jodit-pro 4.12.32 → 4.12.34

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.32
+ * Version: v4.12.34
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -2266,7 +2266,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
 }
-var APP_VERSION = "4.12.32";
+var APP_VERSION = "4.12.34";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7632,6 +7632,34 @@ function normalizeCSS(s) {
  * @module helpers/html
  */ 
 
+var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+/**
+ * Integration points where HTML is legitimately allowed inside MathML/SVG foreign content.
+ */ var HTML_INTEGRATION_POINTS = new Set([
+    'foreignobject',
+    'annotation-xml',
+    'desc',
+    'title'
+]);
+/**
+ * True for an HTML element the parser placed inside MathML/SVG outside an integration point - smuggled
+ * HTML (e.g. `mglyph` / `style` under `<math>`) that a reparse can hoist into a live node. Legitimate
+ * MathML/SVG children and HTML below an integration point are kept.
+ */ function isSmuggledForeignHtml(elm) {
+    if (elm.namespaceURI !== HTML_NAMESPACE || elm.closest('math,svg') == null) {
+        return false;
+    }
+    for(var parent = elm.parentElement; parent; parent = parent.parentElement){
+        var name = parent.nodeName.toLowerCase();
+        if (name === 'math' || name === 'svg') {
+            break;
+        }
+        if (HTML_INTEGRATION_POINTS.has(name)) {
+            return false;
+        }
+    }
+    return true;
+}
 /**
  * Removes dangerous constructs from HTML
  */ function safeHTML(box, options) {
@@ -7639,6 +7667,14 @@ function normalizeCSS(s) {
     if (!_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(box) && !_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isFragment(box)) {
         return;
     }
+    // Drop HTML smuggled into MathML/SVG before the walk: a reparse would otherwise hoist its hidden
+    // markup into a live node.
+    var foreign = box.querySelectorAll('math *, svg *');
+    for(var i = 0; i < foreign.length; i++){
+        if (foreign[i].isConnected && isSmuggledForeignHtml(foreign[i])) {
+            _dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.safeRemove(foreign[i]);
+        }
+    }
     var removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
     // Single synchronous traversal of the subtree. Besides removing event
     // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.32
+ * Version: v4.12.34
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
 	/*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.32
+ * Version: v4.12.34
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */