prosemirror-view 1.42.2 → 1.42.3

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 1.42.3 (2026-08-25)
+
+### Bug fixes
+
+Don't set `contenteditable=false` on widgets that already have a `contenteditable` attribute.
+
+Fix a bug that broke pasting when there was a default trusted type policy defined without a `createHTML` function.
+
+Run attribute validators on attributes provided via slice context in clipboard content. This closes an XSS vulnerability (found by Pedro Paniago).
+
 ## 1.42.2 (2026-07-24)
 
 ### Bug fixes

package/dist/index.cjs

@@ -1105,7 +1105,7 @@ var WidgetViewDesc = function (_ViewDesc) {
         wrap.appendChild(dom);
         dom = wrap;
       }
-      dom.contentEditable = "false";
+      if (!dom.hasAttribute("contenteditable")) dom.contentEditable = "false";
       dom.classList.add("ProseMirror-widget");
     }
     _this = _super.call(this, parent, [], dom, null);
@@ -2852,11 +2852,16 @@ var _policy = null;
 function maybeWrapTrusted(html) {
   var trustedTypes = window.trustedTypes;
   if (!trustedTypes) return html;
-  if (!_policy) _policy = trustedTypes.defaultPolicy || trustedTypes.createPolicy("ProseMirrorClipboard", {
-    createHTML: function createHTML(s) {
-      return s;
-    }
-  });
+  if (!_policy) {
+    if (_policy = trustedTypes.defaultPolicy) try {
+      return _policy.createHTML(html);
+    } catch (_a) {}
+    _policy = trustedTypes.createPolicy("ProseMirrorClipboard", {
+      createHTML: function createHTML(s) {
+        return s;
+      }
+    });
+  }
   return _policy.createHTML(html);
 }
 function readHTML(html) {
@@ -2907,6 +2912,11 @@ function addContext(slice, context) {
   for (var i = array.length - 2; i >= 0; i -= 2) {
     var type = schema.nodes[array[i]];
     if (!type || type.hasRequiredAttrs()) break;
+    try {
+      type.checkAttrs(array[i + 1]);
+    } catch (e) {
+      break;
+    }
     content = prosemirrorModel.Fragment.from(type.create(array[i + 1], content));
     openStart++;
     openEnd++;

package/dist/index.js

@@ -1169,7 +1169,8 @@ class WidgetViewDesc extends ViewDesc {
                 wrap.appendChild(dom);
                 dom = wrap;
             }
-            dom.contentEditable = "false";
+            if (!dom.hasAttribute("contenteditable"))
+                dom.contentEditable = "false";
             dom.classList.add("ProseMirror-widget");
         }
         super(parent, [], dom, null);
@@ -3017,8 +3018,14 @@ function maybeWrapTrusted(html) {
     // With the require-trusted-types-for CSP, Chrome will block
     // innerHTML, even on a detached document. This wraps the string in
     // a way that makes the browser allow us to use its parser again.
-    if (!_policy)
-        _policy = trustedTypes.defaultPolicy || trustedTypes.createPolicy("ProseMirrorClipboard", { createHTML: (s) => s });
+    if (!_policy) {
+        if (_policy = trustedTypes.defaultPolicy)
+            try {
+                return _policy.createHTML(html);
+            }
+            catch (_a) { }
+        _policy = trustedTypes.createPolicy("ProseMirrorClipboard", { createHTML: (s) => s });
+    }
     return _policy.createHTML(html);
 }
 function readHTML(html) {
@@ -3075,6 +3082,12 @@ function addContext(slice, context) {
         let type = schema.nodes[array[i]];
         if (!type || type.hasRequiredAttrs())
             break;
+        try {
+            type.checkAttrs(array[i + 1]);
+        }
+        catch (e) {
+            break;
+        }
         content = Fragment.from(type.create(array[i + 1], content));
         openStart++;
         openEnd++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prosemirror-view",
-  "version": "1.42.2",
+  "version": "1.42.3",
   "description": "ProseMirror's view component",
   "type": "module",
   "main": "dist/index.cjs",

package/src/clipboard.ts

@@ -215,8 +215,11 @@ function maybeWrapTrusted(html: string): string {
   // With the require-trusted-types-for CSP, Chrome will block
   // innerHTML, even on a detached document. This wraps the string in
   // a way that makes the browser allow us to use its parser again.
-  if (!_policy)
-    _policy = trustedTypes.defaultPolicy || trustedTypes.createPolicy("ProseMirrorClipboard", {createHTML: (s: string) => s})
+  if (!_policy) {
+    if (_policy = trustedTypes.defaultPolicy)
+      try { return _policy.createHTML(html) } catch {}
+    _policy = trustedTypes.createPolicy("ProseMirrorClipboard", {createHTML: (s: string) => s})
+  }
   return _policy.createHTML(html)
 }
 
@@ -267,6 +270,8 @@ function addContext(slice: Slice, context: string) {
   for (let i = array.length - 2; i >= 0; i -= 2) {
     let type = schema.nodes[array[i]]
     if (!type || type.hasRequiredAttrs()) break
+    try { type.checkAttrs(array[i + 1]) }
+    catch(e) { break }
     content = Fragment.from(type.create(array[i + 1], content))
     openStart++; openEnd++
   }

package/src/viewdesc.ts

@@ -555,7 +555,8 @@ class WidgetViewDesc extends ViewDesc {
         wrap.appendChild(dom)
         dom = wrap
       }
-      ;(dom as HTMLElement).contentEditable = "false"
+      if (!(dom as HTMLElement).hasAttribute("contenteditable"))
+        (dom as HTMLElement).contentEditable = "false"
       ;(dom as HTMLElement).classList.add("ProseMirror-widget")
     }
     super(parent, [], dom, null)