jodit 4.12.41 → 4.12.43

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.12.41
+ * Version: v4.12.43
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.12.41";
+export const APP_VERSION = "4.12.43";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/plugins/clean-html/helpers/index.d.ts

@@ -7,6 +7,7 @@
  * @module plugins/clean-html
  */
 export * from "./get-hash";
+export * from "./is-allowed-media-embed";
 export * from "./remove-format/remove-format-for-collapsed-selection";
 export * from "./remove-format/remove-format-for-selection";
 export * from "./visitor/visit-node-walker";

package/esm/plugins/clean-html/helpers/index.js

@@ -7,6 +7,7 @@
  * @module plugins/clean-html
  */
 export * from "./get-hash.js";
+export * from "./is-allowed-media-embed.js";
 export * from "./remove-format/remove-format-for-collapsed-selection.js";
 export * from "./remove-format/remove-format-for-selection.js";
 export * from "./visitor/visit-node-walker.js";

package/esm/plugins/clean-html/helpers/is-allowed-media-embed.d.ts

@@ -0,0 +1,15 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * Whether an `<iframe>` `src` points at a recognized YouTube/Vimeo video
+ * player. Such iframes are inserted intentionally through the Video button, so
+ * clean-html must not strip them (`denyTags` includes `iframe` by default) or
+ * neutralize them with an empty `sandbox=""` (#1381). Arbitrary/bare iframes
+ * are still removed.
+ *
+ * @private
+ */
+export declare function isAllowedMediaEmbed(src: string): boolean;

package/esm/plugins/clean-html/helpers/is-allowed-media-embed.js

@@ -0,0 +1,28 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module plugins/clean-html
+ */
+// The embed URLs produced by the built-in Video button (see
+// `convertMediaUrlToVideoEmbed`): `//www.youtube.com/embed/<id>` and
+// `//player.vimeo.com/video/<id>`. `youtube-nocookie.com` is the privacy
+// variant YouTube offers for the same `/embed/` player. The `/embed/` and
+// `/video/` path prefixes are required so a bare provider link
+// (`youtube.com/@somebody`) is not treated as a player.
+const YOUTUBE_EMBED = /^(https?:)?\/\/(www\.|m\.|music\.)?youtube(-nocookie)?\.com\/embed\//i;
+const VIMEO_EMBED = /^(https?:)?\/\/player\.vimeo\.com\/video\//i;
+/**
+ * Whether an `<iframe>` `src` points at a recognized YouTube/Vimeo video
+ * player. Such iframes are inserted intentionally through the Video button, so
+ * clean-html must not strip them (`denyTags` includes `iframe` by default) or
+ * neutralize them with an empty `sandbox=""` (#1381). Arbitrary/bare iframes
+ * are still removed.
+ *
+ * @private
+ */
+export function isAllowedMediaEmbed(src) {
+    return YOUTUBE_EMBED.test(src) || VIMEO_EMBED.test(src);
+}

package/esm/plugins/clean-html/helpers/visitor/filters/sandbox-iframes-in-content.js

@@ -5,6 +5,7 @@
  */
 import { Dom } from "../../../../../core/dom/dom.js";
 import { attr } from "../../../../../core/helpers/utils/attr.js";
+import { isAllowedMediaEmbed } from "../../is-allowed-media-embed.js";
 /**
  * Add `sandbox=""` attribute to all `<iframe>` elements in the editor content
  * @private
@@ -16,6 +17,12 @@ export function sandboxIframesInContent(jodit, nodeElm, hadEffect) {
         return hadEffect;
     }
     const elm = nodeElm;
+    // A trusted YouTube/Vimeo player (inserted via the Video button) must not
+    // get an empty `sandbox=""` — that blocks scripts and stops playback. It
+    // is served in its own third-party origin, so leave it as-is (#1381).
+    if (isAllowedMediaEmbed(attr(elm, 'src') || '')) {
+        return hadEffect;
+    }
     if (!elm.hasAttribute('sandbox')) {
         attr(elm, 'sandbox', '');
         return true;

package/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js

@@ -6,6 +6,8 @@
 import { IS_INLINE } from "../../../../../core/constants.js";
 import { Dom } from "../../../../../core/dom/dom.js";
 import { trimInv } from "../../../../../core/helpers/string/trim.js";
+import { attr } from "../../../../../core/helpers/utils/attr.js";
+import { isAllowedMediaEmbed } from "../../is-allowed-media-embed.js";
 /**
  * @private
  */
@@ -24,7 +26,13 @@ function isRemovableNode(jodit, node, current, allow, deny) {
         if (allow && !allow[node.nodeName]) {
             return true;
         }
-        if (!allow && deny && deny[node.nodeName]) {
+        // A YouTube/Vimeo player inserted through the Video button is trusted
+        // editor content, so keep it even though `iframe` is denied by default
+        // — otherwise the embed is stripped ~300ms after insertion (#1381).
+        // Arbitrary/bare iframes stay denied.
+        const isTrustedEmbed = node.nodeName === 'IFRAME' &&
+            isAllowedMediaEmbed(attr(node, 'src') || '');
+        if (!allow && deny && deny[node.nodeName] && !isTrustedEmbed) {
             return true;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.12.41",
+	"version": "4.12.43",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/plugins/clean-html/helpers/index.d.ts

@@ -7,6 +7,7 @@
  * @module plugins/clean-html
  */
 export * from "./get-hash";
+export * from "./is-allowed-media-embed";
 export * from "./remove-format/remove-format-for-collapsed-selection";
 export * from "./remove-format/remove-format-for-selection";
 export * from "./visitor/visit-node-walker";

package/types/plugins/clean-html/helpers/is-allowed-media-embed.d.ts

@@ -0,0 +1,15 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * Whether an `<iframe>` `src` points at a recognized YouTube/Vimeo video
+ * player. Such iframes are inserted intentionally through the Video button, so
+ * clean-html must not strip them (`denyTags` includes `iframe` by default) or
+ * neutralize them with an empty `sandbox=""` (#1381). Arbitrary/bare iframes
+ * are still removed.
+ *
+ * @private
+ */
+export declare function isAllowedMediaEmbed(src: string): boolean;