jodit 4.17.0 → 4.17.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/es2015/jodit.css +1 -1
- package/es2015/jodit.fat.min.js +3 -3
- package/es2015/jodit.js +23 -7
- package/es2015/jodit.min.js +3 -3
- package/es2015/plugins/debug/debug.css +1 -1
- package/es2015/plugins/debug/debug.js +1 -1
- package/es2015/plugins/debug/debug.min.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2018/jodit.fat.min.js +3 -3
- package/es2018/jodit.min.js +3 -3
- package/es2018/plugins/debug/debug.min.js +1 -1
- package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021/jodit.css +1 -1
- package/es2021/jodit.fat.min.js +4 -4
- package/es2021/jodit.js +23 -7
- package/es2021/jodit.min.js +4 -4
- package/es2021/plugins/debug/debug.css +1 -1
- package/es2021/plugins/debug/debug.js +1 -1
- package/es2021/plugins/debug/debug.min.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es2021.en/jodit.css +1 -1
- package/es2021.en/jodit.fat.min.js +4 -4
- package/es2021.en/jodit.js +23 -7
- package/es2021.en/jodit.min.js +4 -4
- package/es2021.en/plugins/debug/debug.css +1 -1
- package/es2021.en/plugins/debug/debug.js +1 -1
- package/es2021.en/plugins/debug/debug.min.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/jodit.css +2 -2
- package/es5/jodit.fat.min.js +2 -2
- package/es5/jodit.js +23 -7
- package/es5/jodit.min.css +2 -2
- package/es5/jodit.min.js +2 -2
- package/es5/plugins/debug/debug.css +1 -1
- package/es5/plugins/debug/debug.js +1 -1
- package/es5/plugins/debug/debug.min.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
- package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
- package/es5/polyfills.fat.min.js +1 -1
- package/es5/polyfills.js +1 -1
- package/es5/polyfills.min.js +1 -1
- package/esm/core/constants.js +1 -1
- package/esm/core/helpers/html/safe-html.d.ts +1 -1
- package/esm/core/helpers/html/safe-html.js +8 -1
- package/esm/plugins/drag-and-drop/drag-and-drop.js +16 -4
- package/package.json +1 -1
- package/types/core/helpers/html/safe-html.d.ts +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,12 @@
|
|
|
9
9
|
> - :house: [Internal]
|
|
10
10
|
> - :nail_care: [Polish]
|
|
11
11
|
|
|
12
|
+
## 4.17.1
|
|
13
|
+
|
|
14
|
+
#### :bug: Bug Fix
|
|
15
|
+
|
|
16
|
+
- [GHSA-jhhp-r3r7-v2cg](https://github.com/xdan/jodit/security/advisories/GHSA-jhhp-r3r7-v2cg) Security: `cleanHTML.removeEventAttributes` was not enforced by the background sanitizing pass — `sanitizeHTMLElement()` only stripped `onerror`, so any other `on*` handler survived on markup that reached the editable area without `safeHTML`, and a drop from another window was inserted by the browser natively, unsanitized, because the drop handler was only armed after a `dragstart` seen in the same window. The background pass now strips every `on*` attribute, and drops always go through the paste plugin's sanitizing path. Reported by David Vieira Kurz (HiSolutions AG).
|
|
17
|
+
|
|
12
18
|
## 4.17.0
|
|
13
19
|
|
|
14
20
|
#### :boom: Breaking Change
|
package/es2015/jodit.css
CHANGED