jodit 4.17.0 → 4.17.2

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.0
+ * Version: v4.17.2
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.17.0";
+export const APP_VERSION = "4.17.2";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/html/safe-html.d.ts

@@ -13,4 +13,4 @@ export type safeOptions = {
  * Removes dangerous constructs from HTML
  */
 export declare function safeHTML(box: HTMLElement | DocumentFragment, options: safeOptions): void;
-export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError }?: safeOptions): boolean;
+export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError, removeEventAttributes }?: safeOptions): boolean;

package/esm/core/helpers/html/safe-html.js

@@ -145,7 +145,7 @@ function isDangerousUrl(value, tagName) {
     }
     return (/^data:image\/svg/.test(normalized) && DOCUMENT_EMBED_TAGS.has(tagName));
 }
-export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } = {
+export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError, removeEventAttributes } = {
     safeJavaScriptLink: true,
     removeOnError: true
 }) {
@@ -153,6 +153,13 @@ export function sanitizeHTMLElement(elm, { safeJavaScriptLink, removeOnError } =
         return false;
     }
     let effected = false;
+    // Every `on*` handler, not only `onerror`: the clean-html background
+    // pass calls this directly, and markup that reached the editable area
+    // without `safeHTML` (a drop, a script) kept its handlers otherwise.
+    // See GHSA-jhhp-r3r7-v2cg
+    if (removeEventAttributes && removeAllEventAttributes(elm)) {
+        effected = true;
+    }
     if (removeOnError && elm.hasAttribute('onerror')) {
         attr(elm, 'onerror', null);
         effected = true;

package/esm/core/selection/helpers/composed-ranges.d.ts

@@ -0,0 +1,21 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module selection
+ */
+import type { Nullable } from "../../../types/index";
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */
+export declare function composedRanges(selection: Selection, shadowRoot: ShadowRoot): Nullable<StaticRange[]>;

package/esm/core/selection/helpers/composed-ranges.js

@@ -0,0 +1,45 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+import { isFunction } from "../../helpers/checker/index.js";
+function isInside(node, shadowRoot) {
+    return node === shadowRoot || shadowRoot.contains(node);
+}
+function usable(ranges, shadowRoot) {
+    return (Array.isArray(ranges) &&
+        ranges.length > 0 &&
+        ranges.every(range => isInside(range.startContainer, shadowRoot)));
+}
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */
+export function composedRanges(selection, shadowRoot) {
+    const getComposedRanges = selection.getComposedRanges;
+    if (!isFunction(getComposedRanges)) {
+        return null;
+    }
+    for (const args of [[{ shadowRoots: [shadowRoot] }], [shadowRoot]]) {
+        let ranges;
+        try {
+            ranges = getComposedRanges.apply(selection, args);
+        }
+        catch (_a) {
+            // A build that only knows the other shape throws on this one.
+            continue;
+        }
+        if (usable(ranges, shadowRoot)) {
+            return ranges;
+        }
+    }
+    return null;
+}

package/esm/core/selection/helpers/index.d.ts

@@ -3,6 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
+export * from "./composed-ranges";
 export * from "./move-node-inside-start";
 export * from "./move-the-node-along-the-edge-outward";
 /**

package/esm/core/selection/helpers/index.js

@@ -8,6 +8,7 @@
  */
 import { INVISIBLE_SPACE_REG_EXP_END as INV_END, INVISIBLE_SPACE_REG_EXP_START as INV_START } from "../../constants.js";
 import { Dom } from "../../dom/dom.js";
+export * from "./composed-ranges.js";
 export * from "./move-node-inside-start.js";
 export * from "./move-the-node-along-the-edge-outward.js";
 /**

package/esm/core/selection/selection.d.ts

@@ -37,6 +37,29 @@ export declare class Selection implements ISelect {
      * Return current selection object
      */
     get sel(): ISelect['sel'];
+    /**
+     * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+     *
+     * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+     * implemented, and `window.getSelection()` stops at the shadow boundary: for
+     * a caret inside the shadow tree it reports the host, or the document
+     * itself. Everything downstream then works on the wrong tree, which is why
+     * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+     * the editor lived in a shadow root in Safari.
+     *
+     * The standard replacement is `Selection.getComposedRanges()`, which does
+     * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+     * the editor mutates ranges constantly, so they are turned into live ones.
+     *
+     * Reads are answered from those ranges; everything else, including the
+     * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+     * real selection, which does accept nodes inside a shadow tree. Reading is
+     * the only side the browser blocks.
+     *
+     * @returns `null` when the browser offers neither API, so the caller falls
+     * back to the plain window selection.
+     */
+    private __composedSelection;
     /**
      * Return first selected range or create new
      */

package/esm/core/selection/selection.js

@@ -24,7 +24,7 @@ import { assert } from "../helpers/utils/assert.js";
 import { moveTheNodeAlongTheEdgeOutward } from "./helpers/move-the-node-along-the-edge-outward.js";
 import "./interface.js";
 import { CommitStyle } from "./style/commit-style.js";
-import { cursorInTheEdgeOfString, findCorrectCurrentNode } from "./helpers/index.js";
+import { composedRanges, cursorInTheEdgeOfString, findCorrectCurrentNode } from "./helpers/index.js";
 export class Selection {
     constructor(jodit) {
         this.jodit = jodit;
@@ -69,12 +69,88 @@ export class Selection {
      * Return current selection object
      */
     get sel() {
-        if (this.j.o.shadowRoot &&
-            isFunction(this.j.o.shadowRoot.getSelection)) {
-            return this.j.o.shadowRoot.getSelection();
+        const { shadowRoot } = this.j.o;
+        if (shadowRoot) {
+            if (isFunction(shadowRoot.getSelection)) {
+                return shadowRoot.getSelection();
+            }
+            const composed = this.__composedSelection(shadowRoot);
+            if (composed) {
+                return composed;
+            }
         }
         return this.win.getSelection();
     }
+    /**
+     * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+     *
+     * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+     * implemented, and `window.getSelection()` stops at the shadow boundary: for
+     * a caret inside the shadow tree it reports the host, or the document
+     * itself. Everything downstream then works on the wrong tree, which is why
+     * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+     * the editor lived in a shadow root in Safari.
+     *
+     * The standard replacement is `Selection.getComposedRanges()`, which does
+     * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+     * the editor mutates ranges constantly, so they are turned into live ones.
+     *
+     * Reads are answered from those ranges; everything else, including the
+     * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+     * real selection, which does accept nodes inside a shadow tree. Reading is
+     * the only side the browser blocks.
+     *
+     * @returns `null` when the browser offers neither API, so the caller falls
+     * back to the plain window selection.
+     */
+    __composedSelection(shadowRoot) {
+        const selection = this.win.getSelection();
+        if (!selection) {
+            return null;
+        }
+        // Firefox has no `ShadowRoot.getSelection` either, but its window
+        // selection does see into a shadow tree. Where the plain selection
+        // already points at the right node there is nothing to work around, and
+        // taking it over would change behaviour that works today.
+        const { anchorNode } = selection;
+        if (anchorNode && Dom.isOrContains(shadowRoot, anchorNode)) {
+            return null;
+        }
+        const ranges = composedRanges(selection, shadowRoot);
+        if (!ranges) {
+            return null;
+        }
+        const live = ranges.map(staticRange => {
+            const range = this.createRange();
+            range.setStart(staticRange.startContainer, staticRange.startOffset);
+            range.setEnd(staticRange.endContainer, staticRange.endOffset);
+            return range;
+        });
+        const first = live[0];
+        const overrides = {
+            rangeCount: live.length,
+            getRangeAt: (index) => live[index],
+            isCollapsed: live.every(range => range.collapsed),
+            // Without these the editor asks the window selection where the
+            // caret is, is told "outside the editable area", and resets the
+            // caret to the start of it — which is the focus loss that shows up
+            // right after a successful Backspace.
+            anchorNode: first ? first.startContainer : null,
+            anchorOffset: first ? first.startOffset : 0,
+            focusNode: first ? first.endContainer : null,
+            focusOffset: first ? first.endOffset : 0,
+            toString: () => live.map(range => range.toString()).join('')
+        };
+        return new Proxy(selection, {
+            get(target, property) {
+                if (isString(property) && property in overrides) {
+                    return overrides[property];
+                }
+                const value = Reflect.get(target, property, target);
+                return isFunction(value) ? value.bind(target) : value;
+            }
+        });
+    }
     /**
      * Return first selected range or create new
      */

package/esm/plugins/drag-and-drop/drag-and-drop.js

@@ -38,7 +38,13 @@ export class dragAndDrop extends Plugin {
     }
     /** @override */
     afterInit() {
-        this.j.e.on([window, this.j.ed, this.j.editor], 'dragstart.DragAndDrop', this.onDragStart);
+        this.j.e
+            .on([window, this.j.ed, this.j.editor], 'dragstart.DragAndDrop', this.onDragStart)
+            // Always, not only after a `dragstart` seen in this window: a drop
+            // from another window or application never produces one here, and
+            // the browser then inserted its HTML natively, unsanitized. Routed
+            // through the paste plugin instead. See GHSA-jhhp-r3r7-v2cg
+            .on('drop.DragAndDrop', this.onDrop);
     }
     onDragStart(event) {
         let target = event.target;
@@ -69,13 +75,11 @@ export class dragAndDrop extends Plugin {
     addDragListeners() {
         this.j.e
             .on('dragover', this.onDrag)
-            .on('drop.DragAndDrop', this.onDrop)
             .on(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     removeDragListeners() {
         this.j.e
             .off('dragover', this.onDrag)
-            .off('drop.DragAndDrop', this.onDrop)
             .off(window, 'dragend.DragAndDrop drop.DragAndDrop mouseup.DragAndDrop', this.onDragEnd);
     }
     onDrag(event) {
@@ -144,7 +148,15 @@ export class dragAndDrop extends Plugin {
             }
         }
         else if (this.getText(event)) {
-            fragment = this.j.createInside.fromHTML(this.getText(event));
+            // Dropped markup takes the same sanitizing pass as pasted and
+            // assigned content. See GHSA-jhhp-r3r7-v2cg
+            const box = this.j.createInside.div();
+            box.innerHTML = this.getText(event);
+            this.j.e.fire('safeHTML', box);
+            fragment =
+                box.firstChild !== box.lastChild || !box.firstChild
+                    ? box
+                    : box.firstChild;
         }
         return fragment;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "jodit",
-	"version": "4.17.0",
+	"version": "4.17.2",
 	"description": "Jodit is an awesome and useful wysiwyg editor with filebrowser",
 	"main": "esm/index.js",
 	"types": "types/index.d.ts",

package/types/core/helpers/html/safe-html.d.ts

@@ -13,4 +13,4 @@ export type safeOptions = {
  * Removes dangerous constructs from HTML
  */
 export declare function safeHTML(box: HTMLElement | DocumentFragment, options: safeOptions): void;
-export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError }?: safeOptions): boolean;
+export declare function sanitizeHTMLElement(elm: Element | DocumentFragment, { safeJavaScriptLink, removeOnError, removeEventAttributes }?: safeOptions): boolean;

package/types/core/selection/helpers/composed-ranges.d.ts

@@ -0,0 +1,21 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module selection
+ */
+import type { Nullable } from "../../../types/index";
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */
+export declare function composedRanges(selection: Selection, shadowRoot: ShadowRoot): Nullable<StaticRange[]>;

package/types/core/selection/helpers/index.d.ts

@@ -3,6 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
+export * from "./composed-ranges";
 export * from "./move-node-inside-start";
 export * from "./move-the-node-along-the-edge-outward";
 /**

package/types/core/selection/selection.d.ts

@@ -37,6 +37,29 @@ export declare class Selection implements ISelect {
      * Return current selection object
      */
     get sel(): ISelect['sel'];
+    /**
+     * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+     *
+     * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+     * implemented, and `window.getSelection()` stops at the shadow boundary: for
+     * a caret inside the shadow tree it reports the host, or the document
+     * itself. Everything downstream then works on the wrong tree, which is why
+     * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+     * the editor lived in a shadow root in Safari.
+     *
+     * The standard replacement is `Selection.getComposedRanges()`, which does
+     * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+     * the editor mutates ranges constantly, so they are turned into live ones.
+     *
+     * Reads are answered from those ranges; everything else, including the
+     * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+     * real selection, which does accept nodes inside a shadow tree. Reading is
+     * the only side the browser blocks.
+     *
+     * @returns `null` when the browser offers neither API, so the caller falls
+     * back to the plain window selection.
+     */
+    private __composedSelection;
     /**
      * Return first selected range or create new
      */