jodit-pro 4.16.4 → 4.17.1

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.16.4
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -1791,7 +1791,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.16.4";
+ */ const APP_VERSION = "4.17.1";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -6154,7 +6154,7 @@ function isSmuggledForeignHtml(elm) {
     }
     return /^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName);
 }
-function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
+function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError, removeEventAttributes } = {
     safeJavaScriptLink: true,
     removeOnError: true
 }) {
@@ -6162,6 +6162,13 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
         return false;
     }
     let effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -37904,7 +37911,11 @@ _core_global_js__WEBPACK_IMPORTED_MODULE_2__.pluginSystem.add('dragAndDropElemen
             window,
             this.j.ed,
             this.j.editor
-        ], 'dragstart.DragAndDrop', this.onDragStart);
+        ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+        // from another window or application never produces one here, and
+        // the browser then inserted its HTML natively, unsanitized. Routed
+        // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+        .on('drop.DragAndDrop', this.onDrop);
     }
     onDragStart(event) {
         let target = event.target;
@@ -37932,10 +37943,10 @@ _core_global_js__WEBPACK_IMPORTED_MODULE_2__.pluginSystem.add('dragAndDropElemen
         this.addDragListeners();
     }
     addDragListeners() {
-        this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+        this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     removeDragListeners() {
-        this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+        this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     onDrag(event) {
         if (this.draggable) {
@@ -37997,7 +38008,12 @@ _core_global_js__WEBPACK_IMPORTED_MODULE_2__.pluginSystem.add('dragAndDropElemen
                 fragment = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.dataBind)(this.draggable, 'target');
             }
         } else if (this.getText(event)) {
-            fragment = this.j.createInside.fromHTML(this.getText(event));
+            // Dropped markup takes the same sanitizing pass as pasted and
+            // assigned content. See GHSA-jhhp-r3r7-v2cg
+            const box = this.j.createInside.div();
+            box.innerHTML = this.getText(event);
+            this.j.e.fire('safeHTML', box);
+            fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
         }
         return fragment;
     }