npm - jodit-pro - Versions diffs - 4.12.36 → 4.12.38 - Mend

jodit-pro 4.12.36 → 4.12.38

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (303) hide show

package/es2015/jodit.js CHANGED Viewed

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1805,7 +1805,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.12.36";
+ */ const APP_VERSION = "4.12.38";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -5649,11 +5649,22 @@ function normalizeCSS(s) {
  * it applies them to the selectors in the HTML itself
  * and then removes the selector styles, leaving only the inline ones.
  */ function applyStyles(html) {
-    if (html.indexOf('<html ') === -1) {
+    // Match the opening <html> tag whether or not it carries attributes. MS
+    // Word emits `<html xmlns:o=…>` (note the trailing space), but Excel/Calc
+    // wrap the copied table in a bare `<html>`. The old `'<html '` check missed
+    // the bare tag, so for Excel clipboards the `<style>` rules (class-based
+    // cell backgrounds/borders, e.g. `.xl31 { background:#FCE4D6 }`) were never
+    // inlined and all styling was lost once the `<style>` block got stripped.
+    // See https://github.com/xdan/jodit/issues/1362
+    const openMatch = /<html(?:\s[^>]*)?>/i.exec(html);
+    if (!openMatch) {
         return html;
     }
-    html = html.substring(html.indexOf('<html '), html.length);
-    html = html.substring(0, html.lastIndexOf('</html>') + '</html>'.length);
+    html = html.substring(openMatch.index);
+    const closeIndex = html.toLowerCase().lastIndexOf('</html>');
+    if (closeIndex !== -1) {
+        html = html.substring(0, closeIndex + '</html>'.length);
+    }
     const iframe = _constants_js__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('iframe');
     iframe.style.display = 'none';
     _constants_js__WEBPACK_IMPORTED_MODULE_0__.globalDocument.body.appendChild(iframe);
@@ -6045,8 +6056,16 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
     }
+    const tagName = elm.nodeName.toLowerCase();
     const href = elm.getAttribute('href');
-    if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
+    // Neutralize executable-scheme `href`s with the same normalization used for
+    // every other URL attribute (`isDangerousUrl`), which strips control bytes,
+    // tabs and newlines and lowercases before matching the scheme. The previous
+    // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
+    // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
+    // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
+    // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
+    if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
@@ -6057,7 +6076,6 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
             effected = true;
         }
         // Strip executable schemes from any other URL-bearing attribute.
-        const tagName = elm.nodeName.toLowerCase();
         for (const name of URL_ATTRIBUTES){
             const value = elm.getAttribute(name);
             if (value && isDangerousUrl(value, tagName)) {