jodit 4.12.27 → 4.12.29

package/CHANGELOG.md

@@ -9,6 +9,18 @@
 > - :house: [Internal]
 > - :nail_care: [Polish]
 
+## 4.12.29
+
+#### :bug: Bug Fix
+
+- **Event emitter (memory hygiene in SPA / Shadow DOM)**: `EventEmitter` stores its per-subject handler namespaces under a `__JoditEventEmitterNamespaces<timestamp>` property, but on `off()`/`destruct()` it only set that property to `undefined` instead of removing it. On long-lived subjects such as `window`, repeatedly creating and destroying editors in a single-page application left a growing pile of leftover `undefined` keys on the object. The property is now `delete`d on cleanup, so nothing lingers after `destruct()`. Reported by Ralf Pichler (uniquare.com, Jodit OEM).
+
+## 4.12.28
+
+#### :bug: Bug Fix
+
+- **Security / clean-html (mutation XSS, CWE-79)**: the HTML sanitizer (`safeHTML`) walked the parsed value as elements, but a handler smuggled as `<style>` rawtext inside a MathML/SVG foreign-content carrier (e.g. `math > mtext > table > mglyph > style` hiding an `<img onload=…>`) was never an element during that walk. A later serialize-reparse then hoisted the `<img>` out of `<style>` into a live HTML node with its `on*` handler intact, so an application that re-rendered `editor.value` could execute attacker script with no user interaction — a stored XSS in the default config affecting all 3.x/4.x through 4.12.27. The fix drops the smuggled HTML at the source: any HTML-namespace element the parser placed inside `<math>`/`<svg>` outside an integration point (`foreignObject`/`annotation-xml`/`desc`/`title`) is removed before the walk, which also covers carriers nested one level deeper without a re-parse loop. Legitimate MathML/SVG content and top-level `<style>`/`<script>` are preserved. Responsibly reported by Younghun Ko of AhnLab ([@koyokr](https://github.com/koyokr)) (GHSA-rxcw-mc6f-6hr3).
+
 ## 4.12.26
 
 #### :bug: Bug Fix

package/es2015/jodit.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.27
+ * Version: v4.12.29
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */