edytor 0.1.0-next.31 → 0.1.0-next.32

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Edytor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -15,11 +15,11 @@
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **Work in progress.** Edytor is a pre-release (`0.1.0-next.31`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **Work in progress.** Edytor is a pre-release (`0.1.0-next.32`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 
-- **Notion-style editing out of the box.** `<Edytor />` alone is a rich text editor with images: headings, lists, to-dos, toggles, callouts, quotes, dividers, ten marks, Notion's markdown shortcuts and hotkeys. Add the Notion theme, block handles with a block menu (drag one block, or every block the selection covers), a slash menu, a selection toolbar and code blocks.
+- **Notion-style editing out of the box.** `<Edytor />` alone is a rich text editor with images and block handles: headings, lists, to-dos, toggles, callouts, quotes, dividers, ten marks and Notion's hotkeys. Add the Notion theme, a block menu (drag one block, or every block the selection covers), a slash menu, a selection toolbar, markdown shortcuts (`markdownShortcutsPlugin`) and code blocks.
 - **Columns, opt-in.** List `columnsPlugin` for Notion's multi-column layouts: drag a block to the edge of another to put them side by side, or pick "2 columns" to "5 columns"; drag the gap to resize. Layouts converge across collaborators and the room ([Columns](https://edytor.dev/docs/plugins/columns)).
 - **Your markup.** Blocks, marks and inline atoms render through your Svelte snippets; the slash menu, toolbar, block menu and handles take a snippet and keep their behavior.
 - **Synced properties.** `block.data`, `atom.data` and `edytor.data` read and write like plain objects (`bind:value={block.data.title}`); each property and each array item syncs on its own, so concurrent edits of different properties, or of different items of one array, merge.

package/dist/plugins/richtext/richTextOperations.d.ts

@@ -17,11 +17,11 @@ export declare const sanitizeCssColorValue: (value: unknown) => string | null;
 /**
  * Scheme allowlist for link hrefs. `javascript:`/`data:`/`vbscript:`
  * payloads can arrive through native `insertLink`, pasted HTML, or a
- * malicious collaborator — and Svelte renders `href` verbatim. The URL
- * parser is used rather than a regex so whitespace/case obfuscation
- * (`java\tscript:`) can't slip through. Scheme-less hrefs (relative
- * paths, anchors, queries, protocol-relative) are not scriptable and
- * pass through.
+ * malicious collaborator — and Svelte renders `href` verbatim. The href is
+ * read as the browser's URL parser reads it: it strips C0 controls and
+ * spaces at both ends and tab/newline/CR anywhere (`\u0001javascript:` is
+ * `javascript:` to a browser), then resolves it against a base; only an
+ * allowed scheme, or a relative href that stays relative, passes.
  */
 export declare const sanitizeLinkHref: (href: unknown) => string | null;
 /**

package/dist/plugins/richtext/richTextOperations.js

@@ -26,27 +26,26 @@ export const sanitizeCssColorValue = (value) => {
 /**
  * Scheme allowlist for link hrefs. `javascript:`/`data:`/`vbscript:`
  * payloads can arrive through native `insertLink`, pasted HTML, or a
- * malicious collaborator — and Svelte renders `href` verbatim. The URL
- * parser is used rather than a regex so whitespace/case obfuscation
- * (`java\tscript:`) can't slip through. Scheme-less hrefs (relative
- * paths, anchors, queries, protocol-relative) are not scriptable and
- * pass through.
+ * malicious collaborator — and Svelte renders `href` verbatim. The href is
+ * read as the browser's URL parser reads it: it strips C0 controls and
+ * spaces at both ends and tab/newline/CR anywhere (`\u0001javascript:` is
+ * `javascript:` to a browser), then resolves it against a base; only an
+ * allowed scheme, or a relative href that stays relative, passes.
  */
 export const sanitizeLinkHref = (href) => {
     // Marks arrive from untrusted sources too (synced peers, paste) —
     // reject non-strings outright instead of throwing on `.replace`.
     if (typeof href !== 'string')
         return null;
-    // WHATWG URL preprocessing removes tab/newline/CR before parsing —
-    // doing it here too means `java\tscript:` collapses back to a
-    // detectable scheme instead of slipping through as "scheme-less".
-    const trimmed = href.replace(/[\t\n\r]/g, '').trim();
+    // eslint-disable-next-line no-control-regex
+    const trimmed = href.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, '');
     if (!trimmed)
         return null;
-    if (!/^[a-zA-Z][a-zA-Z\d+.-]*:/.test(trimmed))
-        return trimmed;
     try {
-        return SAFE_LINK_PROTOCOLS.has(new URL(trimmed).protocol) ? trimmed : null;
+        // A relative href resolves to the base's `https:`: it names no scheme of its own.
+        return SAFE_LINK_PROTOCOLS.has(new URL(trimmed, 'https://relative.invalid/').protocol)
+            ? trimmed
+            : null;
     }
     catch {
         return null;

package/package.json

@@ -1,6 +1,7 @@
 {
 	"name": "edytor",
-	"version": "0.1.0-next.31",
+	"license": "MIT",
+	"version": "0.1.0-next.32",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/beynar/edytor.git"