@progress/kendo-angular-editor 25.3.0-develop.1 → 25.3.0-develop.2

package/fesm2022/progress-kendo-angular-editor.mjs

@@ -12,7 +12,7 @@ import * as i1$2 from '@progress/kendo-angular-toolbar';
 import { ToolBarToolComponent, ToolBarComponent, ToolBarButtonGroupComponent, ToolBarButtonComponent, KENDO_TOOLBAR } from '@progress/kendo-angular-toolbar';
 import * as i1$1 from '@progress/kendo-angular-dialog';
 import { DialogContentBase, DialogTitleBarComponent, DialogActionsComponent, DialogContainerService, DialogService, WindowService, WindowContainerService } from '@progress/kendo-angular-dialog';
-import { isDocumentAvailable, guid, getLicenseMessage, shouldShowValidationUI, Keys, hasObservers, WatermarkOverlayComponent, KendoInput, KENDO_WEBMCP_HOST, provideComponentName, isPresent as isPresent$1, ResizeBatchService } from '@progress/kendo-angular-common';
+import { isSafeUrl, isSafeImageUrl, isDocumentAvailable, guid, getLicenseMessage, shouldShowValidationUI, Keys, hasObservers, WatermarkOverlayComponent, KendoInput, KENDO_WEBMCP_HOST, provideComponentName, isPresent as isPresent$1, ResizeBatchService } from '@progress/kendo-angular-common';
 import { marks as marks$1, nodes as nodes$1, Schema, createTable, insertNode, alignBlocks, alignRemoveRules, canIndentAsListItem, indent, canBeIndented, indentBlocks, hasNode, liftBlockquote, canOutdentAsListItem, outdent, selectAll, expandToWordWrap, applyInlineStyle, removeLink, link, toggleInlineFormat, underline, superscript, subscript, strikethrough, italic, insertText, applyLink, cleanFormatting, bold, blockquote, undo, setHtml, redo, toggleUnorderedList, toggleOrderedList, insertImage, getHtml, formatBlockElements, isAligned, alignRightRules, alignLeftRules, alignJustifyRules, alignCenterRules, deleteTable, splitCell, mergeCells, deleteColumn, deleteRow, addRowAfter, addRowBefore, addColumnAfter, addColumnBefore, expandSelection, hasMark, getActiveMarks, isIndented, activeNode, getSelectionText as getSelectionText$1, getNodeFromSelection, getMark, removeComments, sanitize, removeAttribute, sanitizeClassAttr, sanitizeStyleAttr, TextSelection, parseContent, Plugin, PluginKey, history, keymap, buildListKeymap, buildKeymap, baseKeymap, gapCursor, imageResizing, tableResizing, tableEditing, caretColor, cspFix, placeholder, EditorState, EditorView, pasteCleanup, replaceImageSourcesFromRtf, AllSelection } from '@progress/kendo-editor-common';
 export { AllSelection, CellSelection, Decoration, DecorationSet, EditorState, EditorView, InputRule, Mark, MarkType, Node, NodeSelection, NodeType, Plugin, PluginKey, Schema, TextSelection, Transaction, baseKeymap, dropCursor, flattenNestedSpans, gapCursor, history, inputRules, keymap, tableNodes, textblockTypeInputRule, wrappingInputRule } from '@progress/kendo-editor-common';
 import { validatePackage } from '@progress/kendo-licensing';
@@ -36,8 +36,8 @@ const packageMetadata = {
     productName: 'Kendo UI for Angular',
     productCode: 'KENDOUIANGULAR',
     productCodes: ['KENDOUIANGULAR'],
-    publishDate: 1790689508,
-    version: '25.3.0-develop.1',
+    publishDate: 1790761643,
+    version: '25.3.0-develop.2',
     licensingDocsUrl: 'https://www.telerik.com/kendo-angular-ui/my-license/'
 };
 
@@ -234,6 +234,18 @@ const insertTable = (attrs) => (state, dispatch) => {
 };
 
 const alignRemove = (state, dispatch) => alignBlocks(alignRemoveRules)(state, dispatch);
+const sanitizeLinkAttrs = (attrs) => {
+    if (attrs && typeof attrs === 'object' && attrs.href !== undefined && !isSafeUrl(attrs.href)) {
+        return { ...attrs, href: '' };
+    }
+    return attrs;
+};
+const sanitizeImageAttrs = (attrs) => {
+    if (attrs && typeof attrs === 'object' && attrs.src !== undefined && !isSafeImageUrl(attrs.src)) {
+        return { ...attrs, src: '' };
+    }
+    return attrs;
+};
 const customIndent = (state, dispatch) => {
     const listItem = state.schema.nodes[indentRules.listsTypes.listItem];
     if (canIndentAsListItem(state, listItem)) {
@@ -258,10 +270,10 @@ const customOutdent = (state, dispatch) => {
 const inlineCommand = {
     bold: (applyToWord) => expandToWordWrap(toggleInlineFormat, { ...bold, applyToWord }),
     cleanFormatting: (options) => cleanFormatting(options),
-    createLink: attrs => expandToWordWrap(applyLink, { mark: 'link', attrs: attrs.value, applyToWord: attrs.applyToWord }),
+    createLink: attrs => expandToWordWrap(applyLink, { mark: 'link', attrs: sanitizeLinkAttrs(attrs.value), applyToWord: attrs.applyToWord }),
     fontFamily: attrs => expandToWordWrap(applyInlineStyle, { style: 'font-family', value: attrs.value, applyToWord: attrs.applyToWord }),
     fontSize: attrs => expandToWordWrap(applyInlineStyle, { style: 'font-size', value: attrs.value, applyToWord: attrs.applyToWord }),
-    insertFile: attrs => expandToWordWrap(applyLink, { mark: 'link', attrs: attrs, applyToWord: attrs.applyToWord }),
+    insertFile: attrs => expandToWordWrap(applyLink, { mark: 'link', attrs: sanitizeLinkAttrs(attrs), applyToWord: attrs.applyToWord }),
     insertText: text => insertText(text),
     italic: (applyToWord) => expandToWordWrap(toggleInlineFormat, { ...italic, applyToWord }),
     strikethrough: (applyToWord) => expandToWordWrap(toggleInlineFormat, { ...strikethrough, applyToWord }),
@@ -281,7 +293,7 @@ const blockCommand = {
     format: formatAttr => formatBlockElements(formatAttr.tag),
     getHTML: () => getHtml,
     indent: () => customIndent,
-    insertImage: attrs => insertImage(attrs),
+    insertImage: attrs => insertImage(sanitizeImageAttrs(attrs)),
     // think about changing the command name.
     insertOrderedList: () => toggleOrderedList,
     // think about changing the command name.
@@ -708,6 +720,29 @@ const replaceMessagePlaceholder = (message, replacements) => {
     replacements.forEach((replacement) => message = message.replace(new RegExp(`\\[\\[\\s*${replacement.placeholder}\\s*]]|{\\s*${replacement.placeholder}\\s*}`, 'g'), replacement.value));
     return message;
 };
+/**
+ * @hidden
+ * Removes `href` and `src` attributes that use unsafe URL schemes (e.g. `javascript:`) from an HTML string.
+ * Uses `<template>` for inert parsing so element event handlers do not fire during sanitization.
+ */
+const sanitizeUnsafeUrls = (html) => {
+    if (!html || !isDocumentAvailable()) {
+        return html;
+    }
+    const template = document.createElement('template');
+    template.innerHTML = html;
+    template.content.querySelectorAll('a[href]').forEach(el => {
+        if (!isSafeUrl(el.getAttribute('href'))) {
+            el.removeAttribute('href');
+        }
+    });
+    template.content.querySelectorAll('img[src], source[src]').forEach(el => {
+        if (!isSafeImageUrl(el.getAttribute('src'))) {
+            el.removeAttribute('src');
+        }
+    });
+    return template.innerHTML;
+};
 
 /**
  * @hidden
@@ -834,6 +869,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.30", ngImpo
                 args: ['textarea', { static: true }]
             }] } });
 
+const safeImageUrlValidator = (control) => isSafeImageUrl(control.value) ? null : { unsafeUrl: true };
 /**
  * @hidden
  */
@@ -842,7 +878,7 @@ class ImageDialogComponent extends DialogContentBase {
     localization;
     editor;
     srcInput;
-    src = new FormControl('', Validators.required);
+    src = new FormControl('', [Validators.required, safeImageUrlValidator]);
     alt = new FormControl('');
     width = new FormControl('', Validators.min(1));
     height = new FormControl('', Validators.min(1));
@@ -1047,6 +1083,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.30", ngImpo
                 args: ['srcInput']
             }] } });
 
+const safeUrlValidator = (control) => isSafeUrl(control.value) ? null : { unsafeUrl: true };
 /**
  * @hidden
  */
@@ -1057,7 +1094,7 @@ class FileLinkDialogComponent extends DialogContentBase {
     command;
     hrefInput;
     linkForm = new FormGroup({
-        'href': new FormControl('', Validators.required),
+        'href': new FormControl('', [Validators.required, safeUrlValidator]),
         'text': new FormControl({ value: '', disabled: true }, Validators.required),
         'title': new FormControl('')
     });
@@ -3257,13 +3294,28 @@ const defaultPasteCleanupSettings = {
 };
 const removeCommentsIf = conditionallyExecute(removeComments);
 const removeInvalidHTMLIf = conditionallyExecute(sanitize);
+const sanitizeHrefAttr = (attr) => {
+    if (!isSafeUrl(attr.value)) {
+        removeAttribute(attr);
+    }
+};
+const sanitizeSrcAttr = (attr) => {
+    const owner = attr.ownerElement;
+    const tag = owner ? owner.tagName : '';
+    const check = (tag === 'IMG' || tag === 'SOURCE') ? isSafeImageUrl : isSafeUrl;
+    if (!check(attr.value)) {
+        removeAttribute(attr);
+    }
+};
 const getPasteCleanupAttributes = (config) => {
     if (config.removeAttributes === 'all') {
         return { '*': removeAttribute };
     }
     const initial = removeEmptyEntries({
         style: config.removeMsStyles ? sanitizeStyleAttr : undefined,
-        class: config.removeMsClasses ? sanitizeClassAttr : undefined
+        class: config.removeMsClasses ? sanitizeClassAttr : undefined,
+        href: sanitizeHrefAttr,
+        src: sanitizeSrcAttr
     });
     return config.removeAttributes.reduce((acc, curr) => ({ ...acc, [curr]: removeAttribute }), initial);
 };
@@ -3794,7 +3846,7 @@ class EditorComponent {
         }
         const currentSchema = this.schema || schema;
         const containerNativeElement = this.container.element.nativeElement;
-        const contentNode = parseContent((this.value || '').trim(), currentSchema, { preserveWhitespace: this.preserveWhitespace });
+        const contentNode = parseContent(sanitizeUnsafeUrls((this.value || '').trim()), currentSchema, { preserveWhitespace: this.preserveWhitespace });
         if (this.iframe) {
             const iframeDoc = containerNativeElement.contentDocument;
             const meta = iframeDoc.createElement('meta');
@@ -4005,7 +4057,7 @@ class EditorComponent {
                     return;
                 }
                 const state = this.view.state;
-                const nextDoc = parseContent(value || '', state.schema, { preserveWhitespace: this.preserveWhitespace });
+                const nextDoc = parseContent(sanitizeUnsafeUrls(value || ''), state.schema, { preserveWhitespace: this.preserveWhitespace });
                 const tr = state.tr
                     .setSelection(new AllSelection(state.doc))
                     .replaceSelectionWith(nextDoc);

package/package-metadata.mjs

@@ -7,7 +7,7 @@ export const packageMetadata = {
   "productCodes": [
     "KENDOUIANGULAR"
   ],
-  "publishDate": 1790689508,
-  "version": "25.3.0-develop.1",
+  "publishDate": 1790761643,
+  "version": "25.3.0-develop.2",
   "licensingDocsUrl": "https://www.telerik.com/kendo-angular-ui/my-license/"
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@progress/kendo-angular-editor",
-  "version": "25.3.0-develop.1",
+  "version": "25.3.0-develop.2",
   "description": "Kendo UI Editor for Angular",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "Progress",
@@ -17,7 +17,7 @@
     "package": {
       "productName": "Kendo UI for Angular",
       "productCode": "KENDOUIANGULAR",
-      "publishDate": 1790689508,
+      "publishDate": 1790761643,
       "licensingDocsUrl": "https://www.telerik.com/kendo-angular-ui/my-license/"
     }
   },
@@ -29,23 +29,23 @@
     "@angular/platform-browser": "20 - 22",
     "@progress/kendo-drawing": "^1.25.0",
     "@progress/kendo-licensing": "^1.11.0",
-    "@progress/kendo-angular-buttons": "25.3.0-develop.1",
-    "@progress/kendo-angular-common": "25.3.0-develop.1",
-    "@progress/kendo-angular-dialog": "25.3.0-develop.1",
-    "@progress/kendo-angular-dropdowns": "25.3.0-develop.1",
-    "@progress/kendo-angular-inputs": "25.3.0-develop.1",
-    "@progress/kendo-angular-intl": "25.3.0-develop.1",
-    "@progress/kendo-angular-l10n": "25.3.0-develop.1",
-    "@progress/kendo-angular-label": "25.3.0-develop.1",
-    "@progress/kendo-angular-layout": "25.3.0-develop.1",
-    "@progress/kendo-angular-icons": "25.3.0-develop.1",
-    "@progress/kendo-angular-popup": "25.3.0-develop.1",
-    "@progress/kendo-angular-toolbar": "25.3.0-develop.1",
+    "@progress/kendo-angular-buttons": "25.3.0-develop.2",
+    "@progress/kendo-angular-common": "25.3.0-develop.2",
+    "@progress/kendo-angular-dialog": "25.3.0-develop.2",
+    "@progress/kendo-angular-dropdowns": "25.3.0-develop.2",
+    "@progress/kendo-angular-inputs": "25.3.0-develop.2",
+    "@progress/kendo-angular-intl": "25.3.0-develop.2",
+    "@progress/kendo-angular-l10n": "25.3.0-develop.2",
+    "@progress/kendo-angular-label": "25.3.0-develop.2",
+    "@progress/kendo-angular-layout": "25.3.0-develop.2",
+    "@progress/kendo-angular-icons": "25.3.0-develop.2",
+    "@progress/kendo-angular-popup": "25.3.0-develop.2",
+    "@progress/kendo-angular-toolbar": "25.3.0-develop.2",
     "rxjs": "^6.5.3 || ^7.0.0"
   },
   "dependencies": {
     "tslib": "^2.3.1",
-    "@progress/kendo-angular-schematics": "25.3.0-develop.1",
+    "@progress/kendo-angular-schematics": "25.3.0-develop.2",
     "@progress/kendo-editor-common": "1.12.8"
   },
   "schematics": "./schematics/collection.json",

package/schematics/ngAdd/index.js

@@ -9,12 +9,12 @@ const schematics_1 = require("@angular-devkit/schematics");
 function default_1(options) {
     const finalOptions = Object.assign(Object.assign({}, options), { mainNgModule: 'EditorModule', package: 'editor', peerDependencies: {
             // peer dependencies of kendo-angular-dropdowns
-            '@progress/kendo-angular-navigation': '25.3.0-develop.1',
-            '@progress/kendo-angular-treeview': '25.3.0-develop.1',
+            '@progress/kendo-angular-navigation': '25.3.0-develop.2',
+            '@progress/kendo-angular-treeview': '25.3.0-develop.2',
             // peer dependency of kendo-angular-layout
-            '@progress/kendo-angular-progressbar': '25.3.0-develop.1',
+            '@progress/kendo-angular-progressbar': '25.3.0-develop.2',
             // peer dependency of kendo-angular-inputs
-            '@progress/kendo-angular-dialog': '25.3.0-develop.1',
+            '@progress/kendo-angular-dialog': '25.3.0-develop.2',
             // Peer dependency of icons
             '@progress/kendo-svg-icons': '^4.0.0'
         } });