jodit-pro 4.12.23 → 4.12.24

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.23
+ * Version: v4.12.24
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -2258,7 +2258,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
 }
-var APP_VERSION = "4.12.23";
+var APP_VERSION = "4.12.24";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7370,6 +7370,16 @@ function normalizeCSS(s) {
             iframeDoc.open();
             iframeDoc.write(html);
             iframeDoc.close();
+            // Word marks its auto-generated list markers (the literal
+            // bullet/number, e.g. `1.` or `·`) with `mso-list:Ignore`.
+            // They are display-only and must not be imported, otherwise
+            // the marker text leaks into the content. Drop them before any
+            // style normalization strips the `mso-list` hint. See #948
+            _dom_dom_js__WEBPACK_IMPORTED_MODULE_1__.Dom.each(iframeDoc.body, function(node) {
+                if (_dom_dom_js__WEBPACK_IMPORTED_MODULE_1__.Dom.isElement(node) && /mso-list:\s*ignore/i.test(node.getAttribute('style') || '')) {
+                    _dom_dom_js__WEBPACK_IMPORTED_MODULE_1__.Dom.safeRemove(node);
+                }
+            });
             try {
                 var _loop = function(i) {
                     var _loop = function(idx) {
@@ -7468,6 +7478,15 @@ function normalizeCSS(s) {
                                 _dom_dom_js__WEBPACK_IMPORTED_MODULE_1__.Dom.unwrap(node);
                                 break;
                             default:
+                                // Word marks its auto-generated list markers
+                                // (the literal bullet/number, e.g. `1.` or `·`)
+                                // with `mso-list:Ignore`. They are display-only
+                                // and must not be imported, otherwise the marker
+                                // text leaks into the content. See #948
+                                if (/mso-list:\s*ignore/i.test(node.getAttribute('style') || '')) {
+                                    marks.push(node);
+                                    break;
+                                }
                                 (0,_array_to_array_js__WEBPACK_IMPORTED_MODULE_2__.toArray)(node.attributes).forEach(function(attr) {
                                     if ([
                                         'src',
@@ -7605,26 +7624,20 @@ function normalizeCSS(s) {
         return;
     }
     var removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
-    if (removeEvents) {
-        removeAllEventAttributes(box);
-        (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('*', box).forEach(function(elm) {
-            return removeAllEventAttributes(elm);
-        });
-    } else if (options.removeOnError) {
-        sanitizeHTMLElement(box, options);
-        (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('[onerror]', box).forEach(function(elm) {
-            return sanitizeHTMLElement(elm, options);
-        });
-    }
-    if (options.safeJavaScriptLink) {
-        sanitizeHTMLElement(box, options);
-        (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('a[href^="javascript"]', box).forEach(function(elm) {
-            return sanitizeHTMLElement(elm, options);
-        });
-    }
-    if (options.safeLinksTarget) {
-        (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.$$)('a[target="_blank"]', box).forEach(function(elm) {
-            var rel = elm.getAttribute('rel') || '';
+    // Single synchronous traversal of the subtree. Besides removing event
+    // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises
+    // executable `iframe[srcdoc]`, `data:text/html` / SVG `data:` document
+    // sources and dangerous schemes in every URL-bearing attribute.
+    var process = function process(node) {
+        if (!_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(node)) {
+            return;
+        }
+        if (removeEvents) {
+            removeAllEventAttributes(node);
+        }
+        sanitizeHTMLElement(node, options);
+        if (options.safeLinksTarget && node.nodeName === 'A' && node.getAttribute('target') === '_blank') {
+            var rel = node.getAttribute('rel') || '';
             var parts = rel.split(/\s+/).filter(Boolean);
             if (!parts.includes('noopener')) {
                 parts.push('noopener');
@@ -7632,9 +7645,11 @@ function normalizeCSS(s) {
             if (!parts.includes('noreferrer')) {
                 parts.push('noreferrer');
             }
-            (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'rel', parts.join(' '));
-        });
-    }
+            (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(node, 'rel', parts.join(' '));
+        }
+    };
+    process(box);
+    _dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.each(box, process);
 }
 /**
  * Remove all on* event handler attributes from an element
@@ -7672,6 +7687,41 @@ function normalizeCSS(s) {
     }
     return effected;
 }
+/**
+ * URL-bearing attributes (besides `href`) that can load or execute content.
+ */ var URL_ATTRIBUTES = [
+    'src',
+    'data',
+    'action',
+    'formaction',
+    'poster',
+    'background',
+    'xlink:href'
+];
+/**
+ * Tags that load their URL as a *document* (scripts inside run). An SVG data
+ * URL is only an XSS vector here — as an `<img>` source it renders inertly.
+ */ var DOCUMENT_EMBED_TAGS = new Set([
+    'iframe',
+    'frame',
+    'object',
+    'embed'
+]);
+/**
+ * Detects executable / script-bearing URL schemes. The attribute value is
+ * already HTML-entity-decoded by `getAttribute`, so only whitespace and
+ * control characters (which browsers ignore inside a scheme) need stripping.
+ */ function isDangerousUrl(value, tagName) {
+    // eslint-disable-next-line no-control-regex
+    var normalized = value.replace(/[\u0000-\u0020]+/g, '').toLowerCase();
+    if (/^(?:javascript|vbscript|livescript|mocha):/.test(normalized)) {
+        return true;
+    }
+    if (/^data:(?:text\/html|application\/xhtml)/.test(normalized)) {
+        return true;
+    }
+    return /^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName);
+}
 function sanitizeHTMLElement(elm) {
     var _ref = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {
         safeJavaScriptLink: true,
@@ -7690,6 +7740,39 @@ function sanitizeHTMLElement(elm) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
+    if (safeJavaScriptLink) {
+        // `srcdoc` runs its content as a full HTML document — drop it entirely.
+        if (elm.hasAttribute('srcdoc')) {
+            (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'srcdoc', null);
+            effected = true;
+        }
+        // Strip executable schemes from any other URL-bearing attribute.
+        var tagName = elm.nodeName.toLowerCase();
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = URL_ATTRIBUTES[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var name = _step.value;
+                var value = elm.getAttribute(name);
+                if (value && isDangerousUrl(value, tagName)) {
+                    (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, name, null);
+                    effected = true;
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+    }
     return effected;
 }
 
@@ -7738,7 +7821,7 @@ var ALONE_TAGS = new Set([
 /**
  * Extract plain text from HTML text
  */ function stripTags(html) {
-    var doc = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : document, exclude = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : null;
+    var doc = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : document, exclude = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : null, blockBr = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : false;
     var tmp = doc.createElement('div');
     if ((0,_checker_is_string_js__WEBPACK_IMPORTED_MODULE_1__.isString)(html)) {
         tmp.innerHTML = html;
@@ -7752,7 +7835,7 @@ var ALONE_TAGS = new Set([
         }
         if (exclude && _dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(p, exclude)) {
             var tag = p.nodeName.toLowerCase();
-            var text = !_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(p, ALONE_TAGS) ? "%%%jodit-".concat(tag, "%%%").concat(stripTags(p.innerHTML, doc, exclude), "%%%/jodit-").concat(tag, "%%%") : "%%%jodit-single-".concat(tag, "%%%");
+            var text = !_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(p, ALONE_TAGS) ? "%%%jodit-".concat(tag, "%%%").concat(stripTags(p.innerHTML, doc, exclude, blockBr), "%%%/jodit-").concat(tag, "%%%") : "%%%jodit-single-".concat(tag, "%%%");
             _dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.before(p, doc.createTextNode(text));
             _dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.safeRemove(p);
             return;
@@ -7769,7 +7852,11 @@ var ALONE_TAGS = new Set([
             return;
         }
         if (nx) {
-            pr.insertBefore(doc.createTextNode(' '), nx);
+            // By default blocks are joined with a single space (single-line
+            // plain text). When `blockBr` is set, separate them with a line
+            // break instead, so paragraph structure survives — e.g. the
+            // "Insert only Text" paste option. See #1232
+            pr.insertBefore(doc.createTextNode(blockBr ? '%%%jodit-single-br%%%' : ' '), nx);
         }
     });
     return restoreTags((0,_string_trim_js__WEBPACK_IMPORTED_MODULE_2__.trim)(tmp.innerText));
@@ -9635,7 +9722,6 @@ function ConfigDeepFlatten(obj) {
         return url;
     }
     var parser = _constants_js__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('a');
-    var pattern1 = /(?:http?s?:\/\/)?(?:www\.)?(?:vimeo\.com)\/?(.+)/g;
     parser.href = url;
     if (!width) {
         width = 400;
@@ -9647,19 +9733,43 @@ function ConfigDeepFlatten(obj) {
     switch(parser.hostname){
         case 'www.vimeo.com':
         case 'vimeo.com':
-            return pattern1.test(url) ? url.replace(pattern1, '<iframe width="' + width + '" height="' + height + '" src="' + protocol + '//player.vimeo.com/video/$1" frameborder="0" allowfullscreen></iframe>') : url;
+            {
+                // The numeric video id can be preceded by `channels/<name>/` or
+                // `groups/<name>/videos/` and followed by tracking params (e.g.
+                // `?share=copy`). Unlisted videos keep a hash right after the id
+                // (`vimeo.com/<id>/<hash>`). Extract the id (+ hash) from the path
+                // so all of those forms produce a valid embed. See #1209
+                var segments = parser.pathname.split('/').filter(Boolean);
+                var idIndex = segments.findIndex(function(s) {
+                    return /^\d+$/.test(s);
+                });
+                if (idIndex === -1) {
+                    return url;
+                }
+                var path = segments[idIndex];
+                var hash = segments[idIndex + 1];
+                if (hash && idIndex === 0) {
+                    path += '/' + hash;
+                }
+                return '<iframe width="' + width + '" height="' + height + '" src="' + protocol + '//player.vimeo.com/video/' + path + '" frameborder="0" allowfullscreen></iframe>';
+            }
         case 'youtube.com':
         case 'www.youtube.com':
+        case 'm.youtube.com':
+        case 'music.youtube.com':
         case 'youtu.be':
         case 'www.youtu.be':
             {
-                var query = parser.search ? (0,_parse_query_js__WEBPACK_IMPORTED_MODULE_2__.parseQuery)(parser.search) : {
-                    v: parser.pathname.substring(1)
-                };
-                if (/^embed\/.*/.test(query.v)) {
-                    query.v = query.v.substring(6);
-                }
-                return query.v ? '<iframe width="' + width + '" height="' + height + '" src="' + protocol + '//www.youtube.com/embed/' + query.v + '" frameborder="0" allowfullscreen></iframe>' : url;
+                var query = parser.search ? (0,_parse_query_js__WEBPACK_IMPORTED_MODULE_2__.parseQuery)(parser.search) : {};
+                // `youtube.com/watch` keeps the video id in the `v` query
+                // parameter, while the short `youtu.be/<id>` links and the
+                // `/embed/`, `/shorts/`, `/live/` paths keep it in the pathname.
+                // Modern share urls add tracking params (e.g. `?si=`, `?t=`), so
+                // the pathname must still be used as a fallback when there is no
+                // `v`. See #1209
+                var v = query.v || parser.pathname.substring(1);
+                v = v.replace(/^(watch|embed|shorts|live|v)\//, '').replace(/\/$/, '');
+                return v ? '<iframe width="' + width + '" height="' + height + '" src="' + protocol + '//www.youtube.com/embed/' + v + '" frameborder="0" allowfullscreen></iframe>' : url;
             }
     }
     return url;
@@ -25846,6 +25956,23 @@ var Jodit = Jodit_1 = /*#__PURE__*/ function(ViewWithToolbar) {
                         }
                         _this.synchronizeValues();
                     }
+                }).on(this.ow, 'mouseup', function(event) {
+                    if (_this.o.readonly || _this.__isSilentChange) {
+                        return;
+                    }
+                    // When a selection is started inside the editor and the
+                    // mouse button is released outside of it, the editable
+                    // area never receives the `mouseup` event, so the toolbar
+                    // state (active buttons) is not recalculated. Re-fire the
+                    // event manually for that case while the selection still
+                    // belongs to the editor. See #1251
+                    var target = event.target;
+                    var insideEditor = Boolean(target && (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.isNumber)(target.nodeType) && editor.contains(target));
+                    if (insideEditor || !_this.s.isInsideArea) {
+                        return;
+                    }
+                    _this.e.fire('changeSelection');
+                    _this.synchronizeValues();
                 });
             }
         },
@@ -40819,9 +40946,14 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.uploader = {
     insertImageAsBase64URI: false,
     imagesExtensions: [
         'jpg',
-        'png',
         'jpeg',
-        'gif'
+        'png',
+        'gif',
+        'webp',
+        'bmp',
+        'svg',
+        'tiff',
+        'avif'
     ],
     headers: null,
     data: null,
@@ -46592,8 +46724,9 @@ _config_js__WEBPACK_IMPORTED_MODULE_3__.Config.prototype.controls.brush = {
         var update = function update(key, value) {
             if (value && value !== (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.css)(editor.editor, key).toString()) {
                 button.state.icon.fill = value;
-                return;
+                return true;
             }
+            return false;
         };
         if (color) {
             var mode = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.dataBind)(button, 'color');
@@ -46603,8 +46736,16 @@ _config_js__WEBPACK_IMPORTED_MODULE_3__.Config.prototype.controls.brush = {
         var current = editor.s.current();
         if (current && !button.state.disabled) {
             var currentBpx = _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(current, _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement, editor.editor) || editor.editor;
-            update('color', (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.css)(currentBpx, 'color').toString());
-            update('background-color', (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.css)(currentBpx, 'background-color').toString());
+            // The icon's fill mirrors the current text/background color so the
+            // button reflects the formatting under the caret. Both calls run so
+            // that a background color (the second call) wins over the text color
+            // when both are set. Keep the computed fill instead of resetting it
+            // below. See #195, #182
+            var hasColor = update('color', (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.css)(currentBpx, 'color').toString());
+            var hasBackground = update('background-color', (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_1__.css)(currentBpx, 'background-color').toString());
+            if (hasColor || hasBackground) {
+                return;
+            }
         }
         button.state.icon.fill = '';
         button.state.activated = false;
@@ -50097,7 +50238,8 @@ _config_js__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.commandToHotkeys = {
         'cmd+shift+7'
     ],
     insertUnorderedList: [
-        'ctrl+shift+8, cmd+shift+8'
+        'ctrl+shift+8',
+        'cmd+shift+8'
     ],
     selectall: [
         'ctrl+a',
@@ -54299,14 +54441,31 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.indent = {
 };
 _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.outdent = {
     isDisabled: function isDisabled(editor) {
+        var _a;
         var current = editor.s.current();
-        if (current) {
-            var currentBox = _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(current, _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isBlock, editor.editor);
-            if (currentBox) {
-                var arrow = (0,_helpers_js__WEBPACK_IMPORTED_MODULE_5__.getKey)(editor.o.direction, currentBox);
-                return !currentBox.style[arrow] || parseInt(currentBox.style[arrow], 10) <= 0;
+        if (!current) {
+            return true;
+        }
+        // A list item whose list is nested inside another list item can be
+        // outdented (un-nested) by the `tab` plugin, even without an inline
+        // indent margin. Keep the button enabled in that case. See #1247
+        if ((_a = editor.o.tab) === null || _a === void 0 ? void 0 : _a.tabInsideLiInsertNewList) {
+            var li = _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(current, 'li', editor.editor);
+            if (li) {
+                var list = _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(li, [
+                    'ul',
+                    'ol'
+                ], editor.editor);
+                if (list && _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(list, 'li', editor.editor)) {
+                    return false;
+                }
             }
         }
+        var currentBox = _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.closest(current, _core_dom_index_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isBlock, editor.editor);
+        if (currentBox) {
+            var arrow = (0,_helpers_js__WEBPACK_IMPORTED_MODULE_5__.getKey)(editor.o.direction, currentBox);
+            return !currentBox.style[arrow] || parseInt(currentBox.style[arrow], 10) <= 0;
+        }
         return true;
     },
     tooltip: 'Decrease Indent'
@@ -58256,7 +58415,7 @@ var pasteFromWord = /*#__PURE__*/ function(Plugin) {
                         }
                     case _core_constants_js__WEBPACK_IMPORTED_MODULE_0__.INSERT_ONLY_TEXT:
                         {
-                            html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.stripTags)((0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.cleanFromWord)(html));
+                            html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.stripTags)((0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_3__.cleanFromWord)(html), this.j.ed, new Set(this.j.o.pasteExcludeStripTags), this.j.o.nl2brInPlainText);
                             break;
                         }
                 }
@@ -59364,10 +59523,15 @@ function _is_native_reflect_construct() {
                             html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.cleanFromWord)(html);
                             break;
                         case _core_constants_js__WEBPACK_IMPORTED_MODULE_0__.INSERT_ONLY_TEXT:
-                            html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.stripTags)(html, this.j.ed, new Set(this.j.o.pasteExcludeStripTags));
+                            html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.stripTags)(html, this.j.ed, new Set(this.j.o.pasteExcludeStripTags), this.j.o.nl2brInPlainText);
                             break;
                         case _core_constants_js__WEBPACK_IMPORTED_MODULE_0__.INSERT_AS_TEXT:
                             html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.htmlspecialchars)(html);
+                            // Keep the source line breaks instead of letting the raw
+                            // newlines collapse into spaces when rendered. See #1093
+                            if (this.j.o.nl2brInPlainText) {
+                                html = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.nl2br)(html);
+                            }
                             break;
                         default:
                             {

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.23
+ * Version: v4.12.24
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
 	/*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.23
+ * Version: v4.12.24
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */