jodit 4.12.27 → 4.12.28

package/es2021.en/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.28
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -1810,7 +1810,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.12.27";
+ */ const APP_VERSION = "4.12.28";
 // prettier-ignore
 const ES = "es2021";
 const IS_ES_MODERN = true;
@@ -6033,12 +6033,48 @@ function normalizeCSS(s) {
  * @module helpers/html
  */ 
 
+const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+/**
+ * Integration points where HTML is legitimately allowed inside MathML/SVG foreign content.
+ */ const HTML_INTEGRATION_POINTS = new Set([
+    'foreignobject',
+    'annotation-xml',
+    'desc',
+    'title'
+]);
+/**
+ * True for an HTML element the parser placed inside MathML/SVG outside an integration point - smuggled
+ * HTML (e.g. `mglyph` / `style` under `<math>`) that a reparse can hoist into a live node. Legitimate
+ * MathML/SVG children and HTML below an integration point are kept.
+ */ function isSmuggledForeignHtml(elm) {
+    if (elm.namespaceURI !== HTML_NAMESPACE || elm.closest('math,svg') == null) {
+        return false;
+    }
+    for(let parent = elm.parentElement; parent; parent = parent.parentElement){
+        const name = parent.nodeName.toLowerCase();
+        if (name === 'math' || name === 'svg') {
+            break;
+        }
+        if (HTML_INTEGRATION_POINTS.has(name)) {
+            return false;
+        }
+    }
+    return true;
+}
 /**
  * Removes dangerous constructs from HTML
  */ function safeHTML(box, options) {
     if (!jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(box) && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isFragment(box)) {
         return;
     }
+    // Drop HTML smuggled into MathML/SVG before the walk: a reparse would otherwise hoist its hidden
+    // markup into a live node.
+    const foreign = box.querySelectorAll('math *, svg *');
+    for(let i = 0; i < foreign.length; i++){
+        if (foreign[i].isConnected && isSmuggledForeignHtml(foreign[i])) {
+            jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.safeRemove(foreign[i]);
+        }
+    }
     const removeEvents = options.removeEventAttributes ?? options.removeOnError;
     // Single synchronous traversal of the subtree. Besides removing event
     // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises