jodit 4.12.30 → 4.12.32

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.30
+ * Version: v4.12.32
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.12.30";
+export const APP_VERSION = "4.12.32";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/html/safe-html.js

@@ -150,8 +150,16 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
         attr(elm, 'onerror', null);
         effected = true;
     }
+    const tagName = elm.nodeName.toLowerCase();
     const href = elm.getAttribute('href');
-    if (safeJavaScriptLink && href && href.trim().indexOf('javascript') === 0) {
+    // Neutralize executable-scheme `href`s with the same normalization used for
+    // every other URL attribute (`isDangerousUrl`), which strips control bytes,
+    // tabs and newlines and lowercases before matching the scheme. The previous
+    // bare `href.trim().indexOf('javascript') === 0` was case-sensitive and
+    // missed `JAVASCRIPT:`, a leading control byte, or a tab/newline inside the
+    // scheme (e.g. `java\tscript:`) — all of which the browser still resolves to
+    // `javascript:` on click. See GHSA-j839-gqq4-gf9j.
+    if (safeJavaScriptLink && href && isDangerousUrl(href, tagName)) {
         attr(elm, 'href', location.protocol + '//' + href);
         effected = true;
     }
@@ -162,7 +170,6 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
             effected = true;
         }
         // Strip executable schemes from any other URL-bearing attribute.
-        const tagName = elm.nodeName.toLowerCase();
         for (const name of URL_ATTRIBUTES) {
             const value = elm.getAttribute(name);
             if (value && isDangerousUrl(value, tagName)) {

package/esm/plugins/size/size.js

@@ -116,10 +116,17 @@ export class size extends Plugin {
      * Returns service spaces: toolbar + statusbar
      */
     __getNotWorkHeight() {
-        var _a, _b;
-        return ((((_a = this.j.toolbarContainer) === null || _a === void 0 ? void 0 : _a.offsetHeight) || 0) +
-            (((_b = this.j.statusbar) === null || _b === void 0 ? void 0 : _b.getHeight()) || 0) +
-            2);
+        var _a;
+        // Only a toolbar that actually lives inside the editor container takes
+        // space away from the workplace. When the `toolbar` option points to an
+        // external element, the toolbar is rendered outside the container, so it
+        // must not be subtracted — otherwise the workplace is wrongly shrunk by
+        // the toolbar's height. See https://github.com/xdan/jodit/discussions/920
+        const toolbar = this.j.toolbarContainer;
+        const toolbarHeight = toolbar && this.j.container.contains(toolbar)
+            ? toolbar.offsetHeight
+            : 0;
+        return toolbarHeight + (((_a = this.j.statusbar) === null || _a === void 0 ? void 0 : _a.getHeight()) || 0) + 2;
     }
     /**
      * Calculate workspace height

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.12.30",
+	"version": "4.12.32",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",