@ckeditor/ckeditor5-engine 47.7.3 → 47.7.5-alpha.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-engine",
-  "version": "47.7.3",
+  "version": "47.7.5-alpha.0",
   "description": "The editing engine of CKEditor 5 – the best browser-based rich text editor.",
   "keywords": [
     "wysiwyg",
@@ -24,8 +24,8 @@
   "type": "module",
   "main": "src/index.js",
   "dependencies": {
-    "@ckeditor/ckeditor5-utils": "47.7.3",
-    "es-toolkit": "1.39.5"
+    "@ckeditor/ckeditor5-utils": "47.7.5-alpha.0",
+    "es-toolkit": "1.52.0"
   },
   "author": "CKSource (http://cksource.com/)",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/view/domconverter.js

@@ -217,9 +217,25 @@ export class ViewDomConverter {
         if (elementName === 'source' && attributeKey === 'srcset') {
             return true;
         }
-        if (attributeValue.replace(/\s+/g, '').match(/^(javascript:|data:(image\/svg|text\/x?html))/i)) {
+        // eslint-disable-next-line no-control-regex
+        attributeValue = attributeValue.replace(/[\s\u0000-\u0020]+/g, '');
+        if (attributeValue.match(/^javascript:/i)) {
             return false;
         }
+        // Block all data: URIs except known-safe binary image, audio and video formats. Such a payload is
+        // decoded by an image decoder or a media player, so it cannot execute a script - not even when
+        // loaded in an iframe, embed or object element. Any XML-based or text-based MIME type (text/xml,
+        // application/xml, application/xhtml+xml, text/xsl, image/svg+xml, text/html, etc.) can.
+        //
+        // The subtype must end at a parameter (`;`) or at the data itself (`,`) - a prefix match would let
+        // `data:image/png+xml` through, and the HTML specification treats every `+xml` subtype as XML.
+        if (attributeValue.match(/^data:/i)) {
+            const isImage = attributeValue.match(/^data:image\/(png|jpeg|jpg|gif|webp|avif|bmp|x-icon|vnd\.microsoft\.icon|apng|tiff|heic|heif|jxl)($|[;,])/i);
+            const isMedia = attributeValue.match(/^data:(audio|video)\/(mp4|mpeg|mp3|ogg|webm|wav|x-wav|aac|flac|quicktime|3gpp)($|[;,])/i);
+            if (!isImage && !isMedia) {
+                return false;
+            }
+        }
         return true;
     }
     /**