jodit 4.14.5 → 4.14.7

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.14.5
+ * Version: v4.14.7
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.14.5";
+export const APP_VERSION = "4.14.7";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/modules/file-browser/builders/context-menu.js

@@ -139,7 +139,7 @@ export default (self) => {
                     }
                     : false,
                 {
-                    icon: 'upload',
+                    icon: 'download',
                     title: 'Download',
                     exec: () => {
                         const url = ga('href');

package/esm/plugins/iframe/iframe.js

@@ -101,6 +101,26 @@ export function iframe(editor) {
                 }
                 return html;
             };
+            /**
+             * Replace the whole iframe document with the given HTML.
+             *
+             * The markup is parsed in an inert document first (no browsing
+             * context: scripts do not run, sub-resources are not fetched),
+             * sanitized there via `safeHTML`, and only then moved into the
+             * live document. `document.write` on the live document would
+             * execute inline scripts and event handlers while parsing,
+             * before the sanitizer had a chance to strip them, and the
+             * iframe is same-origin with the host page by default.
+             * A `<script>` the cleaner is configured to keep still never
+             * executes: nodes coming from an inert parser are flagged
+             * "already started", exactly like `innerHTML`.
+             * See GHSA-w3xv-x3fm-59ph.
+             */
+            const replaceDocument = (html) => {
+                const inert = new DOMParser().parseFromString(html, 'text/html');
+                editor.e.fire('safeHTML', inert.documentElement);
+                doc.replaceChild(doc.adoptNode(inert.documentElement), doc.documentElement);
+            };
             if (docMode) {
                 const tag = editor.element.tagName;
                 if (tag !== 'TEXTAREA' && tag !== 'INPUT') {
@@ -117,21 +137,20 @@ export function iframe(editor) {
                         const old = doc.documentElement.outerHTML;
                         if (clearMarkers(old) !==
                             clearMarkers(value)) {
-                            doc.open();
-                            doc.write(editor.o.iframeDoctype +
-                                clearMarkers(value));
-                            doc.close();
+                            replaceDocument(clearMarkers(value));
                             editor.editor = doc.body;
-                            editor.e.fire('safeHTML', editor.editor);
                             toggleEditable();
                             editor.e.fire('prepareWYSIWYGEditor');
                             editor.e.stopPropagation('beforeSetNativeEditorValue');
                         }
+                        return true;
                     }
-                    else {
-                        doc.body.innerHTML = value;
-                    }
-                    return true;
+                    // A partial value goes through the regular
+                    // path: `clean-html` sanitizes it and the
+                    // editor assigns it to `doc.body` via
+                    // `innerHTML`. Writing the raw value here
+                    // would fire its event handlers first.
+                    return false;
                 }, { top: true });
             }
             editor.editor = doc.body;

package/esm/styles/icons/download.svg.js

@@ -0,0 +1 @@
+export default "<svg xmlns='http://www.w3.org/2000/svg' viewBox=\"0 0 1792 1792\"> <path d=\"M1344 1344q0-26-19-45t-45-19-45 19-19 45 19 45 45 19 45-19 19-45zm256 0q0-26-19-45t-45-19-45 19-19 45 19 45 45 19 45-19 19-45zm128-224v320q0 40-28 68t-68 28h-1472q-40 0-68-28t-28-68v-320q0-40 28-68t68-28h465l135 136q58 56 136 56t136-56l136-136h464q40 0 68 28t28 68zm-325-569q17 41-14 70l-448 448q-18 19-45 19t-45-19l-448-448q-31-29-14-70 17-39 59-39h256v-448q0-26 19-45t45-19h256q26 0 45 19t19 45v448h256q42 0 59 39z\"/> </svg> ";

package/esm/styles/icons/index.d.ts

@@ -8,4 +8,4 @@
  * @packageDocumentation
  * @module icons
  */
-export { angle_down, angle_left, angle_right, angle_up, bin, cancel, center, check, chevron, dots, eye, file, folder, info_circle, left, lock, ok, pencil, plus, resize_handler, right, save, settings, unlock, update, upload, valign };
+export { angle_down, angle_left, angle_right, angle_up, bin, cancel, center, check, chevron, dots, download, eye, file, folder, info_circle, left, lock, ok, pencil, plus, resize_handler, right, save, settings, unlock, update, upload, valign };

package/esm/styles/icons/index.js

@@ -18,6 +18,7 @@ import center from "./center.svg.js";
 import check from "./check.svg.js";
 import chevron from "./chevron.svg.js";
 import dots from "./dots.svg.js";
+import download from "./download.svg.js";
 import eye from "./eye.svg.js";
 import file from "./file.svg.js";
 import folder from "./folder.svg.js";
@@ -35,4 +36,4 @@ import unlock from "./unlock.svg.js";
 import update from "./update.svg.js";
 import upload from "./upload.svg.js";
 import valign from "./valign.svg.js";
-export { angle_down, angle_left, angle_right, angle_up, bin, cancel, center, check, chevron, dots, eye, file, folder, info_circle, left, lock, ok, pencil, plus, resize_handler, right, save, settings, unlock, update, upload, valign };
+export { angle_down, angle_left, angle_right, angle_up, bin, cancel, center, check, chevron, dots, download, eye, file, folder, info_circle, left, lock, ok, pencil, plus, resize_handler, right, save, settings, unlock, update, upload, valign };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.14.5",
+	"version": "4.14.7",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/styles/icons/index.d.ts

@@ -8,4 +8,4 @@
  * @packageDocumentation
  * @module icons
  */
-export { angle_down, angle_left, angle_right, angle_up, bin, cancel, center, check, chevron, dots, eye, file, folder, info_circle, left, lock, ok, pencil, plus, resize_handler, right, save, settings, unlock, update, upload, valign };
+export { angle_down, angle_left, angle_right, angle_up, bin, cancel, center, check, chevron, dots, download, eye, file, folder, info_circle, left, lock, ok, pencil, plus, resize_handler, right, save, settings, unlock, update, upload, valign };