prosemirror-view 1.34.1 → 1.34.2

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 1.34.2 (2024-09-03)
+
+### Bug fixes
+
+Fix pasting in Chrome with the require-trusted-types-for CSP enabled.
+
+Fix an issue where, for some kinds of IME on Windows, pressing Enter while in a composition would execute the resulting command on the wrong selection, erasing some typed content.
+
 ## 1.34.1 (2024-08-26)
 
 ### Bug fixes

package/dist/index.cjs

@@ -2766,6 +2766,15 @@ var _detachedDoc = null;
 function detachedDoc() {
   return _detachedDoc || (_detachedDoc = document.implementation.createHTMLDocument("title"));
 }
+function maybeWrapTrusted(html) {
+  var trustedTypes = window.trustedTypes;
+  if (!trustedTypes) return html;
+  return trustedTypes.createPolicy("detachedDocument", {
+    createHTML: function createHTML(s) {
+      return s;
+    }
+  }).createHTML(html);
+}
 function readHTML(html) {
   var metas = /^(\s*<meta [^>]*>)*/.exec(html);
   if (metas) html = html.slice(metas[0].length);
@@ -2777,7 +2786,7 @@ function readHTML(html) {
   }).join("") + html + wrap.map(function (n) {
     return "</" + n + ">";
   }).reverse().join("");
-  elt.innerHTML = html;
+  elt.innerHTML = maybeWrapTrusted(html);
   if (wrap) for (var i = 0; i < wrap.length; i++) elt = elt.querySelector(wrap[i]) || elt;
   return elt;
 }
@@ -2901,7 +2910,7 @@ editHandlers.keydown = function (view, _event) {
   view.input.lastKeyCode = event.keyCode;
   view.input.lastKeyCodeTime = Date.now();
   if (android && chrome && event.keyCode == 13) return;
-  if (event.keyCode != 229) view.domObserver.forceFlush();
+  if (view.domObserver.selectionChanged(view.domSelectionRange())) view.domObserver.flush();else if (event.keyCode != 229) view.domObserver.forceFlush();
   if (ios && event.keyCode == 13 && !event.ctrlKey && !event.altKey && !event.metaKey) {
     var now = Date.now();
     view.input.lastIOSEnter = now;
@@ -4266,6 +4275,11 @@ var DOMObserver = function () {
       }
       return this.queue;
     }
+  }, {
+    key: "selectionChanged",
+    value: function selectionChanged(sel) {
+      return !this.suppressingSelectionUpdates && !this.currentSelection.eq(sel) && hasFocusAndSelection(this.view) && !this.ignoreSelectionChange(sel);
+    }
   }, {
     key: "flush",
     value: function flush() {
@@ -4273,8 +4287,8 @@ var DOMObserver = function () {
       if (!view.docView || this.flushingSoon > -1) return;
       var mutations = this.pendingRecords();
       if (mutations.length) this.queue = [];
-      var sel = view.domSelectionRange();
-      var newSel = !this.suppressingSelectionUpdates && !this.currentSelection.eq(sel) && hasFocusAndSelection(view) && !this.ignoreSelectionChange(sel);
+      var sel = view.domSelectionRange(),
+        newSel = this.selectionChanged(sel);
       var from = -1,
         to = -1,
         typeOver = false,

package/dist/index.js

@@ -2937,6 +2937,15 @@ let _detachedDoc = null;
 function detachedDoc() {
     return _detachedDoc || (_detachedDoc = document.implementation.createHTMLDocument("title"));
 }
+function maybeWrapTrusted(html) {
+    let trustedTypes = window.trustedTypes;
+    if (!trustedTypes)
+        return html;
+    // With the require-trusted-types-for CSP, Chrome will block
+    // innerHTML, even on a detached document. This wraps the string in
+    // a way that makes the browser allow us to use its parser again.
+    return trustedTypes.createPolicy("detachedDocument", { createHTML: (s) => s }).createHTML(html);
+}
 function readHTML(html) {
     let metas = /^(\s*<meta [^>]*>)*/.exec(html);
     if (metas)
@@ -2945,7 +2954,7 @@ function readHTML(html) {
     let firstTag = /<([a-z][^>\s]+)/i.exec(html), wrap;
     if (wrap = firstTag && wrapMap[firstTag[1].toLowerCase()])
         html = wrap.map(n => "<" + n + ">").join("") + html + wrap.map(n => "</" + n + ">").reverse().join("");
-    elt.innerHTML = html;
+    elt.innerHTML = maybeWrapTrusted(html);
     if (wrap)
         for (let i = 0; i < wrap.length; i++)
             elt = elt.querySelector(wrap[i]) || elt;
@@ -3086,7 +3095,9 @@ editHandlers.keydown = (view, _event) => {
     // and handling them eagerly tends to corrupt the input.
     if (android && chrome && event.keyCode == 13)
         return;
-    if (event.keyCode != 229)
+    if (view.domObserver.selectionChanged(view.domSelectionRange()))
+        view.domObserver.flush();
+    else if (event.keyCode != 229)
         view.domObserver.forceFlush();
     // On iOS, if we preventDefault enter key presses, the virtual
     // keyboard gets confused. So the hack here is to set a flag that
@@ -4609,6 +4620,9 @@ class DOMObserver {
                 this.queue.push(mut);
         return this.queue;
     }
+    selectionChanged(sel) {
+        return !this.suppressingSelectionUpdates && !this.currentSelection.eq(sel) && hasFocusAndSelection(this.view) && !this.ignoreSelectionChange(sel);
+    }
     flush() {
         let { view } = this;
         if (!view.docView || this.flushingSoon > -1)
@@ -4616,8 +4630,7 @@ class DOMObserver {
         let mutations = this.pendingRecords();
         if (mutations.length)
             this.queue = [];
-        let sel = view.domSelectionRange();
-        let newSel = !this.suppressingSelectionUpdates && !this.currentSelection.eq(sel) && hasFocusAndSelection(view) && !this.ignoreSelectionChange(sel);
+        let sel = view.domSelectionRange(), newSel = this.selectionChanged(sel);
         let from = -1, to = -1, typeOver = false, added = [];
         if (view.editable) {
             for (let i = 0; i < mutations.length; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prosemirror-view",
-  "version": "1.34.1",
+  "version": "1.34.2",
   "description": "ProseMirror's view component",
   "type": "module",
   "main": "dist/index.cjs",

package/src/clipboard.ts

@@ -204,6 +204,15 @@ function detachedDoc() {
   return _detachedDoc || (_detachedDoc = document.implementation.createHTMLDocument("title"))
 }
 
+function maybeWrapTrusted(html: string): string {
+  let trustedTypes = (window as any).trustedTypes
+  if (!trustedTypes) return html
+  // With the require-trusted-types-for CSP, Chrome will block
+  // innerHTML, even on a detached document. This wraps the string in
+  // a way that makes the browser allow us to use its parser again.
+  return trustedTypes.createPolicy("detachedDocument", {createHTML: (s: string) => s}).createHTML(html)
+}
+
 function readHTML(html: string) {
   let metas = /^(\s*<meta [^>]*>)*/.exec(html)
   if (metas) html = html.slice(metas[0].length)
@@ -211,7 +220,7 @@ function readHTML(html: string) {
   let firstTag = /<([a-z][^>\s]+)/i.exec(html), wrap
   if (wrap = firstTag && wrapMap[firstTag[1].toLowerCase()])
     html = wrap.map(n => "<" + n + ">").join("") + html + wrap.map(n => "</" + n + ">").reverse().join("")
-  elt.innerHTML = html
+  elt.innerHTML = maybeWrapTrusted(html)
   if (wrap) for (let i = 0; i < wrap.length; i++) elt = elt.querySelector(wrap[i]) || elt
   return elt
 }

package/src/domobserver.ts

@@ -163,14 +163,17 @@ export class DOMObserver {
     return this.queue
   }
 
+  selectionChanged(sel: DOMSelectionRange) {
+    return !this.suppressingSelectionUpdates && !this.currentSelection.eq(sel) && hasFocusAndSelection(this.view) && !this.ignoreSelectionChange(sel)
+  }
+
   flush() {
     let {view} = this
     if (!view.docView || this.flushingSoon > -1) return
     let mutations = this.pendingRecords()
     if (mutations.length) this.queue = []
 
-    let sel = view.domSelectionRange()
-    let newSel = !this.suppressingSelectionUpdates && !this.currentSelection.eq(sel) && hasFocusAndSelection(view) && !this.ignoreSelectionChange(sel)
+    let sel = view.domSelectionRange(), newSel = this.selectionChanged(sel)
 
     let from = -1, to = -1, typeOver = false, added: Node[] = []
     if (view.editable) {

package/src/input.ts

@@ -112,7 +112,9 @@ editHandlers.keydown = (view: EditorView, _event: Event) => {
   // to be part of a confused sequence of composition events fired,
   // and handling them eagerly tends to corrupt the input.
   if (browser.android && browser.chrome && event.keyCode == 13) return
-  if (event.keyCode != 229) view.domObserver.forceFlush()
+
+  if (view.domObserver.selectionChanged(view.domSelectionRange())) view.domObserver.flush()
+  else if (event.keyCode != 229) view.domObserver.forceFlush()
 
   // On iOS, if we preventDefault enter key presses, the virtual
   // keyboard gets confused. So the hack here is to set a flag that