jodit-pro 4.17.0 → 4.17.2

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
@@ -2308,7 +2308,7 @@ function _unsupported_iterable_to_array(o, minLen) {
     if (n === "Map" || n === "Set") return Array.from(n);
     if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
 }
-var APP_VERSION = "4.17.0";
+var APP_VERSION = "4.17.2";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7891,11 +7891,18 @@ function sanitizeHTMLElement(elm) {
     var _ref = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {
         safeJavaScriptLink: true,
         removeOnError: true
-    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError;
+    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError, removeEventAttributes = _ref.removeEventAttributes;
     if (!_dom_dom_js__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(elm)) {
         return false;
     }
     var effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,_utils_index_js__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -13538,20 +13545,86 @@ function _ts_generator(thisArg, body) {
 }();
 
 
+/***/ }),
+
+/***/ 79505:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   composedRanges: function() { return /* binding */ composedRanges; }
+/* harmony export */ });
+/* harmony import */ var _helpers_checker_index_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(27613);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ 
+function isInside(node, shadowRoot) {
+    return node === shadowRoot || shadowRoot.contains(node);
+}
+function usable(ranges, shadowRoot) {
+    return Array.isArray(ranges) && ranges.length > 0 && ranges.every(function(range) {
+        return isInside(range.startContainer, shadowRoot);
+    });
+}
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */ function composedRanges(selection, shadowRoot) {
+    var getComposedRanges = selection.getComposedRanges;
+    if (!(0,_helpers_checker_index_js__WEBPACK_IMPORTED_MODULE_0__.isFunction)(getComposedRanges)) {
+        return null;
+    }
+    for(var _i = 0, _iter = [
+        [
+            {
+                shadowRoots: [
+                    shadowRoot
+                ]
+            }
+        ],
+        [
+            shadowRoot
+        ]
+    ]; _i < _iter.length; _i++){
+        var args = _iter[_i];
+        var ranges = void 0;
+        try {
+            ranges = getComposedRanges.apply(selection, args);
+        } catch (_a) {
+            continue;
+        }
+        if (usable(ranges, shadowRoot)) {
+            return ranges;
+        }
+    }
+    return null;
+}
+
+
 /***/ }),
 
 /***/ 45124:
 /***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   composedRanges: function() { return /* reexport safe */ _composed_ranges_js__WEBPACK_IMPORTED_MODULE_2__.composedRanges; },
 /* harmony export */   cursorInTheEdgeOfString: function() { return /* binding */ cursorInTheEdgeOfString; },
 /* harmony export */   findCorrectCurrentNode: function() { return /* binding */ findCorrectCurrentNode; },
-/* harmony export */   moveNodeInsideStart: function() { return /* reexport safe */ _move_node_inside_start_js__WEBPACK_IMPORTED_MODULE_2__.moveNodeInsideStart; }
+/* harmony export */   moveNodeInsideStart: function() { return /* reexport safe */ _move_node_inside_start_js__WEBPACK_IMPORTED_MODULE_3__.moveNodeInsideStart; }
 /* harmony export */ });
 /* harmony import */ var _constants_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(82758);
 /* harmony import */ var _dom_dom_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2748);
-/* harmony import */ var _move_node_inside_start_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(26716);
-/* harmony import */ var _move_the_node_along_the_edge_outward_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(43463);
+/* harmony import */ var _composed_ranges_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(79505);
+/* harmony import */ var _move_node_inside_start_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(26716);
+/* harmony import */ var _move_the_node_along_the_edge_outward_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(43463);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -13562,6 +13635,7 @@ function _ts_generator(thisArg, body) {
 
 
 
+
 /**
  * Despite the name, returns `true` when the cursor is NOT at the checked edge
  * of the text node: there is significant (non invisible-space) text between
@@ -13995,12 +14069,100 @@ var Selection = /*#__PURE__*/ function() {
             get: /**
      * Return current selection object
      */ function get() {
-                if (this.j.o.shadowRoot && (0,_helpers_checker_index_js__WEBPACK_IMPORTED_MODULE_4__.isFunction)(this.j.o.shadowRoot.getSelection)) {
-                    return this.j.o.shadowRoot.getSelection();
+                var shadowRoot = this.j.o.shadowRoot;
+                if (shadowRoot) {
+                    if ((0,_helpers_checker_index_js__WEBPACK_IMPORTED_MODULE_4__.isFunction)(shadowRoot.getSelection)) {
+                        return shadowRoot.getSelection();
+                    }
+                    var composed = this.__composedSelection(shadowRoot);
+                    if (composed) {
+                        return composed;
+                    }
                 }
                 return this.win.getSelection();
             }
         },
+        {
+            /**
+     * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+     *
+     * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+     * implemented, and `window.getSelection()` stops at the shadow boundary: for
+     * a caret inside the shadow tree it reports the host, or the document
+     * itself. Everything downstream then works on the wrong tree, which is why
+     * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+     * the editor lived in a shadow root in Safari.
+     *
+     * The standard replacement is `Selection.getComposedRanges()`, which does
+     * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+     * the editor mutates ranges constantly, so they are turned into live ones.
+     *
+     * Reads are answered from those ranges; everything else, including the
+     * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+     * real selection, which does accept nodes inside a shadow tree. Reading is
+     * the only side the browser blocks.
+     *
+     * @returns `null` when the browser offers neither API, so the caller falls
+     * back to the plain window selection.
+     */ key: "__composedSelection",
+            value: function __composedSelection(shadowRoot) {
+                var _this = this;
+                var selection = this.win.getSelection();
+                if (!selection) {
+                    return null;
+                }
+                // Firefox has no `ShadowRoot.getSelection` either, but its window
+                // selection does see into a shadow tree. Where the plain selection
+                // already points at the right node there is nothing to work around, and
+                // taking it over would change behaviour that works today.
+                var anchorNode = selection.anchorNode;
+                if (anchorNode && _dom_dom_js__WEBPACK_IMPORTED_MODULE_2__.Dom.isOrContains(shadowRoot, anchorNode)) {
+                    return null;
+                }
+                var ranges = (0,_helpers_index_js__WEBPACK_IMPORTED_MODULE_9__.composedRanges)(selection, shadowRoot);
+                if (!ranges) {
+                    return null;
+                }
+                var live = ranges.map(function(staticRange) {
+                    var range = _this.createRange();
+                    range.setStart(staticRange.startContainer, staticRange.startOffset);
+                    range.setEnd(staticRange.endContainer, staticRange.endOffset);
+                    return range;
+                });
+                var first = live[0];
+                var overrides = {
+                    rangeCount: live.length,
+                    getRangeAt: function getRangeAt(index) {
+                        return live[index];
+                    },
+                    isCollapsed: live.every(function(range) {
+                        return range.collapsed;
+                    }),
+                    // Without these the editor asks the window selection where the
+                    // caret is, is told "outside the editable area", and resets the
+                    // caret to the start of it — which is the focus loss that shows up
+                    // right after a successful Backspace.
+                    anchorNode: first ? first.startContainer : null,
+                    anchorOffset: first ? first.startOffset : 0,
+                    focusNode: first ? first.endContainer : null,
+                    focusOffset: first ? first.endOffset : 0,
+                    toString: function toString() {
+                        return live.map(function(range) {
+                            return range.toString();
+                        }).join('');
+                    }
+                };
+                return new Proxy(selection, {
+                    get: function get(target, property) {
+                        if ((0,_helpers_checker_index_js__WEBPACK_IMPORTED_MODULE_4__.isString)(property) && property in overrides) {
+                            return overrides[property];
+                        }
+                        var value = Reflect.get(target, property, target);
+                        return (0,_helpers_checker_index_js__WEBPACK_IMPORTED_MODULE_4__.isFunction)(value) ? value.bind(target) : value;
+                    }
+                });
+            }
+        },
         {
             key: "range",
             get: /**
@@ -50693,7 +50855,11 @@ function _wrap_native_super(Class) {
                     window,
                     this.j.ed,
                     this.j.editor
-                ], 'dragstart.DragAndDrop', this.onDragStart);
+                ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+                // from another window or application never produces one here, and
+                // the browser then inserted its HTML natively, unsanitized. Routed
+                // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+                .on('drop.DragAndDrop', this.onDrop);
             }
         },
         {
@@ -50729,13 +50895,13 @@ function _wrap_native_super(Class) {
         {
             key: "addDragListeners",
             value: function addDragListeners() {
-                this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
             key: "removeDragListeners",
             value: function removeDragListeners() {
-                this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
@@ -50809,7 +50975,12 @@ function _wrap_native_super(Class) {
                         fragment = (0,_core_helpers_index_js__WEBPACK_IMPORTED_MODULE_4__.dataBind)(this.draggable, 'target');
                     }
                 } else if (this.getText(event)) {
-                    fragment = this.j.createInside.fromHTML(this.getText(event));
+                    // Dropped markup takes the same sanitizing pass as pasted and
+                    // assigned content. See GHSA-jhhp-r3r7-v2cg
+                    var box = this.j.createInside.div();
+                    box.innerHTML = this.getText(event);
+                    this.j.e.fire('safeHTML', box);
+                    fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
                 }
                 return fragment;
             }

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */
 	/*!
  * jodit-pro - PRO Version of Jodit Editor
  * Author: Chupurnov Valerii <chupurnov@gmail.com>
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/pro/
  * License(s): SEE LICENSE IN LICENSE.md
  */