jodit 4.13.3 → 4.13.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +24 -0
- package/es2015/jodit.css +1 -1
- package/es2015/jodit.fat.min.js +14 -14
- package/es2015/jodit.js +17 -8
- package/es2015/jodit.min.js +4 -4
- package/es2015/plugins/debug/debug.css +1 -1
- package/es2015/plugins/debug/debug.js +1 -1
- package/es2015/plugins/debug/debug.min.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2018/jodit.fat.min.js +4 -4
- package/es2018/jodit.min.js +4 -4
- package/es2018/plugins/debug/debug.min.js +1 -1
- package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021/jodit.css +1 -1
- package/es2021/jodit.fat.min.js +5 -5
- package/es2021/jodit.js +17 -8
- package/es2021/jodit.min.js +5 -5
- package/es2021/plugins/debug/debug.css +1 -1
- package/es2021/plugins/debug/debug.js +1 -1
- package/es2021/plugins/debug/debug.min.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021.en/jodit.css +1 -1
- package/es2021.en/jodit.fat.min.js +5 -5
- package/es2021.en/jodit.js +17 -8
- package/es2021.en/jodit.min.js +5 -5
- package/es2021.en/plugins/debug/debug.css +1 -1
- package/es2021.en/plugins/debug/debug.js +1 -1
- package/es2021.en/plugins/debug/debug.min.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/jodit.css +2 -2
- package/es5/jodit.fat.min.js +2 -2
- package/es5/jodit.js +17 -8
- package/es5/jodit.min.css +2 -2
- package/es5/jodit.min.js +2 -2
- package/es5/plugins/debug/debug.css +1 -1
- package/es5/plugins/debug/debug.js +1 -1
- package/es5/plugins/debug/debug.min.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/polyfills.fat.min.js +1 -1
- package/es5/polyfills.js +1 -1
- package/es5/polyfills.min.js +1 -1
- package/esm/core/constants.js +1 -1
- package/esm/core/helpers/html/safe-html.js +3 -2
- package/esm/modules/toolbar/button/button.js +2 -1
- package/esm/plugins/clean-html/helpers/visitor/filters/try-remove-node.js +10 -3
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,30 @@
|
|
|
9
9
|
> - :house: [Internal]
|
|
10
10
|
> - :nail_care: [Polish]
|
|
11
11
|
|
|
12
|
+
## 4.13.6
|
|
13
|
+
|
|
14
|
+
#### :bug: Bug Fix
|
|
15
|
+
|
|
16
|
+
- **Security / clean-html**: a `<script>` nested directly inside `<svg>` (or MathML) is now removed by `denyTags`. The deny/allow tag filter matched `node.nodeName` against an upper-cased hash, but foreign-namespaced elements keep their original case (an SVG `<script>` reports `"script"`, not `"SCRIPT"`), so the script slipped through the default `denyTags` and executed when the value was loaded into the editor. The lookup now normalises the tag name to upper case, so namespace can't bypass the filter — while still honouring `allowTags`. Fixes GHSA-45qg-252v-3f7p. Thanks to Roman Kis for the report.
|
|
17
|
+
- **Toolbar**: fixed `TypeError: Cannot redefine property: component` thrown when the editor is created with `cache: false`. `ToolbarButton.createContainer` (decorated with `@cacheHTML`) defined the `component` back-reference on the button element without `configurable`, i.e. non-configurable. With caching enabled the container is cloned (which drops the property), hiding the problem; with `cache: false` the container isn't cloned, so a button built after an editor became ready reached the constructor still carrying that non-configurable property and the constructor's redefine threw. The property is now defined as configurable, matching the base `UIElement`.
|
|
18
|
+
|
|
19
|
+
## 4.13.5
|
|
20
|
+
|
|
21
|
+
#### :house: Internal
|
|
22
|
+
|
|
23
|
+
- **Build**: pin the ESM build to the project's TypeScript (`node_modules/.bin/tsc`) instead of a bare `tsc` resolved from `PATH`. The `4.13.4` publish build broke after the GitHub runner image began shipping a newer global TypeScript that rejects options (`baseUrl`, `downlevelIteration`, `moduleResolution: "node"`) which the project's pinned TypeScript 6.0.2 still accepts. This re-releases the 4.13.4 security fixes, which never reached npm.
|
|
24
|
+
|
|
25
|
+
## 4.13.4
|
|
26
|
+
|
|
27
|
+
#### :bug: Bug Fix
|
|
28
|
+
|
|
29
|
+
- **Security / clean-html**: HTML smuggled into MathML/SVG (e.g. `<math><mglyph><html><body onload>`) is now stripped even when clean-html parses the fragment in a disconnected sandbox (`useIframeSandbox: false`). The guard used `isConnected`, which is `false` for a detached parse box, so the smuggled node slipped through; it now uses `box.contains()`. Fixes GHSA-rxcw-mc6f-6hr3 (mutation XSS via MathML/style rawtext carrier). Thanks @MatrixNeoKozak (#1380).
|
|
30
|
+
- **safeHTML**: guard `location` access when neutralising `javascript:` links so `sanitizeHTMLElement` no longer throws a `ReferenceError` in SSR / Node environments where `location` is undefined (#1380).
|
|
31
|
+
|
|
32
|
+
#### :house: Internal
|
|
33
|
+
|
|
34
|
+
- **Dependencies**: security bumps for `tar` 7.5.16, `form-data` 4.0.6, `js-yaml` 4.3.0, `launch-editor` 2.14.1, `webpack-dev-server` 5.2.5 (+ `http-proxy-middleware` 2.0.9), `ws` 8.21.1 / `engine.io` 6.6.9 / `socket.io-adapter` 2.5.8, and `websocket-driver` 0.7.5 (Dependabot alerts #189–#197). All dev/test-only. (#1373, #1374, #1375, #1376, #1377, #1382, #1383)
|
|
35
|
+
|
|
12
36
|
## 4.13.3
|
|
13
37
|
|
|
14
38
|
#### :rocket: New Feature
|
package/es2015/jodit.css
CHANGED