jodit-pro 4.10.4 → 4.11.1

package/es2021.en/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.10.4
+ * Version: v4.11.1
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1721,7 +1721,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.10.4";
+ */ const APP_VERSION = "4.11.1";
 // prettier-ignore
 const ES = "es2021";
 const IS_ES_MODERN = true;
@@ -5775,17 +5775,54 @@ function normalizeCSS(s) {
 /**
  * Removes dangerous constructs from HTML
  */ function safeHTML(box, options) {
+    var _a;
     if (!_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(box) && !_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isFragment(box)) {
         return;
     }
-    if (options.removeOnError) {
-        sanitizeHTMLElement(box);
+    const removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
+    if (removeEvents) {
+        removeAllEventAttributes(box);
+        (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('*', box).forEach((elm)=>removeAllEventAttributes(elm));
+    } else if (options.removeOnError) {
+        sanitizeHTMLElement(box, options);
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('[onerror]', box).forEach((elm)=>sanitizeHTMLElement(elm, options));
     }
     if (options.safeJavaScriptLink) {
-        sanitizeHTMLElement(box);
+        sanitizeHTMLElement(box, options);
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('a[href^="javascript"]', box).forEach((elm)=>sanitizeHTMLElement(elm, options));
     }
+    if (options.safeLinksTarget) {
+        (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('a[target="_blank"]', box).forEach((elm)=>{
+            const rel = elm.getAttribute('rel') || '';
+            const parts = rel.split(/\s+/).filter(Boolean);
+            if (!parts.includes('noopener')) {
+                parts.push('noopener');
+            }
+            if (!parts.includes('noreferrer')) {
+                parts.push('noreferrer');
+            }
+            (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'rel', parts.join(' '));
+        });
+    }
+}
+/**
+ * Remove all on* event handler attributes from an element
+ */ function removeAllEventAttributes(elm) {
+    if (!_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(elm)) {
+        return false;
+    }
+    let effected = false;
+    const toRemove = [];
+    for(let i = 0; i < elm.attributes.length; i++){
+        if (elm.attributes[i].name.toLowerCase().startsWith('on')) {
+            toRemove.push(elm.attributes[i].name);
+        }
+    }
+    for (const name of toRemove){
+        elm.removeAttribute(name);
+        effected = true;
+    }
+    return effected;
 }
 function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
     safeJavaScriptLink: true,
@@ -31536,6 +31573,10 @@ _core_ui_icon_js__WEBPACK_IMPORTED_MODULE_4__.Icon.set('class-span', _class_span
         return false;
     }
     onSafeHTML(sandBox) {
+        const sanitizer = this.j.o.cleanHTML.sanitizer;
+        if (sanitizer) {
+            sandBox.innerHTML = sanitizer(sandBox.innerHTML);
+        }
         (0,_core_helpers_html_safe_html_js__WEBPACK_IMPORTED_MODULE_4__.safeHTML)(sandBox, this.j.o.cleanHTML);
     }
     /** @override */ beforeDestruct() {
@@ -31604,10 +31645,19 @@ _config_js__WEBPACK_IMPORTED_MODULE_1__.Config.prototype.cleanHTML = {
         b: 'strong'
     },
     allowTags: false,
-    denyTags: 'script',
+    denyTags: 'script,iframe,object,embed',
     useIframeSandbox: false,
     removeOnError: true,
+    removeEventAttributes: true,
     safeJavaScriptLink: true,
+    safeLinksTarget: true,
+    allowedStyles: false,
+    sanitizer: false,
+    sandboxIframesInContent: true,
+    convertUnsafeEmbeds: [
+        'object',
+        'embed'
+    ],
     disableCleanFilter: null
 };
 _config_js__WEBPACK_IMPORTED_MODULE_1__.Config.prototype.controls.eraser = {
@@ -31864,6 +31914,53 @@ _core_ui_icon_js__WEBPACK_IMPORTED_MODULE_0__.Icon.set('eraser', _eraser_svg_js_
 }
 
 
+/***/ }),
+
+/***/ 1962:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   convertUnsafeEmbeds: function() { return /* binding */ convertUnsafeEmbeds; }
+/* harmony export */ });
+/* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ 
+
+/**
+ * Convert `<object>` and `<embed>` elements to safer `<iframe>` elements.
+ * @private
+ */ function convertUnsafeEmbeds(jodit, nodeElm, hadEffect) {
+    const opt = jodit.o.cleanHTML.convertUnsafeEmbeds;
+    if (!opt || !_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(nodeElm)) {
+        return hadEffect;
+    }
+    const tag = nodeElm.nodeName.toLowerCase();
+    if (!opt.includes(tag)) {
+        return hadEffect;
+    }
+    const elm = nodeElm;
+    const src = (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'data') || (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'src') || (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'movie') || '';
+    if (!src) {
+        _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.safeRemove(elm);
+        return true;
+    }
+    const iframe = jodit.createInside.element('iframe');
+    (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(iframe, {
+        src,
+        sandbox: '',
+        frameborder: '0',
+        width: (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'width'),
+        height: (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'height')
+    });
+    _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.replace(elm, iframe, undefined, false, true);
+    return true;
+}
+
+
 /***/ }),
 
 /***/ 39433:
@@ -31907,20 +32004,28 @@ const TABLE_CONTAINER_TAGS = new Set([
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   allowAttributes: function() { return /* reexport safe */ _allow_attributes_js__WEBPACK_IMPORTED_MODULE_0__.allowAttributes; },
-/* harmony export */   fillEmptyParagraph: function() { return /* reexport safe */ _fill_empty_paragraph_js__WEBPACK_IMPORTED_MODULE_1__.fillEmptyParagraph; },
-/* harmony export */   removeEmptyTextNode: function() { return /* reexport safe */ _remove_empty_text_node_js__WEBPACK_IMPORTED_MODULE_2__.removeEmptyTextNode; },
-/* harmony export */   removeInvTextNodes: function() { return /* reexport safe */ _remove_inv_text_nodes_js__WEBPACK_IMPORTED_MODULE_3__.removeInvTextNodes; },
-/* harmony export */   replaceOldTags: function() { return /* reexport safe */ _replace_old_tags_js__WEBPACK_IMPORTED_MODULE_4__.replaceOldTags; },
-/* harmony export */   sanitizeAttributes: function() { return /* reexport safe */ _sanitize_attributes_js__WEBPACK_IMPORTED_MODULE_5__.sanitizeAttributes; },
-/* harmony export */   tryRemoveNode: function() { return /* reexport safe */ _try_remove_node_js__WEBPACK_IMPORTED_MODULE_6__.tryRemoveNode; }
+/* harmony export */   convertUnsafeEmbeds: function() { return /* reexport safe */ _convert_unsafe_embeds_js__WEBPACK_IMPORTED_MODULE_1__.convertUnsafeEmbeds; },
+/* harmony export */   fillEmptyParagraph: function() { return /* reexport safe */ _fill_empty_paragraph_js__WEBPACK_IMPORTED_MODULE_2__.fillEmptyParagraph; },
+/* harmony export */   removeEmptyTextNode: function() { return /* reexport safe */ _remove_empty_text_node_js__WEBPACK_IMPORTED_MODULE_3__.removeEmptyTextNode; },
+/* harmony export */   removeInvTextNodes: function() { return /* reexport safe */ _remove_inv_text_nodes_js__WEBPACK_IMPORTED_MODULE_4__.removeInvTextNodes; },
+/* harmony export */   replaceOldTags: function() { return /* reexport safe */ _replace_old_tags_js__WEBPACK_IMPORTED_MODULE_5__.replaceOldTags; },
+/* harmony export */   safeLinksTarget: function() { return /* reexport safe */ _safe_links_target_js__WEBPACK_IMPORTED_MODULE_6__.safeLinksTarget; },
+/* harmony export */   sandboxIframesInContent: function() { return /* reexport safe */ _sandbox_iframes_in_content_js__WEBPACK_IMPORTED_MODULE_7__.sandboxIframesInContent; },
+/* harmony export */   sanitizeAttributes: function() { return /* reexport safe */ _sanitize_attributes_js__WEBPACK_IMPORTED_MODULE_8__.sanitizeAttributes; },
+/* harmony export */   sanitizeStyles: function() { return /* reexport safe */ _sanitize_styles_js__WEBPACK_IMPORTED_MODULE_9__.sanitizeStyles; },
+/* harmony export */   tryRemoveNode: function() { return /* reexport safe */ _try_remove_node_js__WEBPACK_IMPORTED_MODULE_10__.tryRemoveNode; }
 /* harmony export */ });
 /* harmony import */ var _allow_attributes_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(82558);
-/* harmony import */ var _fill_empty_paragraph_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(39433);
-/* harmony import */ var _remove_empty_text_node_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(53392);
-/* harmony import */ var _remove_inv_text_nodes_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(25813);
-/* harmony import */ var _replace_old_tags_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(80973);
-/* harmony import */ var _sanitize_attributes_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(384);
-/* harmony import */ var _try_remove_node_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(28800);
+/* harmony import */ var _convert_unsafe_embeds_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1962);
+/* harmony import */ var _fill_empty_paragraph_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(39433);
+/* harmony import */ var _remove_empty_text_node_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(53392);
+/* harmony import */ var _remove_inv_text_nodes_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(25813);
+/* harmony import */ var _replace_old_tags_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(80973);
+/* harmony import */ var _safe_links_target_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(95614);
+/* harmony import */ var _sandbox_iframes_in_content_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(85978);
+/* harmony import */ var _sanitize_attributes_js__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(384);
+/* harmony import */ var _sanitize_styles_js__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(15583);
+/* harmony import */ var _try_remove_node_js__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__(28800);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -31938,6 +32043,10 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
+
+
+
+
 /***/ }),
 
 /***/ 53392:
@@ -32045,6 +32154,84 @@ __webpack_require__.r(__webpack_exports__);
 }
 
 
+/***/ }),
+
+/***/ 95614:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   safeLinksTarget: function() { return /* binding */ safeLinksTarget; }
+/* harmony export */ });
+/* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ 
+
+/**
+ * Automatically add `rel="noopener noreferrer"` to links with `target="_blank"`
+ * @private
+ */ function safeLinksTarget(jodit, nodeElm, hadEffect) {
+    if (!jodit.o.cleanHTML.safeLinksTarget || !_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(nodeElm) || nodeElm.nodeName !== 'A') {
+        return hadEffect;
+    }
+    const elm = nodeElm;
+    if ((0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'target') !== '_blank') {
+        return hadEffect;
+    }
+    const rel = (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'rel') || '';
+    const parts = rel.split(/\s+/).filter(Boolean);
+    let changed = false;
+    if (!parts.includes('noopener')) {
+        parts.push('noopener');
+        changed = true;
+    }
+    if (!parts.includes('noreferrer')) {
+        parts.push('noreferrer');
+        changed = true;
+    }
+    if (changed) {
+        (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'rel', parts.join(' '));
+        return true;
+    }
+    return hadEffect;
+}
+
+
+/***/ }),
+
+/***/ 85978:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   sandboxIframesInContent: function() { return /* binding */ sandboxIframesInContent; }
+/* harmony export */ });
+/* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ 
+
+/**
+ * Add `sandbox=""` attribute to all `<iframe>` elements in the editor content
+ * @private
+ */ function sandboxIframesInContent(jodit, nodeElm, hadEffect) {
+    if (!jodit.o.cleanHTML.sandboxIframesInContent || !_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(nodeElm) || nodeElm.nodeName !== 'IFRAME') {
+        return hadEffect;
+    }
+    const elm = nodeElm;
+    if (!elm.hasAttribute('sandbox')) {
+        (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'sandbox', '');
+        return true;
+    }
+    return hadEffect;
+}
+
+
 /***/ }),
 
 /***/ 384:
@@ -32064,9 +32251,15 @@ __webpack_require__.r(__webpack_exports__);
 /**
  * @private
  */ function sanitizeAttributes(jodit, nodeElm, hadEffect) {
-    if (_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(nodeElm) && (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.sanitizeHTMLElement)(nodeElm, {
-        safeJavaScriptLink: jodit.options.cleanHTML.safeJavaScriptLink,
-        removeOnError: jodit.options.cleanHTML.removeOnError
+    if (!_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(nodeElm)) {
+        return hadEffect;
+    }
+    const opts = jodit.options.cleanHTML;
+    if ((0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.sanitizeHTMLElement)(nodeElm, {
+        safeJavaScriptLink: opts.safeJavaScriptLink,
+        removeOnError: opts.removeOnError,
+        removeEventAttributes: opts.removeEventAttributes,
+        safeLinksTarget: opts.safeLinksTarget
     })) {
         return true;
     }
@@ -32074,6 +32267,81 @@ __webpack_require__.r(__webpack_exports__);
 }
 
 
+/***/ }),
+
+/***/ 15583:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   sanitizeStyles: function() { return /* binding */ sanitizeStyles; }
+/* harmony export */ });
+/* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ 
+
+/**
+ * Filter CSS properties in style attributes based on allowedStyles whitelist
+ * @private
+ */ function sanitizeStyles(jodit, nodeElm, hadEffect) {
+    const allowedStyles = jodit.o.cleanHTML.allowedStyles;
+    if (!allowedStyles || !_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(nodeElm)) {
+        return hadEffect;
+    }
+    const elm = nodeElm;
+    const style = (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'style');
+    if (!style) {
+        return hadEffect;
+    }
+    const tagName = nodeElm.nodeName.toLowerCase();
+    const allowed = getAllowedPropsForTag(tagName, allowedStyles);
+    if (!allowed) {
+        return hadEffect;
+    }
+    const filtered = filterStyleProperties(style, allowed);
+    if (filtered !== style) {
+        (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'style', filtered || null);
+        return true;
+    }
+    return hadEffect;
+}
+function getAllowedPropsForTag(tagName, allowedStyles) {
+    const tagSpecific = allowedStyles[tagName];
+    const global = allowedStyles['*'];
+    if (!tagSpecific && !global) {
+        return null;
+    }
+    const set = new Set();
+    if (global) {
+        for (const prop of global){
+            set.add(prop.toLowerCase());
+        }
+    }
+    if (tagSpecific) {
+        for (const prop of tagSpecific){
+            set.add(prop.toLowerCase());
+        }
+    }
+    return set;
+}
+function filterStyleProperties(style, allowed) {
+    return style.split(';').map((s)=>s.trim()).filter((s)=>{
+        if (!s) {
+            return false;
+        }
+        const colonIdx = s.indexOf(':');
+        if (colonIdx === -1) {
+            return false;
+        }
+        const prop = s.substring(0, colonIdx).trim().toLowerCase();
+        return allowed.has(prop);
+    }).join('; ').replace(/;\s*$/, '');
+}
+
+
 /***/ }),
 
 /***/ 28800:
@@ -33194,7 +33462,7 @@ _core_global_js__WEBPACK_IMPORTED_MODULE_2__.pluginSystem.add('dragAndDropElemen
                     'src'
                 ];
                 fragment = this.j.createInside.element(tagName);
-                fragment.setAttribute(field, (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(this.draggable, 'data-src') || (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(this.draggable, 'src') || '');
+                (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(fragment, field, (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(this.draggable, 'data-src') || (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(this.draggable, 'src') || '');
                 if (tagName === 'a') {
                     fragment.textContent = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(fragment, field) || '';
                 }
@@ -33791,13 +34059,15 @@ function brBefore(start) {
 /* harmony export */   insertParagraph: function() { return /* binding */ insertParagraph; }
 /* harmony export */ });
 /* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
-/* harmony import */ var _core_helpers_utils_scroll_into_view_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(26395);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/* harmony import */ var _core_helpers_utils_scroll_into_view_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(26395);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */ 
 
+
 /**
  * Insert default paragraph
  * @private
@@ -33807,11 +34077,11 @@ function brBefore(start) {
         p.appendChild(br);
     }
     if (style && style.cssText) {
-        p.setAttribute('style', style.cssText);
+        (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(p, 'style', style.cssText);
     }
     _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.after(fake, p);
     _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.before(isBR ? p : br, fake);
-    (0,_core_helpers_utils_scroll_into_view_js__WEBPACK_IMPORTED_MODULE_1__.scrollIntoViewIfNeeded)(p, editor.editor, editor.ed);
+    (0,_core_helpers_utils_scroll_into_view_js__WEBPACK_IMPORTED_MODULE_2__.scrollIntoViewIfNeeded)(p, editor.editor, editor.ed);
     return p;
 }
 
@@ -33988,8 +34258,9 @@ function brBefore(start) {
 /* unused harmony export file */
 /* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
 /* harmony import */ var _core_global_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(580);
-/* harmony import */ var _config_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6441);
-/* harmony import */ var _modules_widget_index_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(92762);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(29960);
+/* harmony import */ var _config_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6441);
+/* harmony import */ var _modules_widget_index_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(92762);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -33998,7 +34269,8 @@ function brBefore(start) {
 
 
 
-_config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.file = {
+
+_config_js__WEBPACK_IMPORTED_MODULE_3__.Config.prototype.controls.file = {
     popup: (editor, current, close)=>{
         const insert = (url, title = '')=>{
             editor.s.insertNode(editor.createInside.fromHTML(`<a href="${url}" title="${title}">${title || url}</a>`));
@@ -34007,7 +34279,7 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.file = {
         if (current && (_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(current, 'a') || _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(current, 'a', editor.editor))) {
             sourceAnchor = _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(current, 'a') ? current : _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(current, 'a', editor.editor);
         }
-        return (0,_modules_widget_index_js__WEBPACK_IMPORTED_MODULE_3__.FileSelectorWidget)(editor, {
+        return (0,_modules_widget_index_js__WEBPACK_IMPORTED_MODULE_4__.FileSelectorWidget)(editor, {
             filebrowser: (data)=>{
                 data.files && data.files.forEach((file)=>insert(data.baseurl + file));
                 close();
@@ -34015,8 +34287,8 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.file = {
             upload: true,
             url: (url, text)=>{
                 if (sourceAnchor) {
-                    sourceAnchor.setAttribute('href', url);
-                    sourceAnchor.setAttribute('title', text);
+                    (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_2__.attr)(sourceAnchor, 'href', url);
+                    (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_2__.attr)(sourceAnchor, 'title', text);
                 } else {
                     insert(url, text);
                 }
@@ -34878,8 +35150,8 @@ _config_js__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
         if (opt.iframeCSSLinks) {
             opt.iframeCSSLinks.forEach((href)=>{
                 const link = doc.createElement('link');
-                link.setAttribute('rel', 'stylesheet');
-                link.setAttribute('href', href);
+                (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__.attr)(link, 'rel', 'stylesheet');
+                (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__.attr)(link, 'href', href);
                 doc.head && doc.head.appendChild(link);
             });
         }
@@ -34896,11 +35168,13 @@ _config_js__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
         iframe.style.display = 'block';
         iframe.src = 'about:blank';
         iframe.className = 'jodit-wysiwyg_iframe';
-        iframe.setAttribute('allowtransparency', 'true');
-        iframe.setAttribute('tabindex', opt.tabIndex.toString());
-        iframe.setAttribute('frameborder', '0');
+        (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__.attr)(iframe, {
+            allowtransparency: 'true',
+            tabindex: opt.tabIndex.toString(),
+            frameborder: '0'
+        });
         if (opt.iframeSandbox != null) {
-            iframe.setAttribute('sandbox', opt.iframeSandbox);
+            (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__.attr)(iframe, 'sandbox', opt.iframeSandbox);
         }
         editor.workplace.appendChild(iframe);
         editor.iframe = iframe;
@@ -36567,6 +36841,10 @@ UIImagePositionTab = __decorate([
         }
         (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(link, 'href', imageLink);
         (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(link, 'target', imageLinkOpenInNewTab ? '_blank' : null);
+        if (!imageLinkOpenInNewTab) {
+            const relParts = ((0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(link, 'rel') || '').split(/\s+/).filter((p)=>p && p !== 'noopener' && p !== 'noreferrer');
+            (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(link, 'rel', relParts.length ? relParts.join(' ') : null);
+        }
     } else {
         if (link && link.parentNode) {
             link.parentNode.replaceChild(image, link);
@@ -36671,10 +36949,11 @@ UIImagePositionTab = __decorate([
 /* harmony import */ var _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(22732);
 /* harmony import */ var _core_global_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(580);
 /* harmony import */ var _core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(21537);
-/* harmony import */ var _core_ui_icon_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(12153);
-/* harmony import */ var _config_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(6441);
-/* harmony import */ var _modules_widget_index_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(92762);
-/* harmony import */ var _image_svg_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(25179);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(29960);
+/* harmony import */ var _core_ui_icon_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(12153);
+/* harmony import */ var _config_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(6441);
+/* harmony import */ var _modules_widget_index_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(92762);
+/* harmony import */ var _image_svg_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(25179);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -36686,15 +36965,16 @@ UIImagePositionTab = __decorate([
 
 
 
-_core_ui_icon_js__WEBPACK_IMPORTED_MODULE_3__.Icon.set('image', _image_svg_js__WEBPACK_IMPORTED_MODULE_6__["default"]);
-_config_js__WEBPACK_IMPORTED_MODULE_4__.Config.prototype.controls.image = {
+
+_core_ui_icon_js__WEBPACK_IMPORTED_MODULE_4__.Icon.set('image', _image_svg_js__WEBPACK_IMPORTED_MODULE_7__["default"]);
+_config_js__WEBPACK_IMPORTED_MODULE_5__.Config.prototype.controls.image = {
     popup: (editor, current, close)=>{
         let sourceImage = null;
         if (current && !_core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isText(current) && _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isHTMLElement(current) && (_core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(current, 'img') || (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__.$$)('img', current).length)) {
             sourceImage = _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(current, 'img') ? current : (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_2__.$$)('img', current)[0];
         }
         editor.s.save();
-        return (0,_modules_widget_index_js__WEBPACK_IMPORTED_MODULE_5__.FileSelectorWidget)(editor, {
+        return (0,_modules_widget_index_js__WEBPACK_IMPORTED_MODULE_6__.FileSelectorWidget)(editor, {
             filebrowser: (data)=>{
                 editor.s.restore();
                 data.files && data.files.forEach((file)=>editor.s.insertImage(data.baseurl + file, null, editor.o.imageDefaultWidth));
@@ -36707,8 +36987,8 @@ _config_js__WEBPACK_IMPORTED_MODULE_4__.Config.prototype.controls.image = {
                     url = '//' + url;
                 }
                 const image = sourceImage || editor.createInside.element('img');
-                image.setAttribute('src', url);
-                image.setAttribute('alt', text);
+                (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__.attr)(image, 'src', url);
+                (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__.attr)(image, 'alt', text);
                 if (!sourceImage) {
                     await editor.s.insertImage(image, null, editor.o.imageDefaultWidth);
                 }
@@ -38344,7 +38624,7 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.link = {
         }
         if (jodit.s.isCollapsed()) {
             const a = jodit.createInside.element('a');
-            a.setAttribute('href', html);
+            (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(a, 'href', html);
             a.textContent = html;
             jodit.e.fire('applyLink', jodit, a, null);
             return a;
@@ -38404,7 +38684,7 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.link = {
                 target_checkbox.checked = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(link, 'target') === '_blank';
             }
             if (noFollowCheckbox && nofollow_checkbox) {
-                nofollow_checkbox.checked = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(link, 'rel') === 'nofollow';
+                nofollow_checkbox.checked = ((0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(link, 'rel') || '').split(/\s+/).includes('nofollow');
             }
             insert.textContent = i18n('Update');
         } else {
@@ -38470,7 +38750,14 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.link = {
                     (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(a, 'target', target_checkbox.checked ? '_blank' : null);
                 }
                 if (noFollowCheckbox && nofollow_checkbox) {
-                    (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(a, 'rel', nofollow_checkbox.checked ? 'nofollow' : null);
+                    const relParts = ((0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(a, 'rel') || '').split(/\s+/).filter(Boolean);
+                    const hasNofollow = relParts.includes('nofollow');
+                    if (nofollow_checkbox.checked && !hasNofollow) {
+                        relParts.push('nofollow');
+                    } else if (!nofollow_checkbox.checked && hasNofollow) {
+                        relParts.splice(relParts.indexOf('nofollow'), 1);
+                    }
+                    (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.attr)(a, 'rel', relParts.length ? relParts.join(' ') : null);
                 }
                 jodit.e.fire('applyLink', jodit, a, form);
             });
@@ -41080,8 +41367,8 @@ const keyBInd = '__jodit-resizer_binded';
             this.j.e.off(element, 'mousedown.select touchstart.select').on(element, 'mousedown.select touchstart.select', ()=>{
                 this.j.s.select(element);
             }).off(element, 'changesize').on(element, 'changesize', ()=>{
-                iframe.setAttribute('width', element.offsetWidth + 'px');
-                iframe.setAttribute('height', element.offsetHeight + 'px');
+                (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(iframe, 'width', element.offsetWidth + 'px');
+                (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.attr)(iframe, 'height', element.offsetHeight + 'px');
             });
         }
         this.j.e.on(element, 'dragstart', this.hide);
@@ -43130,8 +43417,9 @@ class AceEditor extends _sourceEditor_js__WEBPACK_IMPORTED_MODULE_2__.SourceEdit
 /* harmony export */   TextAreaEditor: function() { return /* binding */ TextAreaEditor; }
 /* harmony export */ });
 /* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
-/* harmony import */ var _core_helpers_utils_css_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(41180);
-/* harmony import */ var _sourceEditor_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(23370);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/* harmony import */ var _core_helpers_utils_css_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(41180);
+/* harmony import */ var _sourceEditor_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(23370);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -43139,7 +43427,8 @@ class AceEditor extends _sourceEditor_js__WEBPACK_IMPORTED_MODULE_2__.SourceEdit
  */ 
 
 
-class TextAreaEditor extends _sourceEditor_js__WEBPACK_IMPORTED_MODULE_2__.SourceEditor {
+
+class TextAreaEditor extends _sourceEditor_js__WEBPACK_IMPORTED_MODULE_3__.SourceEditor {
     init(editor) {
         this.instance = editor.c.element('textarea', {
             class: 'jodit-source__mirror',
@@ -43147,7 +43436,7 @@ class TextAreaEditor extends _sourceEditor_js__WEBPACK_IMPORTED_MODULE_2__.Sourc
         });
         this.container.appendChild(this.instance);
         editor.e.on(this.instance, 'mousedown keydown touchstart input', editor.async.debounce(this.toWYSIWYG, editor.defaultTimeout)).on('setMinHeight.source', (minHeightD)=>{
-            (0,_core_helpers_utils_css_js__WEBPACK_IMPORTED_MODULE_1__.css)(this.instance, 'minHeight', minHeightD);
+            (0,_core_helpers_utils_css_js__WEBPACK_IMPORTED_MODULE_2__.css)(this.instance, 'minHeight', minHeightD);
         }).on(this.instance, 'change keydown mousedown touchstart input', this.autosize).on('afterSetMode.source', this.autosize).on(this.instance, 'mousedown focus', (e)=>{
             editor.e.fire(e.type, e);
         });
@@ -43191,14 +43480,10 @@ class TextAreaEditor extends _sourceEditor_js__WEBPACK_IMPORTED_MODULE_2__.Sourc
         this.instance.blur();
     }
     setPlaceHolder(title) {
-        this.instance.setAttribute('placeholder', title);
+        (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(this.instance, 'placeholder', title);
     }
     setReadOnly(isReadOnly) {
-        if (isReadOnly) {
-            this.instance.setAttribute('readonly', 'true');
-        } else {
-            this.instance.removeAttribute('readonly');
-        }
+        (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(this.instance, 'readonly', isReadOnly ? 'true' : null);
     }
     selectAll() {
         this.instance.select();