jodit 4.14.5 → 4.14.6

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.14.5";
+export const APP_VERSION = "4.14.6";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/plugins/iframe/iframe.js

@@ -101,6 +101,26 @@ export function iframe(editor) {
                 }
                 return html;
             };
+            /**
+             * Replace the whole iframe document with the given HTML.
+             *
+             * The markup is parsed in an inert document first (no browsing
+             * context: scripts do not run, sub-resources are not fetched),
+             * sanitized there via `safeHTML`, and only then moved into the
+             * live document. `document.write` on the live document would
+             * execute inline scripts and event handlers while parsing,
+             * before the sanitizer had a chance to strip them, and the
+             * iframe is same-origin with the host page by default.
+             * A `<script>` the cleaner is configured to keep still never
+             * executes: nodes coming from an inert parser are flagged
+             * "already started", exactly like `innerHTML`.
+             * See GHSA-w3xv-x3fm-59ph.
+             */
+            const replaceDocument = (html) => {
+                const inert = new DOMParser().parseFromString(html, 'text/html');
+                editor.e.fire('safeHTML', inert.documentElement);
+                doc.replaceChild(doc.adoptNode(inert.documentElement), doc.documentElement);
+            };
             if (docMode) {
                 const tag = editor.element.tagName;
                 if (tag !== 'TEXTAREA' && tag !== 'INPUT') {
@@ -117,21 +137,20 @@ export function iframe(editor) {
                         const old = doc.documentElement.outerHTML;
                         if (clearMarkers(old) !==
                             clearMarkers(value)) {
-                            doc.open();
-                            doc.write(editor.o.iframeDoctype +
-                                clearMarkers(value));
-                            doc.close();
+                            replaceDocument(clearMarkers(value));
                             editor.editor = doc.body;
-                            editor.e.fire('safeHTML', editor.editor);
                             toggleEditable();
                             editor.e.fire('prepareWYSIWYGEditor');
                             editor.e.stopPropagation('beforeSetNativeEditorValue');
                         }
+                        return true;
                     }
-                    else {
-                        doc.body.innerHTML = value;
-                    }
-                    return true;
+                    // A partial value goes through the regular
+                    // path: `clean-html` sanitizes it and the
+                    // editor assigns it to `doc.body` via
+                    // `innerHTML`. Writing the raw value here
+                    // would fire its event handlers first.
+                    return false;
                 }, { top: true });
             }
             editor.editor = doc.body;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.14.5",
+	"version": "4.14.6",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",