jodit-pro 4.14.7 → 4.14.8

package/es2021/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.14.7
+ * Version: v4.14.8
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1723,7 +1723,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.14.7";
+ */ const APP_VERSION = "4.14.8";
 // prettier-ignore
 const ES = "es2021";
 const IS_ES_MODERN = true;
@@ -38437,6 +38437,25 @@ _config_js__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                 }
                 return html;
             };
+            /**
+             * Replace the whole iframe document with the given HTML.
+             *
+             * The markup is parsed in an inert document first (no browsing
+             * context: scripts do not run, sub-resources are not fetched),
+             * sanitized there via `safeHTML`, and only then moved into the
+             * live document. `document.write` on the live document would
+             * execute inline scripts and event handlers while parsing,
+             * before the sanitizer had a chance to strip them, and the
+             * iframe is same-origin with the host page by default.
+             * A `<script>` the cleaner is configured to keep still never
+             * executes: nodes coming from an inert parser are flagged
+             * "already started", exactly like `innerHTML`.
+             * See GHSA-w3xv-x3fm-59ph.
+             */ const replaceDocument = (html)=>{
+                const inert = new DOMParser().parseFromString(html, 'text/html');
+                editor.e.fire('safeHTML', inert.documentElement);
+                doc.replaceChild(doc.adoptNode(inert.documentElement), doc.documentElement);
+            };
             if (docMode) {
                 const tag = editor.element.tagName;
                 if (tag !== 'TEXTAREA' && tag !== 'INPUT') {
@@ -38449,19 +38468,20 @@ _config_js__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                     if (/<(html|body)/i.test(value)) {
                         const old = doc.documentElement.outerHTML;
                         if (clearMarkers(old) !== clearMarkers(value)) {
-                            doc.open();
-                            doc.write(editor.o.iframeDoctype + clearMarkers(value));
-                            doc.close();
+                            replaceDocument(clearMarkers(value));
                             editor.editor = doc.body;
-                            editor.e.fire('safeHTML', editor.editor);
                             toggleEditable();
                             editor.e.fire('prepareWYSIWYGEditor');
                             editor.e.stopPropagation('beforeSetNativeEditorValue');
                         }
-                    } else {
-                        doc.body.innerHTML = value;
+                        return true;
                     }
-                    return true;
+                    // A partial value goes through the regular
+                    // path: `clean-html` sanitizes it and the
+                    // editor assigns it to `doc.body` via
+                    // `innerHTML`. Writing the raw value here
+                    // would fire its event handlers first.
+                    return false;
                 }, {
                     top: true
                 });