@limetech/lime-elements 37.70.2 → 37.70.3

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [37.70.3](https://github.com/Lundalogik/lime-elements/compare/v37.70.2...v37.70.3) (2024-11-25)
+
+
+### Bug Fixes
+
+
+* **text-editor:** close XSS vulnerability ([f9606ab](https://github.com/Lundalogik/lime-elements/commit/f9606abedd7fcfb969ec191f2973bf3c5ed15929)), closes [Lundalogik/crm-feature#4490](https://github.com/Lundalogik/crm-feature/issues/4490)
+
 ## [37.70.2](https://github.com/Lundalogik/lime-elements/compare/v37.70.1...v37.70.2) (2024-11-22)
 
 

package/dist/cjs/limel-prosemirror-adapter.cjs.entry.js

@@ -25699,11 +25699,7 @@ const buildMarkdownSerializer = (plugins) => {
 class MarkdownConverter {
   constructor(plugins) {
     this.parseAsHTML = (text) => {
-      const whitelist = this.customNodes.map((nodeConfig) => ({
-        tagName: nodeConfig.tagName,
-        attributes: nodeConfig.attributes,
-      }));
-      return markdownParser.markdownToHTML(text, { whitelist: whitelist });
+      return markdownParser.markdownToHTML(text, { whitelist: this.customNodes });
     };
     this.serialize = (view) => {
       if (view.dom.textContent === '') {
@@ -25722,11 +25718,9 @@ class MarkdownConverter {
  * @private
  */
 class HTMLConverter {
-  constructor() {
+  constructor(plugins) {
     this.parseAsHTML = (text) => {
-      return new Promise((resolve) => {
-        resolve(text);
-      });
+      return markdownParser.markdownToHTML(text, { whitelist: this.customNodes });
     };
     this.serialize = (view) => {
       if (view.dom.textContent === '') {
@@ -25736,6 +25730,7 @@ class HTMLConverter {
         return view.dom.innerHTML;
       }
     };
+    this.customNodes = plugins;
   }
 }
 
@@ -27953,7 +27948,7 @@ const ProsemirrorAdapter = class {
       this.contentConverter = new MarkdownConverter(this.customElements);
     }
     else if (this.contentType === 'html') {
-      this.contentConverter = new HTMLConverter();
+      this.contentConverter = new HTMLConverter(this.customElements);
     }
     else {
       throw new Error(`Unsupported content type: ${this.contentType}. Only 'markdown' and 'html' are supported.`);