autumnnote 1.11.0 → 1.11.1

package/dist/autumnnote.es.js

@@ -4643,7 +4643,10 @@ var PROHIBITED_TAGS = [
 	"object",
 	"embed",
 	"form",
-	"base"
+	"base",
+	"template",
+	"link",
+	"meta"
 ];
 /** Tags whose element wrapper is stripped but content (child nodes) is preserved. */
 var UNWRAP_TAGS = new Set(["button"]);
@@ -4652,8 +4655,28 @@ var URL_ATTRS = [
 	"href",
 	"src",
 	"action",
-	"formaction"
+	"formaction",
+	"xlink:href"
 ];
+/** Inline style properties the editor's own toolbar/table features persist on saved content. */
+var ALLOWED_STYLE_PROPS = new Set([
+	"color",
+	"background-color",
+	"font-size",
+	"line-height",
+	"text-align",
+	"vertical-align",
+	"width",
+	"min-width",
+	"height",
+	"min-height",
+	"border-width",
+	"border-style",
+	"border-color",
+	"padding"
+]);
+/** Value patterns that are never safe regardless of property. */
+var DANGEROUS_STYLE_VALUE_RE = /url\s*\(|expression\s*\(|@import|javascript:|vbscript:|behavior\s*:|-moz-binding/i;
 /** Trusted hosts for iframe embeds when allowIframes is enabled. */
 var TRUSTED_IFRAME_HOSTS = new Set([
 	"www.youtube.com",
@@ -4694,6 +4717,12 @@ function sanitiseHTML(html, { allowIframes = false } = {}) {
 				el.removeAttribute(attr.name);
 				continue;
 			}
+			if (attr.name === "style") {
+				const cleaned = sanitiseStyleValue(attr.value);
+				if (cleaned) el.setAttribute("style", cleaned);
+				else el.removeAttribute("style");
+				continue;
+			}
 			if (URL_ATTRS.includes(attr.name)) {
 				const val = attr.value.trim();
 				if (/^(javascript|vbscript):/i.test(val)) {
@@ -4722,6 +4751,28 @@ function sanitiseHTML(html, { allowIframes = false } = {}) {
 	return doc.body.innerHTML;
 }
 /**
+* Filters a style attribute value down to an allowlisted set of CSS
+* properties (ALLOWED_STYLE_PROPS), dropping any declaration whose value
+* contains a dangerous construct — url(), expression(), an "import" rule,
+* javascript:/vbscript:, IE behavior/-moz-binding — regardless of property.
+* @param {string} value
+* @returns {string} The filtered declaration list, or '' if nothing survives.
+*/
+function sanitiseStyleValue(value) {
+	const kept = [];
+	for (const decl of (value || "").split(";")) {
+		const idx = decl.indexOf(":");
+		if (idx === -1) continue;
+		const prop = decl.slice(0, idx).trim().toLowerCase();
+		const val = decl.slice(idx + 1).trim();
+		if (!prop || !val) continue;
+		if (!ALLOWED_STYLE_PROPS.has(prop)) continue;
+		if (DANGEROUS_STYLE_VALUE_RE.test(val)) continue;
+		kept.push(`${prop}: ${val}`);
+	}
+	return kept.join("; ");
+}
+/**
 * Returns true if iframe src points to an approved video host.
 * Relative, protocol-relative and invalid URLs are rejected.
 * @param {string} src
@@ -17911,7 +17962,7 @@ var AutumnNote = {
 	/** All pre-built button definitions — accessible in every module format including UMD/CJS. */
 	buttons,
 	/** Library version */
-	version: "1.11.0"
+	version: "1.11.1"
 };
 /**
 * @param {string|Element|NodeList|Element[]} selector