jodit 4.17.0 → 4.17.2

package/es5/jodit.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
@@ -2129,7 +2129,7 @@ __webpack_require__.r(__webpack_exports__);
  * @packageDocumentation
  * @module constants
  */ 
-var APP_VERSION = "4.17.0";
+var APP_VERSION = "4.17.2";
 // prettier-ignore
 var ES = "es5";
 var IS_ES_MODERN = false;
@@ -7266,11 +7266,18 @@ function sanitizeHTMLElement(elm) {
     var _ref = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {
         safeJavaScriptLink: true,
         removeOnError: true
-    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError;
+    }, safeJavaScriptLink = _ref.safeJavaScriptLink, removeOnError = _ref.removeOnError, removeEventAttributes = _ref.removeEventAttributes;
     if (!jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_0__.Dom.isElement(elm)) {
         return false;
     }
     var effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         (0,jodit_core_helpers_utils__WEBPACK_IMPORTED_MODULE_1__.attr)(elm, 'onerror', null);
         effected = true;
@@ -11963,6 +11970,73 @@ var Response = /*#__PURE__*/ function() {
 }();
 
 
+/***/ }),
+
+/***/ 43134:
+/***/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {
+
+"use strict";
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   composedRanges: function() { return /* binding */ composedRanges; }
+/* harmony export */ });
+/* harmony import */ var jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(28686);
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */ /**
+ * @module selection
+ */ 
+function isInside(node, shadowRoot) {
+    return node === shadowRoot || shadowRoot.contains(node);
+}
+function usable(ranges, shadowRoot) {
+    return Array.isArray(ranges) && ranges.length > 0 && ranges.every(function(range) {
+        return isInside(range.startContainer, shadowRoot);
+    });
+}
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */ function composedRanges(selection, shadowRoot) {
+    var getComposedRanges = selection.getComposedRanges;
+    if (!(0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_0__.isFunction)(getComposedRanges)) {
+        return null;
+    }
+    for(var _i = 0, _iter = [
+        [
+            {
+                shadowRoots: [
+                    shadowRoot
+                ]
+            }
+        ],
+        [
+            shadowRoot
+        ]
+    ]; _i < _iter.length; _i++){
+        var args = _iter[_i];
+        var ranges = void 0;
+        try {
+            ranges = getComposedRanges.apply(selection, args);
+        } catch (unused) {
+            continue;
+        }
+        if (usable(ranges, shadowRoot)) {
+            return ranges;
+        }
+    }
+    return null;
+}
+
+
 /***/ }),
 
 /***/ 42259:
@@ -11970,14 +12044,16 @@ var Response = /*#__PURE__*/ function() {
 
 "use strict";
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   composedRanges: function() { return /* reexport safe */ _composed_ranges__WEBPACK_IMPORTED_MODULE_2__.composedRanges; },
 /* harmony export */   cursorInTheEdgeOfString: function() { return /* binding */ cursorInTheEdgeOfString; },
 /* harmony export */   findCorrectCurrentNode: function() { return /* binding */ findCorrectCurrentNode; },
-/* harmony export */   moveNodeInsideStart: function() { return /* reexport safe */ _move_node_inside_start__WEBPACK_IMPORTED_MODULE_2__.moveNodeInsideStart; }
+/* harmony export */   moveNodeInsideStart: function() { return /* reexport safe */ _move_node_inside_start__WEBPACK_IMPORTED_MODULE_3__.moveNodeInsideStart; }
 /* harmony export */ });
 /* harmony import */ var jodit_core_constants__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(81937);
 /* harmony import */ var jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(23211);
-/* harmony import */ var _move_node_inside_start__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(89817);
-/* harmony import */ var _move_the_node_along_the_edge_outward__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7470);
+/* harmony import */ var _composed_ranges__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(43134);
+/* harmony import */ var _move_node_inside_start__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(89817);
+/* harmony import */ var _move_the_node_along_the_edge_outward__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(7470);
 /*!
  * Jodit Editor (https://xdsoft.net/jodit/)
  * Released under MIT see LICENSE.txt in the project root for license information.
@@ -11988,6 +12064,7 @@ var Response = /*#__PURE__*/ function() {
 
 
 
+
 /**
  * Despite the name, returns `true` when the cursor is NOT at the checked edge
  * of the text node: there is significant (non invisible-space) text between
@@ -12261,12 +12338,100 @@ var Selection = /*#__PURE__*/ function() {
             get: /**
 	 * Return current selection object
 	 */ function get() {
-                if (this.j.o.shadowRoot && (0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_12__.isFunction)(this.j.o.shadowRoot.getSelection)) {
-                    return this.j.o.shadowRoot.getSelection();
+                var shadowRoot = this.j.o.shadowRoot;
+                if (shadowRoot) {
+                    if ((0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_12__.isFunction)(shadowRoot.getSelection)) {
+                        return shadowRoot.getSelection();
+                    }
+                    var composed = this.__composedSelection(shadowRoot);
+                    if (composed) {
+                        return composed;
+                    }
                 }
                 return this.win.getSelection();
             }
         },
+        {
+            key: "__composedSelection",
+            value: /**
+	 * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+	 *
+	 * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+	 * implemented, and `window.getSelection()` stops at the shadow boundary: for
+	 * a caret inside the shadow tree it reports the host, or the document
+	 * itself. Everything downstream then works on the wrong tree, which is why
+	 * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+	 * the editor lived in a shadow root in Safari.
+	 *
+	 * The standard replacement is `Selection.getComposedRanges()`, which does
+	 * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+	 * the editor mutates ranges constantly, so they are turned into live ones.
+	 *
+	 * Reads are answered from those ranges; everything else, including the
+	 * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+	 * real selection, which does accept nodes inside a shadow tree. Reading is
+	 * the only side the browser blocks.
+	 *
+	 * @returns `null` when the browser offers neither API, so the caller falls
+	 * back to the plain window selection.
+	 */ function __composedSelection(shadowRoot) {
+                var _this = this;
+                var selection = this.win.getSelection();
+                if (!selection) {
+                    return null;
+                }
+                // Firefox has no `ShadowRoot.getSelection` either, but its window
+                // selection does see into a shadow tree. Where the plain selection
+                // already points at the right node there is nothing to work around, and
+                // taking it over would change behaviour that works today.
+                var anchorNode = selection.anchorNode;
+                if (anchorNode && jodit_core_dom_dom__WEBPACK_IMPORTED_MODULE_10__.Dom.isOrContains(shadowRoot, anchorNode)) {
+                    return null;
+                }
+                var ranges = (0,_helpers__WEBPACK_IMPORTED_MODULE_17__.composedRanges)(selection, shadowRoot);
+                if (!ranges) {
+                    return null;
+                }
+                var live = ranges.map(function(staticRange) {
+                    var range = _this.createRange();
+                    range.setStart(staticRange.startContainer, staticRange.startOffset);
+                    range.setEnd(staticRange.endContainer, staticRange.endOffset);
+                    return range;
+                });
+                var first = live[0];
+                var overrides = {
+                    rangeCount: live.length,
+                    getRangeAt: function getRangeAt(index) {
+                        return live[index];
+                    },
+                    isCollapsed: live.every(function(range) {
+                        return range.collapsed;
+                    }),
+                    // Without these the editor asks the window selection where the
+                    // caret is, is told "outside the editable area", and resets the
+                    // caret to the start of it — which is the focus loss that shows up
+                    // right after a successful Backspace.
+                    anchorNode: first ? first.startContainer : null,
+                    anchorOffset: first ? first.startOffset : 0,
+                    focusNode: first ? first.endContainer : null,
+                    focusOffset: first ? first.endOffset : 0,
+                    toString: function toString() {
+                        return live.map(function(range) {
+                            return range.toString();
+                        }).join('');
+                    }
+                };
+                return new Proxy(selection, {
+                    get: function get(target, property) {
+                        if ((0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_12__.isString)(property) && property in overrides) {
+                            return overrides[property];
+                        }
+                        var value = Reflect.get(target, property, target);
+                        return (0,jodit_core_helpers_checker__WEBPACK_IMPORTED_MODULE_12__.isFunction)(value) ? value.bind(target) : value;
+                    }
+                });
+            }
+        },
         {
             key: "range",
             get: /**
@@ -37124,7 +37289,11 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_9__.pluginSystem.add('dragAndDropElem
                     window,
                     this.j.ed,
                     this.j.editor
-                ], 'dragstart.DragAndDrop', this.onDragStart);
+                ], 'dragstart.DragAndDrop', this.onDragStart)// Always, not only after a `dragstart` seen in this window: a drop
+                // from another window or application never produces one here, and
+                // the browser then inserted its HTML natively, unsanitized. Routed
+                // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+                .on('drop.DragAndDrop', this.onDrop);
             }
         },
         {
@@ -37160,13 +37329,13 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_9__.pluginSystem.add('dragAndDropElem
         {
             key: "addDragListeners",
             value: function addDragListeners() {
-                this.j.e.on('dragover', this.onDrag).on('drop.DragAndDrop', this.onDrop).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.on('dragover', this.onDrag).on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
             key: "removeDragListeners",
             value: function removeDragListeners() {
-                this.j.e.off('dragover', this.onDrag).off('drop.DragAndDrop', this.onDrop).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
+                this.j.e.off('dragover', this.onDrag).off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
             }
         },
         {
@@ -37240,7 +37409,12 @@ jodit_core_global__WEBPACK_IMPORTED_MODULE_9__.pluginSystem.add('dragAndDropElem
                         fragment = (0,jodit_core_helpers__WEBPACK_IMPORTED_MODULE_12__.dataBind)(this.draggable, 'target');
                     }
                 } else if (this.getText(event)) {
-                    fragment = this.j.createInside.fromHTML(this.getText(event));
+                    // Dropped markup takes the same sanitizing pass as pasted and
+                    // assigned content. See GHSA-jhhp-r3r7-v2cg
+                    var box = this.j.createInside.div();
+                    box.innerHTML = this.getText(event);
+                    this.j.e.fire('safeHTML', box);
+                    fragment = box.firstChild !== box.lastChild || !box.firstChild ? box : box.firstChild;
                 }
                 return fragment;
             }

package/es5/jodit.min.css

@@ -1,14 +1,14 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */
 	/*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */