jodit-pro 4.12.8 → 4.12.10

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.12.8
+ * Version: v4.12.10
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1797,7 +1797,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.12.8";
+ */ const APP_VERSION = "4.12.10";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -39426,13 +39426,14 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.popup = {
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */ 
+const isSafeHref = (href)=>/^(https?:|mailto:|tel:)/i.test(href.trim()) && !/^(javascript:|data:|vbscript:)/i.test(href.trim());
 /* harmony default export */ __webpack_exports__["default"] = ([
     {
         name: 'eye',
         tooltip: 'Open link',
         exec: (editor, current)=>{
             const href = (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_0__.attr)(current, 'href');
-            if (current && href) {
+            if (current && href && isSafeHref(href)) {
                 editor.ow.open(href);
             }
         }
@@ -46691,6 +46692,9 @@ const SpeechRecognition = _core_constants_js__WEBPACK_IMPORTED_MODULE_0__.global
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */ function execSpellCommand(jodit, commandSentence) {
     const [command, value] = commandSentence.split('::');
+    if (command.toLowerCase() === 'open' && value && /^(javascript:|data:|vbscript:)/i.test(value.trim())) {
+        return;
+    }
     jodit.execCommand(command, null, value);
 }