jodit-pro-react 5.4.32 → 5.5.2

package/build/esm/JoditEditor.mjs

@@ -1,6 +1,6 @@
 import {
   JoditEditor_default
-} from "./chunk-C5T4FVGO.mjs";
+} from "./chunk-YJFFCJ5N.mjs";
 export {
   JoditEditor_default as default
 };

package/build/esm/{chunk-C5T4FVGO.mjs → chunk-YJFFCJ5N.mjs}

@@ -182,7 +182,7 @@ var APP_VERSION, ES, IS_ES_MODERN, IS_ES_NEXT, IS_PROD, IS_TEST, FAT_MODE, HOMEP
 var init_constants = __esm({
   "node_modules/jodit/esm/core/constants.js"() {
     "use strict";
-    APP_VERSION = "4.10.3";
+    APP_VERSION = "4.11.3";
     ES = "es2020";
     IS_ES_MODERN = true;
     IS_ES_NEXT = true;
@@ -4294,17 +4294,52 @@ var init_utils3 = __esm({
 
 // node_modules/jodit/esm/core/helpers/html/safe-html.js
 function safeHTML(box, options2) {
+  var _a2;
   if (!Dom.isElement(box) && !Dom.isFragment(box)) {
     return;
   }
-  if (options2.removeOnError) {
-    sanitizeHTMLElement(box);
+  const removeEvents = (_a2 = options2.removeEventAttributes) !== null && _a2 !== void 0 ? _a2 : options2.removeOnError;
+  if (removeEvents) {
+    removeAllEventAttributes(box);
+    $$("*", box).forEach((elm) => removeAllEventAttributes(elm));
+  } else if (options2.removeOnError) {
+    sanitizeHTMLElement(box, options2);
     $$("[onerror]", box).forEach((elm) => sanitizeHTMLElement(elm, options2));
   }
   if (options2.safeJavaScriptLink) {
-    sanitizeHTMLElement(box);
+    sanitizeHTMLElement(box, options2);
     $$('a[href^="javascript"]', box).forEach((elm) => sanitizeHTMLElement(elm, options2));
   }
+  if (options2.safeLinksTarget) {
+    $$('a[target="_blank"]', box).forEach((elm) => {
+      const rel = elm.getAttribute("rel") || "";
+      const parts = rel.split(/\s+/).filter(Boolean);
+      if (!parts.includes("noopener")) {
+        parts.push("noopener");
+      }
+      if (!parts.includes("noreferrer")) {
+        parts.push("noreferrer");
+      }
+      attr(elm, "rel", parts.join(" "));
+    });
+  }
+}
+function removeAllEventAttributes(elm) {
+  if (!Dom.isElement(elm)) {
+    return false;
+  }
+  let effected = false;
+  const toRemove = [];
+  for (let i48 = 0; i48 < elm.attributes.length; i48++) {
+    if (elm.attributes[i48].name.toLowerCase().startsWith("on")) {
+      toRemove.push(elm.attributes[i48].name);
+    }
+  }
+  for (const name of toRemove) {
+    elm.removeAttribute(name);
+    effected = true;
+  }
+  return effected;
 }
 function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
   safeJavaScriptLink: true,
@@ -19398,10 +19433,16 @@ Config.prototype.cleanHTML = {
     b: "strong"
   },
   allowTags: false,
-  denyTags: "script",
+  denyTags: "script,iframe,object,embed",
   useIframeSandbox: false,
   removeOnError: true,
+  removeEventAttributes: true,
   safeJavaScriptLink: true,
+  safeLinksTarget: true,
+  allowedStyles: false,
+  sanitizer: false,
+  sandboxIframesInContent: true,
+  convertUnsafeEmbeds: ["object", "embed"],
   disableCleanFilter: null
 };
 Config.prototype.controls.eraser = {
@@ -19534,11 +19575,15 @@ init_constants();
 var filters_exports = {};
 __export(filters_exports, {
   allowAttributes: () => allowAttributes,
+  convertUnsafeEmbeds: () => convertUnsafeEmbeds,
   fillEmptyParagraph: () => fillEmptyParagraph,
   removeEmptyTextNode: () => removeEmptyTextNode,
   removeInvTextNodes: () => removeInvTextNodes,
   replaceOldTags: () => replaceOldTags,
+  safeLinksTarget: () => safeLinksTarget,
+  sandboxIframesInContent: () => sandboxIframesInContent,
   sanitizeAttributes: () => sanitizeAttributes,
+  sanitizeStyles: () => sanitizeStyles,
   tryRemoveNode: () => tryRemoveNode
 });
 
@@ -19566,6 +19611,36 @@ function allowAttributes(jodit, nodeElm, hadEffect, allow) {
   return hadEffect;
 }
 
+// node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/convert-unsafe-embeds.js
+init_dom();
+init_attr();
+function convertUnsafeEmbeds(jodit, nodeElm, hadEffect) {
+  const opt = jodit.o.cleanHTML.convertUnsafeEmbeds;
+  if (!opt || !Dom.isElement(nodeElm)) {
+    return hadEffect;
+  }
+  const tag = nodeElm.nodeName.toLowerCase();
+  if (!opt.includes(tag)) {
+    return hadEffect;
+  }
+  const elm = nodeElm;
+  const src = attr(elm, "data") || attr(elm, "src") || attr(elm, "movie") || "";
+  if (!src) {
+    Dom.safeRemove(elm);
+    return true;
+  }
+  const iframe2 = jodit.createInside.element("iframe");
+  attr(iframe2, {
+    src,
+    sandbox: "",
+    frameborder: "0",
+    width: attr(elm, "width"),
+    height: attr(elm, "height")
+  });
+  Dom.replace(elm, iframe2, void 0, false, true);
+  return true;
+}
+
 // node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/fill-empty-paragraph.js
 init_constants();
 init_dom();
@@ -19643,19 +19718,127 @@ function replaceIfMatched(jodit, oldParent, list) {
   return oldParent;
 }
 
+// node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/safe-links-target.js
+init_dom();
+init_attr();
+function safeLinksTarget(jodit, nodeElm, hadEffect) {
+  if (!jodit.o.cleanHTML.safeLinksTarget || !Dom.isElement(nodeElm) || nodeElm.nodeName !== "A") {
+    return hadEffect;
+  }
+  const elm = nodeElm;
+  if (attr(elm, "target") !== "_blank") {
+    return hadEffect;
+  }
+  const rel = attr(elm, "rel") || "";
+  const parts = rel.split(/\s+/).filter(Boolean);
+  let changed = false;
+  if (!parts.includes("noopener")) {
+    parts.push("noopener");
+    changed = true;
+  }
+  if (!parts.includes("noreferrer")) {
+    parts.push("noreferrer");
+    changed = true;
+  }
+  if (changed) {
+    attr(elm, "rel", parts.join(" "));
+    return true;
+  }
+  return hadEffect;
+}
+
+// node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.js
+init_dom();
+init_attr();
+function sandboxIframesInContent(jodit, nodeElm, hadEffect) {
+  if (!jodit.o.cleanHTML.sandboxIframesInContent || !Dom.isElement(nodeElm) || nodeElm.nodeName !== "IFRAME") {
+    return hadEffect;
+  }
+  const elm = nodeElm;
+  if (!elm.hasAttribute("sandbox")) {
+    attr(elm, "sandbox", "");
+    return true;
+  }
+  return hadEffect;
+}
+
 // node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/sanitize-attributes.js
 init_dom();
 init_helpers();
 function sanitizeAttributes(jodit, nodeElm, hadEffect) {
-  if (Dom.isElement(nodeElm) && sanitizeHTMLElement(nodeElm, {
-    safeJavaScriptLink: jodit.options.cleanHTML.safeJavaScriptLink,
-    removeOnError: jodit.options.cleanHTML.removeOnError
+  if (!Dom.isElement(nodeElm)) {
+    return hadEffect;
+  }
+  const opts = jodit.options.cleanHTML;
+  if (sanitizeHTMLElement(nodeElm, {
+    safeJavaScriptLink: opts.safeJavaScriptLink,
+    removeOnError: opts.removeOnError,
+    removeEventAttributes: opts.removeEventAttributes,
+    safeLinksTarget: opts.safeLinksTarget
   })) {
     return true;
   }
   return hadEffect;
 }
 
+// node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/sanitize-styles.js
+init_dom();
+init_attr();
+function sanitizeStyles(jodit, nodeElm, hadEffect) {
+  const allowedStyles = jodit.o.cleanHTML.allowedStyles;
+  if (!allowedStyles || !Dom.isElement(nodeElm)) {
+    return hadEffect;
+  }
+  const elm = nodeElm;
+  const style = attr(elm, "style");
+  if (!style) {
+    return hadEffect;
+  }
+  const tagName = nodeElm.nodeName.toLowerCase();
+  const allowed = getAllowedPropsForTag(tagName, allowedStyles);
+  if (!allowed) {
+    return hadEffect;
+  }
+  const filtered = filterStyleProperties(style, allowed);
+  if (filtered !== style) {
+    attr(elm, "style", filtered || null);
+    return true;
+  }
+  return hadEffect;
+}
+function getAllowedPropsForTag(tagName, allowedStyles) {
+  const tagSpecific = allowedStyles[tagName];
+  const global = allowedStyles["*"];
+  if (!tagSpecific && !global) {
+    return null;
+  }
+  const set2 = /* @__PURE__ */ new Set();
+  if (global) {
+    for (const prop of global) {
+      set2.add(prop.toLowerCase());
+    }
+  }
+  if (tagSpecific) {
+    for (const prop of tagSpecific) {
+      set2.add(prop.toLowerCase());
+    }
+  }
+  return set2;
+}
+function filterStyleProperties(style, allowed) {
+  return style.split(";").map((s52) => s52.trim()).filter((s52) => {
+    if (!s52) {
+      return false;
+    }
+    const colonIdx = s52.indexOf(":");
+    if (colonIdx === -1) {
+      return false;
+    }
+    const prop = s52.substring(0, colonIdx).trim().toLowerCase();
+    return allowed.has(prop);
+  }).join("; ").replace(/;\s*$/, "");
+}
+
 // node_modules/jodit/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js
 init_constants();
 init_dom();
@@ -19777,6 +19960,10 @@ var cleanHtml = class extends Plugin {
     return false;
   }
   onSafeHTML(sandBox) {
+    const sanitizer = this.j.o.cleanHTML.sanitizer;
+    if (sanitizer) {
+      sandBox.innerHTML = sanitizer(sandBox.innerHTML);
+    }
     safeHTML(sandBox, this.j.o.cleanHTML);
   }
   /** @override */
@@ -20668,7 +20855,7 @@ var dragAndDrop = class extends Plugin {
       if (this.isCopyMode) {
         const [tagName, field] = attr(this.draggable, "-is-file") === "1" ? ["a", "href"] : ["img", "src"];
         fragment = this.j.createInside.element(tagName);
-        fragment.setAttribute(field, attr(this.draggable, "data-src") || attr(this.draggable, "src") || "");
+        attr(fragment, field, attr(this.draggable, "data-src") || attr(this.draggable, "src") || "");
         if (tagName === "a") {
           fragment.textContent = attr(fragment, field) || "";
         }
@@ -20993,6 +21180,7 @@ function hasPreviousBlock(fake, jodit) {
 
 // node_modules/jodit/esm/plugins/enter/helpers/insert-paragraph.js
 init_dom();
+init_attr();
 init_scroll_into_view();
 function insertParagraph(fake, editor, wrapperTag, style) {
   const isBR = wrapperTag.toLowerCase() === "br", { createInside } = editor, p56 = createInside.element(wrapperTag), br = createInside.element("br");
@@ -21000,7 +21188,7 @@ function insertParagraph(fake, editor, wrapperTag, style) {
     p56.appendChild(br);
   }
   if (style && style.cssText) {
-    p56.setAttribute("style", style.cssText);
+    attr(p56, "style", style.cssText);
   }
   Dom.after(fake, p56);
   Dom.before(isBR ? p56 : br, fake);
@@ -21182,6 +21370,7 @@ pluginSystem.add("enter", enter);
 // node_modules/jodit/esm/plugins/file/file.js
 init_dom();
 init_global2();
+init_attr();
 init_config();
 Config.prototype.controls.file = {
   popup: (editor, current, close) => {
@@ -21200,8 +21389,8 @@ Config.prototype.controls.file = {
       upload: true,
       url: (url2, text) => {
         if (sourceAnchor) {
-          sourceAnchor.setAttribute("href", url2);
-          sourceAnchor.setAttribute("title", text);
+          attr(sourceAnchor, "href", url2);
+          attr(sourceAnchor, "title", text);
         } else {
           insert(url2, text);
         }
@@ -21808,8 +21997,8 @@ function iframe(editor) {
     if (opt.iframeCSSLinks) {
       opt.iframeCSSLinks.forEach((href) => {
         const link2 = doc.createElement("link");
-        link2.setAttribute("rel", "stylesheet");
-        link2.setAttribute("href", href);
+        attr(link2, "rel", "stylesheet");
+        attr(link2, "href", href);
         doc.head && doc.head.appendChild(link2);
       });
     }
@@ -21826,11 +22015,13 @@ function iframe(editor) {
     iframe2.style.display = "block";
     iframe2.src = "about:blank";
     iframe2.className = "jodit-wysiwyg_iframe";
-    iframe2.setAttribute("allowtransparency", "true");
-    iframe2.setAttribute("tabindex", opt.tabIndex.toString());
-    iframe2.setAttribute("frameborder", "0");
+    attr(iframe2, {
+      allowtransparency: "true",
+      tabindex: opt.tabIndex.toString(),
+      frameborder: "0"
+    });
     if (opt.iframeSandbox != null) {
-      iframe2.setAttribute("sandbox", opt.iframeSandbox);
+      attr(iframe2, "sandbox", opt.iframeSandbox);
     }
     editor.workplace.appendChild(iframe2);
     editor.iframe = iframe2;
@@ -21924,6 +22115,7 @@ pluginSystem.add("iframe", iframe);
 init_dom2();
 init_global2();
 init_helpers();
+init_attr();
 init_config();
 
 // node_modules/jodit/esm/plugins/image/image.svg.js
@@ -21951,8 +22143,8 @@ Config.prototype.controls.image = {
           url2 = "//" + url2;
         }
         const image2 = sourceImage || editor.createInside.element("img");
-        image2.setAttribute("src", url2);
-        image2.setAttribute("alt", text);
+        attr(image2, "src", url2);
+        attr(image2, "alt", text);
         if (!sourceImage) {
           yield editor.s.insertImage(image2, null, editor.o.imageDefaultWidth);
         }
@@ -22907,6 +23099,10 @@ function applyLink(j10, image2, imageLink, imageLinkOpenInNewTab) {
     }
     attr(link2, "href", imageLink);
     attr(link2, "target", imageLinkOpenInNewTab ? "_blank" : null);
+    if (!imageLinkOpenInNewTab) {
+      const relParts = (attr(link2, "rel") || "").split(/\s+/).filter((p56) => p56 && p56 !== "noopener" && p56 !== "noreferrer");
+      attr(link2, "rel", relParts.length ? relParts.join(" ") : null);
+    }
   } else {
     if (link2 && link2.parentNode) {
       link2.parentNode.replaceChild(image2, link2);
@@ -24599,7 +24795,7 @@ var link = class extends Plugin {
     }
     if (jodit.s.isCollapsed()) {
       const a68 = jodit.createInside.element("a");
-      a68.setAttribute("href", html);
+      attr(a68, "href", html);
       a68.textContent = html;
       jodit.e.fire("applyLink", jodit, a68, null);
       return a68;
@@ -24659,7 +24855,7 @@ var link = class extends Plugin {
         target_checkbox.checked = attr(link2, "target") === "_blank";
       }
       if (noFollowCheckbox && nofollow_checkbox) {
-        nofollow_checkbox.checked = attr(link2, "rel") === "nofollow";
+        nofollow_checkbox.checked = (attr(link2, "rel") || "").split(/\s+/).includes("nofollow");
       }
       insert.textContent = i18n2("Update");
     } else {
@@ -24719,7 +24915,14 @@ var link = class extends Plugin {
           attr(a68, "target", target_checkbox.checked ? "_blank" : null);
         }
         if (noFollowCheckbox && nofollow_checkbox) {
-          attr(a68, "rel", nofollow_checkbox.checked ? "nofollow" : null);
+          const relParts = (attr(a68, "rel") || "").split(/\s+/).filter(Boolean);
+          const hasNofollow = relParts.includes("nofollow");
+          if (nofollow_checkbox.checked && !hasNofollow) {
+            relParts.push("nofollow");
+          } else if (!nofollow_checkbox.checked && hasNofollow) {
+            relParts.splice(relParts.indexOf("nofollow"), 1);
+          }
+          attr(a68, "rel", relParts.length ? relParts.join(" ") : null);
         }
         jodit.e.fire("applyLink", jodit, a68, form2);
       });
@@ -26840,8 +27043,8 @@ var resizer = class extends Plugin {
       this.j.e.off(element, "mousedown.select touchstart.select").on(element, "mousedown.select touchstart.select", () => {
         this.j.s.select(element);
       }).off(element, "changesize").on(element, "changesize", () => {
-        iframe2.setAttribute("width", element.offsetWidth + "px");
-        iframe2.setAttribute("height", element.offsetHeight + "px");
+        attr(iframe2, "width", element.offsetWidth + "px");
+        attr(iframe2, "height", element.offsetHeight + "px");
       });
     }
     this.j.e.on(element, "dragstart", this.hide);
@@ -28578,6 +28781,7 @@ var AceEditor = class extends SourceEditor {
 
 // node_modules/jodit/esm/plugins/source/editor/engines/area.js
 init_dom();
+init_attr();
 init_css();
 var TextAreaEditor = class extends SourceEditor {
   constructor() {
@@ -28638,14 +28842,10 @@ var TextAreaEditor = class extends SourceEditor {
     this.instance.blur();
   }
   setPlaceHolder(title) {
-    this.instance.setAttribute("placeholder", title);
+    attr(this.instance, "placeholder", title);
   }
   setReadOnly(isReadOnly) {
-    if (isReadOnly) {
-      this.instance.setAttribute("readonly", "true");
-    } else {
-      this.instance.removeAttribute("readonly");
-    }
+    attr(this.instance, "readonly", isReadOnly ? "true" : null);
   }
   selectAll() {
     this.instance.select();
@@ -48358,11 +48558,15 @@ jodit/esm/plugins/clean-html/helpers/get-hash.js:
 jodit/esm/plugins/clean-html/helpers/remove-format/remove-format-for-collapsed-selection.js:
 jodit/esm/plugins/clean-html/helpers/remove-format/remove-format-for-selection.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/allow-attributes.js:
+jodit/esm/plugins/clean-html/helpers/visitor/filters/convert-unsafe-embeds.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/fill-empty-paragraph.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/remove-empty-text-node.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/remove-inv-text-nodes.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/replace-old-tags.js:
+jodit/esm/plugins/clean-html/helpers/visitor/filters/safe-links-target.js:
+jodit/esm/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/sanitize-attributes.js:
+jodit/esm/plugins/clean-html/helpers/visitor/filters/sanitize-styles.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js:
 jodit/esm/plugins/clean-html/helpers/visitor/filters/index.js:
 jodit/esm/plugins/clean-html/helpers/visitor/visit-node-walker.js:

package/build/esm/index.mjs

@@ -2,7 +2,7 @@ import {
   Config,
   JoditEditor_default,
   n
-} from "./chunk-C5T4FVGO.mjs";
+} from "./chunk-YJFFCJ5N.mjs";
 
 // src/index.ts
 var index_default = JoditEditor_default;