jodit 4.12.16 → 4.12.18

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.16
+ * Version: v4.12.18
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.12.16";
+export const APP_VERSION = "4.12.18";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/utils/config-proto.js

@@ -10,6 +10,15 @@ import { isVoid } from "../checker/is-void.js";
 import { Config } from "../../../config.js";
 import { isAtom } from "./extend.js";
 import { keys } from "./utils.js";
+/**
+ * Keys that must never be copied from a (potentially untrusted) config object —
+ * assigning them during a recursive merge can reach and mutate
+ * `Object.prototype` (prototype pollution, CWE-1321).
+ */
+const UNSAFE_PROTO_KEYS = ['__proto__', 'constructor', 'prototype'];
+function isUnsafeProtoKey(key) {
+    return UNSAFE_PROTO_KEYS.indexOf(key) !== -1;
+}
 /**
  * @example
  * ```js
@@ -59,6 +68,9 @@ export function ConfigProto(options, proto, deep = 0) {
     }
     const newOpt = {};
     Object.keys(options).forEach(key => {
+        if (isUnsafeProtoKey(key)) {
+            return;
+        }
         const opt = options[key], protoKey = proto ? proto[key] : null;
         if (isPlainObject(opt) && isPlainObject(protoKey) && !isAtom(opt)) {
             newOpt[key] = ConfigProto(opt, protoKey, deep + 1);
@@ -119,6 +131,9 @@ export function ConfigFlatten(obj) {
  */
 export function ConfigMerge(target, source) {
     Object.keys(source).forEach(key => {
+        if (isUnsafeProtoKey(key)) {
+            return;
+        }
         const srcVal = source[key];
         const tgtVal = target[key];
         if (isPlainObject(srcVal) && isPlainObject(tgtVal) && !isAtom(srcVal)) {

package/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js

@@ -31,9 +31,16 @@ function isRemovableNode(jodit, node, current, allow, deny) {
     if (!jodit.o.cleanHTML.removeEmptyElements) {
         return false;
     }
+    // Never drop an empty inline element that currently holds the caret — it is
+    // a pending-format marker the user is about to type into (#1291). `current`
+    // is captured before a click moves the caret, so also check the live caret.
+    const liveCaret = jodit.s.isCollapsed()
+        ? jodit.s.range.startContainer
+        : null;
     return (Dom.isElement(node) &&
         node.nodeName.match(IS_INLINE) != null &&
         !Dom.isTemporary(node) &&
         trimInv(node.innerHTML).length === 0 &&
-        (current == null || !Dom.isOrContains(node, current)));
+        (current == null || !Dom.isOrContains(node, current)) &&
+        (liveCaret == null || !Dom.isOrContains(node, liveCaret)));
 }

package/esm/plugins/drag-and-drop-element/drag-and-drop-element.d.ts

@@ -21,10 +21,31 @@ export declare class dragAndDropElement extends Plugin {
     private state;
     /** @override */
     protected afterInit(): void;
+    /**
+     * Start dragging a specific element programmatically.
+     *
+     * Allows a separate UI element (for example a drag handle/anchor shown next
+     * to a block) to initiate the drag without the user pressing directly on the
+     * draggable element itself.
+     *
+     * @example
+     * ```js
+     * handle.addEventListener('mousedown', e => {
+     * 	editor.e.fire('startDragElement', preBlock, e);
+     * });
+     * ```
+     */
+    private onStartDragElement;
     /**
      * Drag start handler
      */
     private onDragStart;
+    /**
+     * Prepare the ghost element and switch to the waiting state.
+     * Shared by the native mousedown handler and the programmatic
+     * `startDragElement` event handler.
+     */
+    private startDragging;
     /**
      * Mouse move handler handler
      */

package/esm/plugins/drag-and-drop-element/drag-and-drop-element.js

@@ -49,11 +49,34 @@ export class dragAndDropElement extends Plugin {
                 .filter(Boolean)
                 .map(item => item.toLowerCase())
             : [];
+        // Allow another plugin (e.g. a drag handle/anchor) to start dragging
+        // an element programmatically, regardless of the `draggableTags` list.
+        this.j.e.on('startDragElement', this.onStartDragElement);
         if (!this.dragList.length) {
             return;
         }
         this.j.e.on('mousedown dragstart', this.onDragStart);
     }
+    /**
+     * Start dragging a specific element programmatically.
+     *
+     * Allows a separate UI element (for example a drag handle/anchor shown next
+     * to a block) to initiate the drag without the user pressing directly on the
+     * draggable element itself.
+     *
+     * @example
+     * ```js
+     * handle.addEventListener('mousedown', e => {
+     * 	editor.e.fire('startDragElement', preBlock, e);
+     * });
+     * ```
+     */
+    onStartDragElement(element, event) {
+        if (this.isInDestruct || this.state > DragState.IDLE || !element) {
+            return;
+        }
+        this.startDragging(element, event);
+    }
     /**
      * Drag start handler
      */
@@ -79,11 +102,19 @@ export class dragAndDropElement extends Plugin {
             lastTarget.parentElement.lastChild === lastTarget) {
             lastTarget = lastTarget.parentElement;
         }
+        this.startDragging(lastTarget, event);
+    }
+    /**
+     * Prepare the ghost element and switch to the waiting state.
+     * Shared by the native mousedown handler and the programmatic
+     * `startDragElement` event handler.
+     */
+    startDragging(target, event) {
         this.startX = event.clientX;
         this.startY = event.clientY;
         this.isCopyMode = ctrlKey(event); // we can move only element from editor
-        this.draggable = lastTarget.cloneNode(true);
-        dataBind(this.draggable, 'target', lastTarget);
+        this.draggable = target.cloneNode(true);
+        dataBind(this.draggable, 'target', target);
         this.state = DragState.WAIT_DRAGGING;
         this.addDragListeners();
     }
@@ -157,6 +188,15 @@ export class dragAndDropElement extends Plugin {
         }
         const { parentElement } = fragment;
         this.j.s.insertNode(fragment, true, false);
+        // Dropping a non-editable block (e.g. a `<pre>` code sample) can leave an
+        // invisible filler text node beside it. Remove it so the drop does not
+        // introduce a stray empty line (which clean-html would otherwise strip
+        // later, causing a flash).
+        [fragment.previousSibling, fragment.nextSibling].forEach(node => {
+            if (Dom.isEmptyTextNode(node)) {
+                Dom.safeRemove(node);
+            }
+        });
         if (parentElement &&
             Dom.isEmpty(parentElement) &&
             !Dom.isCell(parentElement)) {
@@ -188,10 +228,15 @@ export class dragAndDropElement extends Plugin {
     /** @override */
     beforeDestruct() {
         this.onDragEnd();
-        this.j.e.off('mousedown dragstart', this.onDragStart);
+        this.j.e
+            .off('mousedown dragstart', this.onDragStart)
+            .off('startDragElement', this.onStartDragElement);
         this.removeDragListeners();
     }
 }
+__decorate([
+    autobind
+], dragAndDropElement.prototype, "onStartDragElement", null);
 __decorate([
     autobind
 ], dragAndDropElement.prototype, "onDragStart", null);

package/esm/plugins/enter/enter.js

@@ -45,12 +45,17 @@ export class enter extends Plugin {
             if (beforeEnter !== undefined) {
                 return beforeEnter;
             }
-            if (!editor.s.isCollapsed()) {
-                editor.execCommand('Delete');
-            }
-            editor.s.focus();
-            this.onEnter(event);
-            editor.e.fire('afterEnter', event);
+            // Delete-of-selection + new block must be a single history step,
+            // otherwise pressing Enter over a selection needs two Ctrl+Z to undo
+            // (the first only reverts to the intermediate empty state). #1292
+            editor.history.snapshot.transaction(() => {
+                if (!editor.s.isCollapsed()) {
+                    editor.execCommand('Delete');
+                }
+                editor.s.focus();
+                this.onEnter(event);
+                editor.e.fire('afterEnter', event);
+            });
             editor.synchronizeValues(); // fire change
             return false;
         }

package/esm/plugins/select/select.d.ts

@@ -33,6 +33,20 @@ export declare class select extends Plugin {
     protected onOutsideClick(e: MouseEvent): void;
     protected beforeCommandCut(): void | false;
     protected beforeCommandSelectAll(): false;
+    /**
+     * Fix caret position when clicking to the right of a list item that has a
+     * nested list. Blink/WebKit place the caret at the start of the line instead
+     * of the end (#1296); move it to the end of the item's own text.
+     */
+    protected onClickRightOfNestedListItem(e: MouseEvent): void;
+    /**
+     * Keep pending inline formatting after a click. Toggling Bold/Italic/etc. on
+     * a collapsed cursor leaves empty marker elements with the caret inside; a
+     * click puts the caret right before them (outside), so they get cleaned up
+     * and the formatting is lost. Move the caret back into the innermost marker
+     * so the next typed character keeps every pending format (#1291).
+     */
+    protected onClickKeepPendingFormat(): void;
     /**
      * Normalize selection after triple click
      */

package/esm/plugins/select/select.js

@@ -13,6 +13,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
                 r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+import { IS_INLINE } from "../../core/constants.js";
 import { autobind, watch } from "../../core/decorators/index.js";
 import { Dom } from "../../core/dom/dom.js";
 import { pluginSystem } from "../../core/global.js";
@@ -92,6 +93,68 @@ export class select extends Plugin {
         s.expandSelection();
         return false;
     }
+    /**
+     * Fix caret position when clicking to the right of a list item that has a
+     * nested list. Blink/WebKit place the caret at the start of the line instead
+     * of the end (#1296); move it to the end of the item's own text.
+     */
+    onClickRightOfNestedListItem(e) {
+        const { s } = this.j;
+        const range = s.range;
+        if (!range.collapsed ||
+            range.startOffset !== 0 ||
+            !Dom.isText(range.startContainer)) {
+            return;
+        }
+        const text = range.startContainer;
+        const li = text.parentNode;
+        // The text must be the direct content of a list item that has a nested
+        // list (the last level has no nested list and behaves correctly).
+        if (!Dom.isTag(li, 'li') ||
+            !(li.querySelector('ul') || li.querySelector('ol'))) {
+            return;
+        }
+        const measure = this.j.ed.createRange();
+        measure.selectNodeContents(text);
+        const rect = measure.getBoundingClientRect();
+        // Only when the click happened to the right of the text.
+        if (e.clientX > rect.right) {
+            s.setCursorAfter(text);
+        }
+    }
+    /**
+     * Keep pending inline formatting after a click. Toggling Bold/Italic/etc. on
+     * a collapsed cursor leaves empty marker elements with the caret inside; a
+     * click puts the caret right before them (outside), so they get cleaned up
+     * and the formatting is lost. Move the caret back into the innermost marker
+     * so the next typed character keeps every pending format (#1291).
+     */
+    onClickKeepPendingFormat() {
+        var _a, _b;
+        const { s } = this.j;
+        const range = s.range;
+        if (!range.collapsed || !Dom.isText(range.startContainer)) {
+            return;
+        }
+        const text = range.startContainer;
+        // Caret must sit at the very end of the text, right before the markers.
+        if (range.startOffset !== ((_b = (_a = text.nodeValue) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0)) {
+            return;
+        }
+        const marker = text.nextSibling;
+        if (!Dom.isElement(marker) ||
+            !marker.nodeName.match(IS_INLINE) ||
+            !Dom.isEmpty(marker)) {
+            return;
+        }
+        let inner = marker;
+        // Descend into the innermost empty formatting marker.
+        while (Dom.isElement(inner.firstElementChild) &&
+            inner.firstElementChild.nodeName.match(IS_INLINE)) {
+            inner = inner.firstElementChild;
+        }
+        s.setCursorIn(inner);
+    }
     /**
      * Normalize selection after triple click
      */
@@ -132,6 +195,12 @@ __decorate([
 __decorate([
     watch([':beforeCommandSelectall'])
 ], select.prototype, "beforeCommandSelectAll", null);
+__decorate([
+    watch([':click'])
+], select.prototype, "onClickRightOfNestedListItem", null);
+__decorate([
+    watch([':click'])
+], select.prototype, "onClickKeepPendingFormat", null);
 __decorate([
     watch([':click'])
 ], select.prototype, "onTripleClickNormalizeSelection", null);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.12.16",
+	"version": "4.12.18",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/plugins/drag-and-drop-element/drag-and-drop-element.d.ts

@@ -21,10 +21,31 @@ export declare class dragAndDropElement extends Plugin {
     private state;
     /** @override */
     protected afterInit(): void;
+    /**
+     * Start dragging a specific element programmatically.
+     *
+     * Allows a separate UI element (for example a drag handle/anchor shown next
+     * to a block) to initiate the drag without the user pressing directly on the
+     * draggable element itself.
+     *
+     * @example
+     * ```js
+     * handle.addEventListener('mousedown', e => {
+     * 	editor.e.fire('startDragElement', preBlock, e);
+     * });
+     * ```
+     */
+    private onStartDragElement;
     /**
      * Drag start handler
      */
     private onDragStart;
+    /**
+     * Prepare the ghost element and switch to the waiting state.
+     * Shared by the native mousedown handler and the programmatic
+     * `startDragElement` event handler.
+     */
+    private startDragging;
     /**
      * Mouse move handler handler
      */

package/types/plugins/select/select.d.ts

@@ -33,6 +33,20 @@ export declare class select extends Plugin {
     protected onOutsideClick(e: MouseEvent): void;
     protected beforeCommandCut(): void | false;
     protected beforeCommandSelectAll(): false;
+    /**
+     * Fix caret position when clicking to the right of a list item that has a
+     * nested list. Blink/WebKit place the caret at the start of the line instead
+     * of the end (#1296); move it to the end of the item's own text.
+     */
+    protected onClickRightOfNestedListItem(e: MouseEvent): void;
+    /**
+     * Keep pending inline formatting after a click. Toggling Bold/Italic/etc. on
+     * a collapsed cursor leaves empty marker elements with the caret inside; a
+     * click puts the caret right before them (outside), so they get cleaned up
+     * and the formatting is lost. Move the caret back into the innermost marker
+     * so the next typed character keeps every pending format (#1291).
+     */
+    protected onClickKeepPendingFormat(): void;
     /**
      * Normalize selection after triple click
      */