@ckeditor/ckeditor5-core 43.1.0-alpha.7 → 43.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-core",
-  "version": "43.1.0-alpha.7",
+  "version": "43.1.0",
   "description": "The core architecture of CKEditor 5 – the best browser-based rich text editor.",
   "keywords": [
     "wysiwyg",
@@ -24,9 +24,9 @@
   "type": "module",
   "main": "src/index.js",
   "dependencies": {
-    "@ckeditor/ckeditor5-engine": "43.1.0-alpha.7",
-    "@ckeditor/ckeditor5-utils": "43.1.0-alpha.7",
-    "@ckeditor/ckeditor5-watchdog": "43.1.0-alpha.7",
+    "@ckeditor/ckeditor5-engine": "43.1.0",
+    "@ckeditor/ckeditor5-utils": "43.1.0",
+    "@ckeditor/ckeditor5-watchdog": "43.1.0",
     "lodash-es": "4.17.21"
   },
   "author": "CKSource (http://cksource.com/)",

package/src/editor/editor.js

@@ -5,7 +5,7 @@
 /**
  * @module core/editor/editor
  */
-import { Config, CKEditorError, ObservableMixin, logWarning } from '@ckeditor/ckeditor5-utils';
+import { Config, CKEditorError, ObservableMixin } from '@ckeditor/ckeditor5-utils';
 import { Conversion, DataController, EditingController, Model, StylesProcessor } from '@ckeditor/ckeditor5-engine';
 import { ContextWatchdog, EditorWatchdog } from '@ckeditor/ckeditor5-watchdog';
 import Context from '../context.js';
@@ -41,6 +41,16 @@ class Editor extends /* #__PURE__ */ ObservableMixin() {
      */
     constructor(config = {}) {
         super();
+        if ('sanitizeHtml' in config) {
+            /**
+             * Configuration property `config.sanitizeHtml` was removed in CKEditor version 43.1.0 and is no longer supported.
+             *
+             * Please use `config.htmlEmbed.sanitizeHtml` and/or `config.mergeFields.sanitizeHtml` instead.
+             *
+             * @error editor-config-sanitizehtml-not-supported
+             */
+            throw new CKEditorError('editor-config-sanitizehtml-not-supported');
+        }
         const constructor = this.constructor;
         // We don't pass translations to the config, because its behavior of splitting keys
         // with dots (e.g. `resize.width` => `resize: { width }`) breaks the translations.
@@ -56,22 +66,6 @@ class Editor extends /* #__PURE__ */ ObservableMixin() {
         this.config = new Config(rest, defaultConfig);
         this.config.define('plugins', availablePlugins);
         this.config.define(this._context._getEditorConfig());
-        this.config.define('sanitizeHtml', function (rawHtml) {
-            /**
-             * One of the editor features directly inserts unsanitized HTML code into the editor.
-             * It is strongly recommended to define a sanitize function that will clean up the input HTML
-             * in order to avoid XSS vulnerability.
-             *
-             * For a detailed overview, check the {@glink getting-started/setup/html-security "HTML security"} guide.
-             *
-             * @error provide-sanitize-function
-             */
-            logWarning('provide-sanitize-function');
-            return {
-                html: rawHtml,
-                hasChanged: false
-            };
-        });
         this.plugins = new PluginCollection(this, availablePlugins, this._context.plugins);
         this.locale = this._context.locale;
         this.t = this.locale.t;

package/src/editor/editorconfig.d.ts

@@ -805,43 +805,6 @@ export interface EditorConfig {
      * Translations to be used in the editor.
      */
     translations?: ArrayOrItem<Translations>;
-    /**
-     * Callback used to sanitize the HTML provided by the user when generating previews of it in the editor.
-     *
-     * We strongly recommend overwriting the default function to avoid XSS vulnerabilities.
-     *
-     * Read more about the security aspect of this feature in the {@glink getting-started/setup/html-security "HTML security"}
-     * guide.
-     *
-     * The function receives the input HTML (as a string), and should return an object
-     * that matches the {@link module:core/editor/editorconfig~SanitizedOutput} interface.
-     *
-     * ```ts
-     * ClassicEditor
-     * 	.create( editorElement, {
-     * 		sanitizeHtml( inputHtml ) {
-     * 		// Strip unsafe elements and attributes, e.g.:
-     * 		// the `<script>` elements and `on*` attributes.
-     * 		const outputHtml = sanitize( inputHtml );
-     *
-     * 		return {
-     * 			html: outputHtml,
-     * 			// `true` or `false` depending on whether the sanitizer stripped anything.
-     * 			hasChanged: inputHtml !== outputHtml
-     * 		};
-     *	} )
-     * 	.then( ... )
-     * 	.catch( ... );
-     * ```
-     *
-     * This function is used by following features:
-     *
-     * * {@glink features/html/html-embed HTML embed}
-     *   (when {@link module:html-embed/htmlembedconfig~HtmlEmbedConfig#showPreviews `showPreviews`} flag is set).
-     * * {@glink features/merge-fields Merge fields}
-     *   (when {@link module:merge-fields/mergefieldsconfig~MergeFieldsConfig#previewHtmlValues `previewHtmlValues`} flag is set).
-     */
-    sanitizeHtml?: HtmlSanitizationCallback;
     /**
      * Label text for the `aria-label` attribute set on editor editing area. Used by assistive technologies
      * to tell apart multiple editor instances (editing areas) on the page. If not set, a default
@@ -1023,17 +986,3 @@ export interface UiConfig {
      **/
     poweredBy?: PoweredByConfig;
 }
-/**
- * An object returned by the {@link module:core/editor/editorconfig~EditorConfig#sanitizeHtml} function.
- */
-export interface SanitizedOutput {
-    /**
-     * An output (safe) HTML that will be inserted into the {@glink framework/architecture/editing-engine editing view}.
-     */
-    html: string;
-    /**
-     * A flag that indicates whether the output HTML is different than the input value.
-     */
-    hasChanged: boolean;
-}
-export type HtmlSanitizationCallback = (html: string) => SanitizedOutput;

package/src/index.d.ts

@@ -15,7 +15,7 @@ export { default as ContextPlugin, type ContextPluginDependencies } from './cont
 export { type EditingKeystrokeCallback } from './editingkeystrokehandler.js';
 export type { PartialBy, NonEmptyArray, HexColor } from './typings.js';
 export { default as Editor, type EditorReadyEvent, type EditorDestroyEvent } from './editor/editor.js';
-export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig, SanitizedOutput } from './editor/editorconfig.js';
+export type { EditorConfig, LanguageConfig, ToolbarConfig, ToolbarConfigItem, UiConfig } from './editor/editorconfig.js';
 export { default as attachToForm } from './editor/utils/attachtoform.js';
 export { default as DataApiMixin, type DataApi } from './editor/utils/dataapimixin.js';
 export { default as ElementApiMixin, type ElementApi } from './editor/utils/elementapimixin.js';