jodit 4.14.5 → 4.14.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (52) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/es2015/jodit.css +1 -1
  3. package/es2015/jodit.fat.min.js +3 -3
  4. package/es2015/jodit.js +29 -9
  5. package/es2015/jodit.min.js +3 -3
  6. package/es2015/plugins/debug/debug.css +1 -1
  7. package/es2015/plugins/debug/debug.js +1 -1
  8. package/es2015/plugins/debug/debug.min.js +1 -1
  9. package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
  10. package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
  11. package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
  12. package/es2018/jodit.fat.min.js +3 -3
  13. package/es2018/jodit.min.js +3 -3
  14. package/es2018/plugins/debug/debug.min.js +1 -1
  15. package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
  16. package/es2021/jodit.css +1 -1
  17. package/es2021/jodit.fat.min.js +3 -3
  18. package/es2021/jodit.js +29 -9
  19. package/es2021/jodit.min.js +3 -3
  20. package/es2021/plugins/debug/debug.css +1 -1
  21. package/es2021/plugins/debug/debug.js +1 -1
  22. package/es2021/plugins/debug/debug.min.js +1 -1
  23. package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
  24. package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
  25. package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
  26. package/es2021.en/jodit.css +1 -1
  27. package/es2021.en/jodit.fat.min.js +3 -3
  28. package/es2021.en/jodit.js +29 -9
  29. package/es2021.en/jodit.min.js +3 -3
  30. package/es2021.en/plugins/debug/debug.css +1 -1
  31. package/es2021.en/plugins/debug/debug.js +1 -1
  32. package/es2021.en/plugins/debug/debug.min.js +1 -1
  33. package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
  34. package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
  35. package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
  36. package/es5/jodit.css +2 -2
  37. package/es5/jodit.fat.min.js +2 -2
  38. package/es5/jodit.js +29 -9
  39. package/es5/jodit.min.css +2 -2
  40. package/es5/jodit.min.js +2 -2
  41. package/es5/plugins/debug/debug.css +1 -1
  42. package/es5/plugins/debug/debug.js +1 -1
  43. package/es5/plugins/debug/debug.min.js +1 -1
  44. package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
  45. package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
  46. package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
  47. package/es5/polyfills.fat.min.js +1 -1
  48. package/es5/polyfills.js +1 -1
  49. package/es5/polyfills.min.js +1 -1
  50. package/esm/core/constants.js +1 -1
  51. package/esm/plugins/iframe/iframe.js +28 -9
  52. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -9,6 +9,12 @@
9
9
  > - :house: [Internal]
10
10
  > - :nail_care: [Polish]
11
11
 
12
+ ## 4.14.6
13
+
14
+ #### :bug: Bug Fix
15
+
16
+ - **Security / iframe (`editHTMLDocumentMode`, stored XSS, CWE-79)**: with `iframe: true` and `editHTMLDocumentMode: true` a full HTML document assigned to `editor.value` was written straight into the live iframe document with `document.write()`, and `safeHTML` was only applied afterwards. Inline `<script>` elements and `on*` handlers therefore executed while the document was being parsed — before the sanitizer could remove them — in an iframe that is same-origin with the host page by default (`iframeSandbox: null`), so an attacker-supplied document could run script in the host application's origin as soon as another user opened it. The document is now parsed in an inert `DOMParser` document (no browsing context: nothing executes, no sub-resources are fetched), sanitized there via the `safeHTML` event, and only then adopted into the live iframe document; nodes coming from an inert parser are flagged "already started", so even a `<script>` the cleaner is configured to keep never executes — the same guarantee `innerHTML` gives in the regular mode. A partial value (no `<html>`/`<body>`) in that mode was also assigned to `doc.body.innerHTML` unsanitized before `clean-html` ran, which fired e.g. `<img onerror>`; it now goes through the regular sanitized path. Affected all versions with `editHTMLDocumentMode` through 4.14.5. Responsibly reported by [@bp0lr](https://github.com/bp0lr) (GHSA-w3xv-x3fm-59ph).
17
+
12
18
  ## 4.14.5
13
19
 
14
20
  #### :house: Internal
package/es2015/jodit.css CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.14.5
4
+ * Version: v4.14.6
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */