jodit 4.17.2 → 4.17.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (62) hide show
  1. package/.nvmrc +1 -0
  2. package/CHANGELOG.md +6 -0
  3. package/es2015/jodit.css +1 -1
  4. package/es2015/jodit.fat.min.js +4 -4
  5. package/es2015/jodit.js +34 -2
  6. package/es2015/jodit.min.js +4 -4
  7. package/es2015/plugins/debug/debug.css +1 -1
  8. package/es2015/plugins/debug/debug.js +1 -1
  9. package/es2015/plugins/debug/debug.min.js +1 -1
  10. package/es2015/plugins/speech-recognize/speech-recognize.css +1 -1
  11. package/es2015/plugins/speech-recognize/speech-recognize.js +1 -1
  12. package/es2015/plugins/speech-recognize/speech-recognize.min.js +1 -1
  13. package/es2018/jodit.fat.min.js +4 -4
  14. package/es2018/jodit.min.js +4 -4
  15. package/es2018/plugins/debug/debug.min.js +1 -1
  16. package/es2018/plugins/speech-recognize/speech-recognize.min.js +1 -1
  17. package/es2021/jodit.css +1 -1
  18. package/es2021/jodit.fat.min.js +5 -5
  19. package/es2021/jodit.js +34 -2
  20. package/es2021/jodit.min.js +5 -5
  21. package/es2021/plugins/debug/debug.css +1 -1
  22. package/es2021/plugins/debug/debug.js +1 -1
  23. package/es2021/plugins/debug/debug.min.js +1 -1
  24. package/es2021/plugins/speech-recognize/speech-recognize.css +1 -1
  25. package/es2021/plugins/speech-recognize/speech-recognize.js +1 -1
  26. package/es2021/plugins/speech-recognize/speech-recognize.min.js +1 -1
  27. package/es2021.en/jodit.css +1 -1
  28. package/es2021.en/jodit.fat.min.js +5 -5
  29. package/es2021.en/jodit.js +34 -2
  30. package/es2021.en/jodit.min.js +5 -5
  31. package/es2021.en/plugins/debug/debug.css +1 -1
  32. package/es2021.en/plugins/debug/debug.js +1 -1
  33. package/es2021.en/plugins/debug/debug.min.js +1 -1
  34. package/es2021.en/plugins/speech-recognize/speech-recognize.css +1 -1
  35. package/es2021.en/plugins/speech-recognize/speech-recognize.js +1 -1
  36. package/es2021.en/plugins/speech-recognize/speech-recognize.min.js +1 -1
  37. package/es5/jodit.css +2 -2
  38. package/es5/jodit.fat.min.js +2 -2
  39. package/es5/jodit.js +54 -2
  40. package/es5/jodit.min.css +2 -2
  41. package/es5/jodit.min.js +2 -2
  42. package/es5/plugins/debug/debug.css +1 -1
  43. package/es5/plugins/debug/debug.js +1 -1
  44. package/es5/plugins/debug/debug.min.js +1 -1
  45. package/es5/plugins/speech-recognize/speech-recognize.css +1 -1
  46. package/es5/plugins/speech-recognize/speech-recognize.js +1 -1
  47. package/es5/plugins/speech-recognize/speech-recognize.min.js +1 -1
  48. package/es5/polyfills.fat.min.js +1 -1
  49. package/es5/polyfills.js +1 -1
  50. package/es5/polyfills.min.js +1 -1
  51. package/esm/core/constants.js +1 -1
  52. package/esm/core/helpers/html/safe-html.js +15 -0
  53. package/esm/jodit.js +5 -0
  54. package/esm/plugins/clean-html/clean-html.d.ts +8 -0
  55. package/esm/plugins/clean-html/clean-html.js +13 -0
  56. package/examples/build/es2015/jodit.min.css +1 -0
  57. package/examples/build/es2015/jodit.min.js +10 -0
  58. package/examples/build/es2015/plugins/debug/debug.min.js +10 -0
  59. package/examples/build/es2015/plugins/speech-recognize/speech-recognize.min.css +1 -0
  60. package/examples/build/es2015/plugins/speech-recognize/speech-recognize.min.js +10 -0
  61. package/package.json +1 -1
  62. package/types/plugins/clean-html/clean-html.d.ts +8 -0
package/.nvmrc ADDED
@@ -0,0 +1 @@
1
+ 22
package/CHANGELOG.md CHANGED
@@ -9,6 +9,12 @@
9
9
  > - :house: [Internal]
10
10
  > - :nail_care: [Polish]
11
11
 
12
+ ## 4.17.3
13
+
14
+ #### :bug: Bug Fix
15
+
16
+ - Security: mutation XSS on value assignment through a `<noscript>` carrier. The value is sanitized in an inert document, where scripting is off and `<noscript>` content is parsed as markup, then serialized and assigned to the live editor, where scripting is on and the same bytes are parsed as raw text ending at the first `</noscript>`. An `<img onerror>` hidden as inert text inside `<noscript><style>` therefore passed the sanitizer unchanged and became a live element whose handler fired as soon as the content loaded. `safeHTML` now removes `<noscript>` outright, and the editor fires a new synchronous `afterSetNativeEditorValue` event right after the assignment, on which `cleanHTML` sanitizes the live tree once more before any task can run, so other parse-context differences cannot leave a live handler either. Reported by Tan-JunWei.
17
+
12
18
  ## 4.17.2
13
19
 
14
20
  #### :bug: Bug Fix
package/es2015/jodit.css CHANGED
@@ -1,7 +1,7 @@
1
1
  /*!
2
2
  * jodit - Jodit is an awesome and useful wysiwyg editor with filebrowser
3
3
  * Author: Chupurnov <chupurnov@gmail.com> (https://xdsoft.net/jodit/)
4
- * Version: v4.17.2
4
+ * Version: v4.17.3
5
5
  * Url: https://xdsoft.net/jodit/
6
6
  * License(s): MIT
7
7
  */