@richscripts/richtexteditor 2.4.1 → 2.4.2

package/richtexteditor/plugins/sanitizer.js

@@ -141,6 +141,17 @@ function RTE_Plugin_Sanitizer() {
         var v = String(value == null ? "" : value).replace(/[\u0000-\u0020\u007F-\u00A0]+/g, "").trim();
         if (!v) return false;
 
+        // <use> resolves its reference by FETCHING it. The only legitimate form
+        // in editor content is a same-document fragment (#icon-id) pointing at a
+        // <symbol>/<defs> in the same markup — nobody authoring a document means
+        // to reference a remote SVG. Left unrestricted it is a beacon that fires
+        // in every reader's browser for content one author saved, which is the
+        // same class of problem as an embedded remote logo or analytics pixel
+        // (see the no-external-calls hardening). Browsers additionally refuse
+        // cross-origin <use>, but relying on that is relying on someone else's
+        // policy to enforce ours.
+        if (tag === "use") return v.charAt(0) === "#";
+
         // Fragments, absolute paths and query-only URLs carry no scheme.
         if (/^[#?/]/.test(v)) return true;
 
@@ -243,6 +254,19 @@ function RTE_Plugin_Sanitizer() {
                 // This is the construct that actually executed downstream.
                 if (el.hasAttribute("srcdoc")) { note(report.removedAttributes, "iframe[srcdoc]"); el.removeAttribute("srcdoc"); }
                 if (!iframeAllowed(el)) { note(report.removedTags, "iframe"); el.parentNode.removeChild(el); continue; }
+            } else if (tag === "title" || tag === "desc") {
+                // Legal inside <svg> (they supply its accessible name), which is
+                // why they are in ALLOWED_TAGS. But the allowance was
+                // unqualified, so a document-level <title> from a pasted or
+                // set full HTML document survived into SAVED content while
+                // <style>/<meta>/<link> beside it were stripped. Head-level
+                // markup has no business in body content; keep these only where
+                // they are actually valid.
+                if (!el.closest || !el.closest("svg")) {
+                    note(report.removedTags, tag);
+                    el.parentNode.removeChild(el);
+                    continue;
+                }
             } else if (DROP_WHOLE[tag]) {
                 note(report.removedTags, tag);
                 el.parentNode.removeChild(el);

package/richtexteditor/rte_theme_default.css

@@ -283,7 +283,13 @@ rte-codebox {
        previously hardcoded #d5d5d5 stayed light-gray on the dark surface. */
     border: 1px solid var(--rte-border, #d5d5d5);
     border-radius: 10px;
-    overflow: hidden;
+    /* Deliberately NOT overflow:hidden. Toolbar dropdown panels
+       (rte-dropdown-panel) are absolutely positioned children of this element,
+       so clipping here cut off any panel anchored near the right edge: Line
+       Height rendered only the "1" of "100%", Paragraphs and Document Outline
+       lost 91px. Corner rounding does not depend on this clip - the toolbar and
+       status bar round their own corners (see the rule below). */
+    overflow: visible;
     background-clip: padding-box;
 }
 
@@ -1986,6 +1992,21 @@ rte-menuspliter {
     margin: 3px 0px 3px 28px;
 }
 
+/* The panel is shrink-to-fit, so its width is decided by its widest preview —
+   "Headline 1" at 32px — and measured 187px of text inside 187px of space:
+   ZERO tolerance. Whenever the font used at layout time is a hair narrower than
+   the one finally painted (a fallback still in place during a webfont swap, a
+   different platform's metrics), the label overflows and the last character is
+   cut off. Reported from the wild with "Headline 1" clipped.
+
+   A min-width gives the panel slack that does not depend on font metrics
+   matching to the pixel; the previews are nowrap, so slack is the only thing
+   that can absorb the variance. */
+.rte-dropdown-panel.rte_command_paragraphs,
+rte-dropdown-panel.rte_command_paragraphs {
+    min-width: 292px;
+}
+
 .rte_command_paragraphs rte-toolbar-dropdown-item div {
     font-size: 15px;
     margin: 0px;