jodit 4.10.2 → 4.11.2

package/types/plugins/clean-html/config.d.ts

@@ -41,13 +41,98 @@ declare module 'jodit/config' {
              */
             useIframeSandbox: boolean;
             /**
+             * @deprecated Use `removeEventAttributes` instead
              * Remove onError attributes
              */
             removeOnError: boolean;
+            /**
+             * Remove all `on*` event handler attributes (onerror, onclick, onload, onmouseover, etc.)
+             * When enabled, this replaces the legacy `removeOnError` behavior with comprehensive protection.
+             *
+             * ```javascript
+             * Jodit.make('#editor', {
+             * 	 cleanHTML: {
+             * 	 	 removeEventAttributes: true
+             * 	 }
+             * });
+             * ```
+             */
+            removeEventAttributes: boolean;
             /**
              * Safe href="javascript:" links
              */
             safeJavaScriptLink: boolean;
+            /**
+             * Automatically add `rel="noopener noreferrer"` to links with `target="_blank"`
+             *
+             * ```javascript
+             * Jodit.make('#editor', {
+             * 	 cleanHTML: {
+             * 	 	 safeLinksTarget: true
+             * 	 }
+             * });
+             * ```
+             */
+            safeLinksTarget: boolean;
+            /**
+             * Whitelist of allowed CSS properties inside `style` attributes.
+             * If set, all CSS properties not in the list will be removed.
+             *
+             * ```javascript
+             * Jodit.make('#editor', {
+             *     cleanHTML: {
+             *         allowedStyles: {
+             *             '*': ['color', 'background-color', 'font-size', 'text-align'],
+             *             img: ['width', 'height']
+             *         }
+             *     }
+             * });
+             * ```
+             */
+            allowedStyles: false | IDictionary<string[]>;
+            /**
+             * Custom sanitizer function. Called after Jodit's built-in sanitization.
+             * Use this to integrate DOMPurify or other external sanitizers.
+             *
+             * ```javascript
+             * import DOMPurify from 'dompurify';
+             *
+             * Jodit.make('#editor', {
+             *     cleanHTML: {
+             *         sanitizer: (html) => DOMPurify.sanitize(html)
+             *     }
+             * });
+             * ```
+             */
+            sanitizer: false | ((value: string) => string);
+            /**
+             * Automatically add `sandbox=""` attribute to all `<iframe>` elements in editor content.
+             * Prevents embedded content from running scripts or accessing the parent page.
+             *
+             * ```javascript
+             * Jodit.make('#editor', {
+             *     cleanHTML: {
+             *         sandboxIframesInContent: true
+             *     }
+             * });
+             * ```
+             */
+            sandboxIframesInContent: boolean;
+            /**
+             * Convert unsafe embed elements to sandboxed `<iframe>`.
+             * - `['object', 'embed']` — default
+             * - `false` — disabled
+             * - `string[]` — custom list of tag names to convert
+             *
+             * ```javascript
+             * Jodit.make('#editor', {
+             *     cleanHTML: {
+             *         convertUnsafeEmbeds: Jodit.atom(['object', 'embed', 'applet'])
+             *     }
+             * });
+             * ```
+             */
+            convertUnsafeEmbeds: false | string[];
             /**
              * The allowTags option defines which elements will remain in the
              * edited text when the editor saves. You can use this limit the returned HTML.

package/types/plugins/clean-html/helpers/visitor/filters/convert-unsafe-embeds.d.ts

@@ -0,0 +1,14 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module plugins/clean-html
+ */
+import type { IJodit } from "../../../../../types/index";
+/**
+ * Convert `<object>` and `<embed>` elements to safer `<iframe>` elements.
+ * @private
+ */
+export declare function convertUnsafeEmbeds(jodit: IJodit, nodeElm: Node, hadEffect: boolean): boolean;

package/types/plugins/clean-html/helpers/visitor/filters/index.d.ts

@@ -10,9 +10,13 @@
  * @private
  */
 export * from "./allow-attributes";
+export * from "./convert-unsafe-embeds";
 export * from "./fill-empty-paragraph";
 export * from "./remove-empty-text-node";
 export * from "./remove-inv-text-nodes";
 export * from "./replace-old-tags";
+export * from "./safe-links-target";
+export * from "./sandbox-iframes-in-content";
 export * from "./sanitize-attributes";
+export * from "./sanitize-styles";
 export * from "./try-remove-node";

package/types/plugins/clean-html/helpers/visitor/filters/safe-links-target.d.ts

@@ -0,0 +1,14 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module plugins/clean-html
+ */
+import type { IJodit } from "../../../../../types/index";
+/**
+ * Automatically add `rel="noopener noreferrer"` to links with `target="_blank"`
+ * @private
+ */
+export declare function safeLinksTarget(jodit: IJodit, nodeElm: Node, hadEffect: boolean): boolean;

package/types/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.d.ts

@@ -0,0 +1,14 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module plugins/clean-html
+ */
+import type { IJodit } from "../../../../../types/index";
+/**
+ * Add `sandbox=""` attribute to all `<iframe>` elements in the editor content
+ * @private
+ */
+export declare function sandboxIframesInContent(jodit: IJodit, nodeElm: Node, hadEffect: boolean): boolean;

package/types/plugins/clean-html/helpers/visitor/filters/sanitize-styles.d.ts

@@ -0,0 +1,14 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module plugins/clean-html
+ */
+import type { IJodit } from "../../../../../types/index";
+/**
+ * Filter CSS properties in style attributes based on allowedStyles whitelist
+ * @private
+ */
+export declare function sanitizeStyles(jodit: IJodit, nodeElm: Node, hadEffect: boolean): boolean;