@progress/kendo-editor-common 1.12.9 → 1.12.10

package/dist/es/config/schema.js

@@ -1,10 +1,24 @@
 import { Schema } from 'prosemirror-model';
 import { tableNodes } from 'prosemirror-tables';
+import { isSafeUrl } from '@progress/kendo-common';
 import { domToPmDoc, htmlToFragment, pmDocToFragment } from '../source';
 import { rowTypeAttr, colgroupAttr, resizableAttr } from './constants';
 const hole = 0;
 const blockquoteDOM = ['blockquote', hole], hrDOM = ['hr'], preDOM = ['pre', ['code', hole]];
 const olDOM = ['ol', 0], ulDOM = ['ul', 0], liDOM = ['li', 0];
+const LINK = 'link';
+const IMAGE = 'image';
+const sanitizeUrlAttributes = (attrs, type) => {
+    if (type === LINK && attrs.href && !isSafeUrl(attrs.href, LINK)) {
+        const { href, ...sanitized } = attrs;
+        return sanitized;
+    }
+    if (type === IMAGE && attrs.src && !isSafeUrl(attrs.src, IMAGE)) {
+        const { src, ...sanitized } = attrs;
+        return sanitized;
+    }
+    return attrs;
+};
 const domAttributes = (dom) => {
     const result = {};
     const attributes = dom.attributes;
@@ -62,8 +76,8 @@ const marks = {
             title: { default: null }
         },
         inclusive: false,
-        parseDOM: [{ tag: 'a', getAttrs: domAttributes }],
-        toDOM: (node) => ['a', pmAttributes(node.attrs), hole]
+        parseDOM: [{ tag: 'a', getAttrs: (node) => sanitizeUrlAttributes(domAttributes(node), LINK) }],
+        toDOM: (node) => ['a', sanitizeUrlAttributes(pmAttributes(node.attrs), LINK), hole]
     },
     ...tagMark('strong'),
     ...tagMark('b'),
@@ -310,8 +324,8 @@ const nodes = {
         },
         group: 'inline',
         draggable: true,
-        parseDOM: [{ tag: 'img', getAttrs: domAttributes }],
-        toDOM: node => hasAttrs(node.attrs) ? ['img', pmAttributes(node.attrs)] : ['img']
+        parseDOM: [{ tag: 'img', getAttrs: (node) => sanitizeUrlAttributes(domAttributes(node), IMAGE) }],
+        toDOM: node => hasAttrs(node.attrs) ? ['img', sanitizeUrlAttributes(pmAttributes(node.attrs), IMAGE)] : ['img']
     },
     // :: NodeSpec A hard line break represented in the DOM as a `<br>` element.
     hard_break: {

package/dist/npm/config/schema.js

@@ -3,11 +3,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.marks = exports.nodes = exports.parseStrColgroup = void 0;
 const prosemirror_model_1 = require("prosemirror-model");
 const prosemirror_tables_1 = require("prosemirror-tables");
+const kendo_common_1 = require("@progress/kendo-common");
 const source_1 = require("../source");
 const constants_1 = require("./constants");
 const hole = 0;
 const blockquoteDOM = ['blockquote', hole], hrDOM = ['hr'], preDOM = ['pre', ['code', hole]];
 const olDOM = ['ol', 0], ulDOM = ['ul', 0], liDOM = ['li', 0];
+const LINK = 'link';
+const IMAGE = 'image';
+const sanitizeUrlAttributes = (attrs, type) => {
+    if (type === LINK && attrs.href && !(0, kendo_common_1.isSafeUrl)(attrs.href, LINK)) {
+        const { href, ...sanitized } = attrs;
+        return sanitized;
+    }
+    if (type === IMAGE && attrs.src && !(0, kendo_common_1.isSafeUrl)(attrs.src, IMAGE)) {
+        const { src, ...sanitized } = attrs;
+        return sanitized;
+    }
+    return attrs;
+};
 const domAttributes = (dom) => {
     const result = {};
     const attributes = dom.attributes;
@@ -65,8 +79,8 @@ const marks = {
             title: { default: null }
         },
         inclusive: false,
-        parseDOM: [{ tag: 'a', getAttrs: domAttributes }],
-        toDOM: (node) => ['a', pmAttributes(node.attrs), hole]
+        parseDOM: [{ tag: 'a', getAttrs: (node) => sanitizeUrlAttributes(domAttributes(node), LINK) }],
+        toDOM: (node) => ['a', sanitizeUrlAttributes(pmAttributes(node.attrs), LINK), hole]
     },
     ...tagMark('strong'),
     ...tagMark('b'),
@@ -315,8 +329,8 @@ const nodes = {
         },
         group: 'inline',
         draggable: true,
-        parseDOM: [{ tag: 'img', getAttrs: domAttributes }],
-        toDOM: node => hasAttrs(node.attrs) ? ['img', pmAttributes(node.attrs)] : ['img']
+        parseDOM: [{ tag: 'img', getAttrs: (node) => sanitizeUrlAttributes(domAttributes(node), IMAGE) }],
+        toDOM: node => hasAttrs(node.attrs) ? ['img', sanitizeUrlAttributes(pmAttributes(node.attrs), IMAGE)] : ['img']
     },
     // :: NodeSpec A hard line break represented in the DOM as a `<br>` element.
     hard_break: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@progress/kendo-editor-common",
   "description": "Kendo UI TypeScript package exporting functions for Editor component",
-  "version": "1.12.9",
+  "version": "1.12.10",
   "keywords": [
     "Kendo UI"
   ],
@@ -30,7 +30,7 @@
     "prepublishOnly": "npm pkg delete devDependencies scripts"
   },
   "peerDependencies": {
-    "@progress/kendo-common": "^1.0.2"
+    "@progress/kendo-common": "^1.1.3"
   },
   "dependencies": {
     "prosemirror-commands": "1.7.2",
@@ -50,7 +50,7 @@
   "devDependencies": {
     "@commitlint/cli": "^17.3.0",
     "@commitlint/config-conventional": "^17.3.0",
-    "@progress/kendo-common": "^1.0.2",
+    "@progress/kendo-common": "^1.1.3",
     "@progress/kendo-e2e": "^4.7.0",
     "@progress/kendo-package-tasks": "dev",
     "@progress/kendo-typescript-tasks": "dev",