jodit 4.14.4 → 4.14.6

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.4
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -2107,7 +2107,7 @@ __webpack_require__.r(__webpack_exports__);
  * @packageDocumentation
  * @module constants
  */ 
-var APP_VERSION = "4.14.4";
+var APP_VERSION = "4.14.6";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -3482,7 +3482,7 @@ var TEMP_ELEMENT_REG_EXP = new RegExp("<([a-z]+)[^>]+".concat(jodit_core_constan
                 var first = current;
                 var last = current;
                 editor.s.save();
-                var needFindNext = false;
+                var needFindNext;
                 do {
                     needFindNext = false;
                     tmp = last.nextSibling;
@@ -3523,7 +3523,7 @@ var TEMP_ELEMENT_REG_EXP = new RegExp("<([a-z]+)[^>]+".concat(jodit_core_constan
                 var first = current;
                 var last = current;
                 editor.s.save();
-                var needFindNext = false;
+                var needFindNext;
                 do {
                     needFindNext = false;
                     tmp = first.previousSibling;
@@ -5698,7 +5698,7 @@ var boxes = new WeakMap();
     var name = (0,jodit_core_helpers_checker_is_string__WEBPACK_IMPORTED_MODULE_1__.isString)(classFunc) ? classFunc : classFunc ? (0,jodit_core_helpers_utils_get_class_name__WEBPACK_IMPORTED_MODULE_6__.getClassName)(classFunc.prototype) : 'jodit-utils';
     var data = boxes.get(jodit) || {}, key = name + tag;
     var view = (0,jodit_core_helpers_checker_is_view_object__WEBPACK_IMPORTED_MODULE_2__.isViewObject)(jodit) ? jodit : jodit.j;
-    var body = null;
+    var body;
     if (!data[key]) {
         var c = view.c;
         body = getPopupViewRoot(view.o, view.container, jodit.od.body);
@@ -5956,7 +5956,7 @@ var boxes = new WeakMap();
 /**
  * Check if browser has a color picker (a new HTML5 attribute for input tag)
  */ function hasBrowserColorPicker() {
-    var supportsColor = true;
+    var supportsColor;
     try {
         var a = jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('input');
         a.type = 'color';
@@ -6801,7 +6801,7 @@ function normalizeCSS(s) {
     var iframe = jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('iframe');
     (0,jodit_core_helpers_utils_css__WEBPACK_IMPORTED_MODULE_4__.css)(iframe, 'display', 'none');
     jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_1__.Dom.append(jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.body, iframe);
-    var convertedString = '', collection = [];
+    var convertedString = '', collection;
     try {
         var iframeDoc = iframe.contentDocument || (iframe.contentWindow ? iframe.contentWindow.document : null);
         if (iframeDoc) {
@@ -8210,7 +8210,7 @@ function size(subject) {
  * Unlike `indexOf` ignores INVISIBLE_SPACE and may fail at `maxDistance` characters
  */ function fuzzySearchIndex(needle, haystack) {
     var offset = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : 0, maxDistance = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : 1;
-    var i = 0, j = 0, startIndex = -1, len = 0, errorDistance = 0;
+    var i = 0, j, startIndex = -1, len = 0, errorDistance = 0;
     for(j = offset; i < needle.length && j < haystack.length;){
         if (needle[i].toLowerCase() === haystack[j].toLowerCase()) {
             i++;
@@ -10497,9 +10497,9 @@ var $$temp = function $$temp() {
     if (parts.some(_is_unsafe_proto_key__WEBPACK_IMPORTED_MODULE_4__.isUnsafeProtoKey)) {
         return;
     }
-    var result = obj, key = parts[0];
+    var result = obj;
     for(var i = 0; i < parts.length - 1; i += 1){
-        key = parts[i];
+        var key = parts[i];
         if (!(0,jodit_core_helpers_checker_is_array__WEBPACK_IMPORTED_MODULE_0__.isArray)(result[key]) && !(0,jodit_core_helpers_checker_is_plain_object__WEBPACK_IMPORTED_MODULE_2__.isPlainObject)(result[key])) {
             result[key] = (0,jodit_core_helpers_checker_is_numeric__WEBPACK_IMPORTED_MODULE_1__.isNumeric)(parts[i + 1]) ? [] : {};
         }
@@ -15604,7 +15604,6 @@ var AsyncStorage = /*#__PURE__*/ function() {
             value: function makeStorage() {
                 var persistentOrStrategy = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : false, suffix = arguments.length > 1 ? arguments[1] : void 0, options = arguments.length > 2 ? arguments[2] : void 0;
                 var provider = undefined;
-                var storage = null;
                 // An explicit `defaultProvider` overrides the strategy-based selection
                 // below and decides which provider backs the storage.
                 var defaultProvider = options === null || options === void 0 ? void 0 : options.defaultProvider;
@@ -15631,8 +15630,7 @@ var AsyncStorage = /*#__PURE__*/ function() {
                 if (!provider) {
                     provider = new _engines_memory_storage_provider__WEBPACK_IMPORTED_MODULE_8__.MemoryStorageProvider();
                 }
-                storage = new AsyncStorage(Promise.resolve(provider), suffix);
-                return storage;
+                return new AsyncStorage(Promise.resolve(provider), suffix);
             }
         }
     ]);
@@ -20255,7 +20253,7 @@ var Popup = /*#__PURE__*/ function(UIGroup) {
                     };
                 };
                 var getMatchStrategy = function getMatchStrategy(inBox) {
-                    var strategy = null;
+                    var strategy;
                     if (Popup.boxInView(getPointByStrategy(defaultStrategy), inBox)) {
                         strategy = defaultStrategy;
                     } else {
@@ -27292,7 +27290,7 @@ var ImageEditor = /*#__PURE__*/ function(ViewComponent) {
             h: 0
         }), (0,_swc_helpers_define_property__WEBPACK_IMPORTED_MODULE_3__._)(_this, "calcCropBox", function() {
             var node = _this.crop_box.parentNode, w = node.offsetWidth * 0.8, h = node.offsetHeight * 0.8;
-            var wn = w, hn = h;
+            var wn, hn;
             var nw = _this.naturalWidth, nh = _this.naturalHeight;
             if (w > nw && h > nh) {
                 wn = nw;
@@ -28971,8 +28969,8 @@ var Table = /*#__PURE__*/ function(ViewComponent) {
         {
             key: "__removeExtraRowspans",
             value: function __removeExtraRowspans(box, marked) {
-                var i = 0;
-                var j = 0;
+                var i;
+                var j;
                 for(i = 0; i < box.length; i += 1){
                     var min = 1000000;
                     var not = false;
@@ -31503,7 +31501,6 @@ jodit_core_ui__WEBPACK_IMPORTED_MODULE_2__.Icon.set('palette', (_palette_svg__WE
                 button
             ])
         ]);
-        currentImage = null;
         if (elm && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isText(elm) && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isComment(elm) && (jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(elm, 'img') || (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_1__.$$)('img', elm).length)) {
             currentImage = elm.tagName === 'IMG' ? elm : (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_1__.$$)('img', elm)[0];
             val(form.container, 'url', (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_1__.attr)(currentImage, 'src'));
@@ -33122,7 +33119,6 @@ function checkRemoveChar(jodit, fakeNode, backspace, mode) {
     }
     if (removeNeighbor) {
         jodit_core_dom__WEBPACK_IMPORTED_MODULE_1__.Dom.safeRemove(removeNeighbor);
-        removeNeighbor = null;
     }
     if (charRemoved) {
         removeEmptyForParent(fakeNode, 'a');
@@ -34811,7 +34807,6 @@ __webpack_require__.r(__webpack_exports__);
  */ function replaceOldTags(jodit, nodeElm, hadEffect) {
     var newNodeElm = replaceIfMatched(jodit, nodeElm, jodit.o.cleanHTML.replaceOldTags);
     if (nodeElm !== newNodeElm) {
-        nodeElm = newNodeElm;
         return true;
     }
     return hadEffect;
@@ -35549,7 +35544,7 @@ jodit_config__WEBPACK_IMPORTED_MODULE_3__.Config.prototype.controls.brush = {
         button.state.activated = false;
     },
     popup: function popup(editor, current, close, button) {
-        var colorHEX = '', bg_color = '', tabs = [], currentElement = null;
+        var colorHEX = '', bg_color = '', tabs, currentElement = null;
         if (current && current !== editor.editor && jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isNode(current)) {
             if (jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(current) && editor.s.isCollapsed() && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(current, new Set([
                 'br',
@@ -38813,6 +38808,25 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                 }
                 return html;
             };
+            /**
+				 * Replace the whole iframe document with the given HTML.
+				 *
+				 * The markup is parsed in an inert document first (no browsing
+				 * context: scripts do not run, sub-resources are not fetched),
+				 * sanitized there via `safeHTML`, and only then moved into the
+				 * live document. `document.write` on the live document would
+				 * execute inline scripts and event handlers while parsing,
+				 * before the sanitizer had a chance to strip them, and the
+				 * iframe is same-origin with the host page by default.
+				 * A `<script>` the cleaner is configured to keep still never
+				 * executes: nodes coming from an inert parser are flagged
+				 * "already started", exactly like `innerHTML`.
+				 * See GHSA-w3xv-x3fm-59ph.
+				 */ var replaceDocument = function replaceDocument(html) {
+                var inert = new DOMParser().parseFromString(html, 'text/html');
+                editor.e.fire('safeHTML', inert.documentElement);
+                doc.replaceChild(doc.adoptNode(inert.documentElement), doc.documentElement);
+            };
             if (docMode) {
                 var tag = editor.element.tagName;
                 if (tag !== 'TEXTAREA' && tag !== 'INPUT') {
@@ -38828,19 +38842,20 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                     if (/<(html|body)/i.test(value)) {
                         var old = doc.documentElement.outerHTML;
                         if (clearMarkers(old) !== clearMarkers(value)) {
-                            doc.open();
-                            doc.write(editor.o.iframeDoctype + clearMarkers(value));
-                            doc.close();
+                            replaceDocument(clearMarkers(value));
                             editor.editor = doc.body;
-                            editor.e.fire('safeHTML', editor.editor);
                             toggleEditable();
                             editor.e.fire('prepareWYSIWYGEditor');
                             editor.e.stopPropagation('beforeSetNativeEditorValue');
                         }
-                    } else {
-                        doc.body.innerHTML = value;
+                        return true;
                     }
-                    return true;
+                    // A partial value goes through the regular
+                    // path: `clean-html` sanitizes it and the
+                    // editor assigns it to `doc.body` via
+                    // `innerHTML`. Writing the raw value here
+                    // would fire its event handlers first.
+                    return false;
                 }, {
                     top: true
                 });
@@ -46142,11 +46157,11 @@ var key = 'table_processor_observer-resize';
                 this.startX = event.clientX;
                 this.j.lock(key);
                 this.resizeHandler.classList.add('jodit-table-resizer_moved');
-                var box, tableBox = this.workTable.getBoundingClientRect();
+                var box;
                 this.minX = 0;
                 this.maxX = 1000000;
                 if (this.wholeTable != null) {
-                    tableBox = this.workTable.parentNode.getBoundingClientRect();
+                    var tableBox = this.workTable.parentNode.getBoundingClientRect();
                     this.minX = tableBox.left;
                     this.maxX = this.minX + tableBox.width;
                 } else {
@@ -46821,7 +46836,7 @@ var keyBInd = '__jodit-resizer_binded';
                         diff_y = this.pointerY - this.startY;
                     }
                     var className = this.handle.className;
-                    var new_w = 0, new_h = 0;
+                    var new_w, new_h;
                     var uar = this.j.o.resizer.useAspectRatio;
                     if (!this.isAltMode && (uar === true || uar && jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_9__.Dom.isTag(this.element, uar))) {
                         if (diff_x) {
@@ -47430,7 +47445,7 @@ var SentenceFinder = /*#__PURE__*/ function() {
             value: function ranges(needle) {
                 var position = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : 0;
                 var results = [];
-                var index = position, len = 0, startQueueIndex = 0;
+                var index = position, len, startQueueIndex = 0;
                 // Find all ranges in substring
                 do {
                     var ref;
@@ -50321,7 +50336,7 @@ var SourceEditor = /*#__PURE__*/ function() {
                     return;
                 }
                 var value = this.getMirrorValue();
-                var selectionStart = 0, selectionEnd = 0;
+                var selectionStart, selectionEnd;
                 try {
                     value = value.replace(/<span[^>]+data-jodit-selection_marker=(["'])start\1[^>]*>[<>]*?<\/span>/gim, this.tempMarkerStart).replace(/<span[^>]+data-jodit-selection_marker=(["'])end\1[^>]*>[<>]*?<\/span>/gim, this.tempMarkerEnd);
                     if (!this.j.o.editHTMLDocumentMode && this.j.o.beautifyHTML) {
@@ -52753,7 +52768,7 @@ jodit_config__WEBPACK_IMPORTED_MODULE_6__.Config.prototype.controls.table = {
                 return;
             }
             var index = parseInt((0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_4__.attr)(e.target, '-index') || '0', 10), row = Math.floor(index / default_cols_count), col = index % default_cols_count;
-            var nextIndex = index;
+            var nextIndex;
             switch(e.key){
                 case jodit_core_constants__WEBPACK_IMPORTED_MODULE_1__.KEY_LEFT:
                     nextIndex = col > 0 ? index - 1 : index;

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.4
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
 	/*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.4
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */