jodit-pro 4.13.18 → 4.13.19

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.13.18
+ * Version: v4.13.19
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1838,7 +1838,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.13.18";
+ */ const APP_VERSION = "4.13.19";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -29622,7 +29622,8 @@ let ToolbarButton = class ToolbarButton extends _core_ui_button_index_js__WEBPAC
         button.classList.remove(cn);
         button.classList.add(cn + '__button');
         Object.defineProperty(button, 'component', {
-            value: this
+            value: this,
+            configurable: true
         });
         container.appendChild(button);
         const trigger = this.j.c.fromHTML(`<span role="button" aria-haspopup="true" aria-expanded="false" class="${cn}__trigger">${_core_ui_icon_js__WEBPACK_IMPORTED_MODULE_18__.Icon.get('chevron')}</span>`);
@@ -34665,15 +34666,22 @@ function filterStyleProperties(style, allowed) {
  * @private
  */ function isRemovableNode(jodit, node, current, allow, deny) {
     if (!_core_dom_dom_js__WEBPACK_IMPORTED_MODULE_1__.Dom.isText(node)) {
-        if (allow && !allow[node.nodeName]) {
+        // The allow/deny hashes are keyed by upper-cased tag name. HTML
+        // `nodeName` is already upper-case, but foreign (SVG/MathML) elements
+        // keep their original case — an SVG `<script>` reports `"script"`, so a
+        // case-sensitive lookup let it slip past `denyTags` and execute. Normalise
+        // to upper case so namespace can't bypass the filter. See
+        // GHSA-45qg-252v-3f7p.
+        const name = node.nodeName.toUpperCase();
+        if (allow && !allow[name]) {
             return true;
         }
         // A YouTube/Vimeo player inserted through the Video button is trusted
         // editor content, so keep it even though `iframe` is denied by default
         // — otherwise the embed is stripped ~300ms after insertion (#1381).
         // Arbitrary/bare iframes stay denied.
-        const isTrustedEmbed = node.nodeName === 'IFRAME' && (0,_is_allowed_media_embed_js__WEBPACK_IMPORTED_MODULE_4__.isAllowedMediaEmbed)((0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__.attr)(node, 'src') || '');
-        if (!allow && deny && deny[node.nodeName] && !isTrustedEmbed) {
+        const isTrustedEmbed = name === 'IFRAME' && (0,_is_allowed_media_embed_js__WEBPACK_IMPORTED_MODULE_4__.isAllowedMediaEmbed)((0,_core_helpers_utils_attr_js__WEBPACK_IMPORTED_MODULE_3__.attr)(node, 'src') || '');
+        if (!allow && deny && deny[name] && !isTrustedEmbed) {
             return true;
         }
     }