jodit 4.14.4 → 4.14.6

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.4
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -1785,7 +1785,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.14.4";
+ */ const APP_VERSION = "4.14.6";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -3085,7 +3085,7 @@ const TEMP_ELEMENT_REG_EXP = new RegExp(`<([a-z]+)[^>]+${jodit_core_constants__W
         const first = current;
         let last = current;
         editor.s.save();
-        let needFindNext = false;
+        let needFindNext;
         do {
             needFindNext = false;
             tmp = last.nextSibling;
@@ -3120,7 +3120,7 @@ const TEMP_ELEMENT_REG_EXP = new RegExp(`<([a-z]+)[^>]+${jodit_core_constants__W
         let first = current;
         let last = current;
         editor.s.save();
-        let needFindNext = false;
+        let needFindNext;
         do {
             needFindNext = false;
             tmp = first.previousSibling;
@@ -4800,7 +4800,7 @@ const boxes = new WeakMap();
     const name = (0,jodit_core_helpers_checker_is_string__WEBPACK_IMPORTED_MODULE_1__.isString)(classFunc) ? classFunc : classFunc ? (0,jodit_core_helpers_utils_get_class_name__WEBPACK_IMPORTED_MODULE_6__.getClassName)(classFunc.prototype) : 'jodit-utils';
     const data = boxes.get(jodit) || {}, key = name + tag;
     const view = (0,jodit_core_helpers_checker_is_view_object__WEBPACK_IMPORTED_MODULE_2__.isViewObject)(jodit) ? jodit : jodit.j;
-    let body = null;
+    let body;
     if (!data[key]) {
         let c = view.c;
         body = getPopupViewRoot(view.o, view.container, jodit.od.body);
@@ -5049,7 +5049,7 @@ const boxes = new WeakMap();
 /**
  * Check if browser has a color picker (a new HTML5 attribute for input tag)
  */ function hasBrowserColorPicker() {
-    let supportsColor = true;
+    let supportsColor;
     try {
         const a = jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('input');
         a.type = 'color';
@@ -5883,7 +5883,7 @@ function normalizeCSS(s) {
     const iframe = jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.createElement('iframe');
     (0,jodit_core_helpers_utils_css__WEBPACK_IMPORTED_MODULE_4__.css)(iframe, 'display', 'none');
     jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_1__.Dom.append(jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.globalDocument.body, iframe);
-    let convertedString = '', collection = [];
+    let convertedString = '', collection;
     try {
         const iframeDoc = iframe.contentDocument || (iframe.contentWindow ? iframe.contentWindow.document : null);
         if (iframeDoc) {
@@ -7222,7 +7222,7 @@ function size(subject) {
  * Finds the position of the substring in the string, if any, and returns the length of the found subsequence.
  * Unlike `indexOf` ignores INVISIBLE_SPACE and may fail at `maxDistance` characters
  */ function fuzzySearchIndex(needle, haystack, offset = 0, maxDistance = 1) {
-    let i = 0, j = 0, startIndex = -1, len = 0, errorDistance = 0;
+    let i = 0, j, startIndex = -1, len = 0, errorDistance = 0;
     for(j = offset; i < needle.length && j < haystack.length;){
         if (needle[i].toLowerCase() === haystack[j].toLowerCase()) {
             i++;
@@ -9450,9 +9450,9 @@ const $$temp = ()=>{
     if (parts.some(_is_unsafe_proto_key__WEBPACK_IMPORTED_MODULE_4__.isUnsafeProtoKey)) {
         return;
     }
-    let result = obj, key = parts[0];
+    let result = obj;
     for(let i = 0; i < parts.length - 1; i += 1){
-        key = parts[i];
+        const key = parts[i];
         if (!(0,jodit_core_helpers_checker_is_array__WEBPACK_IMPORTED_MODULE_0__.isArray)(result[key]) && !(0,jodit_core_helpers_checker_is_plain_object__WEBPACK_IMPORTED_MODULE_2__.isPlainObject)(result[key])) {
             result[key] = (0,jodit_core_helpers_checker_is_numeric__WEBPACK_IMPORTED_MODULE_1__.isNumeric)(parts[i + 1]) ? [] : {};
         }
@@ -13545,7 +13545,6 @@ class AsyncStorage {
     }
     static makeStorage(persistentOrStrategy = false, suffix, options) {
         let provider = undefined;
-        let storage = null;
         // An explicit `defaultProvider` overrides the strategy-based selection
         // below and decides which provider backs the storage.
         const defaultProvider = options === null || options === void 0 ? void 0 : options.defaultProvider;
@@ -13570,8 +13569,7 @@ class AsyncStorage {
         if (!provider) {
             provider = new _engines_memory_storage_provider__WEBPACK_IMPORTED_MODULE_5__.MemoryStorageProvider();
         }
-        storage = new AsyncStorage(Promise.resolve(provider), suffix);
-        return storage;
+        return new AsyncStorage(Promise.resolve(provider), suffix);
     }
     constructor(provider, suffix){
         ;(0,_swc_helpers_define_property__WEBPACK_IMPORTED_MODULE_1__._)(this, "provider", void 0);
@@ -16821,7 +16819,7 @@ class Popup extends jodit_core_ui_group_group__WEBPACK_IMPORTED_MODULE_12__.UIGr
             };
         };
         const getMatchStrategy = (inBox)=>{
-            let strategy = null;
+            let strategy;
             if (Popup.boxInView(getPointByStrategy(defaultStrategy), inBox)) {
                 strategy = defaultStrategy;
             } else {
@@ -22833,7 +22831,7 @@ class ImageEditor extends jodit_core_component__WEBPACK_IMPORTED_MODULE_2__.View
             h: 0
         }), (0,_swc_helpers_define_property__WEBPACK_IMPORTED_MODULE_0__._)(this, "calcCropBox", ()=>{
             const node = this.crop_box.parentNode, w = node.offsetWidth * 0.8, h = node.offsetHeight * 0.8;
-            let wn = w, hn = h;
+            let wn, hn;
             const { naturalWidth: nw, naturalHeight: nh } = this;
             if (w > nw && h > nh) {
                 wn = nw;
@@ -24034,8 +24032,8 @@ class Table extends jodit_core_component__WEBPACK_IMPORTED_MODULE_2__.ViewCompon
         }
     }
     static __removeExtraRowspans(box, marked) {
-        let i = 0;
-        let j = 0;
+        let i;
+        let j;
         for(i = 0; i < box.length; i += 1){
             let min = 1000000;
             let not = false;
@@ -26190,7 +26188,6 @@ jodit_core_ui__WEBPACK_IMPORTED_MODULE_2__.Icon.set('palette', (_palette_svg__WE
                 button
             ])
         ]);
-        currentImage = null;
         if (elm && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isText(elm) && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isComment(elm) && (jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(elm, 'img') || (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_1__.$$)('img', elm).length)) {
             currentImage = elm.tagName === 'IMG' ? elm : (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_1__.$$)('img', elm)[0];
             val(form.container, 'url', (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_1__.attr)(currentImage, 'src'));
@@ -27611,7 +27608,6 @@ function checkRemoveChar(jodit, fakeNode, backspace, mode) {
     }
     if (removeNeighbor) {
         jodit_core_dom__WEBPACK_IMPORTED_MODULE_1__.Dom.safeRemove(removeNeighbor);
-        removeNeighbor = null;
     }
     if (charRemoved) {
         removeEmptyForParent(fakeNode, 'a');
@@ -29213,7 +29209,6 @@ __webpack_require__.r(__webpack_exports__);
  */ function replaceOldTags(jodit, nodeElm, hadEffect) {
     const newNodeElm = replaceIfMatched(jodit, nodeElm, jodit.o.cleanHTML.replaceOldTags);
     if (nodeElm !== newNodeElm) {
-        nodeElm = newNodeElm;
         return true;
     }
     return hadEffect;
@@ -29875,7 +29870,7 @@ jodit_config__WEBPACK_IMPORTED_MODULE_3__.Config.prototype.controls.brush = {
         button.state.activated = false;
     },
     popup: (editor, current, close, button)=>{
-        let colorHEX = '', bg_color = '', tabs = [], currentElement = null;
+        let colorHEX = '', bg_color = '', tabs, currentElement = null;
         if (current && current !== editor.editor && jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isNode(current)) {
             if (jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(current) && editor.s.isCollapsed() && !jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isTag(current, new Set([
                 'br',
@@ -32861,6 +32856,25 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                 }
                 return html;
             };
+            /**
+				 * Replace the whole iframe document with the given HTML.
+				 *
+				 * The markup is parsed in an inert document first (no browsing
+				 * context: scripts do not run, sub-resources are not fetched),
+				 * sanitized there via `safeHTML`, and only then moved into the
+				 * live document. `document.write` on the live document would
+				 * execute inline scripts and event handlers while parsing,
+				 * before the sanitizer had a chance to strip them, and the
+				 * iframe is same-origin with the host page by default.
+				 * A `<script>` the cleaner is configured to keep still never
+				 * executes: nodes coming from an inert parser are flagged
+				 * "already started", exactly like `innerHTML`.
+				 * See GHSA-w3xv-x3fm-59ph.
+				 */ const replaceDocument = (html)=>{
+                const inert = new DOMParser().parseFromString(html, 'text/html');
+                editor.e.fire('safeHTML', inert.documentElement);
+                doc.replaceChild(doc.adoptNode(inert.documentElement), doc.documentElement);
+            };
             if (docMode) {
                 const tag = editor.element.tagName;
                 if (tag !== 'TEXTAREA' && tag !== 'INPUT') {
@@ -32873,19 +32887,20 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                     if (/<(html|body)/i.test(value)) {
                         const old = doc.documentElement.outerHTML;
                         if (clearMarkers(old) !== clearMarkers(value)) {
-                            doc.open();
-                            doc.write(editor.o.iframeDoctype + clearMarkers(value));
-                            doc.close();
+                            replaceDocument(clearMarkers(value));
                             editor.editor = doc.body;
-                            editor.e.fire('safeHTML', editor.editor);
                             toggleEditable();
                             editor.e.fire('prepareWYSIWYGEditor');
                             editor.e.stopPropagation('beforeSetNativeEditorValue');
                         }
-                    } else {
-                        doc.body.innerHTML = value;
+                        return true;
                     }
-                    return true;
+                    // A partial value goes through the regular
+                    // path: `clean-html` sanitizes it and the
+                    // editor assigns it to `doc.body` via
+                    // `innerHTML`. Writing the raw value here
+                    // would fire its event handlers first.
+                    return false;
                 }, {
                     top: true
                 });
@@ -39094,11 +39109,11 @@ const key = 'table_processor_observer-resize';
         this.startX = event.clientX;
         this.j.lock(key);
         this.resizeHandler.classList.add('jodit-table-resizer_moved');
-        let box, tableBox = this.workTable.getBoundingClientRect();
+        let box;
         this.minX = 0;
         this.maxX = 1000000;
         if (this.wholeTable != null) {
-            tableBox = this.workTable.parentNode.getBoundingClientRect();
+            const tableBox = this.workTable.parentNode.getBoundingClientRect();
             this.minX = tableBox.left;
             this.maxX = this.minX + tableBox.width;
         } else {
@@ -39634,7 +39649,7 @@ const keyBInd = '__jodit-resizer_binded';
                 diff_y = this.pointerY - this.startY;
             }
             const className = this.handle.className;
-            let new_w = 0, new_h = 0;
+            let new_w, new_h;
             const uar = this.j.o.resizer.useAspectRatio;
             if (!this.isAltMode && (uar === true || uar && jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_4__.Dom.isTag(this.element, uar))) {
                 if (diff_x) {
@@ -40199,7 +40214,7 @@ class SentenceFinder {
     }
     ranges(needle, position = 0) {
         const results = [];
-        let index = position, len = 0, startQueueIndex = 0;
+        let index = position, len, startQueueIndex = 0;
         // Find all ranges in substring
         do {
             [index, len] = this.searchIndex(needle, this.value, index);
@@ -42391,7 +42406,7 @@ class SourceEditor {
             return;
         }
         let value = this.getMirrorValue();
-        let selectionStart = 0, selectionEnd = 0;
+        let selectionStart, selectionEnd;
         try {
             value = value.replace(/<span[^>]+data-jodit-selection_marker=(["'])start\1[^>]*>[<>]*?<\/span>/gim, this.tempMarkerStart).replace(/<span[^>]+data-jodit-selection_marker=(["'])end\1[^>]*>[<>]*?<\/span>/gim, this.tempMarkerEnd);
             if (!this.j.o.editHTMLDocumentMode && this.j.o.beautifyHTML) {
@@ -44647,7 +44662,7 @@ jodit_config__WEBPACK_IMPORTED_MODULE_5__.Config.prototype.controls.table = {
                 return;
             }
             const index = parseInt((0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_3__.attr)(e.target, '-index') || '0', 10), row = Math.floor(index / default_cols_count), col = index % default_cols_count;
-            let nextIndex = index;
+            let nextIndex;
             switch(e.key){
                 case jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__.KEY_LEFT:
                     nextIndex = col > 0 ? index - 1 : index;