@instructure/canvas-rce 5.14.1 → 5.14.2

package/es/common/fileUrl.js

@@ -15,142 +15,187 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 // I really want to use the native URL api, but it's requirement of an absolute URL
 // or a base URL makes testing difficult, esp since window.location is "about:blank"
 // in mocha tests.
-import { parse, format } from 'url';
-import RCEGlobals from '../rce/RCEGlobals';
 
+import RCEGlobals from '../rce/RCEGlobals';
 function parseCanvasUrl(url) {
   let canvasOrigin = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : window.location.origin;
-
   if (!url) {
     return null;
   }
+  try {
+    // For absolute URLs
+    const fullUrl = url.startsWith('http') ? url : `${canvasOrigin}${url.startsWith('/') ? '' : '/'}${url}`;
+    const parsed = new URL(fullUrl);
+    const canvasUrl = new URL(canvasOrigin);
+    if (parsed.host && canvasUrl.host !== parsed.host) {
+      return null;
+    }
 
-  const parsed = parse(url, true);
-  const canvasHost = parse(canvasOrigin, true).host;
-
-  if (parsed.host && canvasHost !== parsed.host) {
+    // Convert URLSearchParams to query object
+    const query = {};
+    parsed.searchParams.forEach((value, key) => {
+      query[key] = value;
+    });
+    return {
+      pathname: parsed.pathname,
+      search: parsed.search,
+      hash: parsed.hash,
+      host: parsed.host,
+      hostname: parsed.hostname,
+      protocol: parsed.protocol,
+      query
+    };
+  } catch {
+    // If URL parsing fails, return null
     return null;
   }
-
-  return parsed;
 }
-
+function formatUrl(parsed) {
+  try {
+    // Format query string while preserving original encoding
+    const queryPairs = Object.entries(parsed.query || {}).map(_ref => {
+      let [key, value] = _ref;
+      // Use encodeURIComponent to preserve %20 encoding
+      return `${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+    });
+    const search = queryPairs.join('&');
+    const pathname = parsed.pathname || '';
+    const hash = parsed.hash || '';
+    if (parsed.protocol || parsed.host) {
+      const protocol = parsed.protocol ? parsed.protocol.replace(/:$/, '') : '';
+      const host = parsed.host || '';
+      return `${protocol}://${host}${pathname}${search ? '?' + search : ''}${hash}`;
+    }
+    return `${pathname}${search ? '?' + search : ''}${hash}`;
+  } catch {
+    return '';
+  }
+}
 export function absoluteToRelativeUrl(url, canvasOrigin) {
-  const parsed = parseCanvasUrl(url, canvasOrigin);
-
+  const parsed = parseCanvasUrl(url, canvasOrigin || window.location.origin);
   if (!parsed) {
     return url;
   }
-
   parsed.host = '';
   parsed.hostname = '';
-  parsed.slashes = false;
   parsed.protocol = '';
-  const newUrl = format(parsed);
-  return newUrl;
+  return formatUrl(parsed);
 }
-
 function changeDownloadToWrapParams(parsedUrl) {
-  delete parsedUrl.search;
-  delete parsedUrl.query.download_frd;
+  if (parsedUrl.search) {
+    parsedUrl.search = null;
+  }
+  if (parsedUrl.query) {
+    // Remove all download-related parameters
+    delete parsedUrl.query.download_frd;
+  }
+  if (!parsedUrl.query) {
+    parsedUrl.query = {};
+  }
   parsedUrl.query.wrap = '1';
-  parsedUrl.pathname = parsedUrl.pathname.replace(/\/(?:download|preview)\/?$/, '');
+  if (parsedUrl.pathname) {
+    parsedUrl.pathname = parsedUrl.pathname.replace(/\/(?:download|preview)\/?$/, '');
+  }
   return parsedUrl;
 }
-
 function addContext(parsedUrl, contextType, contextId) {
   // if this is a http://canvas/files... url. change it to be contextual
-  if (/^\/files/.test(parsedUrl.pathname)) {
+  if (parsedUrl.pathname && /^\/files/.test(parsedUrl.pathname)) {
     const context = contextType.replace(/([^s])$/, '$1s'); // canvas contexts are plural
-
     parsedUrl.pathname = `/${context}/${contextId}${parsedUrl.pathname}`;
   }
-
   return parsedUrl;
-} // simply replaces the download_frd url param with wrap
+}
+
+// simply replaces the download_frd url param with wrap
 // wrap=1 will (often) cause the resource to be loaded
 // in an iframe on canvas' files page
-
-
 export function downloadToWrap(url) {
   const parsed = parseCanvasUrl(url);
-
   if (!parsed) {
     return url;
   }
+  const formattedUrl = formatUrl(changeDownloadToWrapParams(parsed));
+  return absoluteToRelativeUrl(formattedUrl);
+}
 
-  return format(changeDownloadToWrapParams(parsed));
-} // take a url to a file (e.g. /files/17), and convert it to
+// take a url to a file (e.g. /files/17), and convert it to
 // it's in-context url (e.g. /courses/2/files/17).
 // Add wrap=1 to the url so it previews, not downloads
 // If it is a user file or being referenced from a different origin, add the verifier
 // NOTE: this can be removed once canvas-rce-api is updated
 //       to normalize the file URLs it returns.
-
-export function fixupFileUrl(contextType, contextId, fileInfo, canvasOrigin) {
-  // it's annoying, but depending on how we got here
-  // the file may have an href or a url
+export function fixupFileUrl(
+// it's annoying, but depending on how we got here
+// the file may have an href or a url
+contextType, contextId, fileInfo, canvasOrigin) {
   const key = fileInfo.href ? 'href' : 'url';
-
   if (fileInfo[key]) {
-    var _RCEGlobals$getFeatur;
-
-    let parsed = parseCanvasUrl(fileInfo[key], canvasOrigin);
-
+    var _RCEGlobals$getFeatur, _fileInfo$key, _fileInfo$key2;
+    const currentOrigin = canvasOrigin || window.location.origin;
+    let parsed = parseCanvasUrl(fileInfo[key], currentOrigin);
     if (!parsed) {
       return fileInfo;
     }
-
     parsed = changeDownloadToWrapParams(parsed);
-    parsed = addContext(parsed, contextType, contextId); // if this is a user file, add the verifier
+    parsed = addContext(parsed, contextType, contextId);
+    // if this is a user file, add the verifier
     // if this is in New Quizzes and the feature flag is enabled, add the verifier
 
     if (fileInfo.uuid && (contextType.includes('user') || !!canvasOrigin && canvasOrigin !== window.location.origin && (_RCEGlobals$getFeatur = RCEGlobals.getFeatures()) !== null && _RCEGlobals$getFeatur !== void 0 && _RCEGlobals$getFeatur.file_verifiers_for_quiz_links)) {
-      delete parsed.search;
+      parsed.search = null;
       parsed.query.verifier = fileInfo.uuid;
     } else {
       delete parsed.query.verifier;
     }
+    const formattedUrl = formatUrl(parsed);
 
-    fileInfo[key] = format(parsed);
+    // Keep absolute URLs if they match the canvas origin and input was absolute
+    const isAbsoluteUrl = (_fileInfo$key = fileInfo[key]) === null || _fileInfo$key === void 0 ? void 0 : _fileInfo$key.startsWith('http');
+    const matchesCanvasOrigin = (_fileInfo$key2 = fileInfo[key]) === null || _fileInfo$key2 === void 0 ? void 0 : _fileInfo$key2.startsWith(currentOrigin);
+    fileInfo[key] = isAbsoluteUrl && matchesCanvasOrigin ? formattedUrl : absoluteToRelativeUrl(formattedUrl, currentOrigin);
   }
-
   return fileInfo;
-} // embedded resources, like an <img src=url> with /preview
+}
+
+// embedded resources, like an <img src=url> with /preview
 // in the url will not be logged as a view in canvas.
 // This is appropriate for images in some rce content.
 // Remove wrap=1 to indicate we want the file downloaded
 // (which is necessary to show in an <img> tag), not viewed
-
 export function prepEmbedSrc(url) {
   let canvasOrigin = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : window.location.origin;
   const parsed = parseCanvasUrl(url, canvasOrigin);
-
   if (!parsed) {
     return url;
   }
-
-  if (!/\/preview(?:\?|$)/.test(parsed.pathname)) {
+  if (parsed.pathname && !/\/preview(?:\?|$)/.test(parsed.pathname)) {
     parsed.pathname = parsed.pathname.replace(/(?:\/download)?\/?(\?|$)/, '/preview$1');
   }
-
-  delete parsed.search;
+  parsed.search = null;
   delete parsed.query.wrap;
-  return format(parsed);
-} // when the user opens a link to a resource, we want its view
-// logged, so remove /preview
+  const formattedUrl = formatUrl(parsed);
 
+  // Keep absolute URLs if they match the canvas origin
+  const isAbsoluteUrl = url.startsWith('http');
+  const matchesCanvasOrigin = url.startsWith(canvasOrigin);
+  return isAbsoluteUrl && matchesCanvasOrigin ? formattedUrl : absoluteToRelativeUrl(formattedUrl, canvasOrigin);
+}
+
+// when the user opens a link to a resource, we want its view
+// logged, so remove /preview
 export function prepLinkedSrc(url) {
   const parsed = parseCanvasUrl(url);
-
   if (!parsed) {
     return url;
   }
-
-  delete parsed.search;
-  parsed.pathname = parsed.pathname.replace(/\/preview(\?|$)/, '$1');
-  return format(parsed);
+  if (parsed.pathname) {
+    parsed.pathname = parsed.pathname.replace(/\/preview(?:\?|$)/, '');
+  }
+  const formattedUrl = formatUrl(parsed);
+  return absoluteToRelativeUrl(formattedUrl);
 }

package/es/common/incremental-loading/LoadMoreButton.js

@@ -15,6 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 import React from 'react';
 import { func, shape } from 'prop-types';
 import { Button } from '@instructure/ui-buttons';

package/es/common/incremental-loading/LoadingIndicator.js

@@ -15,15 +15,14 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 import React from 'react';
 import { Spinner } from '@instructure/ui-spinner';
 import { View } from '@instructure/ui-view';
 import formatMessage from '../../format-message';
-
 function renderLoading() {
   return formatMessage('Loading');
 }
-
 export default function LoadingIndicator() {
   return /*#__PURE__*/React.createElement(View, {
     as: "div",

package/es/common/incremental-loading/LoadingStatus.js

@@ -15,6 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 import React from 'react';
 import { number, shape } from 'prop-types';
 import { ScreenReaderContent } from '@instructure/ui-a11y-content';
@@ -24,7 +25,6 @@ export default function LoadingStatus(_ref) {
     loader
   } = _ref;
   let itemsLoadedText = null;
-
   if (loader.lastRecordsLoaded > 0) {
     itemsLoadedText = formatMessage(`{
          count, plural,
@@ -34,7 +34,6 @@ export default function LoadingStatus(_ref) {
       count: loader.lastRecordsLoaded
     });
   }
-
   return /*#__PURE__*/React.createElement(ScreenReaderContent, {
     "aria-live": "polite",
     "aria-relevant": "text additions"

package/es/common/incremental-loading/index.js

@@ -15,6 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 export { default as LoadMoreButton } from './LoadMoreButton';
 export { default as LoadingIndicator } from './LoadingIndicator';
 export { default as LoadingStatus } from './LoadingStatus';

package/es/common/incremental-loading/useIncrementalLoading.js

@@ -15,6 +15,7 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 import { useEffect, useMemo, useRef } from 'react';
 export default function useIncrementalLoading(options) {
   const {
@@ -42,15 +43,12 @@ export default function useIncrementalLoading(options) {
       sortBy,
       searchString,
       contextType,
-
       onLoadMore() {
         if (lastItemRef.current) {
           lastItemRef.current.focus();
         }
-
         onLoadMore();
       }
-
     };
     recordCountRef.current = records.length;
     return loader;

package/es/common/indicate.js

@@ -15,36 +15,43 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
-import { StyleSheet, css } from 'aphrodite'; // margin can be overridden, but default is 3px
 
-const MARGIN = 3; // show the indicator over the target with specified margin
+import { StyleSheet, css } from 'aphrodite';
 
+// margin can be overridden, but default is 3px
+const MARGIN = 3;
+
+// show the indicator over the target with specified margin
 export default function indicate(region) {
   let margin = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : MARGIN;
-  const el = document.createElement('div'); // add margin to region and lift it in front
+  const el = document.createElement('div');
 
+  // add margin to region and lift it in front
   Object.assign(el.style, {
     width: region.width + 2 * margin + 'px',
     height: region.height + 2 * margin + 'px',
     left: region.left - margin + 'px',
     top: region.top - margin + 'px',
     pointerEvents: 'none' // so clicking in the indicator doesn't blur the RCE
+  });
 
-  }); // start hidden and animate a fade in
-
+  // start hidden and animate a fade in
   el.className = css(styles.indicator, styles.enter);
   document.body.appendChild(el);
-  el.className = css(styles.indicator, styles.enter, styles.active); // fades out slowly after a half second
+  el.className = css(styles.indicator, styles.enter, styles.active);
 
+  // fades out slowly after a half second
   const to = setTimeout(() => {
     el.className = css(styles.indicator, styles.leave);
-  }, 900); // when moused over dismiss with quick fade
+  }, 900);
 
+  // when moused over dismiss with quick fade
   el.addEventListener('mouseover', () => {
     clearTimeout(to);
     el.className = css(styles.indicator, styles.leaveFast);
-  }); // destroy element
+  });
 
+  // destroy element
   setTimeout(() => document.body.removeChild(el), 2000);
   return el;
 }

package/es/common/mimeClass.js

@@ -15,9 +15,9 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 export function fileEmbed(file) {
   const fileMimeClass = mimeClass(file);
-
   if (fileMimeClass === 'image') {
     return {
       type: 'image'
@@ -40,8 +40,8 @@ export function mimeClass(file) {
   if (file.mime_class) {
     return file.mime_class;
   } else {
-    const contentType = getContentType(file); // NOTE: Keep this list in sync with what's in canvas-lms/app/models/attachment.rb
-
+    const contentType = getContentType(file);
+    // NOTE: Keep this list in sync with what's in canvas-lms/app/models/attachment.rb
     return contentMapping(contentType) || file.mime_class || 'file';
   }
 }
@@ -114,7 +114,6 @@ export function contentMapping(contentType) {
     'application/x-shockwave-flash': 'flash'
   }[contentType];
 }
-
 function getContentType(file) {
   return file['content-type'] || file.content_type || file.type;
 }

package/es/common/natcompare.js

@@ -14,6 +14,7 @@
 //
 // You should have received a copy of the GNU Affero General Public License along
 // with this program. If not, see <http://www.gnu.org/licenses/>.
+
 let activeLocale = 'en-US';
 export const setLocale = locale => {
   const locale_map = {
@@ -31,17 +32,13 @@ export default {
       numeric: true
     });
   },
-
   by(f) {
     return (x, y) => this.strings(f(x), f(y));
   },
-
   byKey(key) {
     return this.by(x => x[key]);
   },
-
   byGet(key) {
     return this.by(x => x.get(key));
   }
-
 };

package/es/defaultTinymceConfig.js

@@ -15,11 +15,13 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 const defaultTinymceConfig = {
   // ============================================================================
   // Values in this section have acceptable defaults which you may want
   // to override (though you really should provide content_css)
   // ============================================================================
+
   auto_focus: false,
   // any values provided (in an array) will be merged into the standard then sorted
   // you provide the translations
@@ -47,8 +49,7 @@ const defaultTinymceConfig = {
   // ==================================================================================
   branding: false,
   browser_spellcheck: true,
-  content_style: undefined,
-  // this will always be provided by the RCE
+  content_style: '',
   convert_urls: false,
   // fonts specified here need to either be web-safe or self-hosted and loaded in app/stylesheets/bundles/fonts.scss
   font_formats: "Lato Extended=Lato Extended,Helvetica Neue,Helvetica,Arial,sans-serif; Balsamiq Sans=Balsamiq Sans,Lato Extended,Helvetica Neue,Helvetica,Arial,sans-serif; Architect's Daughter=Architects Daughter,Lato Extended,Helvetica Neue,Helvetica,Arial,sans-serif; Arial=arial,helvetica,sans-serif; Arial Black=arial black,avant garde; Courier New=courier new,courier; Georgia=georgia,palatino; Tahoma=tahoma,arial,helvetica,sans-serif; Times New Roman=times new roman,times; Trebuchet MS=trebuchet ms,geneva; Verdana=verdana,geneva",
@@ -73,7 +74,8 @@ const defaultTinymceConfig = {
   //
   // this list needs to be kept in sync with the list in gems/canvas_sanitize/lib/canvas_sanitize/canvas_sanitize.rb
   valid_elements: '@[id|class|style|title|dir<ltr?rtl|lang|xml::lang|role],a[rel|rev|charset|hreflang|tabindex|accesskey|type|name|href|target|title|class|data-old-link],strong/b,em/i,strike/s,u,#p,-ol[type|compact],-ul[type|compact],-li,br,img[longdesc|usemap|src|border|alt|title|hspace|vspace|width|height|align|role|data-old-link],-sub,-sup,-blockquote[cite],-table[border=0|cellspacing|cellpadding|width|frame|rules|height|align|summary|bgcolor|background|bordercolor],-tr[rowspan|width|height|align|valign|bgcolor|background|bordercolor],tbody,thead,tfoot,#td[colspan|rowspan|width|height|align|valign|bgcolor|background|bordercolor|scope],#th[colspan|rowspan|width|height|align|valign|scope],caption,-div,-span,-code,-pre,address,-h1,-h2,-h3,-h4,-h5,-h6,hr[size|noshade],-font[face|size|color],dd,dl,dt,cite,abbr,acronym,del[datetime|cite],ins[datetime|cite],object[classid|width|height|codebase|*],param[name|value|_value],embed[type|width|height|src|*],map[name],area[shape|coords|href|alt|target],bdo,col[align|char|charoff|span|valign|width],colgroup[align|char|charoff|span|valign|width],dfn,kbd,q[cite],samp,small,tt,var,big,figure,figcaption,source[media|width|height|sizes|src|srcset|type|data-old-link],track,mark,article,aside,details,footer,header,nav,section,summary,time',
-  extended_valid_elements: '@[id|accesskey|class|dir|lang|style|tabindex|title|contenteditable|contextmenu|draggable|dropzone|hidden|longdesc|spellcheck|translate|align|role|aria-labelledby|aria-atomic|aria-busy|aria-controls|aria-describedby|aria-disabled|aria-dropeffect|aria-flowto|aria-grabbed|aria-haspopup|aria-hidden|aria-invalid|aria-label|aria-labelledby|aria-live|aria-owns|aria-relevant|aria-autocomplete|aria-checked|aria-disabled|aria-expanded|aria-haspopup|aria-hidden|aria-invalid|aria-label|aria-level|aria-multiline|aria-multiselectable|aria-orientation|aria-pressed|aria-readonly|aria-required|aria-selected|aria-sort|aria-valuemax|aria-valuemin|aria-valuenow|aria-valuetext],iframe[id|data-media-type|title|src|width|height|name|align|style|class|sandbox|allowfullscreen|webkitallowfullscreen|mozallowfullscreen|allow|data-old-link],i[iclass],a[hidden|href|target|rel|media|hreflang|type|charset|name|rev|shape|coords|download|alt],#p,li[value],-ol[reversed|start|type|compact],pre[width],table[border|summary|width|frame|rules|cellspacing|cellpadding|bgcolor],tbody[char|charoff|valign],td[colspan|rowspan|headers|abbr|axis|scope|align|char|charoff|valign|nowrap|bgcolor|width|height],tfoot[char|charoff|valign],th[colspan|rowspan|headers|scope|abbr|axis|align|char|charoff|valign|nowrap|bgcolor|width|height],thead[char|charoff|valign],tr[char|charoff|valign|bgcolor],-ul[compact],video[name|src|allowfullscreen|muted|poster|width|height|controls|playsinline],audio[name|src|muted|controls],annotation[href|xref|definitionURL|encoding|cd|name|src],annotation-xml[href|xref|definitionURL|encoding|cd|name|src],maction[href|xref|mathcolor|mathbackground|actiontype|selection],maligngroup[href|xref|mathcolor|mathbackground|groupalign],malignmark[href|xref|mathcolor|mathbackground|edge],math[xmlns|href|xref|display|maxwidth|overflow|altimg|altimg-width|altimg-height|altimg-valign|alttext|cdgroup|mathcolor|mathbackground|scriptlevel|displaystyle|scriptsizemultiplier|scriptminsize|infixlinebreakstyle|decimalpoint|mathvariant|mathsize|width|height|valign|form|fence|separator|lspace|rspace|stretchy|symmetric|maxsize|minsize|largeop|movablelimits|accent|linebreak|lineleading|linebreakstyle|linebreakmultchar|indentalign|indentshift|indenttarget|indentalignfirst|indentshiftfirst|indentalignlast|indentshiftlast|depth|lquote|rquote|linethickness|munalign|denomalign|bevelled|voffset|open|close|separators|notation|subscriptshift|superscriptshift|accentunder|align|rowalign|columnalign|groupalign|alignmentscope|columnwidth|rowspacing|columnspacing|rowlines|columnlines|frame|framespacing|equalrows|equalcolumns|side|minlabelspacing|rowspan|columnspan|edge|stackalign|charalign|charspacing|longdivstyle|position|shift|location|crossout|length|leftoverhang|rightoverhang|mslinethickness|selection],menclose[href|xref|mathcolor|mathbackground|notation],merror[href|xref|mathcolor|mathbackground],mfenced[href|xref|mathcolor|mathbackground|open|close|separators],mfrac[href|xref|mathcolor|mathbackground|linethickness|munalign|denomalign|bevelled],mglyph[href|xref|mathcolor|mathbackground|src|alt|width|height|valign],mi[href|xref|mathcolor|mathbackground|mathvariant|mathsize],mlabeledtr[href|xref|mathcolor|mathbackground],mlongdiv[href|xref|mathcolor|mathbackground|longdivstyle|align|stackalign|charalign|charspacing],mmultiscripts[href|xref|mathcolor|mathbackground|subscriptshift|superscriptshift],mn[href|xref|mathcolor|mathbackground|mathvariant|mathsize],mo[href|xref|mathcolor|mathbackground|mathvariant|mathsize|form|fence|separator|lspace|rspace|stretchy|symmetric|maxsize|minsize|largeop|movablelimits|accent|linebreak|lineleading|linebreakstyle|linebreakmultchar|indentalign|indentshift|indenttarget|indentalignfirst|indentshiftfirst|indentalignlast|indentshiftlast],mover[href|xref|mathcolor|mathbackground|accent|align],mpadded[href|xref|mathcolor|mathbackground|height|depth|width|lspace|voffset],mphantom[href|xref|mathcolor|mathbackground],mprescripts[href|xref|mathcolor|mathbackground],mroot[href|xref|mathcolor|mathbackground],mrow[href|xref|mathcolor|mathbackground],ms[href|xref|mathcolor|mathbackground|mathvariant|mathsize|lquote|rquote],mscarries[href|xref|mathcolor|mathbackground|position|location|crossout|scriptsizemultiplier],mscarry[href|xref|mathcolor|mathbackground|location|crossout],msgroup[href|xref|mathcolor|mathbackground|position|shift],msline[href|xref|mathcolor|mathbackground|position|length|leftoverhang|rightoverhang|mslinethickness],mspace[href|xref|mathcolor|mathbackground|mathvariant|mathsize],msqrt[href|xref|mathcolor|mathbackground],msrow[href|xref|mathcolor|mathbackground|position],mstack[href|xref|mathcolor|mathbackground|align|stackalign|charalign|charspacing],mstyle[href|xref|mathcolor|mathbackground|scriptlevel|displaystyle|scriptsizemultiplier|scriptminsize|infixlinebreakstyle|decimalpoint|mathvariant|mathsize|width|height|valign|form|fence|separator|lspace|rspace|stretchy|symmetric|maxsize|minsize|largeop|movablelimits|accent|linebreak|lineleading|linebreakstyle|linebreakmultchar|indentalign|indentshift|indenttarget|indentalignfirst|indentshiftfirst|indentalignlast|indentshiftlast|depth|lquote|rquote|linethickness|munalign|denomalign|bevelled|voffset|open|close|separators|notation|subscriptshift|superscriptshift|accentunder|align|rowalign|columnalign|groupalign|alignmentscope|columnwidth|rowspacing|columnspacing|rowlines|columnlines|frame|framespacing|equalrows|equalcolumns|side|minlabelspacing|rowspan|columnspan|edge|stackalign|charalign|charspacing|longdivstyle|position|shift|location|crossout|length|leftoverhang|rightoverhang|mslinethickness|selection],msub[href|xref|mathcolor|mathbackground|subscriptshift],msubsup[href|xref|mathcolor|mathbackground|subscriptshift|superscriptshift],msup[href|xref|mathcolor|mathbackground|superscriptshift],mtable[href|xref|mathcolor|mathbackground|align|rowalign|columnalign|groupalign|alignmentscope|columnwidth|width|rowspacing|columnspacing|rowlines|columnlines|frame|framespacing|equalrows|equalcolumns|displaystyle|side|minlabelspacing],mtd[href|xref|mathcolor|mathbackground|rowspan|columnspan|rowalign|columnalign|groupalign],mtext[href|xref|mathcolor|mathbackground|mathvariant|mathsize|width|height|depth|linebreak],mtr[href|xref|mathcolor|mathbackground|rowalign|columnalign|groupalign],munder[href|xref|mathcolor|mathbackground|accentunder|align],munderover[href|xref|mathcolor|mathbackground|accent|accentunder|align],none[href|xref|mathcolor|mathbackground],semantics[href|xref|definitionURL|encoding],picture,ruby,rp,rt,wbr' + // the svg necessary for the uploading placeholder's spinner
+  extended_valid_elements: '@[id|accesskey|class|dir|lang|style|tabindex|title|contenteditable|contextmenu|draggable|dropzone|hidden|longdesc|spellcheck|translate|align|role|aria-labelledby|aria-atomic|aria-busy|aria-controls|aria-describedby|aria-disabled|aria-dropeffect|aria-flowto|aria-grabbed|aria-haspopup|aria-hidden|aria-invalid|aria-label|aria-labelledby|aria-live|aria-owns|aria-relevant|aria-autocomplete|aria-checked|aria-disabled|aria-expanded|aria-haspopup|aria-hidden|aria-invalid|aria-label|aria-level|aria-multiline|aria-multiselectable|aria-orientation|aria-pressed|aria-readonly|aria-required|aria-selected|aria-sort|aria-valuemax|aria-valuemin|aria-valuenow|aria-valuetext],iframe[id|data-media-type|title|src|width|height|name|align|style|class|sandbox|allowfullscreen|webkitallowfullscreen|mozallowfullscreen|allow|data-old-link],i[iclass],a[hidden|href|target|rel|media|hreflang|type|charset|name|rev|shape|coords|download|alt],#p,li[value],-ol[reversed|start|type|compact],pre[width],table[border|summary|width|frame|rules|cellspacing|cellpadding|bgcolor],tbody[char|charoff|valign],td[colspan|rowspan|headers|abbr|axis|scope|align|char|charoff|valign|nowrap|bgcolor|width|height],tfoot[char|charoff|valign],th[colspan|rowspan|headers|scope|abbr|axis|align|char|charoff|valign|nowrap|bgcolor|width|height],thead[char|charoff|valign],tr[char|charoff|valign|bgcolor],-ul[compact],video[name|src|allowfullscreen|muted|poster|width|height|controls|playsinline],audio[name|src|muted|controls],annotation[href|xref|definitionURL|encoding|cd|name|src],annotation-xml[href|xref|definitionURL|encoding|cd|name|src],maction[href|xref|mathcolor|mathbackground|actiontype|selection],maligngroup[href|xref|mathcolor|mathbackground|groupalign],malignmark[href|xref|mathcolor|mathbackground|edge],math[xmlns|href|xref|display|maxwidth|overflow|altimg|altimg-width|altimg-height|altimg-valign|alttext|cdgroup|mathcolor|mathbackground|scriptlevel|displaystyle|scriptsizemultiplier|scriptminsize|infixlinebreakstyle|decimalpoint|mathvariant|mathsize|width|height|valign|form|fence|separator|lspace|rspace|stretchy|symmetric|maxsize|minsize|largeop|movablelimits|accent|linebreak|lineleading|linebreakstyle|linebreakmultchar|indentalign|indentshift|indenttarget|indentalignfirst|indentshiftfirst|indentalignlast|indentshiftlast|depth|lquote|rquote|linethickness|munalign|denomalign|bevelled|voffset|open|close|separators|notation|subscriptshift|superscriptshift|accentunder|align|rowalign|columnalign|groupalign|alignmentscope|columnwidth|rowspacing|columnspacing|rowlines|columnlines|frame|framespacing|equalrows|equalcolumns|side|minlabelspacing|rowspan|columnspan|edge|stackalign|charalign|charspacing|longdivstyle|position|shift|location|crossout|length|leftoverhang|rightoverhang|mslinethickness|selection],menclose[href|xref|mathcolor|mathbackground|notation],merror[href|xref|mathcolor|mathbackground],mfenced[href|xref|mathcolor|mathbackground|open|close|separators],mfrac[href|xref|mathcolor|mathbackground|linethickness|munalign|denomalign|bevelled],mglyph[href|xref|mathcolor|mathbackground|src|alt|width|height|valign],mi[href|xref|mathcolor|mathbackground|mathvariant|mathsize],mlabeledtr[href|xref|mathcolor|mathbackground],mlongdiv[href|xref|mathcolor|mathbackground|longdivstyle|align|stackalign|charalign|charspacing],mmultiscripts[href|xref|mathcolor|mathbackground|subscriptshift|superscriptshift],mn[href|xref|mathcolor|mathbackground|mathvariant|mathsize],mo[href|xref|mathcolor|mathbackground|mathvariant|mathsize|form|fence|separator|lspace|rspace|stretchy|symmetric|maxsize|minsize|largeop|movablelimits|accent|linebreak|lineleading|linebreakstyle|linebreakmultchar|indentalign|indentshift|indenttarget|indentalignfirst|indentshiftfirst|indentalignlast|indentshiftlast],mover[href|xref|mathcolor|mathbackground|accent|align],mpadded[href|xref|mathcolor|mathbackground|height|depth|width|lspace|voffset],mphantom[href|xref|mathcolor|mathbackground],mprescripts[href|xref|mathcolor|mathbackground],mroot[href|xref|mathcolor|mathbackground],mrow[href|xref|mathcolor|mathbackground],ms[href|xref|mathcolor|mathbackground|mathvariant|mathsize|lquote|rquote],mscarries[href|xref|mathcolor|mathbackground|position|location|crossout|scriptsizemultiplier],mscarry[href|xref|mathcolor|mathbackground|location|crossout],msgroup[href|xref|mathcolor|mathbackground|position|shift],msline[href|xref|mathcolor|mathbackground|position|length|leftoverhang|rightoverhang|mslinethickness],mspace[href|xref|mathcolor|mathbackground|mathvariant|mathsize],msqrt[href|xref|mathcolor|mathbackground],msrow[href|xref|mathcolor|mathbackground|position],mstack[href|xref|mathcolor|mathbackground|align|stackalign|charalign|charspacing],mstyle[href|xref|mathcolor|mathbackground|scriptlevel|displaystyle|scriptsizemultiplier|scriptminsize|infixlinebreakstyle|decimalpoint|mathvariant|mathsize|width|height|valign|form|fence|separator|lspace|rspace|stretchy|symmetric|maxsize|minsize|largeop|movablelimits|accent|linebreak|lineleading|linebreakstyle|linebreakmultchar|indentalign|indentshift|indenttarget|indentalignfirst|indentshiftfirst|indentalignlast|indentshiftlast|depth|lquote|rquote|linethickness|munalign|denomalign|bevelled|voffset|open|close|separators|notation|subscriptshift|superscriptshift|accentunder|align|rowalign|columnalign|groupalign|alignmentscope|columnwidth|rowspacing|columnspacing|rowlines|columnlines|frame|framespacing|equalrows|equalcolumns|side|minlabelspacing|rowspan|columnspan|edge|stackalign|charalign|charspacing|longdivstyle|position|shift|location|crossout|length|leftoverhang|rightoverhang|mslinethickness|selection],msub[href|xref|mathcolor|mathbackground|subscriptshift],msubsup[href|xref|mathcolor|mathbackground|subscriptshift|superscriptshift],msup[href|xref|mathcolor|mathbackground|superscriptshift],mtable[href|xref|mathcolor|mathbackground|align|rowalign|columnalign|groupalign|alignmentscope|columnwidth|width|rowspacing|columnspacing|rowlines|columnlines|frame|framespacing|equalrows|equalcolumns|displaystyle|side|minlabelspacing],mtd[href|xref|mathcolor|mathbackground|rowspan|columnspan|rowalign|columnalign|groupalign],mtext[href|xref|mathcolor|mathbackground|mathvariant|mathsize|width|height|depth|linebreak],mtr[href|xref|mathcolor|mathbackground|rowalign|columnalign|groupalign],munder[href|xref|mathcolor|mathbackground|accentunder|align],munderover[href|xref|mathcolor|mathbackground|accent|accentunder|align],none[href|xref|mathcolor|mathbackground],semantics[href|xref|definitionURL|encoding],picture,ruby,rp,rt,wbr' +
+  // the svg necessary for the uploading placeholder's spinner
   'svg[*],g[*],circle[*]',
   non_empty_elements: 'td th iframe video audio object script a i area base basefont br col frame hr img input isindex link meta param embed source wbr track ruby',
   // tiny's external link create/edit dialog config

package/es/elementDenylist.js

@@ -15,5 +15,6 @@
  * You should have received a copy of the GNU Affero General Public License along
  * with this program. If not, see <http://www.gnu.org/licenses/>.
  */
+
 const elementDenylist = ('html,base,head,link,meta,style,title,body,main,data,rb,rtc,portal,svg,canvas,noscript,script,button,datalist,fieldset,form,input,label,legend,meter,optgroup' + ',option,output,progress,select,textarea,dialog,menu,slot,template,applet,basefont,bgsound,blink,center,content,dir,frame,frameset,hgroup,image,keygen,marquee,menuitem,nobr,noembed' + ',noframes,plaintext,rb,rtc,shadow,spacer,xmp').split(',');
 export default elementDenylist;