npm - jodit-pro - Versions diffs - 4.12.36 → 4.12.38 - Mend

jodit-pro 4.12.36 → 4.12.38

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (303) hide show

package/es5/jodit.js CHANGED Viewed

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -2266,7 +2266,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
 }
-var APP_VERSION = "4.12.36";
+var APP_VERSION = "4.12.38";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7371,11 +7371,22 @@ function normalizeCSS(s) {
  * it applies them to the selectors in the HTML itself
  * and then removes the selector styles, leaving only the inline ones.
  */ function applyStyles(html) {
-    if (html.indexOf('<html ') === -1) {
+    // Match the opening <html> tag whether or not it carries attributes. MS
+    // Word emits `<html xmlns:o=…>` (note the trailing space), but Excel/Calc
+    // wrap the copied table in a bare `<html>`. The old `'<html '` check missed
+    // the bare tag, so for Excel clipboards the `<style>` rules (class-based
+    // cell backgrounds/borders, e.g. `.xl31 { background:#FCE4D6 }`) were never
+    // inlined and all styling was lost once the `<style>` block got stripped.
+    // See https://github.com/xdan/jodit/issues/1362
+    var openMatch = /<html(?:\s[^>]*)?>/i.exec(html);
+    if (!openMatch) {
         return html;
     }
-    html = html.substring(html.indexOf('<html '), html.length);
-    html = html.substring(0, html.lastIndexOf('</html>') + '</html>'.length);
+    html = html.substring(openMatch.index);
+    var closeIndex = html.toLowerCase().lastIndexOf('</html>');
+    if (closeIndex !== -1) {
+        html = html.substring(0, closeIndex + '</html>'.length);
+    }
     var iframe = _constants_js__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('iframe');
     iframe.style.display = 'none';
     _constants_js__WEBPACK_IMPORTED_MODULE_0__.globalDocument.body.appendChild(iframe);
@@ -7787,8 +7798,16 @@ function sanitizeHTMLElement(elm) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
     }
+    var tagName = elm.nodeName.toLowerCase();
     var href = elm.getAttribute('href');
-    if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
+    // Neutralize executable-scheme `href`s with the same normalization used for
+    // every other URL attribute (`isDangerousUrl`), which strips control bytes,
+    // tabs and newlines and lowercases before matching the scheme. The previous
+    // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
+    // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
+    // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
+    // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
+    if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
@@ -7798,10 +7817,9 @@ function sanitizeHTMLElement(elm) {
             (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'srcdoc', null);
             effected = true;
         }
-        // Strip executable schemes from any other URL-bearing attribute.
-        var tagName = elm.nodeName.toLowerCase();
         var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
         try {
+            // Strip executable schemes from any other URL-bearing attribute.
             for(var _iterator = URL_ATTRIBUTES[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var name = _step.value;
                 var value = elm.getAttribute(name);

package/es5/jodit.min.css CHANGED Viewed

@@ -1,14 +1,14 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
 	/*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */