roosterjs 9.48.0 → 9.50.0

package/dist/rooster.js

@@ -4310,6 +4310,10 @@ function setListType(model, listType, removeMargins) {
                         fontSize: segmentFormat.fontSize,
                         textColor: segmentFormat.textColor,
                     });
+                    if (removeMargins) {
+                        newListItem.format.marginBottom = '0px';
+                        newListItem.format.marginTop = '0px';
+                    }
                     if (block.blockType == 'Paragraph') {
                         (0, roosterjs_content_model_dom_1.setParagraphNotImplicit)(block);
                     }
@@ -7887,21 +7891,25 @@ exports.setTableCellShade = setTableCellShade;
 /*!******************************************************************************!*\
   !*** ./packages/roosterjs-content-model-api/lib/publicApi/utils/checkXss.ts ***!
   \******************************************************************************/
-(__unused_webpack_module, exports) {
+(__unused_webpack_module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.checkXss = void 0;
+var roosterjs_content_model_dom_1 = __webpack_require__(/*! roosterjs-content-model-dom */ "./packages/roosterjs-content-model-dom/lib/index.ts");
 /**
  * @internal Check if there is XSS attack in the link
  * @param link The link to be checked
- * @returns The safe link, or empty string if there is XSS attack
- * @remarks This function checks for patterns like s\nc\nr\ni\np\nt: to prevent XSS attacks. This may block some valid links,
+ * @returns The safe link with invisible Unicode characters stripped, or empty string if there is XSS attack
+ * @remarks This function strips invisible Unicode characters (zero-width chars, Unicode Tags, etc.)
+ * and checks for patterns like s\nc\nr\ni\np\nt: to prevent XSS attacks. This may block some valid links,
  * but it is necessary for security reasons. We treat the word "script" as safe if there are "/" before it.
  */
 function checkXss(link) {
-    return link.match(/^[^\/]*s\n*c\n*r\n*i\n*p\n*t\n*:/i) ? '' : link;
+    // Defense-in-depth: strip invisible Unicode even if already handled elsewhere
+    var sanitized = (0, roosterjs_content_model_dom_1.stripInvisibleUnicode)(link);
+    return sanitized.match(/^[^\/]*s\n*c\n*r\n*i\n*p\n*t\n*:/i) ? '' : sanitized;
 }
 exports.checkXss = checkXss;
 
@@ -8139,7 +8147,7 @@ var splitSelectedParagraphByBr_1 = __webpack_require__(/*! ../../modelApi/block/
 function formatParagraphWithContentModel(editor, apiName, setStyleCallback) {
     editor.formatContentModel(function (model, context) {
         (0, splitSelectedParagraphByBr_1.splitSelectedParagraphByBr)(model);
-        var paragraphs = (0, roosterjs_content_model_dom_1.getSelectedParagraphs)(model, true /*mutate*/);
+        var paragraphs = (0, roosterjs_content_model_dom_1.getSelectedParagraphs)(model, true /*mutate*/, false /*removeUnmeaningful*/);
         paragraphs.forEach(setStyleCallback);
         context.newPendingFormat = 'preserve';
         return paragraphs.length > 0;
@@ -12990,17 +12998,24 @@ var DOMEventPlugin = /** @class */ (function () {
                 dragEvent.preventDefault();
             }
         };
-        this.onDrop = function () {
-            var _a, _b;
-            var doc = (_a = _this.editor) === null || _a === void 0 ? void 0 : _a.getDocument();
-            (_b = doc === null || doc === void 0 ? void 0 : doc.defaultView) === null || _b === void 0 ? void 0 : _b.requestAnimationFrame(function () {
-                if (_this.editor) {
-                    _this.editor.takeSnapshot();
-                    _this.editor.triggerEvent('contentChanged', {
-                        source: roosterjs_content_model_dom_1.ChangeSource.Drop,
+        this.onDrop = function (e) {
+            var _a;
+            if (_this.editor) {
+                var beforeDropEvent = _this.editor.triggerEvent('beforeDrop', {
+                    rawEvent: e,
+                });
+                if (!(beforeDropEvent === null || beforeDropEvent === void 0 ? void 0 : beforeDropEvent.rawEvent.defaultPrevented)) {
+                    var doc = _this.editor.getDocument();
+                    (_a = doc === null || doc === void 0 ? void 0 : doc.defaultView) === null || _a === void 0 ? void 0 : _a.requestAnimationFrame(function () {
+                        if (_this.editor) {
+                            _this.editor.takeSnapshot();
+                            _this.editor.triggerEvent('contentChanged', {
+                                source: roosterjs_content_model_dom_1.ChangeSource.Drop,
+                            });
+                        }
                     });
                 }
-            });
+            }
         };
         this.onScroll = function (e) {
             var _a;
@@ -13136,7 +13151,7 @@ var DOMEventPlugin = /** @class */ (function () {
             compositionend: { beforeDispatch: this.onCompositionEnd },
             // 4. Drag and Drop event
             dragstart: { beforeDispatch: this.onDragStart },
-            drop: { beforeDispatch: this.onDrop },
+            drop: { beforeDispatch: function (event) { return _this.onDrop(event); } },
             // 5. Pointer event
             pointerdown: { beforeDispatch: function (event) { return _this.onPointerDown(event); } },
         };
@@ -15619,6 +15634,7 @@ var Editor = /** @class */ (function () {
         };
         this.core = (0, createEditorCore_1.createEditorCore)(contentDiv, options);
         var initialModel = (_a = options.initialModel) !== null && _a !== void 0 ? _a : (0, roosterjs_content_model_dom_1.createEmptyModel)(this.core.format.defaultFormat);
+        (0, roosterjs_content_model_dom_1.sanitizeInvisibleUnicode)(initialModel);
         this.core.api.setContentModel(this.core, initialModel, { ignoreSelection: true }, undefined /*onNodeCreated*/, true /*isInitializing*/);
         this.core.plugins.forEach(function (plugin) { return plugin.initialize(_this); });
     }
@@ -16394,10 +16410,10 @@ function shouldApplyToItem(listStyleType, listType) {
 exports.listItemMetadataApplier = {
     metadataDefinition: roosterjs_content_model_dom_1.ListMetadataDefinition,
     applierFunction: function (metadata, format, context) {
-        var _a;
-        var depth = context.listFormat.nodeStack.length - 2; // Minus two for the parent element and convert length to index
+        var _a, _b;
+        var depth = context.listFormat.currentLevel;
         if (depth >= 0) {
-            var listType = (_a = context.listFormat.nodeStack[depth + 1].listType) !== null && _a !== void 0 ? _a : 'OL';
+            var listType = (_b = (_a = context.listFormat.nodeStack[depth + 1]) === null || _a === void 0 ? void 0 : _a.listType) !== null && _b !== void 0 ? _b : 'OL';
             var listStyleType = (0, roosterjs_content_model_dom_1.getAutoListStyleType)(listType, metadata !== null && metadata !== void 0 ? metadata : {}, depth);
             if (listStyleType !== undefined) {
                 if (shouldApplyToItem(listStyleType, listType)) {
@@ -16416,10 +16432,10 @@ exports.listItemMetadataApplier = {
 exports.listLevelMetadataApplier = {
     metadataDefinition: roosterjs_content_model_dom_1.ListMetadataDefinition,
     applierFunction: function (metadata, format, context) {
-        var _a;
-        var depth = context.listFormat.nodeStack.length - 2; // Minus two for the parent element and convert length to index
+        var _a, _b;
+        var depth = context.listFormat.currentLevel;
         if (depth >= 0) {
-            var listType = (_a = context.listFormat.nodeStack[depth + 1].listType) !== null && _a !== void 0 ? _a : 'OL';
+            var listType = (_b = (_a = context.listFormat.nodeStack[depth + 1]) === null || _a === void 0 ? void 0 : _a.listType) !== null && _b !== void 0 ? _b : 'OL';
             var listStyleType = (0, roosterjs_content_model_dom_1.getAutoListStyleType)(listType, metadata !== null && metadata !== void 0 ? metadata : {}, depth);
             if (listStyleType !== undefined) {
                 if (!shouldApplyToItem(listStyleType, listType)) {
@@ -20792,6 +20808,38 @@ function normalizeText(txt, isForward) {
 exports.normalizeText = normalizeText;
 
 
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts"
+/*!************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts ***!
+  \************************************************************************************/
+(__unused_webpack_module, exports) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.stripInvisibleUnicode = void 0;
+var INVISIBLE_UNICODE_REGEX = 
+// eslint-disable-next-line no-misleading-character-class
+/[\u00AD\u034F\u061C\u115F\u1160\u17B4\u17B5\u180B-\u180E\u200B-\u200F\u202A-\u202E\u2028\u2029\u2060-\u2064\u2066-\u2069\u3164\uFEFF\uFFA0\uFFF9-\uFFFB]|\uDB40[\uDC01-\uDCFF]/g;
+/**
+ * Strip invisible Unicode characters from a string.
+ * This removes zero-width characters, bidirectional marks, Unicode Tags (U+E0001-U+E00FF),
+ * interlinear annotation anchors, Mongolian free variation selectors,
+ * and other invisible formatting characters that can be used to hide content in links.
+ *
+ * @remarks This function strips ZWJ (U+200D) which may affect emoji sequences.
+ * It should only be applied to href attributes, not to visible text content.
+ * @param value The string to strip invisible characters from
+ * @returns The string with invisible characters removed
+ */
+function stripInvisibleUnicode(value) {
+    return value.replace(INVISIBLE_UNICODE_REGEX, '');
+}
+exports.stripInvisibleUnicode = stripInvisibleUnicode;
+
+
 /***/ },
 
 /***/ "./packages/roosterjs-content-model-dom/lib/domUtils/style/borderValues.ts"
@@ -21635,6 +21683,7 @@ var BorderStyleKeyMap = {
     borderBottom: 'border-bottom-style',
     borderLeft: 'border-left-style',
 };
+var DEFAULT_COLOR = '#000000';
 /**
  * @internal
  */
@@ -21645,7 +21694,8 @@ exports.borderColorFormatHandler = {
             borderKeys_1.BorderKeys.forEach(function (key) {
                 var width = element.style.getPropertyValue(BorderWidthKeyMap[key]);
                 var style = element.style.getPropertyValue(BorderStyleKeyMap[key]);
-                var borderColor = (0, color_1.retrieveElementColor)(element, key);
+                var color = (0, color_1.retrieveElementColor)(element, key);
+                var borderColor = color == 'initial' ? DEFAULT_COLOR : color;
                 if (borderColor) {
                     var lightModeColor = (0, color_1.getLightModeColor)(borderColor, !!context.isDarkMode, context.darkColorHandler);
                     format[key] = (0, borderValues_1.combineBorderValue)({
@@ -21664,10 +21714,10 @@ exports.borderColorFormatHandler = {
                 var value = format[key];
                 if (value) {
                     var borderValues = (0, borderValues_1.extractBorderValues)(value);
+                    var borderColorProperty = borderKeys_1.BorderColorKeyMap[key];
                     if (borderValues.color) {
                         var transformedColor = (0, color_1.adaptColor)(element, borderValues.color, 'border', !!context.isDarkMode, context.darkColorHandler);
                         if (transformedColor) {
-                            var borderColorProperty = borderKeys_1.BorderColorKeyMap[key];
                             element.style.setProperty(borderColorProperty, transformedColor);
                         }
                     }
@@ -23586,9 +23636,9 @@ exports.shouldSetValue = shouldSetValue;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createImage = exports.createText = exports.createTableCell = exports.createTable = exports.createSelectionMarker = exports.createParagraph = exports.createFormatContainer = exports.createListItem = exports.createBr = exports.isLinkUndeletable = exports.setLinkUndeletable = exports.scrollRectIntoView = exports.normalizeRect = exports.isWhiteSpacePreserved = exports.reuseCachedElement = exports.findClosestBlockEntityContainer = exports.isBlockEntityContainer = exports.isEntityDelimiter = exports.addDelimiters = exports.generateEntityClassNames = exports.parseEntityFormat = exports.getAllEntityWrappers = exports.findClosestEntityWrapper = exports.isEntityElement = exports.unwrap = exports.wrap = exports.wrapAllChildNodes = exports.moveChildNodes = exports.toArray = exports.getSafeIdSelector = exports.getObjectKeys = exports.isElementOfType = exports.isNodeOfType = exports.hasMetadata = exports.getMetadata = exports.updateMetadata = exports.buildSelectionMarker = exports.isBlockElement = exports.areSameFormats = exports.parseFormat = exports.getRegularSelectionOffsets = exports.formatContainerProcessor = exports.tableProcessor = exports.entityProcessor = exports.processChildNode = exports.handleRegularSelection = exports.childProcessor = exports.contentModelToText = exports.contentModelToDom = exports.domToContentModel = void 0;
-exports.trimModelForSelection = exports.getDOMInsertPointRect = exports.getSelectionRootNode = exports.isBold = exports.createModelToDomConfig = exports.createModelToDomContextWithConfig = exports.createModelToDomContext = exports.createDomToModelConfig = exports.createDomToModelContextWithConfig = exports.createDomToModelContext = exports.defaultGenerateColorKey = exports.parseColor = exports.setColor = exports.getColor = exports.DeprecatedColors = exports.BorderKeys = exports.parseValueWithUnit = exports.getAutoListStyleType = exports.getOrderedListNumberStr = exports.ParagraphFormats = exports.ListFormatsToMove = exports.ListFormatsToKeep = exports.ListFormats = exports.copyFormat = exports.setParagraphNotImplicit = exports.normalizeSegmentFormat = exports.mergeTextSegments = exports.normalizeSingleSegment = exports.isEmpty = exports.addSegment = exports.unwrapBlock = exports.isGeneralSegment = exports.normalizeContentModel = exports.normalizeParagraph = exports.addTextSegment = exports.addLink = exports.addCode = exports.addBlock = exports.mutateSegment = exports.mutateSegments = exports.mutateBlock = exports.createTableRow = exports.createEmptyModel = exports.createListLevel = exports.createDivider = exports.createEntity = exports.createGeneralBlock = exports.createGeneralSegment = exports.createParagraphDecorator = exports.createContentModelDocument = void 0;
-exports.runEditSteps = exports.getClosestAncestorBlockGroupIndex = exports.getSegmentTextFormat = exports.getListStyleTypeFromString = exports.retrieveModelFormatState = exports.setTableCellBackgroundColor = exports.MIN_ALLOWED_TABLE_CELL_HEIGHT = exports.MIN_ALLOWED_TABLE_CELL_WIDTH = exports.normalizeTable = exports.setFirstColumnFormatBorders = exports.applyTableFormat = exports.deleteBlock = exports.deleteSegment = exports.deleteSelection = exports.mergeModel = exports.cloneModel = exports.setSelection = exports.hasSelectionInBlockGroup = exports.hasSelectionInSegment = exports.hasSelectionInBlock = exports.getSelectedCells = exports.getSelectedSegmentsAndParagraphs = exports.getSelectedSegments = exports.getSelectedParagraphs = exports.getOperationalBlocks = exports.getFirstSelectedTable = exports.getFirstSelectedListItem = exports.iterateSelections = exports.isBlockGroupOfType = exports.getRangesByText = exports.getImageState = exports.setImageState = exports.getParagraphMarker = exports.setParagraphMarker = exports.cacheGetEventData = exports.extractClipboardItems = exports.normalizeFontFamily = exports.transformColor = exports.retrieveDocumentMetadata = exports.readFile = exports.parseTableCells = exports.normalizeText = exports.isSpace = exports.isPunctuation = exports.extractBorderValues = exports.combineBorderValue = exports.getNodePositionFromEvent = exports.isCursorMovingKey = exports.isModifierKey = exports.isCharacterValue = void 0;
-exports.EmptySegmentFormat = exports.UnorderedListStyleMap = exports.OrderedListStyleMap = exports.TableBorderFormat = exports.NumberingListType = exports.BulletListType = exports.ChangeSource = exports.ListMetadataDefinition = exports.getListMetadata = exports.updateListMetadata = exports.getTableMetadata = exports.updateTableMetadata = exports.getTableCellMetadata = exports.updateTableCellMetadata = exports.getImageMetadata = exports.updateImageMetadata = void 0;
+exports.getDOMInsertPointRect = exports.getSelectionRootNode = exports.isBold = exports.createModelToDomConfig = exports.createModelToDomContextWithConfig = exports.createModelToDomContext = exports.createDomToModelConfig = exports.createDomToModelContextWithConfig = exports.createDomToModelContext = exports.defaultGenerateColorKey = exports.parseColor = exports.setColor = exports.getColor = exports.DeprecatedColors = exports.BorderKeys = exports.parseValueWithUnit = exports.getAutoListStyleType = exports.getOrderedListNumberStr = exports.ParagraphFormats = exports.ListFormatsToMove = exports.ListFormatsToKeep = exports.ListFormats = exports.copyFormat = exports.setParagraphNotImplicit = exports.normalizeSegmentFormat = exports.mergeTextSegments = exports.normalizeSingleSegment = exports.isEmpty = exports.addSegment = exports.unwrapBlock = exports.isGeneralSegment = exports.sanitizeInvisibleUnicode = exports.normalizeContentModel = exports.normalizeParagraph = exports.addTextSegment = exports.addLink = exports.addCode = exports.addBlock = exports.mutateSegment = exports.mutateSegments = exports.mutateBlock = exports.createTableRow = exports.createEmptyModel = exports.createListLevel = exports.createDivider = exports.createEntity = exports.createGeneralBlock = exports.createGeneralSegment = exports.createParagraphDecorator = exports.createContentModelDocument = void 0;
+exports.getSegmentTextFormat = exports.getListStyleTypeFromString = exports.retrieveModelFormatState = exports.setTableCellBackgroundColor = exports.MIN_ALLOWED_TABLE_CELL_HEIGHT = exports.MIN_ALLOWED_TABLE_CELL_WIDTH = exports.normalizeTable = exports.setFirstColumnFormatBorders = exports.applyTableFormat = exports.deleteBlock = exports.deleteSegment = exports.deleteSelection = exports.mergeModel = exports.cloneModel = exports.setSelection = exports.hasSelectionInBlockGroup = exports.hasSelectionInSegment = exports.hasSelectionInBlock = exports.getSelectedCells = exports.getSelectedSegmentsAndParagraphs = exports.getSelectedSegments = exports.getSelectedParagraphs = exports.getOperationalBlocks = exports.getFirstSelectedTable = exports.getFirstSelectedListItem = exports.iterateSelections = exports.isBlockGroupOfType = exports.getRangesByText = exports.getImageState = exports.setImageState = exports.getParagraphMarker = exports.setParagraphMarker = exports.cacheGetEventData = exports.extractClipboardItems = exports.normalizeFontFamily = exports.transformColor = exports.retrieveDocumentMetadata = exports.readFile = exports.parseTableCells = exports.stripInvisibleUnicode = exports.normalizeText = exports.isSpace = exports.isPunctuation = exports.extractBorderValues = exports.combineBorderValue = exports.getNodePositionFromEvent = exports.isCursorMovingKey = exports.isModifierKey = exports.isCharacterValue = exports.trimModelForSelection = void 0;
+exports.EmptySegmentFormat = exports.UnorderedListStyleMap = exports.OrderedListStyleMap = exports.TableBorderFormat = exports.NumberingListType = exports.BulletListType = exports.ChangeSource = exports.ListMetadataDefinition = exports.getListMetadata = exports.updateListMetadata = exports.getTableMetadata = exports.updateTableMetadata = exports.getTableCellMetadata = exports.updateTableCellMetadata = exports.getImageMetadata = exports.updateImageMetadata = exports.runEditSteps = exports.getClosestAncestorBlockGroupIndex = void 0;
 var domToContentModel_1 = __webpack_require__(/*! ./domToModel/domToContentModel */ "./packages/roosterjs-content-model-dom/lib/domToModel/domToContentModel.ts");
 Object.defineProperty(exports, "domToContentModel", ({ enumerable: true, get: function () { return domToContentModel_1.domToContentModel; } }));
 var contentModelToDom_1 = __webpack_require__(/*! ./modelToDom/contentModelToDom */ "./packages/roosterjs-content-model-dom/lib/modelToDom/contentModelToDom.ts");
@@ -23709,6 +23759,8 @@ var normalizeParagraph_1 = __webpack_require__(/*! ./modelApi/common/normalizePa
 Object.defineProperty(exports, "normalizeParagraph", ({ enumerable: true, get: function () { return normalizeParagraph_1.normalizeParagraph; } }));
 var normalizeContentModel_1 = __webpack_require__(/*! ./modelApi/common/normalizeContentModel */ "./packages/roosterjs-content-model-dom/lib/modelApi/common/normalizeContentModel.ts");
 Object.defineProperty(exports, "normalizeContentModel", ({ enumerable: true, get: function () { return normalizeContentModel_1.normalizeContentModel; } }));
+var sanitizeInvisibleUnicode_1 = __webpack_require__(/*! ./modelApi/common/sanitizeInvisibleUnicode */ "./packages/roosterjs-content-model-dom/lib/modelApi/common/sanitizeInvisibleUnicode.ts");
+Object.defineProperty(exports, "sanitizeInvisibleUnicode", ({ enumerable: true, get: function () { return sanitizeInvisibleUnicode_1.sanitizeInvisibleUnicode; } }));
 var isGeneralSegment_1 = __webpack_require__(/*! ./modelApi/typeCheck/isGeneralSegment */ "./packages/roosterjs-content-model-dom/lib/modelApi/typeCheck/isGeneralSegment.ts");
 Object.defineProperty(exports, "isGeneralSegment", ({ enumerable: true, get: function () { return isGeneralSegment_1.isGeneralSegment; } }));
 var unwrapBlock_1 = __webpack_require__(/*! ./modelApi/common/unwrapBlock */ "./packages/roosterjs-content-model-dom/lib/modelApi/common/unwrapBlock.ts");
@@ -23774,6 +23826,8 @@ var stringUtil_1 = __webpack_require__(/*! ./domUtils/stringUtil */ "./packages/
 Object.defineProperty(exports, "isPunctuation", ({ enumerable: true, get: function () { return stringUtil_1.isPunctuation; } }));
 Object.defineProperty(exports, "isSpace", ({ enumerable: true, get: function () { return stringUtil_1.isSpace; } }));
 Object.defineProperty(exports, "normalizeText", ({ enumerable: true, get: function () { return stringUtil_1.normalizeText; } }));
+var stripInvisibleUnicode_1 = __webpack_require__(/*! ./domUtils/stripInvisibleUnicode */ "./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts");
+Object.defineProperty(exports, "stripInvisibleUnicode", ({ enumerable: true, get: function () { return stripInvisibleUnicode_1.stripInvisibleUnicode; } }));
 var parseTableCells_1 = __webpack_require__(/*! ./domUtils/table/parseTableCells */ "./packages/roosterjs-content-model-dom/lib/domUtils/table/parseTableCells.ts");
 Object.defineProperty(exports, "parseTableCells", ({ enumerable: true, get: function () { return parseTableCells_1.parseTableCells; } }));
 var readFile_1 = __webpack_require__(/*! ./domUtils/readFile */ "./packages/roosterjs-content-model-dom/lib/domUtils/readFile.ts");
@@ -23904,6 +23958,8 @@ exports.ListFormatsToKeep = [
     'direction',
     'textAlign',
     'htmlAlign',
+    'marginBottom',
+    'marginTop',
 ];
 /**
  * When copy format from one block to another, these are all the formats that we can copy
@@ -24770,6 +24826,134 @@ function normalizeSegmentFormat(format, environment) {
 exports.normalizeSegmentFormat = normalizeSegmentFormat;
 
 
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-dom/lib/modelApi/common/sanitizeInvisibleUnicode.ts"
+/*!**********************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-dom/lib/modelApi/common/sanitizeInvisibleUnicode.ts ***!
+  \**********************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.sanitizeInvisibleUnicode = void 0;
+var tslib_1 = __webpack_require__(/*! tslib */ "./node_modules/tslib/tslib.es6.mjs");
+var stripInvisibleUnicode_1 = __webpack_require__(/*! ../../domUtils/stripInvisibleUnicode */ "./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts");
+/**
+ * Strip invisible Unicode characters from all text and link hrefs in a content model.
+ * This sanitizes the model at initialization time to prevent hidden content in links
+ * or text (e.g. zero-width chars, bidirectional marks, Unicode Tags).
+ * For General segments, all Text nodes under the element are also sanitized.
+ * @param model The content model document to sanitize in-place
+ */
+function sanitizeInvisibleUnicode(model) {
+    sanitizeBlockGroup(model);
+}
+exports.sanitizeInvisibleUnicode = sanitizeInvisibleUnicode;
+function sanitizeBlockGroup(group) {
+    var e_1, _a;
+    try {
+        for (var _b = (0, tslib_1.__values)(group.blocks), _c = _b.next(); !_c.done; _c = _b.next()) {
+            var block = _c.value;
+            sanitizeBlock(block);
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+}
+function sanitizeBlock(block) {
+    var e_2, _a, e_3, _b, e_4, _c;
+    switch (block.blockType) {
+        case 'Paragraph':
+            try {
+                for (var _d = (0, tslib_1.__values)(block.segments), _e = _d.next(); !_e.done; _e = _d.next()) {
+                    var segment = _e.value;
+                    sanitizeSegment(segment);
+                }
+            }
+            catch (e_2_1) { e_2 = { error: e_2_1 }; }
+            finally {
+                try {
+                    if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
+                }
+                finally { if (e_2) throw e_2.error; }
+            }
+            break;
+        case 'Table':
+            try {
+                for (var _f = (0, tslib_1.__values)(block.rows), _g = _f.next(); !_g.done; _g = _f.next()) {
+                    var row = _g.value;
+                    try {
+                        for (var _h = (e_4 = void 0, (0, tslib_1.__values)(row.cells)), _j = _h.next(); !_j.done; _j = _h.next()) {
+                            var cell = _j.value;
+                            sanitizeBlockGroup(cell);
+                        }
+                    }
+                    catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                    finally {
+                        try {
+                            if (_j && !_j.done && (_c = _h.return)) _c.call(_h);
+                        }
+                        finally { if (e_4) throw e_4.error; }
+                    }
+                }
+            }
+            catch (e_3_1) { e_3 = { error: e_3_1 }; }
+            finally {
+                try {
+                    if (_g && !_g.done && (_b = _f.return)) _b.call(_f);
+                }
+                finally { if (e_3) throw e_3.error; }
+            }
+            break;
+        case 'BlockGroup':
+            sanitizeBlockGroup(block);
+            if (block.blockGroupType === 'General' && block.element) {
+                sanitizeTextNodes(block.element);
+            }
+            break;
+        case 'Entity':
+        case 'Divider':
+            break;
+    }
+}
+function sanitizeSegment(segment) {
+    var _a;
+    if ((_a = segment.link) === null || _a === void 0 ? void 0 : _a.format.href) {
+        segment.link.format.href = (0, stripInvisibleUnicode_1.stripInvisibleUnicode)(segment.link.format.href);
+    }
+    switch (segment.segmentType) {
+        case 'Text':
+            segment.text = (0, stripInvisibleUnicode_1.stripInvisibleUnicode)(segment.text);
+            break;
+        case 'General':
+            sanitizeTextNodes(segment.element);
+            sanitizeBlockGroup(segment);
+            break;
+        case 'Image':
+        case 'Entity':
+        case 'Br':
+        case 'SelectionMarker':
+            break;
+    }
+}
+function sanitizeTextNodes(element) {
+    var walker = element.ownerDocument.createTreeWalker(element, NodeFilter.SHOW_TEXT);
+    var node;
+    while ((node = walker.nextNode())) {
+        if (node.nodeValue) {
+            node.nodeValue = (0, stripInvisibleUnicode_1.stripInvisibleUnicode)(node.nodeValue);
+        }
+    }
+}
+
+
 /***/ },
 
 /***/ "./packages/roosterjs-content-model-dom/lib/modelApi/common/unwrapBlock.ts"
@@ -28119,10 +28303,13 @@ function getSelectedSegments(model, includingFormatHolder, mutate) {
     return segments.map(function (x) { return x[0]; });
 }
 exports.getSelectedSegments = getSelectedSegments;
-function getSelectedParagraphs(model, mutate) {
+function getSelectedParagraphs(model, mutate, removeUnmeaningful) {
+    if (removeUnmeaningful === void 0) { removeUnmeaningful = true; }
     var selections = collectSelections(model, { includeListFormatHolder: 'never' });
     var result = [];
-    removeUnmeaningfulSelections(selections);
+    if (removeUnmeaningful) {
+        removeUnmeaningfulSelections(selections);
+    }
     selections.forEach(function (_a) {
         var block = _a.block;
         if ((block === null || block === void 0 ? void 0 : block.blockType) == 'Paragraph') {
@@ -28896,6 +29083,7 @@ function createModelToDomFormatContext() {
         listFormat: {
             threadItemCounts: [],
             nodeStack: [],
+            currentLevel: 0,
         },
         implicitFormat: {},
     };
@@ -29470,6 +29658,7 @@ var handleList = function (doc, parent, listItem, context, refNode) {
         var parentLevel = nodeStack[layer];
         var stackLevel = nodeStack[layer + 1];
         var itemLevel = listItem.levels[layer];
+        context.listFormat.currentLevel = layer;
         if (stackLevel.listType != itemLevel.listType ||
             ((_a = stackLevel.dataset) === null || _a === void 0 ? void 0 : _a.editingInfo) != itemLevel.dataset.editingInfo ||
             (itemLevel.listType == 'OL' &&
@@ -29505,6 +29694,7 @@ var handleList = function (doc, parent, listItem, context, refNode) {
         var newList = void 0;
         var isNewlyCreated = false;
         var levelRefNode = (_c = nodeStack[layer].refNode) !== null && _c !== void 0 ? _c : null;
+        context.listFormat.currentLevel = layer;
         if (context.allowCacheListItem && level.cachedElement) {
             newList = level.cachedElement;
             nodeStack[layer].refNode = (0, reuseCachedElement_1.reuseCachedElement)(lastParent, level.cachedElement, levelRefNode, context.rewriteFromModel);
@@ -31350,16 +31540,43 @@ exports.isMarkdownTable = isMarkdownTable;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.splitParagraphSegments = void 0;
-var linkRegex = /(\[([^\[]+)\]\((https?:\/\/[^\)]+)\))|(\!\[([^\[]+)\]\((https?:\/\/[^\)]+)\))/g;
+// Matches markdown links and images in a string.
+// Group 1 (full link):  [text](url)       e.g. [Click here](https://example.com)
+//   Group 2: link text  e.g. "Click here"
+//   Group 3: link url   e.g. "https://example.com"
+// Group 4 (full image): ![alt](url)       e.g. ![Logo](https://example.com/logo.png)
+//   Group 5: alt text   e.g. "Logo"
+//   Group 6: image url  e.g. "https://example.com/logo.png"
+var linkRegex = /(\[([^\[]+)\]\(([^\)]+)\))|(\!\[([^\[]+)\]\(([^\)]+)\))/g;
 var isValidUrl = function (url) {
-    try {
-        new URL(url);
+    if (!url) {
+        return false;
+    }
+    // Accept common non-http schemes and relative paths
+    if (url.startsWith('data:') ||
+        url.startsWith('blob:') ||
+        url.startsWith('/') ||
+        url.startsWith('./') ||
+        url.startsWith('../')) {
         return true;
     }
+    try {
+        var parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
     catch (_) {
         return false;
     }
 };
+function pushText(result, text) {
+    var last = result[result.length - 1];
+    if (last && last.type === 'text') {
+        last.text += text;
+    }
+    else {
+        result.push({ type: 'text', text: text, url: '' });
+    }
+}
 /**
  * @internal
  */
@@ -31369,22 +31586,28 @@ function splitParagraphSegments(text) {
     var match = null;
     while ((match = linkRegex.exec(text)) !== null) {
         if (match.index > lastIndex) {
-            result.push({ type: 'text', text: text.slice(lastIndex, match.index), url: '' });
+            pushText(result, text.slice(lastIndex, match.index));
         }
         if (match[2] && match[3]) {
-            result.push(isValidUrl(match[3])
-                ? { type: 'link', text: match[2], url: match[3] }
-                : { type: 'text', text: match[0], url: '' });
+            if (isValidUrl(match[3])) {
+                result.push({ type: 'link', text: match[2], url: match[3] });
+            }
+            else {
+                pushText(result, match[0]);
+            }
         }
         else if (match[5] && match[6]) {
-            result.push(isValidUrl(match[6])
-                ? { type: 'image', text: match[5], url: match[6] }
-                : { type: 'text', text: match[0], url: '' });
+            if (isValidUrl(match[6])) {
+                result.push({ type: 'image', text: match[5], url: match[6] });
+            }
+            else {
+                pushText(result, match[0]);
+            }
         }
         lastIndex = linkRegex.lastIndex;
     }
     if (lastIndex < text.length) {
-        result.push({ type: 'text', text: text.slice(lastIndex), url: '' });
+        pushText(result, text.slice(lastIndex));
     }
     return result;
 }
@@ -33209,6 +33432,192 @@ var CustomReplacePlugin = /** @class */ (function () {
 exports.CustomReplacePlugin = CustomReplacePlugin;
 
 
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/DragAndDropPlugin.ts"
+/*!***************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-plugins/lib/dragAndDrop/DragAndDropPlugin.ts ***!
+  \***************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DragAndDropPlugin = void 0;
+var handleDroppedContent_1 = __webpack_require__(/*! ./utils/handleDroppedContent */ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/handleDroppedContent.ts");
+var DefaultOptions = {
+    forbiddenElements: ['iframe'],
+};
+/**
+ * DragAndDrop plugin, handles ContentChanged event when change source is "Drop"
+ * to sanitize dropped content, similar to how PastePlugin sanitizes pasted content.
+ */
+var DragAndDropPlugin = /** @class */ (function () {
+    /**
+     * Construct a new instance of DragAndDropPlugin
+     */
+    function DragAndDropPlugin(options) {
+        if (options === void 0) { options = DefaultOptions; }
+        var _a;
+        this.editor = null;
+        this.forbiddenElements = [];
+        this.isInternalDragging = false;
+        this.disposer = null;
+        this.forbiddenElements = (_a = options.forbiddenElements) !== null && _a !== void 0 ? _a : [];
+    }
+    /**
+     * Get name of this plugin
+     */
+    DragAndDropPlugin.prototype.getName = function () {
+        return 'DragAndDrop';
+    };
+    /**
+     * The first method that editor will call to a plugin when editor is initializing.
+     * It will pass in the editor instance, plugin should take this chance to save the
+     * editor reference so that it can call to any editor method or format API later.
+     * @param editor The editor object
+     */
+    DragAndDropPlugin.prototype.initialize = function (editor) {
+        var _this = this;
+        this.editor = editor;
+        this.disposer = editor.attachDomEvent({
+            dragstart: {
+                beforeDispatch: function (_ev) {
+                    _this.isInternalDragging = true;
+                },
+            },
+        });
+    };
+    /**
+     * The last method that editor will call to a plugin before it is disposed.
+     * Plugin can take this chance to clear the reference to editor. After this method is
+     * called, plugin should not call to any editor method since it will result in error.
+     */
+    DragAndDropPlugin.prototype.dispose = function () {
+        this.editor = null;
+        if (this.disposer) {
+            this.disposer();
+            this.disposer = null;
+        }
+        this.isInternalDragging = false;
+        this.forbiddenElements = [];
+    };
+    /**
+     * Core method for a plugin. Once an event happens in editor, editor will call this
+     * method of each plugin to handle the event as long as the event is not handled
+     * exclusively by another plugin.
+     * @param event The event to handle:
+     */
+    DragAndDropPlugin.prototype.onPluginEvent = function (event) {
+        var _a;
+        if (this.editor && event.eventType == 'beforeDrop') {
+            if (this.isInternalDragging) {
+                this.isInternalDragging = false;
+            }
+            else {
+                var dropEvent = event.rawEvent;
+                var html = (_a = dropEvent.dataTransfer) === null || _a === void 0 ? void 0 : _a.getData('text/html');
+                if (html) {
+                    (0, handleDroppedContent_1.handleDroppedContent)(this.editor, dropEvent, html, this.forbiddenElements);
+                }
+            }
+            return;
+        }
+    };
+    return DragAndDropPlugin;
+}());
+exports.DragAndDropPlugin = DragAndDropPlugin;
+
+
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/cleanForbiddenElements.ts"
+/*!**************************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/cleanForbiddenElements.ts ***!
+  \**************************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.cleanForbiddenElements = void 0;
+var tslib_1 = __webpack_require__(/*! tslib */ "./node_modules/tslib/tslib.es6.mjs");
+/**
+ * @internal
+ * Remove all forbidden elements from a parsed HTML document
+ * @param doc The parsed HTML document to clean
+ * @param forbiddenElements Array of tag names to remove (e.g., ['iframe', 'script'])
+ */
+function cleanForbiddenElements(doc, forbiddenElements) {
+    var e_1, _a;
+    var _b;
+    if (forbiddenElements.length === 0) {
+        return;
+    }
+    var selector = forbiddenElements.join(',');
+    var elements = Array.from(doc.body.querySelectorAll(selector));
+    try {
+        for (var elements_1 = (0, tslib_1.__values)(elements), elements_1_1 = elements_1.next(); !elements_1_1.done; elements_1_1 = elements_1.next()) {
+            var element = elements_1_1.value;
+            (_b = element.parentNode) === null || _b === void 0 ? void 0 : _b.removeChild(element);
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (elements_1_1 && !elements_1_1.done && (_a = elements_1.return)) _a.call(elements_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+}
+exports.cleanForbiddenElements = cleanForbiddenElements;
+
+
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/handleDroppedContent.ts"
+/*!************************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/handleDroppedContent.ts ***!
+  \************************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.handleDroppedContent = void 0;
+var cleanForbiddenElements_1 = __webpack_require__(/*! ./cleanForbiddenElements */ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/cleanForbiddenElements.ts");
+var roosterjs_content_model_dom_1 = __webpack_require__(/*! roosterjs-content-model-dom */ "./packages/roosterjs-content-model-dom/lib/index.ts");
+/**
+ * @internal
+ * Handle dropped HTML content by inserting it at the drop position
+ */
+function handleDroppedContent(editor, event, html, forbiddenElements) {
+    var doc = editor.getDocument();
+    var domPosition = (0, roosterjs_content_model_dom_1.getNodePositionFromEvent)(doc, editor.getDOMHelper(), event.x, event.y);
+    if (domPosition) {
+        event.preventDefault();
+        event.stopPropagation();
+        var range = doc.createRange();
+        range.setStart(domPosition.node, domPosition.offset);
+        range.collapse(true);
+        var parsedHtml = editor.getDOMCreator().htmlToDOM(html);
+        (0, cleanForbiddenElements_1.cleanForbiddenElements)(parsedHtml, forbiddenElements);
+        var droppedModel_1 = (0, roosterjs_content_model_dom_1.domToContentModel)(parsedHtml.body, (0, roosterjs_content_model_dom_1.createDomToModelContext)());
+        editor.formatContentModel(function (model, context) {
+            (0, roosterjs_content_model_dom_1.mergeModel)(model, droppedModel_1, context);
+            return true;
+        }, {
+            selectionOverride: {
+                type: 'range',
+                range: range,
+                isReverted: false,
+            },
+        });
+    }
+}
+exports.handleDroppedContent = handleDroppedContent;
+
+
 /***/ },
 
 /***/ "./packages/roosterjs-content-model-plugins/lib/edit/EditPlugin.ts"
@@ -38213,7 +38622,7 @@ exports.updateWrapper = updateWrapper;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.AnnouncePlugin = exports.moveHighlight = exports.replace = exports.find = exports.createFindReplaceContext = exports.FindReplacePlugin = exports.TouchPlugin = exports.HiddenPropertyPlugin = exports.ImageEditPlugin = exports.CustomReplacePlugin = exports.PickerPlugin = exports.HyperlinkPlugin = exports.MarkdownPlugin = exports.isModelEmptyFast = exports.WatermarkPlugin = exports.ContextMenuPluginBase = exports.ShortcutPlugin = exports.ShortcutOutdentList = exports.ShortcutIndentList = exports.ShortcutDecreaseFont = exports.ShortcutIncreaseFont = exports.ShortcutNumbering = exports.ShortcutBullet = exports.ShortcutRedoMacOS = exports.ShortcutRedoAlt = exports.ShortcutRedo = exports.ShortcutUndo2 = exports.ShortcutUndo = exports.ShortcutClearFormat = exports.ShortcutUnderline = exports.ShortcutItalic = exports.ShortcutBold = exports.AutoFormatPlugin = exports.EditPlugin = exports.DefaultSanitizers = exports.PastePlugin = exports.TableEditPlugin = void 0;
+exports.DragAndDropPlugin = exports.AnnouncePlugin = exports.moveHighlight = exports.replace = exports.find = exports.createFindReplaceContext = exports.FindReplacePlugin = exports.TouchPlugin = exports.HiddenPropertyPlugin = exports.ImageEditPlugin = exports.CustomReplacePlugin = exports.PickerPlugin = exports.HyperlinkPlugin = exports.MarkdownPlugin = exports.isModelEmptyFast = exports.WatermarkPlugin = exports.ContextMenuPluginBase = exports.ShortcutPlugin = exports.ShortcutOutdentList = exports.ShortcutIndentList = exports.ShortcutDecreaseFont = exports.ShortcutIncreaseFont = exports.ShortcutNumbering = exports.ShortcutBullet = exports.ShortcutRedoMacOS = exports.ShortcutRedoAlt = exports.ShortcutRedo = exports.ShortcutUndo2 = exports.ShortcutUndo = exports.ShortcutClearFormat = exports.ShortcutUnderline = exports.ShortcutItalic = exports.ShortcutBold = exports.AutoFormatPlugin = exports.EditPlugin = exports.DefaultSanitizers = exports.PastePlugin = exports.TableEditPlugin = void 0;
 var TableEditPlugin_1 = __webpack_require__(/*! ./tableEdit/TableEditPlugin */ "./packages/roosterjs-content-model-plugins/lib/tableEdit/TableEditPlugin.ts");
 Object.defineProperty(exports, "TableEditPlugin", ({ enumerable: true, get: function () { return TableEditPlugin_1.TableEditPlugin; } }));
 var PastePlugin_1 = __webpack_require__(/*! ./paste/PastePlugin */ "./packages/roosterjs-content-model-plugins/lib/paste/PastePlugin.ts");
@@ -38274,6 +38683,8 @@ var moveHighlight_1 = __webpack_require__(/*! ./findReplace/moveHighlight */ "./
 Object.defineProperty(exports, "moveHighlight", ({ enumerable: true, get: function () { return moveHighlight_1.moveHighlight; } }));
 var AnnouncePlugin_1 = __webpack_require__(/*! ./announce/AnnouncePlugin */ "./packages/roosterjs-content-model-plugins/lib/announce/AnnouncePlugin.ts");
 Object.defineProperty(exports, "AnnouncePlugin", ({ enumerable: true, get: function () { return AnnouncePlugin_1.AnnouncePlugin; } }));
+var DragAndDropPlugin_1 = __webpack_require__(/*! ./dragAndDrop/DragAndDropPlugin */ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/DragAndDropPlugin.ts");
+Object.defineProperty(exports, "DragAndDropPlugin", ({ enumerable: true, get: function () { return DragAndDropPlugin_1.DragAndDropPlugin; } }));
 
 
 /***/ },