devexpress-richedit 22.2.13 → 22.2.15

package/index.d.ts

@@ -1,7 +1,7 @@
 /**
 * DevExpress WebRichEdit (index.d.ts)
-* Version: 22.2.13
-* Copyright (c) 2012 - 2024 Developer Express Inc. ALL RIGHTS RESERVED
+* Version: 22.2.15
+* Copyright (c) 2012 - 2025 Developer Express Inc. ALL RIGHTS RESERVED
 * License: https://www.devexpress.com/Support/EULAs
 */
 export * from './lib/client/public/all';

package/index.js

@@ -1,7 +1,7 @@
 /**
 * DevExpress WebRichEdit (index.js)
-* Version: 22.2.13
-* Copyright (c) 2012 - 2024 Developer Express Inc. ALL RIGHTS RESERVED
+* Version: 22.2.15
+* Copyright (c) 2012 - 2025 Developer Express Inc. ALL RIGHTS RESERVED
 * License: https://www.devexpress.com/Support/EULAs
 */
 "use strict";

package/lib/base/commands/fields/open-hyperlink-command.js

@@ -8,6 +8,7 @@ var i_rich_edit_core_1 = require("../../interfaces/i-rich-edit-core");
 var client_command_1 = require("../client-command");
 var command_base_1 = require("../command-base");
 var hyperlink_command_base_1 = require("./hyperlink-command-base");
+var utils_1 = require("../../../base-utils/utils");
 var OpenHyperlinkCommand = (function (_super) {
     tslib_1.__extends(OpenHyperlinkCommand, _super);
     function OpenHyperlinkCommand() {
@@ -35,8 +36,10 @@ var OpenHyperlinkCommand = (function (_super) {
         if (hyperlinkInfo.anchor)
             this.control.commandManager.getCommand(client_command_1.RichEditClientCommand.GoToBookmark)
                 .execute(this.control.commandManager.isPublicApiCall, new command_base_1.CommandSimpleOptions(this.control, hyperlinkInfo.anchor));
-        else if (!(url_1.Url.containsClientScript(hyperlinkInfo.uri) || /^\s*data\s*\:\s*/gi.test(hyperlinkInfo.uri)))
-            url_1.Url.navigate(hyperlinkInfo.uri, "_blank");
+        else {
+            var url = utils_1.UrlUtils.isValid(hyperlinkInfo.uri) ? hyperlinkInfo.uri : utils_1.UrlUtils.EmptyPage;
+            url_1.Url.navigate(url, "_blank");
+        }
         return true;
     };
     OpenHyperlinkCommand.prototype.isEnabledInReadOnlyMode = function () {

package/lib/base-utils/utils.d.ts

@@ -10,4 +10,12 @@ export declare function searchTreeItem<T extends {
     items?: T[];
 }>(items: T[], comparer: (item: T) => boolean): SearchTreeItemResult<T> | null;
 export declare function convertToFunction(func: any): any | null;
+export interface IUrlValidationOptions {
+    allowRelativeUrl?: boolean;
+    allowedProtocols?: string[];
+}
+export declare class UrlUtils {
+    static EmptyPage: string;
+    static isValid(url: string): boolean;
+}
 //# sourceMappingURL=utils.d.ts.map

package/lib/base-utils/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.convertToFunction = exports.searchTreeItem = exports.SearchTreeItemResult = exports.rotatePoint = void 0;
+exports.UrlUtils = exports.convertToFunction = exports.searchTreeItem = exports.SearchTreeItemResult = exports.rotatePoint = void 0;
 var point_1 = require("@devexpress/utils/lib/geometry/point");
 var list_1 = require("@devexpress/utils/lib/utils/list");
 function rotatePoint(point, angle, center) {
@@ -61,3 +61,24 @@ function convertToFunction(func) {
     return null;
 }
 exports.convertToFunction = convertToFunction;
+var disallowedProtocols = [
+    'data',
+    'javascript'
+];
+var UrlUtils = (function () {
+    function UrlUtils() {
+    }
+    UrlUtils.isValid = function (url) {
+        var currentLocation = window.location.href;
+        try {
+            var resultUrl = new URL(url, currentLocation);
+            var protocol = resultUrl.protocol.slice(0, -1);
+            return !disallowedProtocols.includes(protocol);
+        }
+        catch (_a) { }
+        return false;
+    };
+    UrlUtils.EmptyPage = "about:blank";
+    return UrlUtils;
+}());
+exports.UrlUtils = UrlUtils;

package/lib/core/model/options/fields.js

@@ -30,9 +30,8 @@ var FieldsSettings = (function () {
             this.openHyperlinkOnClick = obj.openHyperlinkOnClick;
         if (common_1.isDefined(obj.keepHyperlinkResultForInvalidReference))
             this.keepHyperlinkResultForInvalidReference = obj.keepHyperlinkResultForInvalidReference;
-        if (common_1.isDefined(obj.createHyperlinkTooltip) && obj.createHyperlinkTooltip !== '') {
+        if (common_1.isDefined(obj.createHyperlinkTooltip) && obj.createHyperlinkTooltip !== '')
             this.createHyperlinkTooltip = utils_1.convertToFunction(obj.createHyperlinkTooltip);
-        }
     };
     FieldsSettings.prototype.clone = function () {
         var result = new FieldsSettings();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devexpress-richedit",
-  "version": "22.2.13",
+  "version": "22.2.15",
   "homepage": "https://www.devexpress.com/",
   "bugs": "https://www.devexpress.com/support/",
   "author": "Developer Express Inc.",
@@ -14,7 +14,7 @@
     "build-nspell": "webpack --mode production --config=bin/nspell.webpack.config.js"
   },
   "peerDependencies": {
-    "devextreme": "22.2.13"
+    "devextreme": "22.2.15"
   },
   "dependencies": {
     "jszip": "~3.7.0",