 and is no longer supported.
+			 *
+			 * Please use `config.htmlEmbed.sanitizeHtml` and/or `config.mergeFields.sanitizeHtml` instead.
+			 *
+			 * @error editor-config-sanitizehtml-not-supported
+			 */ throw new CKEditorError('editor-config-sanitizehtml-not-supported');
+        }
         const constructor = this.constructor;
         // We don't pass translations to the config, because its behavior of splitting keys
         // with dots (e.g. `resize.width` => `resize: { width }`) breaks the translations.
@@ -1844,21 +1853,6 @@ const DEFAULT_GROUP_ID = 'common';
         this.config = new Config(rest, defaultConfig);
         this.config.define('plugins', availablePlugins);
         this.config.define(this._context._getEditorConfig());
-        this.config.define('sanitizeHtml', function(rawHtml) {
-            /**
-			 * One of the editor features directly inserts unsanitized HTML code into the editor.
-			 * It is strongly recommended to define a sanitize function that will clean up the input HTML
-			 * in order to avoid XSS vulnerability.
-			 *
-			 * For a detailed overview, check the {@glink getting-started/setup/html-security "HTML security"} guide.
-			 *
-			 * @error provide-sanitize-function
-			 */ logWarning('provide-sanitize-function');
-            return {
-                html: rawHtml,
-                hasChanged: false
-            };
-        });
         this.plugins = new PluginCollection(this, availablePlugins, this._context.plugins);
         this.locale = this._context.locale;
         this.t = this.locale.t;