jodit 4.17.0 → 4.17.1

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.17.0";
+export const APP_VERSION = "4.17.1";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/html/safe-html.d.ts

@@ -13,4 +13,4 @@ export type safeOptions = {
  * Removes dangerous constructs from HTML
  */
 export declare function safeHTML(box: HTMLElement | DocumentFragment, options: safeOptions): void;
-export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError }?: safeOptions): boolean;
+export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError, removeEventAttributes }?: safeOptions): boolean;

package/esm/core/helpers/html/safe-html.js

@@ -145,7 +145,7 @@ function isDangerousUrl(value, tagName) {
     }
     return (/^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName));
 }
-export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
+export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError, removeEventAttributes } = {
     safeJavaScriptLink: true,
     removeOnError: true
 }) {
@@ -153,6 +153,13 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
         return false;
     }
     let effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         attr(elm, 'onerror', null);
         effected = true;

package/esm/plugins/drag-and-drop/drag-and-drop.js

@@ -38,7 +38,13 @@ export class dragAndDrop extends Plugin {
     }
     /** @override */
     afterInit() {
-        this.j.e.on([window, this.j.ed, this.j.editor], 'dragstart.DragAndDrop', this.onDragStart);
+        this.j.e
+            .on([window, this.j.ed, this.j.editor], 'dragstart.DragAndDrop', this.onDragStart)
+            // Always, not only after a `dragstart` seen in this window: a drop
+            // from another window or application never produces one here, and
+            // the browser then inserted its HTML natively, unsanitized. Routed
+            // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+            .on('drop.DragAndDrop', this.onDrop);
     }
     onDragStart(event) {
         let target = event.target;
@@ -69,13 +75,11 @@ export class dragAndDrop extends Plugin {
     addDragListeners() {
         this.j.e
             .on('dragover', this.onDrag)
-            .on('drop.DragAndDrop', this.onDrop)
             .on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     removeDragListeners() {
         this.j.e
             .off('dragover', this.onDrag)
-            .off('drop.DragAndDrop', this.onDrop)
             .off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     onDrag(event) {
@@ -144,7 +148,15 @@ export class dragAndDrop extends Plugin {
             }
         }
         else if (this.getText(event)) {
-            fragment = this.j.createInside.fromHTML(this.getText(event));
+            // Dropped markup takes the same sanitizing pass as pasted and
+            // assigned content. See GHSA-jhhp-r3r7-v2cg
+            const box = this.j.createInside.div();
+            box.innerHTML = this.getText(event);
+            this.j.e.fire('safeHTML', box);
+            fragment =
+                box.firstChild !== box.lastChild || !box.firstChild
+                    ? box
+                    : box.firstChild;
         }
         return fragment;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.17.0",
+	"version": "4.17.1",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/core/helpers/html/safe-html.d.ts

@@ -13,4 +13,4 @@ export type safeOptions = {
  * Removes dangerous constructs from HTML
  */
 export declare function safeHTML(box: HTMLElement | DocumentFragment, options: safeOptions): void;
-export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError }?: safeOptions): boolean;
+export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError, removeEventAttributes }?: safeOptions): boolean;