jodit 4.12.30 → 4.12.32

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -2074,7 +2074,7 @@ __webpack_require__.r(__webpack_exports__);
  * @packageDocumentation
  * @module constants
  */ 
-var APP_VERSION = "4.12.30";
+var APP_VERSION = "4.12.32";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7152,8 +7152,16 @@ function sanitizeHTMLElement(elm) {
         (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
     }
+    var tagName = elm.nodeName.toLowerCase();
     var href = elm.getAttribute('href');
-    if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
+    // Neutralize executable-scheme `href`s with the same normalization used for
+    // every other URL attribute (`isDangerousUrl`), which strips control bytes,
+    // tabs and newlines and lowercases before matching the scheme. The previous
+    // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
+    // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
+    // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
+    // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
+    if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
         (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
@@ -7163,10 +7171,9 @@ function sanitizeHTMLElement(elm) {
             (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'srcdoc', null);
             effected = true;
         }
-        // Strip executable schemes from any other URL-bearing attribute.
-        var tagName = elm.nodeName.toLowerCase();
         var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
         try {
+            // Strip executable schemes from any other URL-bearing attribute.
             for(var _iterator = URL_ATTRIBUTES[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
                 var name = _step.value;
                 var value = elm.getAttribute(name);
@@ -48033,8 +48040,15 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.maxHeight = 'auto';
             value: /**
 	 * Returns service spaces: toolbar + statusbar
 	 */ function __getNotWorkHeight() {
-                var _this_j_toolbarContainer, _this_j_statusbar;
-                return (((_this_j_toolbarContainer = this.j.toolbarContainer) === null || _this_j_toolbarContainer === void 0 ? void 0 : _this_j_toolbarContainer.offsetHeight) || 0) + (((_this_j_statusbar = this.j.statusbar) === null || _this_j_statusbar === void 0 ? void 0 : _this_j_statusbar.getHeight()) || 0) + 2;
+                var _this_j_statusbar;
+                // Only a toolbar that actually lives inside the editor container takes
+                // space away from the workplace. When the `toolbar` option points to an
+                // external element, the toolbar is rendered outside the container, so it
+                // must not be subtracted — otherwise the workplace is wrongly shrunk by
+                // the toolbar's height. See https://github.com/xdan/jodit/discussions/920
+                var toolbar = this.j.toolbarContainer;
+                var toolbarHeight = toolbar && this.j.container.contains(toolbar) ? toolbar.offsetHeight : 0;
+                return toolbarHeight + (((_this_j_statusbar = this.j.statusbar) === null || _this_j_statusbar === void 0 ? void 0 : _this_j_statusbar.getHeight()) || 0) + 2;
             }
         },
         {

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
 	/*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */