autumnnote 1.11.0 → 1.12.0

package/dist/autumnnote.umd.js

@@ -4356,7 +4356,10 @@
 		"object",
 		"embed",
 		"form",
-		"base"
+		"base",
+		"template",
+		"link",
+		"meta"
 	];
 	/** Tags whose element wrapper is stripped but content (child nodes) is preserved. */
 	var UNWRAP_TAGS = new Set(["button"]);
@@ -4365,8 +4368,28 @@
 		"href",
 		"src",
 		"action",
-		"formaction"
+		"formaction",
+		"xlink:href"
 	];
+	/** Inline style properties the editor's own toolbar/table features persist on saved content. */
+	var ALLOWED_STYLE_PROPS = new Set([
+		"color",
+		"background-color",
+		"font-size",
+		"line-height",
+		"text-align",
+		"vertical-align",
+		"width",
+		"min-width",
+		"height",
+		"min-height",
+		"border-width",
+		"border-style",
+		"border-color",
+		"padding"
+	]);
+	/** Value patterns that are never safe regardless of property. */
+	var DANGEROUS_STYLE_VALUE_RE = /url\s*\(|expression\s*\(|@import|javascript:|vbscript:|behavior\s*:|-moz-binding/i;
 	/** Trusted hosts for iframe embeds when allowIframes is enabled. */
 	var TRUSTED_IFRAME_HOSTS = new Set([
 		"www.youtube.com",
@@ -4407,6 +4430,12 @@
 					el.removeAttribute(attr.name);
 					continue;
 				}
+				if (attr.name === "style") {
+					const cleaned = sanitiseStyleValue(attr.value);
+					if (cleaned) el.setAttribute("style", cleaned);
+					else el.removeAttribute("style");
+					continue;
+				}
 				if (URL_ATTRS.includes(attr.name)) {
 					const val = attr.value.trim();
 					if (/^(javascript|vbscript):/i.test(val)) {
@@ -4435,6 +4464,28 @@
 		return doc.body.innerHTML;
 	}
 	/**
+	* Filters a style attribute value down to an allowlisted set of CSS
+	* properties (ALLOWED_STYLE_PROPS), dropping any declaration whose value
+	* contains a dangerous construct — url(), expression(), an "import" rule,
+	* javascript:/vbscript:, IE behavior/-moz-binding — regardless of property.
+	* @param {string} value
+	* @returns {string} The filtered declaration list, or '' if nothing survives.
+	*/
+	function sanitiseStyleValue(value) {
+		const kept = [];
+		for (const decl of (value || "").split(";")) {
+			const idx = decl.indexOf(":");
+			if (idx === -1) continue;
+			const prop = decl.slice(0, idx).trim().toLowerCase();
+			const val = decl.slice(idx + 1).trim();
+			if (!prop || !val) continue;
+			if (!ALLOWED_STYLE_PROPS.has(prop)) continue;
+			if (DANGEROUS_STYLE_VALUE_RE.test(val)) continue;
+			kept.push(`${prop}: ${val}`);
+		}
+		return kept.join("; ");
+	}
+	/**
 	* Returns true if iframe src points to an approved video host.
 	* Relative, protocol-relative and invalid URLs are rejected.
 	* @param {string} src
@@ -17498,7 +17549,7 @@
 		/** All pre-built button definitions — accessible in every module format including UMD/CJS. */
 		buttons,
 		/** Library version */
-		version: "1.11.0"
+		version: "1.12.0"
 	};
 	/**
 	* @param {string|Element|NodeList|Element[]} selector