jodit 4.14.5 → 4.14.6

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.6
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -1785,7 +1785,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.14.5";
+ */ const APP_VERSION = "4.14.6";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -32856,6 +32856,25 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                 }
                 return html;
             };
+            /**
+				 * Replace the whole iframe document with the given HTML.
+				 *
+				 * The markup is parsed in an inert document first (no browsing
+				 * context: scripts do not run, sub-resources are not fetched),
+				 * sanitized there via `safeHTML`, and only then moved into the
+				 * live document. `document.write` on the live document would
+				 * execute inline scripts and event handlers while parsing,
+				 * before the sanitizer had a chance to strip them, and the
+				 * iframe is same-origin with the host page by default.
+				 * A `<script>` the cleaner is configured to keep still never
+				 * executes: nodes coming from an inert parser are flagged
+				 * "already started", exactly like `innerHTML`.
+				 * See GHSA-w3xv-x3fm-59ph.
+				 */ const replaceDocument = (html)=>{
+                const inert = new DOMParser().parseFromString(html, 'text/html');
+                editor.e.fire('safeHTML', inert.documentElement);
+                doc.replaceChild(doc.adoptNode(inert.documentElement), doc.documentElement);
+            };
             if (docMode) {
                 const tag = editor.element.tagName;
                 if (tag !== 'TEXTAREA' && tag !== 'INPUT') {
@@ -32868,19 +32887,20 @@ jodit_config__WEBPACK_IMPORTED_MODULE_0__.Config.prototype.iframeSandbox = null;
                     if (/<(html|body)/i.test(value)) {
                         const old = doc.documentElement.outerHTML;
                         if (clearMarkers(old) !== clearMarkers(value)) {
-                            doc.open();
-                            doc.write(editor.o.iframeDoctype + clearMarkers(value));
-                            doc.close();
+                            replaceDocument(clearMarkers(value));
                             editor.editor = doc.body;
-                            editor.e.fire('safeHTML', editor.editor);
                             toggleEditable();
                             editor.e.fire('prepareWYSIWYGEditor');
                             editor.e.stopPropagation('beforeSetNativeEditorValue');
                         }
-                    } else {
-                        doc.body.innerHTML = value;
+                        return true;
                     }
-                    return true;
+                    // A partial value goes through the regular
+                    // path: `clean-html` sanitizes it and the
+                    // editor assigns it to `doc.body` via
+                    // `innerHTML`. Writing the raw value here
+                    // would fire its event handlers first.
+                    return false;
                 }, {
                     top: true
                 });