jodit 4.17.1 → 4.17.3

package/es5/plugins/debug/debug.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/debug/debug.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.css

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/plugins/speech-recognize/speech-recognize.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.fat.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/es5/polyfills.min.js

@@ -1,7 +1,7 @@
 /*!
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
- * Version: v4.17.1
+ * Version: v4.17.3
  * Url: https://xdsoft.net/jodit/
  * License(s): MIT
  */

package/esm/core/constants.js

@@ -3,7 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
-export const APP_VERSION = "4.17.1";
+export const APP_VERSION = "4.17.3";
 // prettier-ignore
 export const ES = "es2020";
 export const IS_ES_MODERN = true;

package/esm/core/helpers/html/safe-html.js

@@ -60,6 +60,21 @@ export function safeHTML(box, options) {
             Dom.safeRemove(elm);
         }
     }
+    // `<noscript>` is parsed as markup in a document with scripting off (the
+    // inert document the value is sanitized in) and as raw text in one with
+    // scripting on (the live editor). The same serialized bytes therefore
+    // describe two different trees, and markup hidden as inert text in the
+    // first comes alive as elements in the second. The element has no use in
+    // editor content, so it goes, together with everything it carried.
+    const noscript = [];
+    Dom.each(box, node => {
+        if (Dom.isElement(node) && node.nodeName === 'NOSCRIPT') {
+            noscript.push(node);
+        }
+    });
+    for (const elm of noscript) {
+        Dom.safeRemove(elm);
+    }
     const removeEvents = (_a = options.removeEventAttributes) !== null && _a !== void 0 ? _a : options.removeOnError;
     // Single synchronous traversal of the subtree. Besides removing event
     // handlers and `javascript:` links, `sanitizeHTMLElement` neutralises

package/esm/core/selection/helpers/composed-ranges.d.ts

@@ -0,0 +1,21 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+/**
+ * @module selection
+ */
+import type { Nullable } from "../../../types/index";
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */
+export declare function composedRanges(selection: Selection, shadowRoot: ShadowRoot): Nullable<StaticRange[]>;

package/esm/core/selection/helpers/composed-ranges.js

@@ -0,0 +1,45 @@
+/*!
+ * Jodit Editor (https://xdsoft.net/jodit/)
+ * Released under MIT see LICENSE.txt in the project root for license information.
+ * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
+ */
+import { isFunction } from "../../helpers/checker/index.js";
+function isInside(node, shadowRoot) {
+    return node === shadowRoot || shadowRoot.contains(node);
+}
+function usable(ranges, shadowRoot) {
+    return (Array.isArray(ranges) &&
+        ranges.length > 0 &&
+        ranges.every(range => isInside(range.startContainer, shadowRoot)));
+}
+/**
+ * Ranges of a selection that lies inside the given shadow tree.
+ *
+ * `window.getSelection()` stops at the shadow boundary and reports the host
+ * instead of the node the caret is really in. `getComposedRanges` is the
+ * standard way to ask past that boundary.
+ *
+ * @returns `null` when the browser has no `getComposedRanges`, or when neither
+ * call shape returned ranges that point inside the shadow tree — in which case
+ * there is nothing better to offer than the plain window selection.
+ */
+export function composedRanges(selection, shadowRoot) {
+    const getComposedRanges = selection.getComposedRanges;
+    if (!isFunction(getComposedRanges)) {
+        return null;
+    }
+    for (const args of [[{ shadowRoots: [shadowRoot] }], [shadowRoot]]) {
+        let ranges;
+        try {
+            ranges = getComposedRanges.apply(selection, args);
+        }
+        catch (_a) {
+            // A build that only knows the other shape throws on this one.
+            continue;
+        }
+        if (usable(ranges, shadowRoot)) {
+            return ranges;
+        }
+    }
+    return null;
+}

package/esm/core/selection/helpers/index.d.ts

@@ -3,6 +3,7 @@
  * Released under MIT see LICENSE.txt in the project root for license information.
  * Copyright (c) 2013-2026 Valerii Chupurnov. All rights reserved. https://xdsoft.net
  */
+export * from "./composed-ranges";
 export * from "./move-node-inside-start";
 export * from "./move-the-node-along-the-edge-outward";
 /**

package/esm/core/selection/helpers/index.js

@@ -8,6 +8,7 @@
  */
 import { INVISIBLE_SPACE_REG_EXP_END as INV_END, INVISIBLE_SPACE_REG_EXP_START as INV_START } from "../../constants.js";
 import { Dom } from "../../dom/dom.js";
+export * from "./composed-ranges.js";
 export * from "./move-node-inside-start.js";
 export * from "./move-the-node-along-the-edge-outward.js";
 /**

package/esm/core/selection/selection.d.ts

@@ -37,6 +37,29 @@ export declare class Selection implements ISelect {
      * Return current selection object
      */
     get sel(): ISelect['sel'];
+    /**
+     * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+     *
+     * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+     * implemented, and `window.getSelection()` stops at the shadow boundary: for
+     * a caret inside the shadow tree it reports the host, or the document
+     * itself. Everything downstream then works on the wrong tree, which is why
+     * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+     * the editor lived in a shadow root in Safari.
+     *
+     * The standard replacement is `Selection.getComposedRanges()`, which does
+     * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+     * the editor mutates ranges constantly, so they are turned into live ones.
+     *
+     * Reads are answered from those ranges; everything else, including the
+     * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+     * real selection, which does accept nodes inside a shadow tree. Reading is
+     * the only side the browser blocks.
+     *
+     * @returns `null` when the browser offers neither API, so the caller falls
+     * back to the plain window selection.
+     */
+    private __composedSelection;
     /**
      * Return first selected range or create new
      */

package/esm/core/selection/selection.js

@@ -24,7 +24,7 @@ import { assert } from "../helpers/utils/assert.js";
 import { moveTheNodeAlongTheEdgeOutward } from "./helpers/move-the-node-along-the-edge-outward.js";
 import "./interface.js";
 import { CommitStyle } from "./style/commit-style.js";
-import { cursorInTheEdgeOfString, findCorrectCurrentNode } from "./helpers/index.js";
+import { composedRanges, cursorInTheEdgeOfString, findCorrectCurrentNode } from "./helpers/index.js";
 export class Selection {
     constructor(jodit) {
         this.jodit = jodit;
@@ -69,12 +69,88 @@ export class Selection {
      * Return current selection object
      */
     get sel() {
-        if (this.j.o.shadowRoot &&
-            isFunction(this.j.o.shadowRoot.getSelection)) {
-            return this.j.o.shadowRoot.getSelection();
+        const { shadowRoot } = this.j.o;
+        if (shadowRoot) {
+            if (isFunction(shadowRoot.getSelection)) {
+                return shadowRoot.getSelection();
+            }
+            const composed = this.__composedSelection(shadowRoot);
+            if (composed) {
+                return composed;
+            }
         }
         return this.win.getSelection();
     }
+    /**
+     * Selection of a shadow tree in a browser without `ShadowRoot.getSelection`.
+     *
+     * `ShadowRoot.getSelection()` is a non-standard method that WebKit never
+     * implemented, and `window.getSelection()` stops at the shadow boundary: for
+     * a caret inside the shadow tree it reports the host, or the document
+     * itself. Everything downstream then works on the wrong tree, which is why
+     * Backspace used to throw `HierarchyRequestError` and Enter did nothing when
+     * the editor lived in a shadow root in Safari.
+     *
+     * The standard replacement is `Selection.getComposedRanges()`, which does
+     * reach into a shadow tree it is given. It hands back `StaticRange`s, and
+     * the editor mutates ranges constantly, so they are turned into live ones.
+     *
+     * Reads are answered from those ranges; everything else, including the
+     * writes (`addRange`, `removeAllRanges`, `setBaseAndExtent`), goes to the
+     * real selection, which does accept nodes inside a shadow tree. Reading is
+     * the only side the browser blocks.
+     *
+     * @returns `null` when the browser offers neither API, so the caller falls
+     * back to the plain window selection.
+     */
+    __composedSelection(shadowRoot) {
+        const selection = this.win.getSelection();
+        if (!selection) {
+            return null;
+        }
+        // Firefox has no `ShadowRoot.getSelection` either, but its window
+        // selection does see into a shadow tree. Where the plain selection
+        // already points at the right node there is nothing to work around, and
+        // taking it over would change behaviour that works today.
+        const { anchorNode } = selection;
+        if (anchorNode && Dom.isOrContains(shadowRoot, anchorNode)) {
+            return null;
+        }
+        const ranges = composedRanges(selection, shadowRoot);
+        if (!ranges) {
+            return null;
+        }
+        const live = ranges.map(staticRange => {
+            const range = this.createRange();
+            range.setStart(staticRange.startContainer, staticRange.startOffset);
+            range.setEnd(staticRange.endContainer, staticRange.endOffset);
+            return range;
+        });
+        const first = live[0];
+        const overrides = {
+            rangeCount: live.length,
+            getRangeAt: (index) => live[index],
+            isCollapsed: live.every(range => range.collapsed),
+            // Without these the editor asks the window selection where the
+            // caret is, is told "outside the editable area", and resets the
+            // caret to the start of it — which is the focus loss that shows up
+            // right after a successful Backspace.
+            anchorNode: first ? first.startContainer : null,
+            anchorOffset: first ? first.startOffset : 0,
+            focusNode: first ? first.endContainer : null,
+            focusOffset: first ? first.endOffset : 0,
+            toString: () => live.map(range => range.toString()).join('')
+        };
+        return new Proxy(selection, {
+            get(target, property) {
+                if (isString(property) && property in overrides) {
+                    return overrides[property];
+                }
+                const value = Reflect.get(target, property, target);
+                return isFunction(value) ? value.bind(target) : value;
+            }
+        });
+    }
     /**
      * Return first selected range or create new
      */

package/esm/jodit.js

@@ -333,6 +333,11 @@ let Jodit = Jodit_1 = class Jodit extends ViewWithToolbar {
         }
         if (this.editor) {
             this.editor.innerHTML = data.value;
+            // Fired synchronously, before any task can run: the value was
+            // sanitized in an inert document and re-parsed here with scripting
+            // on, and the two parsers do not always agree. Listeners get to
+            // look at the tree that actually exists.
+            this.e.fire('afterSetNativeEditorValue');
         }
     }
     /**

package/esm/plugins/clean-html/clean-html.d.ts

@@ -25,6 +25,14 @@ export declare class cleanHtml extends Plugin {
     private walker;
     protected startWalker(): void;
     protected beforeCommand(command: string): void | false;
+    /**
+     * The value was sanitized in an inert document and has just been re-parsed
+     * into the live editor with scripting on. Where the two parsers disagree
+     * (`<noscript>`, raw-text elements), markup that was inert text a moment
+     * ago is a real element now, so the live tree is sanitized once more, in
+     * the same call stack, before any handler it might carry can fire.
+     */
+    protected onAfterSetNativeEditorValue(): void;
     /**
      * Event handler when manually assigning a value to the HTML editor.
      */

package/esm/plugins/clean-html/clean-html.js

@@ -81,6 +81,16 @@ export class cleanHtml extends Plugin {
             return false;
         }
     }
+    /**
+     * The value was sanitized in an inert document and has just been re-parsed
+     * into the live editor with scripting on. Where the two parsers disagree
+     * (`<noscript>`, raw-text elements), markup that was inert text a moment
+     * ago is a real element now, so the live tree is sanitized once more, in
+     * the same call stack, before any handler it might carry can fire.
+     */
+    onAfterSetNativeEditorValue() {
+        safeHTML(this.j.editor, this.j.o.cleanHTML);
+    }
     /**
      * Event handler when manually assigning a value to the HTML editor.
      */
@@ -201,6 +211,9 @@ __decorate([
 __decorate([
     watch(':beforeCommand')
 ], cleanHtml.prototype, "beforeCommand", null);
+__decorate([
+    watch(':afterSetNativeEditorValue')
+], cleanHtml.prototype, "onAfterSetNativeEditorValue", null);
 __decorate([
     watch(':beforeSetNativeEditorValue')
 ], cleanHtml.prototype, "onBeforeSetNativeEditorValue", null);