jodit 4.12.17 → 4.12.20

package/CHANGELOG.md

@@ -9,6 +9,42 @@
 > - :house: [Internal]
 > - :nail_care: [Polish]
 
+## 4.12.19
+
+#### :bug: Bug Fix
+
+- **Security (stored XSS)**: the HTML sanitizer (`safeHTML`) stripped `on*` event handlers and `javascript:` links but left several executable constructs in the serialized editor value, so an application that re-rendered `editor.value` as trusted HTML could execute attacker script. It now also: drops `iframe[srcdoc]`; removes `data:text/html` / `data:application/xhtml` (and SVG `data:` URLs in `iframe`/`object`/`embed`/`frame`) sources; and strips `javascript:`/`vbscript:`/`livescript:`/`mocha:` from every URL-bearing attribute (`src`, `data`, `action`, `formaction`, `poster`, `background`, `xlink:href`), not just `<a href>`. Safe `data:image/*` sources (e.g. base64 PNG/SVG used in `<img>`) are preserved. Responsibly reported by Yuji Tounai.
+- **Paste (Insert as Text)**: pasting multi-line content with the *Insert as Text* option lost its line breaks — the escaped text kept raw newlines that collapse to spaces when rendered. The *Insert as Text* path now converts newlines to `<br>` (gated on `nl2brInPlainText`, like the plain-text paste path). Fixes [#1093](https://github.com/xdan/jodit/issues/1093).
+- **Hotkeys**: the default keyboard shortcut for *Insert Unordered List* (`Ctrl/Cmd+Shift+8`) never fired — both variants were written as a single comma-joined string `'ctrl+shift+8, cmd+shift+8'` instead of two separate array entries, so the combined value never matched a real keypress. Fixes [#1079](https://github.com/xdan/jodit/issues/1079).
+- **Color / Brush button**: the brush (text/background color) button never reflected the color under the caret. Its `update` handler computed the current color into the icon fill but then **unconditionally** reset `icon.fill` to an empty string on every toolbar update, discarding it — which also made the icon render invisibly against some themes (`editorCssClass`). The computed fill is now kept when a color is present (and only cleared when there is none). Fixes [#195](https://github.com/xdan/jodit/issues/195) and [#182](https://github.com/xdan/jodit/issues/182).
+- **Toolbar / Selection**: when a text selection was started inside the editor and the mouse button was released **outside** of the editable area (a drag-select that ends over the page), the editor never received the `mouseup` event, so the active state of toolbar buttons (Bold, Italic, etc.) was not recalculated and stayed stale. A document-level `mouseup` listener now re-fires `changeSelection` when the selection still belongs to the editor, so the toolbar updates correctly. Fixes [#1251](https://github.com/xdan/jodit/issues/1251).
+- **Media embed (YouTube & Vimeo)**: real-world share URLs were not converted to an embedded player. For YouTube, short links of the form `https://youtu.be/<id>?si=…` (the *Share* button format) and `?t=` timestamp links were inserted as plain text — the video id sits in the path but was only read when there was no query string — and `/shorts/<id>` / `/live/<id>` produced a broken `embed/shorts/<id>` src. For Vimeo, `?share=copy` tracking params and `channels/<name>/<id>` / `groups/<name>/videos/<id>` URLs produced a broken `video/channels/…` src. `convertMediaUrlToVideoEmbed` now extracts the video id (and the unlisted Vimeo hash) from the URL path, ignoring tracking params and channel/group/`embed`/`shorts`/`live` prefixes, and also recognises the `m.youtube.com` (mobile) and `music.youtube.com` hosts. Fixes [#1209](https://github.com/xdan/jodit/issues/1209).
+- **Indent / Lists**: the *Decrease Indent* (outdent) toolbar button stayed disabled when the cursor was inside a nested list item, even though `Shift+Tab` could un-nest it. The button's enabled state only considered an inline indent margin and ignored list nesting. It is now also enabled when the cursor sits in a list whose parent is another list item (matching the `tab` plugin's outdent behaviour). Fixes [#1247](https://github.com/xdan/jodit/issues/1247).
+- **Uploader (base64)**: with `uploader.insertImageAsBase64URI = true`, dropping or pasting images in formats outside the default `imagesExtensions` list — notably `.svg`, `.bmp`, `.webp` — failed with `Need Url for Ajax Request` instead of being inlined as a data URI (the file fell through to the server-upload path). The default `imagesExtensions` now also includes `webp`, `bmp`, `svg`, `tiff` and `avif`. Fixes [#1228](https://github.com/xdan/jodit/issues/1228).
+- **Paste (Insert only Text)**: pasting multi-paragraph HTML with the *Insert only Text* option collapsed everything into a single paragraph — block boundaries became spaces, so the text could no longer be split into list items or separate blocks. `stripTags` gained an opt-in `blockBr` mode and the *Insert only Text* path now uses it (gated on `nl2brInPlainText`), so paragraphs are separated by `<br>`. The default `stripTags` behaviour (space-joined single-line plain text) is unchanged. Fixes [#1232](https://github.com/xdan/jodit/issues/1232).
+- **Paste from Word**: list items pasted from Microsoft Word kept their auto-generated marker text — the bullet glyph or the literal item number (`1.`, `2.`, …) leaked into the content as plain text. Word emits these markers inside `<span style="mso-list:Ignore">` elements that are explicitly flagged as display-only; both paste paths now drop those spans entirely instead of just stripping their attributes — `cleanFromWord` (the *Clean* / *As text* options) and `applyStyles` (the *Keep* / insert-as-HTML option). Fixes [#948](https://github.com/xdan/jodit/issues/948).
+
+#### :house: Internal
+
+- **Accessibility tests**: added a regression test asserting that a toolbar button's `aria-label` is placed on the interactive `<button>` element (not only on the wrapper `<span>`), covering the toolbar-specific case of [#1261](https://github.com/xdan/jodit/issues/1261) (already fixed in 4.9.7).
+- **Color tests**: added a regression test for applying a single font color over a selection that already contains several different colors — every part of the text must be recolored, none left without a color, covering [#169](https://github.com/xdan/jodit/issues/169) (already fixed in the v4 style engine).
+
+## 4.12.18
+
+#### :rocket: New Feature
+
+- **Drag and drop element**: added a `startDragElement` event so another plugin can begin dragging a specific element programmatically — e.g. from a dedicated drag handle/anchor shown next to a block. Fire `editor.e.fire('startDragElement', element, mouseEvent)`; the element does **not** need to be listed in `draggableTags` (the listener is registered even when that list is empty), so handles can move elements such as `<pre>` code blocks that are not auto-draggable.
+
+#### :bug: Bug Fix
+
+- **Formatting / Selection**: toggling Bold/Italic/Underline (etc.) on a collapsed cursor and then clicking in the editor lost one or more of the pending formats. The click placed the caret just before the empty marker elements, so `clean-html` removed them. The caret is now moved back into the innermost pending marker on click, and `clean-html` keeps empty inline elements that hold the live caret, so the next typed character keeps every format. Fixes [#1291](https://github.com/xdan/jodit/issues/1291).
+- **History / Enter**: pressing Enter while a selection was active (e.g. Ctrl+A then Enter) required two Ctrl+Z presses to undo — the first only reverted to an intermediate empty state. The delete-of-selection and the new block are now a single history transaction, so one undo restores the original content. Fixes [#1292](https://github.com/xdan/jodit/issues/1292).
+- **Security / Config (prototype pollution)**: `Jodit.configure()` — and the internal `ConfigMerge`/`ConfigProto` helpers — merged user-supplied options without filtering prototype-mutating keys, so a payload nested under an existing plain-object option such as `controls` (e.g. `{"controls":{"__proto__":{"polluted":"yes"}}}`) could reach and mutate `Object.prototype` (CWE-1321). Merging now rejects `__proto__`, `constructor`, and `prototype` at every nesting level. Responsibly reported by Junming Wu.
+
+#### :nail_care: Polish
+
+- **Drag and drop element**: dropping a non-editable block (e.g. a `<pre>` code sample) no longer leaves an invisible filler text node (``) next to it. Previously this stray node showed up as an extra empty line until `clean-html` removed it later; it is now stripped in `onDrop` right after insertion.
+
 ## 4.12.17
 
 #### :bug: Bug Fix

package/es2015/jodit.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.17
+ * Version: v4.12.20
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */