jodit 4.17.0 → 4.17.1

package/es2015/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.1
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -1805,7 +1805,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.17.0";
+ */ const APP_VERSION = "4.17.1";
 // prettier-ignore
 const ES = "es2015";
 const IS_ES_MODERN = true;
@@ -6306,7 +6306,7 @@ function isSmuggledForeignHtml(elm) {
     }
     return /^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName);
 }
-function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
+function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError, removeEventAttributes } = {
     safeJavaScriptLink: true,
     removeOnError: true
 }) {
@@ -6314,6 +6314,13 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
         return false;
     }
     let effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -31269,7 +31276,11 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_4__.pluginSystem.add('dragAndDropElem
             window,
             this.j.ed,
             this.j.editor
-        ], 'dragstart.DragAndDrop', this.onDragStart);
+        ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+        // from another window or application never produces one here, and
+        // the browser then inserted its HTML natively, unsanitized. Routed
+        // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+        .on('drop.DragAndDrop', this.onDrop);
     }
     onDragStart(event) {
         let target = event.target;
@@ -31297,10 +31308,10 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_4__.pluginSystem.add('dragAndDropElem
         this.addDragListeners();
     }
     addDragListeners() {
-        this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+        this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     removeDragListeners() {
-        this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+        this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     onDrag(event) {
         if (this.draggable) {
@@ -31362,7 +31373,12 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_4__.pluginSystem.add('dragAndDropElem
                 fragment = (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_6__.dataBind)(this.draggable, 'target');
             }
         } else if (this.getText(event)) {
-            fragment = this.j.createInside.fromHTML(this.getText(event));
+            // Dropped markup takes the same sanitizing pass as pasted and
+            // assigned content. See GHSA-jhhp-r3r7-v2cg
+            const box = this.j.createInside.div();
+            box.innerHTML = this.getText(event);
+            this.j.e.fire('safeHTML', box);
+            fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
         }
         return fragment;
     }