prosemirror-view 1.42.2 → 1.42.4

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 1.42.4 (2026-09-18)
+
+### Bug fixes
+
+Prevent uneditable elements rendered as part of node or mark view from blocking cursor motion.
+
+Fix a bug that could break some types of composition input starting with a non-empty selection.
+
+## 1.42.3 (2026-08-25)
+
+### Bug fixes
+
+Don't set `contenteditable=false` on widgets that already have a `contenteditable` attribute.
+
+Fix a bug that broke pasting when there was a default trusted type policy defined without a `createHTML` function.
+
+Run attribute validators on attributes provided via slice context in clipboard content. This closes an XSS vulnerability (found by Pedro Paniago).
+
 ## 1.42.2 (2026-07-24)
 
 ### Bug fixes

package/dist/index.cjs

@@ -1105,7 +1105,7 @@ var WidgetViewDesc = function (_ViewDesc) {
         wrap.appendChild(dom);
         dom = wrap;
       }
-      dom.contentEditable = "false";
+      if (!dom.hasAttribute("contenteditable")) dom.contentEditable = "false";
       dom.classList.add("ProseMirror-widget");
     }
     _this = _super.call(this, parent, [], dom, null);
@@ -2400,7 +2400,7 @@ function nodeLen(node) {
 }
 function isIgnorable(dom, dir) {
   var desc = dom.pmViewDesc;
-  return desc && desc.size == 0 && (dir < 0 || dom.nextSibling || dom.nodeName != "BR");
+  return desc ? desc.size == 0 && (dir < 0 || dom.nextSibling || dom.nodeName != "BR") : dom.nodeType == 1 && dom.contentEditable == "false";
 }
 function skipIgnoredNodes(view, dir) {
   return dir < 0 ? skipIgnoredNodesBefore(view) : skipIgnoredNodesAfter(view);
@@ -2852,11 +2852,16 @@ var _policy = null;
 function maybeWrapTrusted(html) {
   var trustedTypes = window.trustedTypes;
   if (!trustedTypes) return html;
-  if (!_policy) _policy = trustedTypes.defaultPolicy || trustedTypes.createPolicy("ProseMirrorClipboard", {
-    createHTML: function createHTML(s) {
-      return s;
-    }
-  });
+  if (!_policy) {
+    if (_policy = trustedTypes.defaultPolicy) try {
+      return _policy.createHTML(html);
+    } catch (_a) {}
+    _policy = trustedTypes.createPolicy("ProseMirrorClipboard", {
+      createHTML: function createHTML(s) {
+        return s;
+      }
+    });
+  }
   return _policy.createHTML(html);
 }
 function readHTML(html) {
@@ -2907,6 +2912,11 @@ function addContext(slice, context) {
   for (var i = array.length - 2; i >= 0; i -= 2) {
     var type = schema.nodes[array[i]];
     if (!type || type.hasRequiredAttrs()) break;
+    try {
+      type.checkAttrs(array[i + 1]);
+    } catch (e) {
+      break;
+    }
     content = prosemirrorModel.Fragment.from(type.create(array[i + 1], content));
     openStart++;
     openEnd++;
@@ -3377,7 +3387,7 @@ editHandlers.compositionstart = editHandlers.compositionupdate = function (view)
     view.domObserver.flush();
     var state = view.state,
       $pos = state.selection.$to;
-    if (state.selection instanceof prosemirrorState.TextSelection && (state.storedMarks || !$pos.textOffset && $pos.parentOffset && $pos.nodeBefore.marks.some(function (m) {
+    if (state.selection instanceof prosemirrorState.TextSelection && state.selection.empty && (state.storedMarks || !$pos.textOffset && $pos.parentOffset && $pos.nodeBefore.marks.some(function (m) {
       return m.type.spec.inclusive === false;
     }) || chrome && windows && selectionBeforeUneditable(view))) {
       view.markCursor = view.state.storedMarks || $pos.marks();

package/dist/index.js

@@ -1169,7 +1169,8 @@ class WidgetViewDesc extends ViewDesc {
                 wrap.appendChild(dom);
                 dom = wrap;
             }
-            dom.contentEditable = "false";
+            if (!dom.hasAttribute("contenteditable"))
+                dom.contentEditable = "false";
             dom.classList.add("ProseMirror-widget");
         }
         super(parent, [], dom, null);
@@ -2493,7 +2494,8 @@ function nodeLen(node) {
 }
 function isIgnorable(dom, dir) {
     let desc = dom.pmViewDesc;
-    return desc && desc.size == 0 && (dir < 0 || dom.nextSibling || dom.nodeName != "BR");
+    return desc ? desc.size == 0 && (dir < 0 || dom.nextSibling || dom.nodeName != "BR")
+        : dom.nodeType == 1 && dom.contentEditable == "false";
 }
 function skipIgnoredNodes(view, dir) {
     return dir < 0 ? skipIgnoredNodesBefore(view) : skipIgnoredNodesAfter(view);
@@ -3017,8 +3019,14 @@ function maybeWrapTrusted(html) {
     // With the require-trusted-types-for CSP, Chrome will block
     // innerHTML, even on a detached document. This wraps the string in
     // a way that makes the browser allow us to use its parser again.
-    if (!_policy)
-        _policy = trustedTypes.defaultPolicy || trustedTypes.createPolicy("ProseMirrorClipboard", { createHTML: (s) => s });
+    if (!_policy) {
+        if (_policy = trustedTypes.defaultPolicy)
+            try {
+                return _policy.createHTML(html);
+            }
+            catch (_a) { }
+        _policy = trustedTypes.createPolicy("ProseMirrorClipboard", { createHTML: (s) => s });
+    }
     return _policy.createHTML(html);
 }
 function readHTML(html) {
@@ -3075,6 +3083,12 @@ function addContext(slice, context) {
         let type = schema.nodes[array[i]];
         if (!type || type.hasRequiredAttrs())
             break;
+        try {
+            type.checkAttrs(array[i + 1]);
+        }
+        catch (e) {
+            break;
+        }
         content = Fragment.from(type.create(array[i + 1], content));
         openStart++;
         openEnd++;
@@ -3556,7 +3570,7 @@ editHandlers.compositionstart = editHandlers.compositionupdate = view => {
     if (!view.composing) {
         view.domObserver.flush();
         let { state } = view, $pos = state.selection.$to;
-        if (state.selection instanceof TextSelection &&
+        if (state.selection instanceof TextSelection && state.selection.empty &&
             (state.storedMarks ||
                 (!$pos.textOffset && $pos.parentOffset && $pos.nodeBefore.marks.some(m => m.type.spec.inclusive === false)) ||
                 chrome && windows && selectionBeforeUneditable(view))) { // Issue #1500

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prosemirror-view",
-  "version": "1.42.2",
+  "version": "1.42.4",
   "description": "ProseMirror's view component",
   "type": "module",
   "main": "dist/index.cjs",

package/src/capturekeys.ts

@@ -61,7 +61,8 @@ function nodeLen(node: Node) {
 
 function isIgnorable(dom: Node, dir: number) {
   let desc = dom.pmViewDesc
-  return desc && desc.size == 0 && (dir < 0 || dom.nextSibling || dom.nodeName != "BR")
+  return desc ? desc.size == 0 && (dir < 0 || dom.nextSibling || dom.nodeName != "BR")
+    : dom.nodeType == 1 && (dom as HTMLElement).contentEditable == "false"
 }
 
 function skipIgnoredNodes(view: EditorView, dir: number) {

package/src/clipboard.ts

@@ -215,8 +215,11 @@ function maybeWrapTrusted(html: string): string {
   // With the require-trusted-types-for CSP, Chrome will block
   // innerHTML, even on a detached document. This wraps the string in
   // a way that makes the browser allow us to use its parser again.
-  if (!_policy)
-    _policy = trustedTypes.defaultPolicy || trustedTypes.createPolicy("ProseMirrorClipboard", {createHTML: (s: string) => s})
+  if (!_policy) {
+    if (_policy = trustedTypes.defaultPolicy)
+      try { return _policy.createHTML(html) } catch {}
+    _policy = trustedTypes.createPolicy("ProseMirrorClipboard", {createHTML: (s: string) => s})
+  }
   return _policy.createHTML(html)
 }
 
@@ -267,6 +270,8 @@ function addContext(slice: Slice, context: string) {
   for (let i = array.length - 2; i >= 0; i -= 2) {
     let type = schema.nodes[array[i]]
     if (!type || type.hasRequiredAttrs()) break
+    try { type.checkAttrs(array[i + 1]) }
+    catch(e) { break }
     content = Fragment.from(type.create(array[i + 1], content))
     openStart++; openEnd++
   }

package/src/input.ts

@@ -518,7 +518,7 @@ editHandlers.compositionstart = editHandlers.compositionupdate = view => {
   if (!view.composing) {
     view.domObserver.flush()
     let {state} = view, $pos = state.selection.$to
-    if (state.selection instanceof TextSelection &&
+    if (state.selection instanceof TextSelection && state.selection.empty &&
         (state.storedMarks ||
          (!$pos.textOffset && $pos.parentOffset && $pos.nodeBefore!.marks.some(m => m.type.spec.inclusive === false)) ||
          browser.chrome && browser.windows && selectionBeforeUneditable(view))) { // Issue #1500

package/src/viewdesc.ts

@@ -555,7 +555,8 @@ class WidgetViewDesc extends ViewDesc {
         wrap.appendChild(dom)
         dom = wrap
       }
-      ;(dom as HTMLElement).contentEditable = "false"
+      if (!(dom as HTMLElement).hasAttribute("contenteditable"))
+        (dom as HTMLElement).contentEditable = "false"
       ;(dom as HTMLElement).classList.add("ProseMirror-widget")
     }
     super(parent, [], dom, null)