jodit 4.12.29 → 4.12.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/es2015/jodit.css +1 -1
  3. package/es2015/jodit.fat.min.js +2 -2
  4. package/es2015/jodit.js +25 -7
  5. package/es2015/jodit.min.js +2 -2
  6. package/es2015/plugins/debug/debug.css +1 -1
  7. package/es2015/plugins/debug/debug.js +1 -1
  8. package/es2015/plugins/debug/debug.min.js +1 -1
  9. package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
  10. package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
  11. package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
  12. package/es2018/jodit.fat.min.js +2 -2
  13. package/es2018/jodit.min.js +2 -2
  14. package/es2018/plugins/debug/debug.min.js +1 -1
  15. package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
  16. package/es2021/jodit.css +1 -1
  17. package/es2021/jodit.fat.min.js +3 -3
  18. package/es2021/jodit.js +25 -7
  19. package/es2021/jodit.min.js +3 -3
  20. package/es2021/plugins/debug/debug.css +1 -1
  21. package/es2021/plugins/debug/debug.js +1 -1
  22. package/es2021/plugins/debug/debug.min.js +1 -1
  23. package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
  24. package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
  25. package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
  26. package/es2021.en/jodit.css +1 -1
  27. package/es2021.en/jodit.fat.min.js +3 -3
  28. package/es2021.en/jodit.js +25 -7
  29. package/es2021.en/jodit.min.js +3 -3
  30. package/es2021.en/plugins/debug/debug.css +1 -1
  31. package/es2021.en/plugins/debug/debug.js +1 -1
  32. package/es2021.en/plugins/debug/debug.min.js +1 -1
  33. package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
  34. package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
  35. package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
  36. package/es5/jodit.css +2 -2
  37. package/es5/jodit.fat.min.js +2 -2
  38. package/es5/jodit.js +26 -8
  39. package/es5/jodit.min.css +2 -2
  40. package/es5/jodit.min.js +2 -2
  41. package/es5/plugins/debug/debug.css +1 -1
  42. package/es5/plugins/debug/debug.js +1 -1
  43. package/es5/plugins/debug/debug.min.js +1 -1
  44. package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
  45. package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
  46. package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
  47. package/es5/polyfills.fat.min.js +1 -1
  48. package/es5/polyfills.js +1 -1
  49. package/es5/polyfills.min.js +1 -1
  50. package/esm/core/constants.js +1 -1
  51. package/esm/core/helpers/html/apply-styles.js +14 -3
  52. package/esm/core/helpers/html/safe-html.js +9 -2
  53. package/package.json +1 -1
package/es5/jodit.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
@@ -2074,7 +2074,7 @@ __webpack_require__.r(__webpack_exports__);
2074
2074
  * @packageDocumentation
2075
2075
  * @module constants
2076
2076
  */
2077
- var APP_VERSION = "4.12.29";
2077
+ var APP_VERSION = "4.12.31";
2078
2078
  // prettier-ignore
2079
2079
  var ES = "es5";
2080
2080
  var IS_ES_MODERN = false;
@@ -6720,11 +6720,22 @@ function normalizeCSS(s) {
6720
6720
  * it applies them to the selectors in the HTML itself
6721
6721
  * and then removes the selector styles, leaving only the inline ones.
6722
6722
  */ function applyStyles(html) {
6723
- if (html.indexOf('<html ') === -1) {
6723
+ // Match the opening <html> tag whether or not it carries attributes. MS
6724
+ // Word emits `<html xmlns:o=…>` (note the trailing space), but Excel/Calc
6725
+ // wrap the copied table in a bare `<html>`. The old `'<html '` check missed
6726
+ // the bare tag, so for Excel clipboards the `<style>` rules (class-based
6727
+ // cell backgrounds/borders, e.g. `.xl31 { background:#FCE4D6 }`) were never
6728
+ // inlined and all styling was lost once the `<style>` block got stripped.
6729
+ // See https://github.com/xdan/jodit/issues/1362
6730
+ var openMatch = /<html(?:\s[^>]*)?>/i.exec(html);
6731
+ if (!openMatch) {
6724
6732
  return html;
6725
6733
  }
6726
- html = html.substring(html.indexOf('<html '), html.length);
6727
- html = html.substring(0, html.lastIndexOf('</html>') + '</html>'.length);
6734
+ html = html.substring(openMatch.index);
6735
+ var closeIndex = html.toLowerCase().lastIndexOf('</html>');
6736
+ if (closeIndex !== -1) {
6737
+ html = html.substring(0, closeIndex + '</html>'.length);
6738
+ }
6728
6739
  var iframe = jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('iframe');
6729
6740
  iframe.style.display = 'none';
6730
6741
  jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.body.appendChild(iframe);
@@ -7141,8 +7152,16 @@ function sanitizeHTMLElement(elm) {
7141
7152
  (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
7142
7153
  effected = true;
7143
7154
  }
7155
+ var tagName = elm.nodeName.toLowerCase();
7144
7156
  var href = elm.getAttribute('href');
7145
- if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
7157
+ // Neutralize executable-scheme `href`s with the same normalization used for
7158
+ // every other URL attribute (`isDangerousUrl`), which strips control bytes,
7159
+ // tabs and newlines and lowercases before matching the scheme. The previous
7160
+ // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
7161
+ // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
7162
+ // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
7163
+ // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
7164
+ if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
7146
7165
  (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'href', location.protocol + '//' + href);
7147
7166
  effected = true;
7148
7167
  }
@@ -7152,10 +7171,9 @@ function sanitizeHTMLElement(elm) {
7152
7171
  (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'srcdoc', null);
7153
7172
  effected = true;
7154
7173
  }
7155
- // Strip executable schemes from any other URL-bearing attribute.
7156
- var tagName = elm.nodeName.toLowerCase();
7157
7174
  var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
7158
7175
  try {
7176
+ // Strip executable schemes from any other URL-bearing attribute.
7159
7177
  for(var _iterator = URL_ATTRIBUTES[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
7160
7178
  var name = _step.value;
7161
7179
  var value = elm.getAttribute(name);
package/es5/jodit.min.css CHANGED
@@ -1,14 +1,14 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
8
8
  /*!
9
9
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
10
10
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
11
- * Version: v4.12.29
11
+ * Version: v4.12.31
12
12
  * Url: https://xdsoft.net/jodit/
13
13
  * License(s): MIT
14
14
  */