jodit 4.17.0 → 4.17.2

package/es2021/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -1799,7 +1799,7 @@ __webpack_require__.r(__webpack_exports__);
  * ```
  * @packageDocumentation
  * @module constants
- */ const APP_VERSION = "4.17.0";
+ */ const APP_VERSION = "4.17.2";
 // prettier-ignore
 const ES = "es2021";
 const IS_ES_MODERN = true;
@@ -6281,7 +6281,7 @@ function isSmuggledForeignHtml(elm) {
     }
     return /^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName);
 }
-function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
+function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError, removeEventAttributes } = {
     safeJavaScriptLink: true,
     removeOnError: true
 }) {
@@ -6289,6 +6289,13 @@ function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
         return false;
     }
     let effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -10534,6 +10541,70 @@ class Response {
 }
 
 
+/***/ }),
+
+/***/ 43134:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+"use strict";
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   composedRanges: function() { return /* binding */ composedRanges; }
+/* harmony export */ });
+/* harmony import */ var jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(28686);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ /**
+ * @module selection
+ */ 
+function isInside(node, shadowRoot) {
+    return node === shadowRoot || shadowRoot.contains(node);
+}
+function usable(ranges, shadowRoot) {
+    return Array.isArray(ranges) && ranges.length > 0 && ranges.every((range)=>isInside(range.startContainer, shadowRoot));
+}
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */ function composedRanges(selection, shadowRoot) {
+    const getComposedRanges = selection.getComposedRanges;
+    if (!(0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_0__.isFunction)(getComposedRanges)) {
+        return null;
+    }
+    for (const args of [
+        [
+            {
+                shadowRoots: [
+                    shadowRoot
+                ]
+            }
+        ],
+        [
+            shadowRoot
+        ]
+    ]){
+        let ranges;
+        try {
+            ranges = getComposedRanges.apply(selection, args);
+        } catch  {
+            continue;
+        }
+        if (usable(ranges, shadowRoot)) {
+            return ranges;
+        }
+    }
+    return null;
+}
+
+
 /***/ }),
 
 /***/ 42259:
@@ -10541,14 +10612,16 @@ class Response {
 
 "use strict";
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   composedRanges: function() { return /* reexport safe */ _composed_ranges__WEBPACK_IMPORTED_MODULE_2__.composedRanges; },
 /* harmony export */   cursorInTheEdgeOfString: function() { return /* binding */ cursorInTheEdgeOfString; },
 /* harmony export */   findCorrectCurrentNode: function() { return /* binding */ findCorrectCurrentNode; },
-/* harmony export */   moveNodeInsideStart: function() { return /* reexport safe */ _move_node_inside_start__WEBPACK_IMPORTED_MODULE_2__.moveNodeInsideStart; }
+/* harmony export */   moveNodeInsideStart: function() { return /* reexport safe */ _move_node_inside_start__WEBPACK_IMPORTED_MODULE_3__.moveNodeInsideStart; }
 /* harmony export */ });
 /* harmony import */ var jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(81937);
 /* harmony import */ var jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(23211);
-/* harmony import */ var _move_node_inside_start__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(89817);
-/* harmony import */ var _move_the_node_along_the_edge_outward__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7470);
+/* harmony import */ var _composed_ranges__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(43134);
+/* harmony import */ var _move_node_inside_start__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(89817);
+/* harmony import */ var _move_the_node_along_the_edge_outward__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(7470);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -10559,6 +10632,7 @@ class Response {
 
 
 
+
 /**
  * Despite the name, returns `true` when the cursor is NOT at the checked edge
  * of the text node: there is significant (non invisible-space) text between
@@ -10787,11 +10861,87 @@ class Selection {
     /**
 	 * Return current selection object
 	 */ get sel() {
-        if (this.j.o.shadowRoot && (0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_6__.isFunction)(this.j.o.shadowRoot.getSelection)) {
-            return this.j.o.shadowRoot.getSelection();
+        const { shadowRoot } = this.j.o;
+        if (shadowRoot) {
+            if ((0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_6__.isFunction)(shadowRoot.getSelection)) {
+                return shadowRoot.getSelection();
+            }
+            const composed = this.__composedSelection(shadowRoot);
+            if (composed) {
+                return composed;
+            }
         }
         return this.win.getSelection();
     }
+    /**
+	 * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+	 *
+	 * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+	 * implemented, and `window.getSelection()` stops at the shadow boundary: for
+	 * a caret inside the shadow tree it reports the host, or the document
+	 * itself. Everything downstream then works on the wrong tree, which is why
+	 * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+	 * the editor lived in a shadow root in Safari.
+	 *
+	 * The standard replacement is `Selection.getComposedRanges()`, which does
+	 * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+	 * the editor mutates ranges constantly, so they are turned into live ones.
+	 *
+	 * Reads are answered from those ranges; everything else, including the
+	 * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+	 * real selection, which does accept nodes inside a shadow tree. Reading is
+	 * the only side the browser blocks.
+	 *
+	 * @returns `null` when the browser offers neither API, so the caller falls
+	 * back to the plain window selection.
+	 */ __composedSelection(shadowRoot) {
+        const selection = this.win.getSelection();
+        if (!selection) {
+            return null;
+        }
+        // Firefox has no `ShadowRoot.getSelection` either, but its window
+        // selection does see into a shadow tree. Where the plain selection
+        // already points at the right node there is nothing to work around, and
+        // taking it over would change behaviour that works today.
+        const { anchorNode } = selection;
+        if (anchorNode && jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_4__.Dom.isOrContains(shadowRoot, anchorNode)) {
+            return null;
+        }
+        const ranges = (0,_helpers__WEBPACK_IMPORTED_MODULE_11__.composedRanges)(selection, shadowRoot);
+        if (!ranges) {
+            return null;
+        }
+        const live = ranges.map((staticRange)=>{
+            const range = this.createRange();
+            range.setStart(staticRange.startContainer, staticRange.startOffset);
+            range.setEnd(staticRange.endContainer, staticRange.endOffset);
+            return range;
+        });
+        const first = live[0];
+        const overrides = {
+            rangeCount: live.length,
+            getRangeAt: (index)=>live[index],
+            isCollapsed: live.every((range)=>range.collapsed),
+            // Without these the editor asks the window selection where the
+            // caret is, is told "outside the editable area", and resets the
+            // caret to the start of it — which is the focus loss that shows up
+            // right after a successful Backspace.
+            anchorNode: first ? first.startContainer : null,
+            anchorOffset: first ? first.startOffset : 0,
+            focusNode: first ? first.endContainer : null,
+            focusOffset: first ? first.endOffset : 0,
+            toString: ()=>live.map((range)=>range.toString()).join('')
+        };
+        return new Proxy(selection, {
+            get (target, property) {
+                if ((0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_6__.isString)(property) && property in overrides) {
+                    return overrides[property];
+                }
+                const value = Reflect.get(target, property, target);
+                return (0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_6__.isFunction)(value) ? value.bind(target) : value;
+            }
+        });
+    }
     /**
 	 * Return first selected range or create new
 	 */ get range() {
@@ -31049,7 +31199,11 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_4__.pluginSystem.add('dragAndDropElem
             window,
             this.j.ed,
             this.j.editor
-        ], 'dragstart.DragAndDrop', this.onDragStart);
+        ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+        // from another window or application never produces one here, and
+        // the browser then inserted its HTML natively, unsanitized. Routed
+        // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+        .on('drop.DragAndDrop', this.onDrop);
     }
     onDragStart(event) {
         let target = event.target;
@@ -31077,10 +31231,10 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_4__.pluginSystem.add('dragAndDropElem
         this.addDragListeners();
     }
     addDragListeners() {
-        this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+        this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     removeDragListeners() {
-        this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+        this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     onDrag(event) {
         if (this.draggable) {
@@ -31142,7 +31296,12 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_4__.pluginSystem.add('dragAndDropElem
                 fragment = (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_6__.dataBind)(this.draggable, 'target');
             }
         } else if (this.getText(event)) {
-            fragment = this.j.createInside.fromHTML(this.getText(event));
+            // Dropped markup takes the same sanitizing pass as pasted and
+            // assigned content. See GHSA-jhhp-r3r7-v2cg
+            const box = this.j.createInside.div();
+            box.innerHTML = this.getText(event);
+            this.j.e.fire('safeHTML', box);
+            fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
         }
         return fragment;
     }