edytor 0.1.0-next.30 → 0.1.0-next.32

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Edytor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -15,11 +15,11 @@
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **Work in progress.** Edytor is a pre-release (`0.1.0-next.30`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **Work in progress.** Edytor is a pre-release (`0.1.0-next.32`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 
-- **Notion-style editing out of the box.** `<Edytor />` alone is a rich text editor with images: headings, lists, to-dos, toggles, callouts, quotes, dividers, ten marks, Notion's markdown shortcuts and hotkeys. Add the Notion theme, block handles with a block menu (drag one block, or every block the selection covers), a slash menu, a selection toolbar and code blocks.
+- **Notion-style editing out of the box.** `<Edytor />` alone is a rich text editor with images and block handles: headings, lists, to-dos, toggles, callouts, quotes, dividers, ten marks and Notion's hotkeys. Add the Notion theme, a block menu (drag one block, or every block the selection covers), a slash menu, a selection toolbar, markdown shortcuts (`markdownShortcutsPlugin`) and code blocks.
 - **Columns, opt-in.** List `columnsPlugin` for Notion's multi-column layouts: drag a block to the edge of another to put them side by side, or pick "2 columns" to "5 columns"; drag the gap to resize. Layouts converge across collaborators and the room ([Columns](https://edytor.dev/docs/plugins/columns)).
 - **Your markup.** Blocks, marks and inline atoms render through your Svelte snippets; the slash menu, toolbar, block menu and handles take a snippet and keep their behavior.
 - **Synced properties.** `block.data`, `atom.data` and `edytor.data` read and write like plain objects (`bind:value={block.data.title}`); each property and each array item syncs on its own, so concurrent edits of different properties, or of different items of one array, merge.

package/dist/plugins/richtext/RichTextPlugin.svelte

@@ -4,6 +4,7 @@
 	import type { SerializableContent } from '../../utils/json.js';
 	import type { HotKey } from '../../session/keymap.js';
 	import {
+		pastedLink,
 		richTextOperations,
 		sanitizeLinkHref,
 		sanitizeCssColorValue,
@@ -141,6 +142,19 @@
 					])
 				)
 			},
+			// Pasting a link over selected text links it (Notion), where the toolbar
+			// offers a link: a text range outside code blocks and voids.
+			onPaste: ({ e, prevent }) => {
+				const { selection } = edytor;
+				const { value, projection } = selection;
+				if (value.kind !== 'text' || selection.state.isCollapsed) return;
+				if (projection.islandRoot !== null || projection.voidRoot !== null) return;
+				const href = pastedLink(e.clipboardData?.getData('text/plain'));
+				if (href)
+					prevent(() =>
+						edytor.dispatcher.run('insertFromPaste', () => operations.setLinkAtRange({ href }))
+					);
+			},
 			onBeforeInput: ({ e, prevent }) => {
 				const { inputType, data } = e;
 				if (isNativeFormatInputType(inputType)) {

package/dist/plugins/richtext/richTextOperations.d.ts

@@ -17,13 +17,20 @@ export declare const sanitizeCssColorValue: (value: unknown) => string | null;
 /**
  * Scheme allowlist for link hrefs. `javascript:`/`data:`/`vbscript:`
  * payloads can arrive through native `insertLink`, pasted HTML, or a
- * malicious collaborator — and Svelte renders `href` verbatim. The URL
- * parser is used rather than a regex so whitespace/case obfuscation
- * (`java\tscript:`) can't slip through. Scheme-less hrefs (relative
- * paths, anchors, queries, protocol-relative) are not scriptable and
- * pass through.
+ * malicious collaborator — and Svelte renders `href` verbatim. The href is
+ * read as the browser's URL parser reads it: it strips C0 controls and
+ * spaces at both ends and tab/newline/CR anywhere (`\u0001javascript:` is
+ * `javascript:` to a browser), then resolves it against a base; only an
+ * allowed scheme, or a relative href that stays relative, passes.
  */
 export declare const sanitizeLinkHref: (href: unknown) => string | null;
+/**
+ * The URL a paste carries when its plain text is one link and nothing else
+ * (surrounding whitespace aside): `http:`/`https:` with a host, or
+ * `mailto:`. `null` for anything else — words, several URLs, a bare
+ * domain, a scriptable scheme.
+ */
+export declare const pastedLink: (plain: string | undefined | null) => string | null;
 export declare const richTextOperations: (edytor: Edytor) => {
     /**
      * Insert a `divider` void block at the caret — the native

package/dist/plugins/richtext/richTextOperations.js

@@ -26,27 +26,45 @@ export const sanitizeCssColorValue = (value) => {
 /**
  * Scheme allowlist for link hrefs. `javascript:`/`data:`/`vbscript:`
  * payloads can arrive through native `insertLink`, pasted HTML, or a
- * malicious collaborator — and Svelte renders `href` verbatim. The URL
- * parser is used rather than a regex so whitespace/case obfuscation
- * (`java\tscript:`) can't slip through. Scheme-less hrefs (relative
- * paths, anchors, queries, protocol-relative) are not scriptable and
- * pass through.
+ * malicious collaborator — and Svelte renders `href` verbatim. The href is
+ * read as the browser's URL parser reads it: it strips C0 controls and
+ * spaces at both ends and tab/newline/CR anywhere (`\u0001javascript:` is
+ * `javascript:` to a browser), then resolves it against a base; only an
+ * allowed scheme, or a relative href that stays relative, passes.
  */
 export const sanitizeLinkHref = (href) => {
     // Marks arrive from untrusted sources too (synced peers, paste) —
     // reject non-strings outright instead of throwing on `.replace`.
     if (typeof href !== 'string')
         return null;
-    // WHATWG URL preprocessing removes tab/newline/CR before parsing —
-    // doing it here too means `java\tscript:` collapses back to a
-    // detectable scheme instead of slipping through as "scheme-less".
-    const trimmed = href.replace(/[\t\n\r]/g, '').trim();
+    // eslint-disable-next-line no-control-regex
+    const trimmed = href.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, '');
     if (!trimmed)
         return null;
-    if (!/^[a-zA-Z][a-zA-Z\d+.-]*:/.test(trimmed))
-        return trimmed;
     try {
-        return SAFE_LINK_PROTOCOLS.has(new URL(trimmed).protocol) ? trimmed : null;
+        // A relative href resolves to the base's `https:`: it names no scheme of its own.
+        return SAFE_LINK_PROTOCOLS.has(new URL(trimmed, 'https://relative.invalid/').protocol)
+            ? trimmed
+            : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * The URL a paste carries when its plain text is one link and nothing else
+ * (surrounding whitespace aside): `http:`/`https:` with a host, or
+ * `mailto:`. `null` for anything else — words, several URLs, a bare
+ * domain, a scriptable scheme.
+ */
+export const pastedLink = (plain) => {
+    const text = plain?.trim();
+    if (!text || /\s/.test(text))
+        return null;
+    try {
+        const url = new URL(text);
+        const web = (url.protocol === 'http:' || url.protocol === 'https:') && url.host;
+        return web || (url.protocol === 'mailto:' && url.pathname) ? sanitizeLinkHref(text) : null;
     }
     catch {
         return null;

package/package.json

@@ -1,6 +1,7 @@
 {
 	"name": "edytor",
-	"version": "0.1.0-next.30",
+	"license": "MIT",
+	"version": "0.1.0-next.32",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/beynar/edytor.git"