jodit-pro 4.13.12 → 4.13.14

package/es2021/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.13.12
+ * Version: v4.13.14
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1767,7 +1767,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.13.12";
+ */ const APP_VERSION = "4.13.14";
 // prettier-ignore
 const ES = "es2021";
 const IS_ES_MODERN = true;
@@ -32744,6 +32744,42 @@ _core_ui_icon_js__WEBPACK_IMPORTED_MODULE_0__.Icon.set('eraser', _eraser_svg_js_
 
 
 
+
+/***/ }),
+
+/***/ 15908:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   isAllowedMediaEmbed: function() { return /* binding */ isAllowedMediaEmbed; }
+/* harmony export */ });
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ /**
+ * @module plugins/clean-html
+ */ // The embed URLs produced by the built-in Video button (see
+// `convertMediaUrlToVideoEmbed`): `//www.youtube.com/embed/<id>` and
+// `//player.vimeo.com/video/<id>`. `youtube-nocookie.com` is the privacy
+// variant YouTube offers for the same `/embed/` player. The `/embed/` and
+// `/video/` path prefixes are required so a bare provider link
+// (`youtube.com/@somebody`) is not treated as a player.
+const YOUTUBE_EMBED = /^(https?:)?\/\/(www\.|m\.|music\.)?youtube(-nocookie)?\.com\/embed\//i;
+const VIMEO_EMBED = /^(https?:)?\/\/player\.vimeo\.com\/video\//i;
+/**
+ * Whether an `<iframe>` `src` points at a recognized YouTube/Vimeo video
+ * player. Such iframes are inserted intentionally through the Video button, so
+ * clean-html must not strip them (`denyTags` includes `iframe` by default) or
+ * neutralize them with an empty `sandbox=""` (#1381). Arbitrary/bare iframes
+ * are still removed.
+ *
+ * @private
+ */ function isAllowedMediaEmbed(src) {
+    return YOUTUBE_EMBED.test(src) || VIMEO_EMBED.test(src);
+}
+
+
 /***/ }),
 
 /***/ 84272:
@@ -33203,12 +33239,14 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ });
 /* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2748);
 /* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(29960);
+/* harmony import */ var _is_allowed_media_embed_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(15908);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */ 
 
+
 /**
  * Add `sandbox=""` attribute to all `<iframe>` elements in the editor content
  * @private
@@ -33217,6 +33255,12 @@ __webpack_require__.r(__webpack_exports__);
         return hadEffect;
     }
     const elm = nodeElm;
+    // A trusted YouTube/Vimeo player (inserted via the Video button) must not
+    // get an empty `sandbox=""` — that blocks scripts and stops playback. It
+    // is served in its own third-party origin, so leave it as-is (#1381).
+    if ((0,_is_allowed_media_embed_js__WEBPACK_IMPORTED_MODULE_2__.isAllowedMediaEmbed)((0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'src') || '')) {
+        return hadEffect;
+    }
     if (!elm.hasAttribute('sandbox')) {
         (0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'sandbox', '');
         return true;
@@ -33346,6 +33390,8 @@ function filterStyleProperties(style, allowed) {
 /* harmony import */ var _core_constants_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(82758);
 /* harmony import */ var _core_dom_dom_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2748);
 /* harmony import */ var _core_helpers_string_trim_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(49055);
+/* harmony import */ var _core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(29960);
+/* harmony import */ var _is_allowed_media_embed_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(15908);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -33353,6 +33399,8 @@ function filterStyleProperties(style, allowed) {
  */ 
 
 
+
+
 /**
  * @private
  */ function tryRemoveNode(jodit, nodeElm, hadEffect, allowTags, denyTags, currentSelectionNode) {
@@ -33369,7 +33417,12 @@ function filterStyleProperties(style, allowed) {
         if (allow && !allow[node.nodeName]) {
             return true;
         }
-        if (!allow && deny && deny[node.nodeName]) {
+        // A YouTube/Vimeo player inserted through the Video button is trusted
+        // editor content, so keep it even though `iframe` is denied by default
+        // — otherwise the embed is stripped ~300ms after insertion (#1381).
+        // Arbitrary/bare iframes stay denied.
+        const isTrustedEmbed = node.nodeName === 'IFRAME' && (0,_is_allowed_media_embed_js__WEBPACK_IMPORTED_MODULE_4__.isAllowedMediaEmbed)((0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__.attr)(node, 'src') || '');
+        if (!allow && deny && deny[node.nodeName] && !isTrustedEmbed) {
             return true;
         }
     }
@@ -50407,6 +50460,17 @@ class autocomplete extends jodit_esm_core_plugin__WEBPACK_IMPORTED_MODULE_9__.Pl
         const query = range && (0,_helpers__WEBPACK_IMPORTED_MODULE_4__.getTextLeftOfCursor)(range).split(' ').pop();
         if (query && (0,jodit_esm_core_helpers__WEBPACK_IMPORTED_MODULE_8__.trim)(query).length) {
             const result = await this.onAutoComplete(query);
+            // The sources are async. While one was resolving the user may have
+            // deleted the word we searched for (or moved the caret elsewhere).
+            // In that case the anchor is gone and opening would position the
+            // popup at a stale/empty range — visually at the top of the editor.
+            // Bail instead of reopening.
+            if (!this.isQueryStillAnchored(query)) {
+                if (this.popup.isOpened) {
+                    this.popup.close();
+                }
+                return;
+            }
             if (result.length) {
                 return this.openPopup(result);
             }
@@ -50415,6 +50479,23 @@ class autocomplete extends jodit_esm_core_plugin__WEBPACK_IMPORTED_MODULE_9__.Pl
             this.popup.close();
         }
     }
+    /**
+	 * Whether the query we searched for is still anchored at the caret: the
+	 * selection is collapsed inside the editable, its start node is still in the
+	 * DOM, and the word left of the cursor still starts with `query`. Used to
+	 * discard stale async autocomplete responses (see `onKeyDown`).
+	 */ isQueryStillAnchored(query) {
+        const { s } = this.j;
+        if (!s.isInsideArea || !s.isCollapsed) {
+            return false;
+        }
+        const range = s.sel?.rangeCount ? s.sel.getRangeAt(0) : null;
+        if (!range || !range.startContainer.isConnected) {
+            return false;
+        }
+        const current = (0,_helpers__WEBPACK_IMPORTED_MODULE_4__.getTextLeftOfCursor)(range).split(' ').pop() ?? '';
+        return current.startsWith(query);
+    }
     onKeyControlDown(e) {
         if (this.popup.isOpened && autocomplete.isControlKey(e.key)) {
             switch(e.key){