jodit 4.12.36 → 4.12.38

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.36
+ * Version: v4.12.38
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/config.d.ts

@@ -267,6 +267,20 @@ declare class Config implements IViewOptions {
      * ```
      */
     shadowRoot: Nullable<ShadowRoot>;
+    /**
+     * CSP nonce applied to every `<style>`, `<script>` and `<link>` element
+     * Jodit injects at runtime (plugin styles, CDN scripts for ACE/beautify,
+     * downloaded stylesheets). Set it to the same nonce your server puts in the
+     * `Content-Security-Policy` header so a strict `style-src`/`script-src`
+     * policy does not block the editor.
+     *
+     * ```js
+     * Jodit.make('#editor', {
+     * 	nonce: 'r4nd0m'
+     * });
+     * ```
+     */
+    nonce: string;
     /**
      * Base CSS `z-index` for the editor UI (toolbar, popups, dialogs).
      * Set to a higher value when other page elements overlap the editor.
@@ -1383,6 +1397,14 @@ interface Config {
          * Wrap inserted link
          */
         processPastedLink: boolean;
+        /**
+         * When opening the link dialog for a new link with an empty URL field,
+         * pre-fill it from the selected text if that text looks like a URL or
+         * an email address (`example.com` → `https://example.com`,
+         * `user@site.com` → `mailto:user@site.com`). Plain text that is not a
+         * URL/email is left untouched. Default: false.
+         */
+        deriveUrlFromText: boolean;
         /**
          * Show `no follow` checkbox in link dialog.
          */
@@ -1678,15 +1700,22 @@ interface Config {
      */
     sourceEditor: 'area' | 'ace' | ((jodit: IJodit) => ISourceEditor);
     /**
-     * Options for [ace](https://ace.c9.io/#config) editor
+     * Options for [ace](https://ace.c9.io/#config) editor.
+     *
+     * Besides the named keys below, any other native ACE option is
+     * forwarded to `editor.setOptions()` as is, so e.g. `fontSize`,
+     * `tabSize` or `useSoftTabs` work too.
      *
      * ```js
      * Jodit.make('#editor', {
-     * 	showGutter: true,
-     * 	theme: 'ace/theme/idle_fingers',
-     * 	mode: 'ace/mode/html',
-     * 	wrap: true,
-     * 	highlightActiveLine: true
+     * 	sourceEditorNativeOptions: {
+     * 		showGutter: true,
+     * 		theme: 'ace/theme/idle_fingers',
+     * 		mode: 'ace/mode/html',
+     * 		wrap: true,
+     * 		highlightActiveLine: true,
+     * 		fontSize: '16px'
+     * 	}
      * })
      * ```
      */
@@ -1696,6 +1725,7 @@ interface Config {
         mode: string;
         wrap: string | boolean | number;
         highlightActiveLine: boolean;
+        [option: string]: string | boolean | number | undefined;
     };
     /**
      * Beautify HTML then it possible

package/esm/config.js

@@ -278,6 +278,20 @@ class Config {
          * ```
          */
         this.shadowRoot = null;
+        /**
+         * CSP nonce applied to every `<style>`, `<script>` and `<link>` element
+         * Jodit injects at runtime (plugin styles, CDN scripts for ACE/beautify,
+         * downloaded stylesheets). Set it to the same nonce your server puts in the
+         * `Content-Security-Policy` header so a strict `style-src`/`script-src`
+         * policy does not block the editor.
+         *
+         * ```js
+         * Jodit.make('#editor', {
+         * 	nonce: 'r4nd0m'
+         * });
+         * ```
+         */
+        this.nonce = '';
         /**
          * Base CSS `z-index` for the editor UI (toolbar, popups, dialogs).
          * Set to a higher value when other page elements overlap the editor.

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.12.36";
+export const APP_VERSION = "4.12.38";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/global.js

@@ -74,6 +74,10 @@ export function getContainer(jodit, classFunc, tag = 'div', createInsideEditor =
         const box = c.element(tag, {
             className: `jodit jodit-${kebabCase(name)}-container jodit-box`
         });
+        // Let a strict CSP accept the injected <style>/<script> box
+        if (view.o.nonce && (tag === 'style' || tag === 'script')) {
+            box.setAttribute('nonce', view.o.nonce);
+        }
         box.classList.add(`jodit_theme_${view.o.theme || 'default'}`);
         body.appendChild(box);
         data[key] = box;

package/esm/core/helpers/utils/append-script.js

@@ -31,6 +31,9 @@ export const appendScriptAsync = cacheLoaders((jodit, url) => {
             async: true,
             src: completeUrl(url)
         });
+        if (jodit.o.nonce) {
+            script.setAttribute('nonce', jodit.o.nonce);
+        }
         jodit.e.one(script, 'error', reject).one(script, 'load', resolve);
         jodit.od.body.appendChild(script);
     });
@@ -47,6 +50,9 @@ export const appendStyleAsync = cacheLoaders((jodit, url) => {
         link.rel = 'stylesheet';
         link.media = 'all';
         link.crossOrigin = 'anonymous';
+        if (jodit.o.nonce) {
+            link.setAttribute('nonce', jodit.o.nonce);
+        }
         const callback = () => resolve(link);
         !jodit.isInDestruct &&
             jodit.e.on(link, 'load', callback).on(link, 'error', reject);

package/esm/plugins/link/config.d.ts

@@ -27,6 +27,14 @@ declare module 'jodit/config' {
              * Wrap inserted link
              */
             processPastedLink: boolean;
+            /**
+             * When opening the link dialog for a new link with an empty URL field,
+             * pre-fill it from the selected text if that text looks like a URL or
+             * an email address (`example.com` → `https://example.com`,
+             * `user@site.com` → `mailto:user@site.com`). Plain text that is not a
+             * URL/email is left untouched. Default: false.
+             */
+            deriveUrlFromText: boolean;
             /**
              * Show `no follow` checkbox in link dialog.
              */

package/esm/plugins/link/config.js

@@ -14,6 +14,7 @@ Config.prototype.link = {
     followOnDblClick: false,
     processVideoLink: true,
     processPastedLink: true,
+    deriveUrlFromText: false,
     noFollowCheckbox: true,
     openInNewTabCheckbox: true,
     openInNewTabCheckboxDefaultChecked: false,

package/esm/plugins/link/link.js

@@ -167,6 +167,12 @@ export class link extends Plugin {
         }
         else {
             Dom.hide(unlink);
+            if (jodit.o.link.deriveUrlFromText &&
+                url_input &&
+                !isImageContent &&
+                !url_input.value.trim()) {
+                url_input.value = guessUrlFromText(content_input.value);
+            }
             if (openInNewTabCheckbox && target_checkbox) {
                 target_checkbox.checked = openInNewTabCheckboxDefaultChecked;
             }
@@ -293,6 +299,30 @@ __decorate([
     autobind
 ], link.prototype, "__onClickReadOnlyLink", null);
 pluginSystem.add('link', link);
+/**
+ * Guess a usable `href` from the selected text for the link dialog.
+ * Returns an empty string when the text is not a plausible URL/email,
+ * so plain text (e.g. "click here") is left untouched.
+ */
+function guessUrlFromText(text) {
+    const value = text.trim();
+    if (!value || /\s/.test(value)) {
+        return '';
+    }
+    // already an explicit scheme, an anchor or a relative path
+    if (/^(https?:|mailto:|tel:|ftp:|#|\/|\.{1,2}\/)/i.test(value)) {
+        return value;
+    }
+    // email address -> mailto:
+    if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
+        return `mailto:${value}`;
+    }
+    // bare domain like example.com or www.example.com/path -> https://
+    if (/^[a-z0-9-]+(\.[a-z0-9-]+)+(\/\S*)?$/i.test(value)) {
+        return `https://${value}`;
+    }
+    return '';
+}
 function writeClasses(modeClassName, className_input, className_select, a) {
     var _a;
     if (modeClassName && (className_input !== null && className_input !== void 0 ? className_input : className_select)) {

package/esm/plugins/source/config.d.ts

@@ -15,15 +15,22 @@ declare module 'jodit/config' {
          */
         sourceEditor: 'area' | 'ace' | ((jodit: IJodit) => ISourceEditor);
         /**
-         * Options for [ace](https://ace.c9.io/#config) editor
+         * Options for [ace](https://ace.c9.io/#config) editor.
+         *
+         * Besides the named keys below, any other native ACE option is
+         * forwarded to `editor.setOptions()` as is, so e.g. `fontSize`,
+         * `tabSize` or `useSoftTabs` work too.
          *
          * ```js
          * Jodit.make('#editor', {
-         * 	showGutter: true,
-         * 	theme: 'ace/theme/idle_fingers',
-         * 	mode: 'ace/mode/html',
-         * 	wrap: true,
-         * 	highlightActiveLine: true
+         * 	sourceEditorNativeOptions: {
+         * 		showGutter: true,
+         * 		theme: 'ace/theme/idle_fingers',
+         * 		mode: 'ace/mode/html',
+         * 		wrap: true,
+         * 		highlightActiveLine: true,
+         * 		fontSize: '16px'
+         * 	}
          * })
          * ```
          */
@@ -33,6 +40,7 @@ declare module 'jodit/config' {
             mode: string;
             wrap: string | boolean | number;
             highlightActiveLine: boolean;
+            [option: string]: string | boolean | number | undefined;
         };
         /**
          * Beautify HTML then it possible

package/esm/plugins/source/editor/engines/ace.js

@@ -81,6 +81,11 @@ export class AceEditor extends SourceEditor {
                 this.instance.setOption('rtlText', true);
                 this.instance.setOption('rtl', true);
             }
+            // Forward every native ACE option the user provided (theme,
+            // mode, fontSize, tabSize, …). Without this only the handful of
+            // keys explicitly wired below were applied and extras such as
+            // `fontSize` were silently ignored. See #1285
+            this.instance.setOptions(editor.o.sourceEditorNativeOptions);
             this.instance.setTheme(editor.o.sourceEditorNativeOptions.theme);
             this.instance.renderer.setShowGutter(editor.o.sourceEditorNativeOptions.showGutter);
             this.instance

package/esm/types/view.d.ts

@@ -63,6 +63,12 @@ interface IViewOptions extends ILanguageOptions, IToolbarOptions {
     createAttributes?: IDictionary<Attributes | NodeFunction>;
     events?: IDictionary<(...args: any[]) => any>;
     shadowRoot?: Nullable<ShadowRoot>;
+    /**
+     * CSP nonce applied to every `<style>`/`<script>`/`<link>` element Jodit
+     * injects at runtime, so a strict `style-src`/`script-src` policy does not
+     * block them.
+     */
+    nonce?: string;
     popupRoot?: Nullable<HTMLElement>;
     ownerWindow?: Window;
     language?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.12.36",
+	"version": "4.12.38",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/config.d.ts

@@ -267,6 +267,20 @@ declare class Config implements IViewOptions {
      * ```
      */
     shadowRoot: Nullable<ShadowRoot>;
+    /**
+     * CSP nonce applied to every `<style>`, `<script>` and `<link>` element
+     * Jodit injects at runtime (plugin styles, CDN scripts for ACE/beautify,
+     * downloaded stylesheets). Set it to the same nonce your server puts in the
+     * `Content-Security-Policy` header so a strict `style-src`/`script-src`
+     * policy does not block the editor.
+     *
+     * ```js
+     * Jodit.make('#editor', {
+     * 	nonce: 'r4nd0m'
+     * });
+     * ```
+     */
+    nonce: string;
     /**
      * Base CSS `z-index` for the editor UI (toolbar, popups, dialogs).
      * Set to a higher value when other page elements overlap the editor.
@@ -1383,6 +1397,14 @@ interface Config {
          * Wrap inserted link
          */
         processPastedLink: boolean;
+        /**
+         * When opening the link dialog for a new link with an empty URL field,
+         * pre-fill it from the selected text if that text looks like a URL or
+         * an email address (`example.com` → `https://example.com`,
+         * `user@site.com` → `mailto:user@site.com`). Plain text that is not a
+         * URL/email is left untouched. Default: false.
+         */
+        deriveUrlFromText: boolean;
         /**
          * Show `no follow` checkbox in link dialog.
          */
@@ -1678,15 +1700,22 @@ interface Config {
      */
     sourceEditor: 'area' | 'ace' | ((jodit: IJodit) => ISourceEditor);
     /**
-     * Options for [ace](https://ace.c9.io/#config) editor
+     * Options for [ace](https://ace.c9.io/#config) editor.
+     *
+     * Besides the named keys below, any other native ACE option is
+     * forwarded to `editor.setOptions()` as is, so e.g. `fontSize`,
+     * `tabSize` or `useSoftTabs` work too.
      *
      * ```js
      * Jodit.make('#editor', {
-     * 	showGutter: true,
-     * 	theme: 'ace/theme/idle_fingers',
-     * 	mode: 'ace/mode/html',
-     * 	wrap: true,
-     * 	highlightActiveLine: true
+     * 	sourceEditorNativeOptions: {
+     * 		showGutter: true,
+     * 		theme: 'ace/theme/idle_fingers',
+     * 		mode: 'ace/mode/html',
+     * 		wrap: true,
+     * 		highlightActiveLine: true,
+     * 		fontSize: '16px'
+     * 	}
      * })
      * ```
      */
@@ -1696,6 +1725,7 @@ interface Config {
         mode: string;
         wrap: string | boolean | number;
         highlightActiveLine: boolean;
+        [option: string]: string | boolean | number | undefined;
     };
     /**
      * Beautify HTML then it possible

package/types/plugins/link/config.d.ts

@@ -27,6 +27,14 @@ declare module 'jodit/config' {
              * Wrap inserted link
              */
             processPastedLink: boolean;
+            /**
+             * When opening the link dialog for a new link with an empty URL field,
+             * pre-fill it from the selected text if that text looks like a URL or
+             * an email address (`example.com` → `https://example.com`,
+             * `user@site.com` → `mailto:user@site.com`). Plain text that is not a
+             * URL/email is left untouched. Default: false.
+             */
+            deriveUrlFromText: boolean;
             /**
              * Show `no follow` checkbox in link dialog.
              */

package/types/plugins/source/config.d.ts

@@ -15,15 +15,22 @@ declare module 'jodit/config' {
          */
         sourceEditor: 'area' | 'ace' | ((jodit: IJodit) => ISourceEditor);
         /**
-         * Options for [ace](https://ace.c9.io/#config) editor
+         * Options for [ace](https://ace.c9.io/#config) editor.
+         *
+         * Besides the named keys below, any other native ACE option is
+         * forwarded to `editor.setOptions()` as is, so e.g. `fontSize`,
+         * `tabSize` or `useSoftTabs` work too.
          *
          * ```js
          * Jodit.make('#editor', {
-         * 	showGutter: true,
-         * 	theme: 'ace/theme/idle_fingers',
-         * 	mode: 'ace/mode/html',
-         * 	wrap: true,
-         * 	highlightActiveLine: true
+         * 	sourceEditorNativeOptions: {
+         * 		showGutter: true,
+         * 		theme: 'ace/theme/idle_fingers',
+         * 		mode: 'ace/mode/html',
+         * 		wrap: true,
+         * 		highlightActiveLine: true,
+         * 		fontSize: '16px'
+         * 	}
          * })
          * ```
          */
@@ -33,6 +40,7 @@ declare module 'jodit/config' {
             mode: string;
             wrap: string | boolean | number;
             highlightActiveLine: boolean;
+            [option: string]: string | boolean | number | undefined;
         };
         /**
          * Beautify HTML then it possible

package/types/types/view.d.ts

@@ -63,6 +63,12 @@ interface IViewOptions extends ILanguageOptions, IToolbarOptions {
     createAttributes?: IDictionary<Attributes | NodeFunction>;
     events?: IDictionary<(...args: any[]) => any>;
     shadowRoot?: Nullable<ShadowRoot>;
+    /**
+     * CSP nonce applied to every `<style>`/`<script>`/`<link>` element Jodit
+     * injects at runtime, so a strict `style-src`/`script-src` policy does not
+     * block them.
+     */
+    nonce?: string;
     popupRoot?: Nullable<HTMLElement>;
     ownerWindow?: Window;
     language?: string;