jodit 4.17.0 → 4.17.1

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -2129,7 +2129,7 @@ __webpack_require__.r(__webpack_exports__);
  * @packageDocumentation
  * @module constants
  */ 
-var APP_VERSION = "4.17.0";
+var APP_VERSION = "4.17.1";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7266,11 +7266,18 @@ function sanitizeHTMLElement(elm) {
     var _ref = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {
         safeJavaScriptLink: true,
         removeOnError: true
-    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError;
+    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError, removeEventAttributes = _ref.removeEventAttributes;
     if (!jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(elm)) {
         return false;
     }
     var effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -37124,7 +37131,11 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_9__.pluginSystem.add('dragAndDropElem
                     window,
                     this.j.ed,
                     this.j.editor
-                ], 'dragstart.DragAndDrop', this.onDragStart);
+                ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+                // from another window or application never produces one here, and
+                // the browser then inserted its HTML natively, unsanitized. Routed
+                // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+                .on('drop.DragAndDrop', this.onDrop);
             }
         },
         {
@@ -37160,13 +37171,13 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_9__.pluginSystem.add('dragAndDropElem
         {
             key: "addDragListeners",
             value: function addDragListeners() {
-                this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
             key: "removeDragListeners",
             value: function removeDragListeners() {
-                this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
@@ -37240,7 +37251,12 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_9__.pluginSystem.add('dragAndDropElem
                         fragment = (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_12__.dataBind)(this.draggable, 'target');
                     }
                 } else if (this.getText(event)) {
-                    fragment = this.j.createInside.fromHTML(this.getText(event));
+                    // Dropped markup takes the same sanitizing pass as pasted and
+                    // assigned content. See GHSA-jhhp-r3r7-v2cg
+                    var box = this.j.createInside.div();
+                    box.innerHTML = this.getText(event);
+                    this.j.e.fire('safeHTML', box);
+                    fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
                 }
                 return fragment;
             }

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
 	/*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */