jodit-pro 4.13.3 → 4.13.4

package/es2021/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.13.3
+ * Version: v4.13.4
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -297,6 +297,19 @@ let ConfigPrototype = {};
          * editor.value = '<p>start</p>';
          * ```
          */ this.shadowRoot = null;
+        /**
+         * CSP nonce applied to every `<style>`, `<script>` and `<link>` element
+         * Jodit injects at runtime (plugin styles, CDN scripts for ACE/beautify,
+         * downloaded stylesheets). Set it to the same nonce your server puts in the
+         * `Content-Security-Policy` header so a strict `style-src`/`script-src`
+         * policy does not block the editor.
+         *
+         * ```js
+         * Jodit.make('#editor', {
+         * 	nonce: 'r4nd0m'
+         * });
+         * ```
+         */ this.nonce = '';
         /**
          * Base CSS `z-index` for the editor UI (toolbar, popups, dialogs).
          * Set to a higher value when other page elements overlap the editor.
@@ -1754,7 +1767,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.13.3";
+ */ const APP_VERSION = "4.13.4";
 // prettier-ignore
 const ES = "es2021";
 const IS_ES_MODERN = true;
@@ -4633,6 +4646,10 @@ const boxes = new WeakMap();
         const box = c.element(tag, {
             className: `jodit jodit-${(0,_helpers_string_kebab_case_js__WEBPACK_IMPORTED_MODULE_3__.kebabCase)(name)}-container jodit-box`
         });
+        // Let a strict CSP accept the injected <style>/<script> box
+        if (view.o.nonce && (tag === 'style' || tag === 'script')) {
+            box.setAttribute('nonce', view.o.nonce);
+        }
         box.classList.add(`jodit_theme_${view.o.theme || 'default'}`);
         body.appendChild(box);
         data[key] = box;
@@ -7406,6 +7423,9 @@ const cacheLoaders = (loader)=>{
             async: true,
             src: (0,_complete_url_js__WEBPACK_IMPORTED_MODULE_1__.completeUrl)(url)
         });
+        if (jodit.o.nonce) {
+            script.setAttribute('nonce', jodit.o.nonce);
+        }
         jodit.e.one(script, 'error', reject).one(script, 'load', resolve);
         jodit.od.body.appendChild(script);
     });
@@ -7421,6 +7441,9 @@ const cacheLoaders = (loader)=>{
         link.rel = 'stylesheet';
         link.media = 'all';
         link.crossOrigin = 'anonymous';
+        if (jodit.o.nonce) {
+            link.setAttribute('nonce', jodit.o.nonce);
+        }
         const callback = ()=>resolve(link);
         !jodit.isInDestruct && jodit.e.on(link, 'load', callback).on(link, 'error', reject);
         link.href = (0,_complete_url_js__WEBPACK_IMPORTED_MODULE_1__.completeUrl)(url);
@@ -40383,6 +40406,7 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.link = {
     followOnDblClick: false,
     processVideoLink: true,
     processPastedLink: true,
+    deriveUrlFromText: false,
     noFollowCheckbox: true,
     openInNewTabCheckbox: true,
     openInNewTabCheckboxDefaultChecked: false,
@@ -40596,6 +40620,9 @@ _config_js__WEBPACK_IMPORTED_MODULE_2__.Config.prototype.controls.link = {
             insert.textContent = i18n('Update');
         } else {
             _core_dom_index_js__WEBPACK_IMPORTED_MODULE_1__.Dom.hide(unlink);
+            if (jodit.o.link.deriveUrlFromText && url_input && !isImageContent && !url_input.value.trim()) {
+                url_input.value = guessUrlFromText(content_input.value);
+            }
             if (openInNewTabCheckbox && target_checkbox) {
                 target_checkbox.checked = openInNewTabCheckboxDefaultChecked;
             }
@@ -40723,6 +40750,29 @@ __decorate([
     _core_decorators_index_js__WEBPACK_IMPORTED_MODULE_0__.autobind
 ], link.prototype, "__onClickReadOnlyLink", null);
 _core_global_js__WEBPACK_IMPORTED_MODULE_2__.pluginSystem.add('link', link);
+/**
+ * Guess a usable `href` from the selected text for the link dialog.
+ * Returns an empty string when the text is not a plausible URL/email,
+ * so plain text (e.g. "click here") is left untouched.
+ */ function guessUrlFromText(text) {
+    const value = text.trim();
+    if (!value || /\s/.test(value)) {
+        return '';
+    }
+    // already an explicit scheme, an anchor or a relative path
+    if (/^(https?:|mailto:|tel:|ftp:|#|\/|\.{1,2}\/)/i.test(value)) {
+        return value;
+    }
+    // email address -> mailto:
+    if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
+        return `mailto:${value}`;
+    }
+    // bare domain like example.com or www.example.com/path -> https://
+    if (/^[a-z0-9-]+(\.[a-z0-9-]+)+(\/\S*)?$/i.test(value)) {
+        return `https://${value}`;
+    }
+    return '';
+}
 function writeClasses(modeClassName, className_input, className_select, a) {
     var _a;
     if (modeClassName && (className_input !== null && className_input !== void 0 ? className_input : className_select)) {