jodit 4.14.4 → 4.14.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (187) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/es2015/jodit.css +1 -1
  3. package/es2015/jodit.fat.min.js +9 -9
  4. package/es2015/jodit.js +49 -34
  5. package/es2015/jodit.min.js +9 -9
  6. package/es2015/plugins/debug/debug.css +1 -1
  7. package/es2015/plugins/debug/debug.js +1 -1
  8. package/es2015/plugins/debug/debug.min.js +1 -1
  9. package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
  10. package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
  11. package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
  12. package/es2018/jodit.fat.min.js +9 -9
  13. package/es2018/jodit.min.js +9 -9
  14. package/es2018/plugins/debug/debug.min.js +1 -1
  15. package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
  16. package/es2021/jodit.css +1 -1
  17. package/es2021/jodit.fat.min.js +10 -10
  18. package/es2021/jodit.js +49 -34
  19. package/es2021/jodit.min.js +10 -10
  20. package/es2021/plugins/debug/debug.css +1 -1
  21. package/es2021/plugins/debug/debug.js +1 -1
  22. package/es2021/plugins/debug/debug.min.js +1 -1
  23. package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
  24. package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
  25. package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
  26. package/es2021.en/jodit.css +1 -1
  27. package/es2021.en/jodit.fat.min.js +10 -10
  28. package/es2021.en/jodit.js +49 -34
  29. package/es2021.en/jodit.min.js +10 -10
  30. package/es2021.en/plugins/debug/debug.css +1 -1
  31. package/es2021.en/plugins/debug/debug.js +1 -1
  32. package/es2021.en/plugins/debug/debug.min.js +1 -1
  33. package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
  34. package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
  35. package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
  36. package/es5/jodit.css +2 -2
  37. package/es5/jodit.fat.min.js +2 -2
  38. package/es5/jodit.js +49 -34
  39. package/es5/jodit.min.css +2 -2
  40. package/es5/jodit.min.js +2 -2
  41. package/es5/plugins/debug/debug.css +1 -1
  42. package/es5/plugins/debug/debug.js +1 -1
  43. package/es5/plugins/debug/debug.min.js +1 -1
  44. package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
  45. package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
  46. package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
  47. package/es5/polyfills.fat.min.js +1 -1
  48. package/es5/polyfills.js +1 -1
  49. package/es5/polyfills.min.js +1 -1
  50. package/esm/core/constants.js +1 -1
  51. package/esm/core/dom/dom.js +2 -2
  52. package/esm/core/global.js +1 -1
  53. package/esm/core/helpers/checker/has-browser-color-picker.js +1 -1
  54. package/esm/core/helpers/html/apply-styles.js +1 -1
  55. package/esm/core/helpers/string/fuzzy-search-index.js +1 -1
  56. package/esm/core/helpers/utils/set.js +2 -2
  57. package/esm/core/storage/async-storage.js +1 -3
  58. package/esm/core/ui/popup/popup.js +1 -1
  59. package/esm/modules/image-editor/image-editor.js +1 -1
  60. package/esm/modules/table/table.js +2 -2
  61. package/esm/modules/widget/file-selector/file-selector.js +0 -1
  62. package/esm/plugins/ai-assistant/langs/en.js +1 -1
  63. package/esm/plugins/ai-assistant/langs/es.js +1 -1
  64. package/esm/plugins/backspace/cases/check-remove-char.js +0 -1
  65. package/esm/plugins/clean-html/helpers/visitor/filters/replace-old-tags.js +0 -1
  66. package/esm/plugins/color/config.js +1 -1
  67. package/esm/plugins/copy-format/langs/ar.js +1 -1
  68. package/esm/plugins/copy-format/langs/cs_cz.js +1 -1
  69. package/esm/plugins/copy-format/langs/de.js +1 -1
  70. package/esm/plugins/copy-format/langs/es.js +1 -1
  71. package/esm/plugins/copy-format/langs/fa.js +1 -1
  72. package/esm/plugins/copy-format/langs/fi.js +1 -1
  73. package/esm/plugins/copy-format/langs/fr.js +1 -1
  74. package/esm/plugins/copy-format/langs/he.js +1 -1
  75. package/esm/plugins/copy-format/langs/hu.js +1 -1
  76. package/esm/plugins/copy-format/langs/id.js +1 -1
  77. package/esm/plugins/copy-format/langs/it.js +1 -1
  78. package/esm/plugins/copy-format/langs/ja.js +1 -1
  79. package/esm/plugins/copy-format/langs/ko.js +1 -1
  80. package/esm/plugins/copy-format/langs/mn.js +1 -1
  81. package/esm/plugins/copy-format/langs/nl.js +1 -1
  82. package/esm/plugins/copy-format/langs/pl.js +1 -1
  83. package/esm/plugins/copy-format/langs/pt_br.js +1 -1
  84. package/esm/plugins/copy-format/langs/ru.js +1 -1
  85. package/esm/plugins/copy-format/langs/tr.js +1 -1
  86. package/esm/plugins/copy-format/langs/zh_cn.js +1 -1
  87. package/esm/plugins/copy-format/langs/zh_tw.js +1 -1
  88. package/esm/plugins/iframe/iframe.js +28 -9
  89. package/esm/plugins/line-height/langs/ar.js +1 -1
  90. package/esm/plugins/line-height/langs/cs_cz.js +1 -1
  91. package/esm/plugins/line-height/langs/de.js +1 -1
  92. package/esm/plugins/line-height/langs/es.js +1 -1
  93. package/esm/plugins/line-height/langs/fa.js +1 -1
  94. package/esm/plugins/line-height/langs/fi.js +1 -1
  95. package/esm/plugins/line-height/langs/fr.js +1 -1
  96. package/esm/plugins/line-height/langs/he.js +1 -1
  97. package/esm/plugins/line-height/langs/hu.js +1 -1
  98. package/esm/plugins/line-height/langs/id.js +1 -1
  99. package/esm/plugins/line-height/langs/it.js +1 -1
  100. package/esm/plugins/line-height/langs/ja.js +1 -1
  101. package/esm/plugins/line-height/langs/ko.js +1 -1
  102. package/esm/plugins/line-height/langs/mn.js +1 -1
  103. package/esm/plugins/line-height/langs/nl.js +1 -1
  104. package/esm/plugins/line-height/langs/pl.js +1 -1
  105. package/esm/plugins/line-height/langs/pt_br.js +1 -1
  106. package/esm/plugins/line-height/langs/ru.js +1 -1
  107. package/esm/plugins/line-height/langs/sk.js +1 -1
  108. package/esm/plugins/line-height/langs/tr.js +1 -1
  109. package/esm/plugins/line-height/langs/ua.js +1 -1
  110. package/esm/plugins/line-height/langs/zh_cn.js +1 -1
  111. package/esm/plugins/line-height/langs/zh_tw.js +1 -1
  112. package/esm/plugins/resize-cells/resize-cells.js +2 -2
  113. package/esm/plugins/resizer/resizer.js +1 -1
  114. package/esm/plugins/search/helpers/sentence-finder.js +1 -1
  115. package/esm/plugins/source/source.js +1 -1
  116. package/esm/plugins/speech-recognize/langs/ar.js +1 -1
  117. package/esm/plugins/speech-recognize/langs/cs_cz.js +1 -1
  118. package/esm/plugins/speech-recognize/langs/de.js +1 -1
  119. package/esm/plugins/speech-recognize/langs/es.js +1 -1
  120. package/esm/plugins/speech-recognize/langs/fa.js +1 -1
  121. package/esm/plugins/speech-recognize/langs/fi.js +1 -1
  122. package/esm/plugins/speech-recognize/langs/fr.js +1 -1
  123. package/esm/plugins/speech-recognize/langs/he.js +1 -1
  124. package/esm/plugins/speech-recognize/langs/hu.js +1 -1
  125. package/esm/plugins/speech-recognize/langs/id.js +1 -1
  126. package/esm/plugins/speech-recognize/langs/it.js +1 -1
  127. package/esm/plugins/speech-recognize/langs/ja.js +1 -1
  128. package/esm/plugins/speech-recognize/langs/ko.js +1 -1
  129. package/esm/plugins/speech-recognize/langs/mn.js +1 -1
  130. package/esm/plugins/speech-recognize/langs/nl.js +1 -1
  131. package/esm/plugins/speech-recognize/langs/no.js +1 -1
  132. package/esm/plugins/speech-recognize/langs/pl.js +1 -1
  133. package/esm/plugins/speech-recognize/langs/pt_br.js +1 -1
  134. package/esm/plugins/speech-recognize/langs/ru.js +1 -1
  135. package/esm/plugins/speech-recognize/langs/sk.js +1 -1
  136. package/esm/plugins/speech-recognize/langs/tr.js +1 -1
  137. package/esm/plugins/speech-recognize/langs/ua.js +1 -1
  138. package/esm/plugins/speech-recognize/langs/zh_cn.js +1 -1
  139. package/esm/plugins/speech-recognize/langs/zh_tw.js +1 -1
  140. package/esm/plugins/spellcheck/langs/ar.js +1 -1
  141. package/esm/plugins/spellcheck/langs/cs_cz.js +1 -1
  142. package/esm/plugins/spellcheck/langs/de.js +1 -1
  143. package/esm/plugins/spellcheck/langs/es.js +1 -1
  144. package/esm/plugins/spellcheck/langs/fa.js +1 -1
  145. package/esm/plugins/spellcheck/langs/fi.js +1 -1
  146. package/esm/plugins/spellcheck/langs/fr.js +1 -1
  147. package/esm/plugins/spellcheck/langs/he.js +1 -1
  148. package/esm/plugins/spellcheck/langs/hu.js +1 -1
  149. package/esm/plugins/spellcheck/langs/id.js +1 -1
  150. package/esm/plugins/spellcheck/langs/it.js +1 -1
  151. package/esm/plugins/spellcheck/langs/ja.js +1 -1
  152. package/esm/plugins/spellcheck/langs/ko.js +1 -1
  153. package/esm/plugins/spellcheck/langs/mn.js +1 -1
  154. package/esm/plugins/spellcheck/langs/nl.js +1 -1
  155. package/esm/plugins/spellcheck/langs/no.js +1 -1
  156. package/esm/plugins/spellcheck/langs/pl.js +1 -1
  157. package/esm/plugins/spellcheck/langs/pt_br.js +1 -1
  158. package/esm/plugins/spellcheck/langs/ru.js +1 -1
  159. package/esm/plugins/spellcheck/langs/sk.js +1 -1
  160. package/esm/plugins/spellcheck/langs/tr.js +1 -1
  161. package/esm/plugins/spellcheck/langs/ua.js +1 -1
  162. package/esm/plugins/spellcheck/langs/zh_cn.js +1 -1
  163. package/esm/plugins/spellcheck/langs/zh_tw.js +1 -1
  164. package/esm/plugins/symbols/langs/ar.js +1 -1
  165. package/esm/plugins/symbols/langs/cs_cz.js +1 -1
  166. package/esm/plugins/symbols/langs/de.js +1 -1
  167. package/esm/plugins/symbols/langs/es.js +1 -1
  168. package/esm/plugins/symbols/langs/fa.js +1 -1
  169. package/esm/plugins/symbols/langs/fi.js +1 -1
  170. package/esm/plugins/symbols/langs/fr.js +1 -1
  171. package/esm/plugins/symbols/langs/he.js +1 -1
  172. package/esm/plugins/symbols/langs/hu.js +1 -1
  173. package/esm/plugins/symbols/langs/id.js +1 -1
  174. package/esm/plugins/symbols/langs/it.js +1 -1
  175. package/esm/plugins/symbols/langs/ja.js +1 -1
  176. package/esm/plugins/symbols/langs/ko.js +1 -1
  177. package/esm/plugins/symbols/langs/mn.js +1 -1
  178. package/esm/plugins/symbols/langs/nl.js +1 -1
  179. package/esm/plugins/symbols/langs/pl.js +1 -1
  180. package/esm/plugins/symbols/langs/pt_br.js +1 -1
  181. package/esm/plugins/symbols/langs/ru.js +1 -1
  182. package/esm/plugins/symbols/langs/tr.js +1 -1
  183. package/esm/plugins/symbols/langs/ua.js +1 -1
  184. package/esm/plugins/symbols/langs/zh_cn.js +1 -1
  185. package/esm/plugins/symbols/langs/zh_tw.js +1 -1
  186. package/esm/plugins/table/config.js +1 -1
  187. package/package.json +4 -1
package/CHANGELOG.md CHANGED
@@ -9,6 +9,21 @@
9
9
  > - :house: [Internal]
10
10
  > - :nail_care: [Polish]
11
11
 
12
+ ## 4.14.6
13
+
14
+ #### :bug: Bug Fix
15
+
16
+ - **Security / iframe (`editHTMLDocumentMode`, stored XSS, CWE-79)**: with `iframe: true` and `editHTMLDocumentMode: true` a full HTML document assigned to `editor.value` was written straight into the live iframe document with `document.write()`, and `safeHTML` was only applied afterwards. Inline `<script>` elements and `on*` handlers therefore executed while the document was being parsed — before the sanitizer could remove them — in an iframe that is same-origin with the host page by default (`iframeSandbox: null`), so an attacker-supplied document could run script in the host application's origin as soon as another user opened it. The document is now parsed in an inert `DOMParser` document (no browsing context: nothing executes, no sub-resources are fetched), sanitized there via the `safeHTML` event, and only then adopted into the live iframe document; nodes coming from an inert parser are flagged "already started", so even a `<script>` the cleaner is configured to keep never executes — the same guarantee `innerHTML` gives in the regular mode. A partial value (no `<html>`/`<body>`) in that mode was also assigned to `doc.body.innerHTML` unsanitized before `clean-html` ran, which fired e.g. `<img onerror>`; it now goes through the regular sanitized path. Affected all versions with `editHTMLDocumentMode` through 4.14.5. Responsibly reported by [@bp0lr](https://github.com/bp0lr) (GHSA-w3xv-x3fm-59ph).
17
+
18
+ ## 4.14.5
19
+
20
+ #### :house: Internal
21
+
22
+ - Upgraded ESLint 9 to 10 and `@eslint/js` 9 to 10. Replaced the unmaintained `eslint-plugin-import` with ESLint 10-compatible `eslint-plugin-import-x` 4, removed the obsolete compatibility wrapper, and upgraded `eslint-plugin-mocha` to 12 and Mocha to 12.
23
+ - Migrated the release/build scripts from the vulnerable `replace` package to `replace-in-file` 9. ESLint 10's new checks removed redundant assignments and test errors now preserve their original `cause`.
24
+ - Updated the screenshot-test image and its packages to Playwright 1.63.0 and refreshed affected browser snapshots. Fixed the Make target so `updateTests=false` no longer enables snapshot updates. Forced the patched `qs` 6.16.0 for Karma's server dependencies; `npm audit` now reports no known vulnerabilities.
25
+ - Kept TypeScript at 6.0.3 because typescript-eslint does not yet support TypeScript 7 and the project build tools use the compiler API removed from TypeScript 7. Kept `cssnano-preset-advanced` at 8.0.10 because version 9 fails while loading its `caniuse-api` dependency under the TypeScript Webpack configuration.
26
+
12
27
  ## 4.14.4
13
28
 
14
29
  #### :house: Internal
package/es2015/jodit.css CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.14.4
4
+ * Version: v4.14.6
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */