bpmn-js 3.4.0 → 3.5.0

package/CHANGELOG.md

@@ -6,6 +6,22 @@ All notable changes to [bpmn-js](https://github.com/bpmn-io/bpmn-js) are documen
 
 ___Note:__ Yet to be released changes appear here._
 
+## 3.5.0
+
+* `FEAT`: restore `Viewer#importDefinitions` and make it public API ([#1112](https://github.com/bpmn-io/bpmn-js/pull/1112))
+
+## 3.4.3
+
+* `FIX`: prevent HTML injection in search ([diagram-js#362](https://github.com/bpmn-io/diagram-js/pull/362))
+
+## 3.4.2
+
+* `FIX`: do not evaluate pasted text as HTML ([#1073](https://github.com/bpmn-io/bpmn-js/issues/1073))
+
+## 3.4.1
+
+_Republish of `v3.4.0` without `.git` folder._
+
 ## 3.4.0
 
 * `FIX`: properly render colored connection markers ([#981](https://github.com/bpmn-io/bpmn-js/issues/981))

package/dist/bpmn-modeler.development.js

@@ -1,5 +1,5 @@
 /*!
- * bpmn-js - bpmn-modeler v3.4.0
+ * bpmn-js - bpmn-modeler v3.5.0
  *
  * Copyright (c) 2014-present, camunda Services GmbH
  *
@@ -8,7 +8,7 @@
  *
  * Source Code: https://github.com/bpmn-io/bpmn-js
  *
- * Date: 2019-04-25
+ * Date: 2019-06-28
  */
 (function (global, factory) {
 	typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
@@ -20260,9 +20260,7 @@
 	      return done(err, parseWarnings);
 	    }
 
-	    self._setDefinitions(definitions);
-
-	    self.open(bpmnDiagram, function(err, importWarnings) {
+	    self.importDefinitions(definitions, bpmnDiagram, function(err, importWarnings) {
 	      var allWarnings = [].concat(parseWarnings, importWarnings || []);
 
 	      self._emit('import.done', { error: err, warnings: allWarnings });
@@ -20272,6 +20270,40 @@
 	  });
 	};
 
+	/**
+	 * Import parsed definitions and render a BPMN 2.0 diagram.
+	 *
+	 * Once finished the viewer reports back the result to the
+	 * provided callback function with (err, warnings).
+	 *
+	 * ## Life-Cycle Events
+	 *
+	 * During import the viewer will fire life-cycle events:
+	 *
+	 *   * import.render.start (graphical import start)
+	 *   * import.render.complete (graphical import finished)
+	 *
+	 * You can use these events to hook into the life-cycle.
+	 *
+	 * @param {ModdleElement<Definitions>} definitions parsed BPMN 2.0 definitions
+	 * @param {ModdleElement<BPMNDiagram>|String} [bpmnDiagram] BPMN diagram or id of diagram to render (if not provided, the first one will be rendered)
+	 * @param {Function} [done] invoked with (err, warnings=[])
+	 */
+	Viewer.prototype.importDefinitions = function(definitions, bpmnDiagram, done) {
+
+	  if (isFunction(bpmnDiagram)) {
+	    done = bpmnDiagram;
+	    bpmnDiagram = null;
+	  }
+
+	  // done is optional
+	  done = done || function() {};
+
+	  this._setDefinitions(definitions);
+
+	  return this.open(bpmnDiagram, done);
+	};
+
 	/**
 	 * Open diagram of previously imported XML.
 	 *
@@ -26986,6 +27018,17 @@
 	}));
 	});
 
+	var HTML_ESCAPE_MAP = {
+	  '<': '&lt',
+	  '>': '&gt'
+	};
+
+	function escapeHTML(str) {
+	  return str.replace(/[<>]/g, function(match) {
+	    return HTML_ESCAPE_MAP[match];
+	  });
+	}
+
 	var round$2 = Math.round,
 	    max = Math.max;
 
@@ -28396,8 +28439,6 @@
 	 * Intercept paste events to remove formatting from pasted text.
 	 */
 	TextBox.prototype.handlePaste = function(e) {
-	  var self = this;
-
 	  var options = this.options,
 	      style = this.style;
 
@@ -28415,77 +28456,88 @@
 	    text = window.clipboardData.getData('Text');
 	  }
 
-	  // insertHTML command not supported by Internet Explorer
-	  var success = document.execCommand('insertHTML', false, text);
+	  this.insertText(text);
 
-	  if (!success) {
+	  if (options.autoResize) {
+	    var hasResized = this.autoResize(style);
 
-	    // Internet Explorer
-	    var range = this.getSelection(),
-	        startContainer = range.startContainer,
-	        endContainer = range.endContainer,
-	        startOffset = range.startOffset,
-	        endOffset = range.endOffset,
-	        commonAncestorContainer = range.commonAncestorContainer;
+	    if (hasResized) {
+	      this.resizeHandler(hasResized);
+	    }
+	  }
+	};
 
-	    var childNodesArray = toArray(commonAncestorContainer.childNodes);
+	TextBox.prototype.insertText = function(text) {
 
-	    var container,
-	        offset;
+	  // insertText command not supported by Internet Explorer
+	  var success = document.execCommand('insertText', false, text);
 
-	    if (isTextNode(commonAncestorContainer)) {
-	      var containerTextContent = startContainer.textContent;
+	  if (success) {
+	    return;
+	  }
 
-	      startContainer.textContent =
-	        containerTextContent.substring(0, startOffset)
-	        + text
-	        + containerTextContent.substring(endOffset);
+	  this._insertTextIE(text);
+	};
 
-	      container = startContainer;
-	      offset = startOffset + text.length;
+	TextBox.prototype._insertTextIE = function(text) {
 
-	    } else if (startContainer === this.content && endContainer === this.content) {
-	      var textNode = document.createTextNode(text);
+	  // Internet Explorer
+	  var range = this.getSelection(),
+	      startContainer = range.startContainer,
+	      endContainer = range.endContainer,
+	      startOffset = range.startOffset,
+	      endOffset = range.endOffset,
+	      commonAncestorContainer = range.commonAncestorContainer;
 
-	      this.content.insertBefore(textNode, childNodesArray[startOffset]);
+	  var childNodesArray = toArray(commonAncestorContainer.childNodes);
 
-	      container = textNode;
-	      offset = textNode.textContent.length;
-	    } else {
-	      var startContainerChildIndex = childNodesArray.indexOf(startContainer),
-	          endContainerChildIndex = childNodesArray.indexOf(endContainer);
-
-	      childNodesArray.forEach(function(childNode, index) {
-
-	        if (index === startContainerChildIndex) {
-	          childNode.textContent =
-	            startContainer.textContent.substring(0, startOffset) +
-	            text +
-	            endContainer.textContent.substring(endOffset);
-	        } else if (index > startContainerChildIndex && index <= endContainerChildIndex) {
-	          remove(childNode);
-	        }
-	      });
+	  var container,
+	      offset;
 
-	      container = startContainer;
-	      offset = startOffset + text.length;
-	    }
+	  if (isTextNode(commonAncestorContainer)) {
+	    var containerTextContent = startContainer.textContent;
 
-	    if (container && offset !== undefined) {
+	    startContainer.textContent =
+	      containerTextContent.substring(0, startOffset)
+	      + text
+	      + containerTextContent.substring(endOffset);
 
-	      // is necessary in Internet Explorer
-	      setTimeout(function() {
-	        self.setSelection(container, offset);
-	      });
-	    }
+	    container = startContainer;
+	    offset = startOffset + text.length;
+
+	  } else if (startContainer === this.content && endContainer === this.content) {
+	    var textNode = document.createTextNode(text);
+
+	    this.content.insertBefore(textNode, childNodesArray[startOffset]);
+
+	    container = textNode;
+	    offset = textNode.textContent.length;
+	  } else {
+	    var startContainerChildIndex = childNodesArray.indexOf(startContainer),
+	        endContainerChildIndex = childNodesArray.indexOf(endContainer);
+
+	    childNodesArray.forEach(function(childNode, index) {
+
+	      if (index === startContainerChildIndex) {
+	        childNode.textContent =
+	          startContainer.textContent.substring(0, startOffset) +
+	          text +
+	          endContainer.textContent.substring(endOffset);
+	      } else if (index > startContainerChildIndex && index <= endContainerChildIndex) {
+	        remove(childNode);
+	      }
+	    });
+
+	    container = startContainer;
+	    offset = startOffset + text.length;
 	  }
 
-	  if (options.autoResize) {
-	    var hasResized = this.autoResize(style);
+	  if (container && offset !== undefined) {
 
-	    if (hasResized) {
-	      this.resizeHandler(hasResized);
-	    }
+	    // is necessary in Internet Explorer
+	    setTimeout(function() {
+	      self.setSelection(container, offset);
+	    });
 	  }
 	};
 
@@ -50736,9 +50788,9 @@
 
 	  tokens.forEach(function(t) {
 	    if (t.matched) {
-	      htmlText += '<strong class="' + SearchPad.RESULT_HIGHLIGHT_CLASS + '">' + t.matched + '</strong>';
+	      htmlText += '<strong class="' + SearchPad.RESULT_HIGHLIGHT_CLASS + '">' + escapeHTML(t.matched) + '</strong>';
 	    } else {
-	      htmlText += t.normal;
+	      htmlText += escapeHTML(t.normal);
 	    }
 	  });