jodit 4.12.29 → 4.12.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/es2015/jodit.css +1 -1
  3. package/es2015/jodit.fat.min.js +2 -2
  4. package/es2015/jodit.js +25 -7
  5. package/es2015/jodit.min.js +2 -2
  6. package/es2015/plugins/debug/debug.css +1 -1
  7. package/es2015/plugins/debug/debug.js +1 -1
  8. package/es2015/plugins/debug/debug.min.js +1 -1
  9. package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
  10. package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
  11. package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
  12. package/es2018/jodit.fat.min.js +2 -2
  13. package/es2018/jodit.min.js +2 -2
  14. package/es2018/plugins/debug/debug.min.js +1 -1
  15. package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
  16. package/es2021/jodit.css +1 -1
  17. package/es2021/jodit.fat.min.js +3 -3
  18. package/es2021/jodit.js +25 -7
  19. package/es2021/jodit.min.js +3 -3
  20. package/es2021/plugins/debug/debug.css +1 -1
  21. package/es2021/plugins/debug/debug.js +1 -1
  22. package/es2021/plugins/debug/debug.min.js +1 -1
  23. package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
  24. package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
  25. package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
  26. package/es2021.en/jodit.css +1 -1
  27. package/es2021.en/jodit.fat.min.js +3 -3
  28. package/es2021.en/jodit.js +25 -7
  29. package/es2021.en/jodit.min.js +3 -3
  30. package/es2021.en/plugins/debug/debug.css +1 -1
  31. package/es2021.en/plugins/debug/debug.js +1 -1
  32. package/es2021.en/plugins/debug/debug.min.js +1 -1
  33. package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
  34. package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
  35. package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
  36. package/es5/jodit.css +2 -2
  37. package/es5/jodit.fat.min.js +2 -2
  38. package/es5/jodit.js +26 -8
  39. package/es5/jodit.min.css +2 -2
  40. package/es5/jodit.min.js +2 -2
  41. package/es5/plugins/debug/debug.css +1 -1
  42. package/es5/plugins/debug/debug.js +1 -1
  43. package/es5/plugins/debug/debug.min.js +1 -1
  44. package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
  45. package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
  46. package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
  47. package/es5/polyfills.fat.min.js +1 -1
  48. package/es5/polyfills.js +1 -1
  49. package/es5/polyfills.min.js +1 -1
  50. package/esm/core/constants.js +1 -1
  51. package/esm/core/helpers/html/apply-styles.js +14 -3
  52. package/esm/core/helpers/html/safe-html.js +9 -2
  53. package/package.json +1 -1
package/es5/plugins/debug/debug.css CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/plugins/debug/debug.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/plugins/debug/debug.min.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/plugins/speech-recognize/speech-recognize.css CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/plugins/speech-recognize/speech-recognize.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/plugins/speech-recognize/speech-recognize.min.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/polyfills.fat.min.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/polyfills.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/es5/polyfills.min.js CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.12.29
4
+ * Version: v4.12.31
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */
package/esm/core/constants.js CHANGED
@@ -3,7 +3,7 @@
3
3
  * Released under MIT see LICENSE.txt in the project root for license information.
4
4
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
5
5
  */
6
- export const APP_VERSION = "4.12.29";
6
+ export const APP_VERSION = "4.12.31";
7
7
  // prettier-ignore
8
8
  export const ES = "es2020";
9
9
  export const IS_ES_MODERN = true;
package/esm/core/helpers/html/apply-styles.js CHANGED
@@ -31,11 +31,22 @@ function normalizeCSS(s) {
31
31
  * and then removes the selector styles, leaving only the inline ones.
32
32
  */
33
33
  export function applyStyles(html) {
34
- if (html.indexOf('<html ') === -1) {
34
+ // Match the opening <html> tag whether or not it carries attributes. MS
35
+ // Word emits `<html xmlns:o=…>` (note the trailing space), but Excel/Calc
36
+ // wrap the copied table in a bare `<html>`. The old `'<html '` check missed
37
+ // the bare tag, so for Excel clipboards the `<style>` rules (class-based
38
+ // cell backgrounds/borders, e.g. `.xl31 { background:#FCE4D6 }`) were never
39
+ // inlined and all styling was lost once the `<style>` block got stripped.
40
+ // See https://github.com/xdan/jodit/issues/1362
41
+ const openMatch = /<html(?:\s[^>]*)?>/i.exec(html);
42
+ if (!openMatch) {
35
43
  return html;
36
44
  }
37
- html = html.substring(html.indexOf('<html '), html.length);
38
- html = html.substring(0, html.lastIndexOf('</html>') + '</html>'.length);
45
+ html = html.substring(openMatch.index);
46
+ const closeIndex = html.toLowerCase().lastIndexOf('</html>');
47
+ if (closeIndex !== -1) {
48
+ html = html.substring(0, closeIndex + '</html>'.length);
49
+ }
39
50
  const iframe = globalDocument.createElement('iframe');
40
51
  iframe.style.display = 'none';
41
52
  globalDocument.body.appendChild(iframe);
package/esm/core/helpers/html/safe-html.js CHANGED
@@ -150,8 +150,16 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
150
150
  attr(elm, 'onerror', null);
151
151
  effected = true;
152
152
  }
153
+ const tagName = elm.nodeName.toLowerCase();
153
154
  const href = elm.getAttribute('href');
154
- if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
155
+ // Neutralize executable-scheme `href`s with the same normalization used for
156
+ // every other URL attribute (`isDangerousUrl`), which strips control bytes,
157
+ // tabs and newlines and lowercases before matching the scheme. The previous
158
+ // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
159
+ // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
160
+ // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
161
+ // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
162
+ if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
155
163
  attr(elm, 'href', location.protocol + '//' + href);
156
164
  effected = true;
157
165
  }
@@ -162,7 +170,6 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
162
170
  effected = true;
163
171
  }
164
172
  // Strip executable schemes from any other URL-bearing attribute.
165
- const tagName = elm.nodeName.toLowerCase();
166
173
  for (const name of URL_ATTRIBUTES) {
167
174
  const value = elm.getAttribute(name);
168
175
  if (value && isDangerousUrl(value, tagName)) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "jodit",
3
- "version": "4.12.29",
3
+ "version": "4.12.31",
4
4
  "description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
5
5
  "main": "esm/index.js",
6
6
  "types": "types/index.d.ts",