jodit-pro 4.16.4 → 4.17.1

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.16.4
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -2308,7 +2308,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
 }
-var APP_VERSION = "4.16.4";
+var APP_VERSION = "4.17.1";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7891,11 +7891,18 @@ function sanitizeHTMLElement(elm) {
     var _ref = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {
         safeJavaScriptLink: true,
         removeOnError: true
-    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError;
+    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError, removeEventAttributes = _ref.removeEventAttributes;
     if (!_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(elm)) {
         return false;
     }
     var effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -50693,7 +50700,11 @@ function _wrap_native_super(Class) {
                     window,
                     this.j.ed,
                     this.j.editor
-                ], 'dragstart.DragAndDrop', this.onDragStart);
+                ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+                // from another window or application never produces one here, and
+                // the browser then inserted its HTML natively, unsanitized. Routed
+                // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+                .on('drop.DragAndDrop', this.onDrop);
             }
         },
         {
@@ -50729,13 +50740,13 @@ function _wrap_native_super(Class) {
         {
             key: "addDragListeners",
             value: function addDragListeners() {
-                this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
             key: "removeDragListeners",
             value: function removeDragListeners() {
-                this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
@@ -50809,7 +50820,12 @@ function _wrap_native_super(Class) {
                         fragment = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.dataBind)(this.draggable, 'target');
                     }
                 } else if (this.getText(event)) {
-                    fragment = this.j.createInside.fromHTML(this.getText(event));
+                    // Dropped markup takes the same sanitizing pass as pasted and
+                    // assigned content. See GHSA-jhhp-r3r7-v2cg
+                    var box = this.j.createInside.div();
+                    box.innerHTML = this.getText(event);
+                    this.j.e.fire('safeHTML', box);
+                    fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
                 }
                 return fragment;
             }

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.16.4
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
 	/*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.16.4
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */