jodit 4.10.2 → 4.11.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -0
- package/es2015/jodit.css +1 -1
- package/es2015/jodit.fat.min.js +121 -121
- package/es2015/jodit.js +36183 -35886
- package/es2015/jodit.min.js +121 -121
- package/es2015/plugins/debug/debug.css +1 -1
- package/es2015/plugins/debug/debug.js +1 -1
- package/es2015/plugins/debug/debug.min.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.js +724 -724
- package/es2015/plugins/speech-recognize/speech-recognize.min.js +2 -2
- package/es2018/jodit.fat.min.js +121 -121
- package/es2018/jodit.min.js +121 -121
- package/es2018/plugins/debug/debug.min.js +1 -1
- package/es2018/plugins/speech-recognize/speech-recognize.min.js +2 -2
- package/es2021/jodit.css +1 -1
- package/es2021/jodit.fat.min.js +135 -135
- package/es2021/jodit.js +35482 -35186
- package/es2021/jodit.min.js +135 -135
- package/es2021/plugins/debug/debug.css +1 -1
- package/es2021/plugins/debug/debug.js +1 -1
- package/es2021/plugins/debug/debug.min.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.js +681 -681
- package/es2021/plugins/speech-recognize/speech-recognize.min.js +2 -2
- package/es2021.en/jodit.css +1 -1
- package/es2021.en/jodit.fat.min.js +151 -151
- package/es2021.en/jodit.js +34392 -34096
- package/es2021.en/jodit.min.js +135 -135
- package/es2021.en/plugins/debug/debug.css +1 -1
- package/es2021.en/plugins/debug/debug.js +1 -1
- package/es2021.en/plugins/debug/debug.min.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.js +306 -306
- package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +2 -2
- package/es5/jodit.css +2 -2
- package/es5/jodit.fat.min.js +2 -2
- package/es5/jodit.js +44054 -43700
- package/es5/jodit.min.css +2 -2
- package/es5/jodit.min.js +2 -2
- package/es5/plugins/debug/debug.css +1 -1
- package/es5/plugins/debug/debug.js +1 -1
- package/es5/plugins/debug/debug.min.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.js +839 -839
- package/es5/plugins/speech-recognize/speech-recognize.min.js +2 -2
- package/es5/polyfills.fat.min.js +2 -2
- package/es5/polyfills.js +4211 -4211
- package/es5/polyfills.min.js +2 -2
- package/esm/config.d.ts +85 -0
- package/esm/core/constants.js +1 -1
- package/esm/core/dom/dom.d.ts +1 -0
- package/esm/core/helpers/html/safe-html.d.ts +3 -2
- package/esm/core/helpers/html/safe-html.js +42 -3
- package/esm/plugins/clean-html/clean-html.js +4 -0
- package/esm/plugins/clean-html/config.d.ts +85 -0
- package/esm/plugins/clean-html/config.js +7 -1
- package/esm/plugins/clean-html/helpers/visitor/filters/convert-unsafe-embeds.d.ts +14 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/convert-unsafe-embeds.js +37 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/index.d.ts +4 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/index.js +4 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/safe-links-target.d.ts +14 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/safe-links-target.js +38 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.d.ts +14 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.js +24 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/sanitize-attributes.js +10 -5
- package/esm/plugins/clean-html/helpers/visitor/filters/sanitize-styles.d.ts +14 -0
- package/esm/plugins/clean-html/helpers/visitor/filters/sanitize-styles.js +70 -0
- package/esm/plugins/drag-and-drop/drag-and-drop.js +1 -1
- package/esm/plugins/enter/helpers/insert-paragraph.js +2 -1
- package/esm/plugins/file/file.js +3 -2
- package/esm/plugins/iframe/iframe.js +8 -6
- package/esm/plugins/image/image.js +3 -2
- package/esm/plugins/image-properties/writers/link.js +6 -0
- package/esm/plugins/link/link.js +15 -3
- package/esm/plugins/resizer/resizer.js +2 -2
- package/esm/plugins/source/editor/engines/area.js +3 -7
- package/package.json +1 -1
- package/types/config.d.ts +85 -0
- package/types/core/dom/dom.d.ts +1 -0
- package/types/core/helpers/html/safe-html.d.ts +3 -2
- package/types/plugins/clean-html/config.d.ts +85 -0
- package/types/plugins/clean-html/helpers/visitor/filters/convert-unsafe-embeds.d.ts +14 -0
- package/types/plugins/clean-html/helpers/visitor/filters/index.d.ts +4 -0
- package/types/plugins/clean-html/helpers/visitor/filters/safe-links-target.d.ts +14 -0
- package/types/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.d.ts +14 -0
- package/types/plugins/clean-html/helpers/visitor/filters/sanitize-styles.d.ts +14 -0
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,34 @@
|
|
|
9
9
|
> - :house: [Internal]
|
|
10
10
|
> - :nail_care: [Polish]
|
|
11
11
|
|
|
12
|
+
## 4.11.2
|
|
13
|
+
|
|
14
|
+
#### :boom: Breaking Change
|
|
15
|
+
|
|
16
|
+
- `cleanHTML.denyTags` default changed from `'script'` to `'script,iframe,object,embed'` — iframes, objects, and embeds are now blocked by default
|
|
17
|
+
- `cleanHTML.removeOnError` is deprecated in favor of `cleanHTML.removeEventAttributes` — all `on*` event handler attributes (`onerror`, `onclick`, `onload`, `onmouseover`, etc.) are now removed by default, not just `onerror`
|
|
18
|
+
- `cleanHTML.safeLinksTarget` is now `true` by default — links with `target="_blank"` automatically get `rel="noopener noreferrer"`
|
|
19
|
+
- `cleanHTML.sandboxIframesInContent` is now `true` by default — all `<iframe>` elements in editor content get `sandbox=""` attribute
|
|
20
|
+
- `cleanHTML.convertUnsafeEmbeds` is now `['object', 'embed']` by default — listed elements are converted to sandboxed `<iframe>`
|
|
21
|
+
|
|
22
|
+
#### :house: Internal
|
|
23
|
+
|
|
24
|
+
- Add Statoscope for webpack bundle size analysis and build comparison
|
|
25
|
+
- refactor: replace setAttribute and removeAttribute with attr helper in multiple files
|
|
26
|
+
|
|
27
|
+
#### :rocket: New Feature
|
|
28
|
+
|
|
29
|
+
- New option `cleanHTML.removeEventAttributes` — removes all `on*` event handler attributes for comprehensive XSS protection (onerror, onclick, onload, onmouseover, onfocus, etc.)
|
|
30
|
+
- New option `cleanHTML.safeLinksTarget` — automatically adds `rel="noopener noreferrer"` to `target="_blank"` links to prevent `window.opener` attacks
|
|
31
|
+
- New option `cleanHTML.allowedStyles` — whitelist of allowed CSS properties in `style` attributes, prevents CSS injection attacks (e.g. data exfiltration via `background-image: url(...)`)
|
|
32
|
+
- New option `cleanHTML.sanitizer` — hook for external sanitizer integration (e.g. DOMPurify). Called before Jodit's built-in sanitization
|
|
33
|
+
- New option `cleanHTML.sandboxIframesInContent` — adds `sandbox=""` to all `<iframe>` in editor content
|
|
34
|
+
- New option `cleanHTML.convertUnsafeEmbeds` (`false | string[]`) — converts listed tags to sandboxed `<iframe>`, customizable list
|
|
35
|
+
|
|
36
|
+
#### :memo: Documentation
|
|
37
|
+
|
|
38
|
+
- New comprehensive security guide: `docs/security.md` covering XSS protection, CSP, Trusted Types, HTML Sanitizer API, server-side sanitization, and hardened configuration examples
|
|
39
|
+
|
|
12
40
|
## 4.10.1
|
|
13
41
|
|
|
14
42
|
#### :boom: Breaking Change
|
package/es2015/jodit.css
CHANGED