jodit-pro 4.12.37 → 4.12.38

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.37
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1805,7 +1805,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.12.37";
+ */ const APP_VERSION = "4.12.38";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -6056,8 +6056,16 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
     }
+    const tagName = elm.nodeName.toLowerCase();
     const href = elm.getAttribute('href');
-    if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
+    // Neutralize executable-scheme `href`s with the same normalization used for
+    // every other URL attribute (`isDangerousUrl`), which strips control bytes,
+    // tabs and newlines and lowercases before matching the scheme. The previous
+    // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
+    // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
+    // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
+    // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
+    if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
@@ -6068,7 +6076,6 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
             effected = true;
         }
         // Strip executable schemes from any other URL-bearing attribute.
-        const tagName = elm.nodeName.toLowerCase();
         for (const name of URL_ATTRIBUTES){
             const value = elm.getAttribute(name);
             if (value && isDangerousUrl(value, tagName)) {