roosterjs 9.49.0 → 9.50.1

package/dist/rooster.js

@@ -7891,25 +7891,21 @@ exports.setTableCellShade = setTableCellShade;
 /*!******************************************************************************!*\
   !*** ./packages/roosterjs-content-model-api/lib/publicApi/utils/checkXss.ts ***!
   \******************************************************************************/
-(__unused_webpack_module, exports, __webpack_require__) {
+(__unused_webpack_module, exports) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.checkXss = void 0;
-var roosterjs_content_model_dom_1 = __webpack_require__(/*! roosterjs-content-model-dom */ "./packages/roosterjs-content-model-dom/lib/index.ts");
 /**
  * @internal Check if there is XSS attack in the link
  * @param link The link to be checked
- * @returns The safe link with invisible Unicode characters stripped, or empty string if there is XSS attack
- * @remarks This function strips invisible Unicode characters (zero-width chars, Unicode Tags, etc.)
- * and checks for patterns like s\nc\nr\ni\np\nt: to prevent XSS attacks. This may block some valid links,
+ * @returns The safe link, or empty string if there is XSS attack
+ * @remarks This function checks for patterns like s\nc\nr\ni\np\nt: to prevent XSS attacks. This may block some valid links,
  * but it is necessary for security reasons. We treat the word "script" as safe if there are "/" before it.
  */
 function checkXss(link) {
-    // Defense-in-depth: strip invisible Unicode even if already handled elsewhere
-    var sanitized = (0, roosterjs_content_model_dom_1.stripInvisibleUnicode)(link);
-    return sanitized.match(/^[^\/]*s\n*c\n*r\n*i\n*p\n*t\n*:/i) ? '' : sanitized;
+    return link.match(/^[^\/]*s\n*c\n*r\n*i\n*p\n*t\n*:/i) ? '' : link;
 }
 exports.checkXss = checkXss;
 
@@ -12998,17 +12994,24 @@ var DOMEventPlugin = /** @class */ (function () {
                 dragEvent.preventDefault();
             }
         };
-        this.onDrop = function () {
-            var _a, _b;
-            var doc = (_a = _this.editor) === null || _a === void 0 ? void 0 : _a.getDocument();
-            (_b = doc === null || doc === void 0 ? void 0 : doc.defaultView) === null || _b === void 0 ? void 0 : _b.requestAnimationFrame(function () {
-                if (_this.editor) {
-                    _this.editor.takeSnapshot();
-                    _this.editor.triggerEvent('contentChanged', {
-                        source: roosterjs_content_model_dom_1.ChangeSource.Drop,
+        this.onDrop = function (e) {
+            var _a;
+            if (_this.editor) {
+                var beforeDropEvent = _this.editor.triggerEvent('beforeDrop', {
+                    rawEvent: e,
+                });
+                if (!(beforeDropEvent === null || beforeDropEvent === void 0 ? void 0 : beforeDropEvent.rawEvent.defaultPrevented)) {
+                    var doc = _this.editor.getDocument();
+                    (_a = doc === null || doc === void 0 ? void 0 : doc.defaultView) === null || _a === void 0 ? void 0 : _a.requestAnimationFrame(function () {
+                        if (_this.editor) {
+                            _this.editor.takeSnapshot();
+                            _this.editor.triggerEvent('contentChanged', {
+                                source: roosterjs_content_model_dom_1.ChangeSource.Drop,
+                            });
+                        }
                     });
                 }
-            });
+            }
         };
         this.onScroll = function (e) {
             var _a;
@@ -13144,7 +13147,7 @@ var DOMEventPlugin = /** @class */ (function () {
             compositionend: { beforeDispatch: this.onCompositionEnd },
             // 4. Drag and Drop event
             dragstart: { beforeDispatch: this.onDragStart },
-            drop: { beforeDispatch: this.onDrop },
+            drop: { beforeDispatch: function (event) { return _this.onDrop(event); } },
             // 5. Pointer event
             pointerdown: { beforeDispatch: function (event) { return _this.onPointerDown(event); } },
         };
@@ -15627,7 +15630,6 @@ var Editor = /** @class */ (function () {
         };
         this.core = (0, createEditorCore_1.createEditorCore)(contentDiv, options);
         var initialModel = (_a = options.initialModel) !== null && _a !== void 0 ? _a : (0, roosterjs_content_model_dom_1.createEmptyModel)(this.core.format.defaultFormat);
-        (0, roosterjs_content_model_dom_1.sanitizeInvisibleUnicode)(initialModel);
         this.core.api.setContentModel(this.core, initialModel, { ignoreSelection: true }, undefined /*onNodeCreated*/, true /*isInitializing*/);
         this.core.plugins.forEach(function (plugin) { return plugin.initialize(_this); });
     }
@@ -20801,38 +20803,6 @@ function normalizeText(txt, isForward) {
 exports.normalizeText = normalizeText;
 
 
-/***/ },
-
-/***/ "./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts"
-/*!************************************************************************************!*\
-  !*** ./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts ***!
-  \************************************************************************************/
-(__unused_webpack_module, exports) {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.stripInvisibleUnicode = void 0;
-var INVISIBLE_UNICODE_REGEX = 
-// eslint-disable-next-line no-misleading-character-class
-/[\u00AD\u034F\u061C\u115F\u1160\u17B4\u17B5\u180B-\u180E\u200B-\u200F\u202A-\u202E\u2028\u2029\u2060-\u2064\u2066-\u2069\u3164\uFEFF\uFFA0\uFFF9-\uFFFB]|\uDB40[\uDC01-\uDCFF]/g;
-/**
- * Strip invisible Unicode characters from a string.
- * This removes zero-width characters, bidirectional marks, Unicode Tags (U+E0001-U+E00FF),
- * interlinear annotation anchors, Mongolian free variation selectors,
- * and other invisible formatting characters that can be used to hide content in links.
- *
- * @remarks This function strips ZWJ (U+200D) which may affect emoji sequences.
- * It should only be applied to href attributes, not to visible text content.
- * @param value The string to strip invisible characters from
- * @returns The string with invisible characters removed
- */
-function stripInvisibleUnicode(value) {
-    return value.replace(INVISIBLE_UNICODE_REGEX, '');
-}
-exports.stripInvisibleUnicode = stripInvisibleUnicode;
-
-
 /***/ },
 
 /***/ "./packages/roosterjs-content-model-dom/lib/domUtils/style/borderValues.ts"
@@ -23629,9 +23599,9 @@ exports.shouldSetValue = shouldSetValue;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createImage = exports.createText = exports.createTableCell = exports.createTable = exports.createSelectionMarker = exports.createParagraph = exports.createFormatContainer = exports.createListItem = exports.createBr = exports.isLinkUndeletable = exports.setLinkUndeletable = exports.scrollRectIntoView = exports.normalizeRect = exports.isWhiteSpacePreserved = exports.reuseCachedElement = exports.findClosestBlockEntityContainer = exports.isBlockEntityContainer = exports.isEntityDelimiter = exports.addDelimiters = exports.generateEntityClassNames = exports.parseEntityFormat = exports.getAllEntityWrappers = exports.findClosestEntityWrapper = exports.isEntityElement = exports.unwrap = exports.wrap = exports.wrapAllChildNodes = exports.moveChildNodes = exports.toArray = exports.getSafeIdSelector = exports.getObjectKeys = exports.isElementOfType = exports.isNodeOfType = exports.hasMetadata = exports.getMetadata = exports.updateMetadata = exports.buildSelectionMarker = exports.isBlockElement = exports.areSameFormats = exports.parseFormat = exports.getRegularSelectionOffsets = exports.formatContainerProcessor = exports.tableProcessor = exports.entityProcessor = exports.processChildNode = exports.handleRegularSelection = exports.childProcessor = exports.contentModelToText = exports.contentModelToDom = exports.domToContentModel = void 0;
-exports.getDOMInsertPointRect = exports.getSelectionRootNode = exports.isBold = exports.createModelToDomConfig = exports.createModelToDomContextWithConfig = exports.createModelToDomContext = exports.createDomToModelConfig = exports.createDomToModelContextWithConfig = exports.createDomToModelContext = exports.defaultGenerateColorKey = exports.parseColor = exports.setColor = exports.getColor = exports.DeprecatedColors = exports.BorderKeys = exports.parseValueWithUnit = exports.getAutoListStyleType = exports.getOrderedListNumberStr = exports.ParagraphFormats = exports.ListFormatsToMove = exports.ListFormatsToKeep = exports.ListFormats = exports.copyFormat = exports.setParagraphNotImplicit = exports.normalizeSegmentFormat = exports.mergeTextSegments = exports.normalizeSingleSegment = exports.isEmpty = exports.addSegment = exports.unwrapBlock = exports.isGeneralSegment = exports.sanitizeInvisibleUnicode = exports.normalizeContentModel = exports.normalizeParagraph = exports.addTextSegment = exports.addLink = exports.addCode = exports.addBlock = exports.mutateSegment = exports.mutateSegments = exports.mutateBlock = exports.createTableRow = exports.createEmptyModel = exports.createListLevel = exports.createDivider = exports.createEntity = exports.createGeneralBlock = exports.createGeneralSegment = exports.createParagraphDecorator = exports.createContentModelDocument = void 0;
-exports.getSegmentTextFormat = exports.getListStyleTypeFromString = exports.retrieveModelFormatState = exports.setTableCellBackgroundColor = exports.MIN_ALLOWED_TABLE_CELL_HEIGHT = exports.MIN_ALLOWED_TABLE_CELL_WIDTH = exports.normalizeTable = exports.setFirstColumnFormatBorders = exports.applyTableFormat = exports.deleteBlock = exports.deleteSegment = exports.deleteSelection = exports.mergeModel = exports.cloneModel = exports.setSelection = exports.hasSelectionInBlockGroup = exports.hasSelectionInSegment = exports.hasSelectionInBlock = exports.getSelectedCells = exports.getSelectedSegmentsAndParagraphs = exports.getSelectedSegments = exports.getSelectedParagraphs = exports.getOperationalBlocks = exports.getFirstSelectedTable = exports.getFirstSelectedListItem = exports.iterateSelections = exports.isBlockGroupOfType = exports.getRangesByText = exports.getImageState = exports.setImageState = exports.getParagraphMarker = exports.setParagraphMarker = exports.cacheGetEventData = exports.extractClipboardItems = exports.normalizeFontFamily = exports.transformColor = exports.retrieveDocumentMetadata = exports.readFile = exports.parseTableCells = exports.stripInvisibleUnicode = exports.normalizeText = exports.isSpace = exports.isPunctuation = exports.extractBorderValues = exports.combineBorderValue = exports.getNodePositionFromEvent = exports.isCursorMovingKey = exports.isModifierKey = exports.isCharacterValue = exports.trimModelForSelection = void 0;
-exports.EmptySegmentFormat = exports.UnorderedListStyleMap = exports.OrderedListStyleMap = exports.TableBorderFormat = exports.NumberingListType = exports.BulletListType = exports.ChangeSource = exports.ListMetadataDefinition = exports.getListMetadata = exports.updateListMetadata = exports.getTableMetadata = exports.updateTableMetadata = exports.getTableCellMetadata = exports.updateTableCellMetadata = exports.getImageMetadata = exports.updateImageMetadata = exports.runEditSteps = exports.getClosestAncestorBlockGroupIndex = void 0;
+exports.trimModelForSelection = exports.getDOMInsertPointRect = exports.getSelectionRootNode = exports.isBold = exports.createModelToDomConfig = exports.createModelToDomContextWithConfig = exports.createModelToDomContext = exports.createDomToModelConfig = exports.createDomToModelContextWithConfig = exports.createDomToModelContext = exports.defaultGenerateColorKey = exports.parseColor = exports.setColor = exports.getColor = exports.DeprecatedColors = exports.BorderKeys = exports.parseValueWithUnit = exports.getAutoListStyleType = exports.getOrderedListNumberStr = exports.ParagraphFormats = exports.ListFormatsToMove = exports.ListFormatsToKeep = exports.ListFormats = exports.copyFormat = exports.setParagraphNotImplicit = exports.normalizeSegmentFormat = exports.mergeTextSegments = exports.normalizeSingleSegment = exports.isEmpty = exports.addSegment = exports.unwrapBlock = exports.isGeneralSegment = exports.normalizeContentModel = exports.normalizeParagraph = exports.addTextSegment = exports.addLink = exports.addCode = exports.addBlock = exports.mutateSegment = exports.mutateSegments = exports.mutateBlock = exports.createTableRow = exports.createEmptyModel = exports.createListLevel = exports.createDivider = exports.createEntity = exports.createGeneralBlock = exports.createGeneralSegment = exports.createParagraphDecorator = exports.createContentModelDocument = void 0;
+exports.runEditSteps = exports.getClosestAncestorBlockGroupIndex = exports.getSegmentTextFormat = exports.getListStyleTypeFromString = exports.retrieveModelFormatState = exports.setTableCellBackgroundColor = exports.MIN_ALLOWED_TABLE_CELL_HEIGHT = exports.MIN_ALLOWED_TABLE_CELL_WIDTH = exports.normalizeTable = exports.setFirstColumnFormatBorders = exports.applyTableFormat = exports.deleteBlock = exports.deleteSegment = exports.deleteSelection = exports.mergeModel = exports.cloneModel = exports.setSelection = exports.hasSelectionInBlockGroup = exports.hasSelectionInSegment = exports.hasSelectionInBlock = exports.getSelectedCells = exports.getSelectedSegmentsAndParagraphs = exports.getSelectedSegments = exports.getSelectedParagraphs = exports.getOperationalBlocks = exports.getFirstSelectedTable = exports.getFirstSelectedListItem = exports.iterateSelections = exports.isBlockGroupOfType = exports.getRangesByText = exports.getImageState = exports.setImageState = exports.getParagraphMarker = exports.setParagraphMarker = exports.cacheGetEventData = exports.extractClipboardItems = exports.normalizeFontFamily = exports.transformColor = exports.retrieveDocumentMetadata = exports.readFile = exports.parseTableCells = exports.normalizeText = exports.isSpace = exports.isPunctuation = exports.extractBorderValues = exports.combineBorderValue = exports.getNodePositionFromEvent = exports.isCursorMovingKey = exports.isModifierKey = exports.isCharacterValue = void 0;
+exports.EmptySegmentFormat = exports.UnorderedListStyleMap = exports.OrderedListStyleMap = exports.TableBorderFormat = exports.NumberingListType = exports.BulletListType = exports.ChangeSource = exports.ListMetadataDefinition = exports.getListMetadata = exports.updateListMetadata = exports.getTableMetadata = exports.updateTableMetadata = exports.getTableCellMetadata = exports.updateTableCellMetadata = exports.getImageMetadata = exports.updateImageMetadata = void 0;
 var domToContentModel_1 = __webpack_require__(/*! ./domToModel/domToContentModel */ "./packages/roosterjs-content-model-dom/lib/domToModel/domToContentModel.ts");
 Object.defineProperty(exports, "domToContentModel", ({ enumerable: true, get: function () { return domToContentModel_1.domToContentModel; } }));
 var contentModelToDom_1 = __webpack_require__(/*! ./modelToDom/contentModelToDom */ "./packages/roosterjs-content-model-dom/lib/modelToDom/contentModelToDom.ts");
@@ -23752,8 +23722,6 @@ var normalizeParagraph_1 = __webpack_require__(/*! ./modelApi/common/normalizePa
 Object.defineProperty(exports, "normalizeParagraph", ({ enumerable: true, get: function () { return normalizeParagraph_1.normalizeParagraph; } }));
 var normalizeContentModel_1 = __webpack_require__(/*! ./modelApi/common/normalizeContentModel */ "./packages/roosterjs-content-model-dom/lib/modelApi/common/normalizeContentModel.ts");
 Object.defineProperty(exports, "normalizeContentModel", ({ enumerable: true, get: function () { return normalizeContentModel_1.normalizeContentModel; } }));
-var sanitizeInvisibleUnicode_1 = __webpack_require__(/*! ./modelApi/common/sanitizeInvisibleUnicode */ "./packages/roosterjs-content-model-dom/lib/modelApi/common/sanitizeInvisibleUnicode.ts");
-Object.defineProperty(exports, "sanitizeInvisibleUnicode", ({ enumerable: true, get: function () { return sanitizeInvisibleUnicode_1.sanitizeInvisibleUnicode; } }));
 var isGeneralSegment_1 = __webpack_require__(/*! ./modelApi/typeCheck/isGeneralSegment */ "./packages/roosterjs-content-model-dom/lib/modelApi/typeCheck/isGeneralSegment.ts");
 Object.defineProperty(exports, "isGeneralSegment", ({ enumerable: true, get: function () { return isGeneralSegment_1.isGeneralSegment; } }));
 var unwrapBlock_1 = __webpack_require__(/*! ./modelApi/common/unwrapBlock */ "./packages/roosterjs-content-model-dom/lib/modelApi/common/unwrapBlock.ts");
@@ -23819,8 +23787,6 @@ var stringUtil_1 = __webpack_require__(/*! ./domUtils/stringUtil */ "./packages/
 Object.defineProperty(exports, "isPunctuation", ({ enumerable: true, get: function () { return stringUtil_1.isPunctuation; } }));
 Object.defineProperty(exports, "isSpace", ({ enumerable: true, get: function () { return stringUtil_1.isSpace; } }));
 Object.defineProperty(exports, "normalizeText", ({ enumerable: true, get: function () { return stringUtil_1.normalizeText; } }));
-var stripInvisibleUnicode_1 = __webpack_require__(/*! ./domUtils/stripInvisibleUnicode */ "./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts");
-Object.defineProperty(exports, "stripInvisibleUnicode", ({ enumerable: true, get: function () { return stripInvisibleUnicode_1.stripInvisibleUnicode; } }));
 var parseTableCells_1 = __webpack_require__(/*! ./domUtils/table/parseTableCells */ "./packages/roosterjs-content-model-dom/lib/domUtils/table/parseTableCells.ts");
 Object.defineProperty(exports, "parseTableCells", ({ enumerable: true, get: function () { return parseTableCells_1.parseTableCells; } }));
 var readFile_1 = __webpack_require__(/*! ./domUtils/readFile */ "./packages/roosterjs-content-model-dom/lib/domUtils/readFile.ts");
@@ -24819,134 +24785,6 @@ function normalizeSegmentFormat(format, environment) {
 exports.normalizeSegmentFormat = normalizeSegmentFormat;
 
 
-/***/ },
-
-/***/ "./packages/roosterjs-content-model-dom/lib/modelApi/common/sanitizeInvisibleUnicode.ts"
-/*!**********************************************************************************************!*\
-  !*** ./packages/roosterjs-content-model-dom/lib/modelApi/common/sanitizeInvisibleUnicode.ts ***!
-  \**********************************************************************************************/
-(__unused_webpack_module, exports, __webpack_require__) {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.sanitizeInvisibleUnicode = void 0;
-var tslib_1 = __webpack_require__(/*! tslib */ "./node_modules/tslib/tslib.es6.mjs");
-var stripInvisibleUnicode_1 = __webpack_require__(/*! ../../domUtils/stripInvisibleUnicode */ "./packages/roosterjs-content-model-dom/lib/domUtils/stripInvisibleUnicode.ts");
-/**
- * Strip invisible Unicode characters from all text and link hrefs in a content model.
- * This sanitizes the model at initialization time to prevent hidden content in links
- * or text (e.g. zero-width chars, bidirectional marks, Unicode Tags).
- * For General segments, all Text nodes under the element are also sanitized.
- * @param model The content model document to sanitize in-place
- */
-function sanitizeInvisibleUnicode(model) {
-    sanitizeBlockGroup(model);
-}
-exports.sanitizeInvisibleUnicode = sanitizeInvisibleUnicode;
-function sanitizeBlockGroup(group) {
-    var e_1, _a;
-    try {
-        for (var _b = (0, tslib_1.__values)(group.blocks), _c = _b.next(); !_c.done; _c = _b.next()) {
-            var block = _c.value;
-            sanitizeBlock(block);
-        }
-    }
-    catch (e_1_1) { e_1 = { error: e_1_1 }; }
-    finally {
-        try {
-            if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
-        }
-        finally { if (e_1) throw e_1.error; }
-    }
-}
-function sanitizeBlock(block) {
-    var e_2, _a, e_3, _b, e_4, _c;
-    switch (block.blockType) {
-        case 'Paragraph':
-            try {
-                for (var _d = (0, tslib_1.__values)(block.segments), _e = _d.next(); !_e.done; _e = _d.next()) {
-                    var segment = _e.value;
-                    sanitizeSegment(segment);
-                }
-            }
-            catch (e_2_1) { e_2 = { error: e_2_1 }; }
-            finally {
-                try {
-                    if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
-                }
-                finally { if (e_2) throw e_2.error; }
-            }
-            break;
-        case 'Table':
-            try {
-                for (var _f = (0, tslib_1.__values)(block.rows), _g = _f.next(); !_g.done; _g = _f.next()) {
-                    var row = _g.value;
-                    try {
-                        for (var _h = (e_4 = void 0, (0, tslib_1.__values)(row.cells)), _j = _h.next(); !_j.done; _j = _h.next()) {
-                            var cell = _j.value;
-                            sanitizeBlockGroup(cell);
-                        }
-                    }
-                    catch (e_4_1) { e_4 = { error: e_4_1 }; }
-                    finally {
-                        try {
-                            if (_j && !_j.done && (_c = _h.return)) _c.call(_h);
-                        }
-                        finally { if (e_4) throw e_4.error; }
-                    }
-                }
-            }
-            catch (e_3_1) { e_3 = { error: e_3_1 }; }
-            finally {
-                try {
-                    if (_g && !_g.done && (_b = _f.return)) _b.call(_f);
-                }
-                finally { if (e_3) throw e_3.error; }
-            }
-            break;
-        case 'BlockGroup':
-            sanitizeBlockGroup(block);
-            if (block.blockGroupType === 'General' && block.element) {
-                sanitizeTextNodes(block.element);
-            }
-            break;
-        case 'Entity':
-        case 'Divider':
-            break;
-    }
-}
-function sanitizeSegment(segment) {
-    var _a;
-    if ((_a = segment.link) === null || _a === void 0 ? void 0 : _a.format.href) {
-        segment.link.format.href = (0, stripInvisibleUnicode_1.stripInvisibleUnicode)(segment.link.format.href);
-    }
-    switch (segment.segmentType) {
-        case 'Text':
-            segment.text = (0, stripInvisibleUnicode_1.stripInvisibleUnicode)(segment.text);
-            break;
-        case 'General':
-            sanitizeTextNodes(segment.element);
-            sanitizeBlockGroup(segment);
-            break;
-        case 'Image':
-        case 'Entity':
-        case 'Br':
-        case 'SelectionMarker':
-            break;
-    }
-}
-function sanitizeTextNodes(element) {
-    var walker = element.ownerDocument.createTreeWalker(element, NodeFilter.SHOW_TEXT);
-    var node;
-    while ((node = walker.nextNode())) {
-        if (node.nodeValue) {
-            node.nodeValue = (0, stripInvisibleUnicode_1.stripInvisibleUnicode)(node.nodeValue);
-        }
-    }
-}
-
-
 /***/ },
 
 /***/ "./packages/roosterjs-content-model-dom/lib/modelApi/common/unwrapBlock.ts"
@@ -31533,16 +31371,43 @@ exports.isMarkdownTable = isMarkdownTable;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.splitParagraphSegments = void 0;
-var linkRegex = /(\[([^\[]+)\]\((https?:\/\/[^\)]+)\))|(\!\[([^\[]+)\]\((https?:\/\/[^\)]+)\))/g;
+// Matches markdown links and images in a string.
+// Group 1 (full link):  [text](url)       e.g. [Click here](https://example.com)
+//   Group 2: link text  e.g. "Click here"
+//   Group 3: link url   e.g. "https://example.com"
+// Group 4 (full image): ![alt](url)       e.g. ![Logo](https://example.com/logo.png)
+//   Group 5: alt text   e.g. "Logo"
+//   Group 6: image url  e.g. "https://example.com/logo.png"
+var linkRegex = /(\[([^\[]+)\]\(([^\)]+)\))|(\!\[([^\[]+)\]\(([^\)]+)\))/g;
 var isValidUrl = function (url) {
-    try {
-        new URL(url);
+    if (!url) {
+        return false;
+    }
+    // Accept common non-http schemes and relative paths
+    if (url.startsWith('data:') ||
+        url.startsWith('blob:') ||
+        url.startsWith('/') ||
+        url.startsWith('./') ||
+        url.startsWith('../')) {
         return true;
     }
+    try {
+        var parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
     catch (_) {
         return false;
     }
 };
+function pushText(result, text) {
+    var last = result[result.length - 1];
+    if (last && last.type === 'text') {
+        last.text += text;
+    }
+    else {
+        result.push({ type: 'text', text: text, url: '' });
+    }
+}
 /**
  * @internal
  */
@@ -31552,22 +31417,28 @@ function splitParagraphSegments(text) {
     var match = null;
     while ((match = linkRegex.exec(text)) !== null) {
         if (match.index > lastIndex) {
-            result.push({ type: 'text', text: text.slice(lastIndex, match.index), url: '' });
+            pushText(result, text.slice(lastIndex, match.index));
         }
         if (match[2] && match[3]) {
-            result.push(isValidUrl(match[3])
-                ? { type: 'link', text: match[2], url: match[3] }
-                : { type: 'text', text: match[0], url: '' });
+            if (isValidUrl(match[3])) {
+                result.push({ type: 'link', text: match[2], url: match[3] });
+            }
+            else {
+                pushText(result, match[0]);
+            }
         }
         else if (match[5] && match[6]) {
-            result.push(isValidUrl(match[6])
-                ? { type: 'image', text: match[5], url: match[6] }
-                : { type: 'text', text: match[0], url: '' });
+            if (isValidUrl(match[6])) {
+                result.push({ type: 'image', text: match[5], url: match[6] });
+            }
+            else {
+                pushText(result, match[0]);
+            }
         }
         lastIndex = linkRegex.lastIndex;
     }
     if (lastIndex < text.length) {
-        result.push({ type: 'text', text: text.slice(lastIndex), url: '' });
+        pushText(result, text.slice(lastIndex));
     }
     return result;
 }
@@ -33392,6 +33263,192 @@ var CustomReplacePlugin = /** @class */ (function () {
 exports.CustomReplacePlugin = CustomReplacePlugin;
 
 
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/DragAndDropPlugin.ts"
+/*!***************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-plugins/lib/dragAndDrop/DragAndDropPlugin.ts ***!
+  \***************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DragAndDropPlugin = void 0;
+var handleDroppedContent_1 = __webpack_require__(/*! ./utils/handleDroppedContent */ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/handleDroppedContent.ts");
+var DefaultOptions = {
+    forbiddenElements: ['iframe'],
+};
+/**
+ * DragAndDrop plugin, handles ContentChanged event when change source is "Drop"
+ * to sanitize dropped content, similar to how PastePlugin sanitizes pasted content.
+ */
+var DragAndDropPlugin = /** @class */ (function () {
+    /**
+     * Construct a new instance of DragAndDropPlugin
+     */
+    function DragAndDropPlugin(options) {
+        if (options === void 0) { options = DefaultOptions; }
+        var _a;
+        this.editor = null;
+        this.forbiddenElements = [];
+        this.isInternalDragging = false;
+        this.disposer = null;
+        this.forbiddenElements = (_a = options.forbiddenElements) !== null && _a !== void 0 ? _a : [];
+    }
+    /**
+     * Get name of this plugin
+     */
+    DragAndDropPlugin.prototype.getName = function () {
+        return 'DragAndDrop';
+    };
+    /**
+     * The first method that editor will call to a plugin when editor is initializing.
+     * It will pass in the editor instance, plugin should take this chance to save the
+     * editor reference so that it can call to any editor method or format API later.
+     * @param editor The editor object
+     */
+    DragAndDropPlugin.prototype.initialize = function (editor) {
+        var _this = this;
+        this.editor = editor;
+        this.disposer = editor.attachDomEvent({
+            dragstart: {
+                beforeDispatch: function (_ev) {
+                    _this.isInternalDragging = true;
+                },
+            },
+        });
+    };
+    /**
+     * The last method that editor will call to a plugin before it is disposed.
+     * Plugin can take this chance to clear the reference to editor. After this method is
+     * called, plugin should not call to any editor method since it will result in error.
+     */
+    DragAndDropPlugin.prototype.dispose = function () {
+        this.editor = null;
+        if (this.disposer) {
+            this.disposer();
+            this.disposer = null;
+        }
+        this.isInternalDragging = false;
+        this.forbiddenElements = [];
+    };
+    /**
+     * Core method for a plugin. Once an event happens in editor, editor will call this
+     * method of each plugin to handle the event as long as the event is not handled
+     * exclusively by another plugin.
+     * @param event The event to handle:
+     */
+    DragAndDropPlugin.prototype.onPluginEvent = function (event) {
+        var _a;
+        if (this.editor && event.eventType == 'beforeDrop') {
+            if (this.isInternalDragging) {
+                this.isInternalDragging = false;
+            }
+            else {
+                var dropEvent = event.rawEvent;
+                var html = (_a = dropEvent.dataTransfer) === null || _a === void 0 ? void 0 : _a.getData('text/html');
+                if (html) {
+                    (0, handleDroppedContent_1.handleDroppedContent)(this.editor, dropEvent, html, this.forbiddenElements);
+                }
+            }
+            return;
+        }
+    };
+    return DragAndDropPlugin;
+}());
+exports.DragAndDropPlugin = DragAndDropPlugin;
+
+
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/cleanForbiddenElements.ts"
+/*!**************************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/cleanForbiddenElements.ts ***!
+  \**************************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.cleanForbiddenElements = void 0;
+var tslib_1 = __webpack_require__(/*! tslib */ "./node_modules/tslib/tslib.es6.mjs");
+/**
+ * @internal
+ * Remove all forbidden elements from a parsed HTML document
+ * @param doc The parsed HTML document to clean
+ * @param forbiddenElements Array of tag names to remove (e.g., ['iframe', 'script'])
+ */
+function cleanForbiddenElements(doc, forbiddenElements) {
+    var e_1, _a;
+    var _b;
+    if (forbiddenElements.length === 0) {
+        return;
+    }
+    var selector = forbiddenElements.join(',');
+    var elements = Array.from(doc.body.querySelectorAll(selector));
+    try {
+        for (var elements_1 = (0, tslib_1.__values)(elements), elements_1_1 = elements_1.next(); !elements_1_1.done; elements_1_1 = elements_1.next()) {
+            var element = elements_1_1.value;
+            (_b = element.parentNode) === null || _b === void 0 ? void 0 : _b.removeChild(element);
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (elements_1_1 && !elements_1_1.done && (_a = elements_1.return)) _a.call(elements_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+}
+exports.cleanForbiddenElements = cleanForbiddenElements;
+
+
+/***/ },
+
+/***/ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/handleDroppedContent.ts"
+/*!************************************************************************************************!*\
+  !*** ./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/handleDroppedContent.ts ***!
+  \************************************************************************************************/
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.handleDroppedContent = void 0;
+var cleanForbiddenElements_1 = __webpack_require__(/*! ./cleanForbiddenElements */ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/utils/cleanForbiddenElements.ts");
+var roosterjs_content_model_dom_1 = __webpack_require__(/*! roosterjs-content-model-dom */ "./packages/roosterjs-content-model-dom/lib/index.ts");
+/**
+ * @internal
+ * Handle dropped HTML content by inserting it at the drop position
+ */
+function handleDroppedContent(editor, event, html, forbiddenElements) {
+    var doc = editor.getDocument();
+    var domPosition = (0, roosterjs_content_model_dom_1.getNodePositionFromEvent)(doc, editor.getDOMHelper(), event.x, event.y);
+    if (domPosition) {
+        event.preventDefault();
+        event.stopPropagation();
+        var range = doc.createRange();
+        range.setStart(domPosition.node, domPosition.offset);
+        range.collapse(true);
+        var parsedHtml = editor.getDOMCreator().htmlToDOM(html);
+        (0, cleanForbiddenElements_1.cleanForbiddenElements)(parsedHtml, forbiddenElements);
+        var droppedModel_1 = (0, roosterjs_content_model_dom_1.domToContentModel)(parsedHtml.body, (0, roosterjs_content_model_dom_1.createDomToModelContext)());
+        editor.formatContentModel(function (model, context) {
+            (0, roosterjs_content_model_dom_1.mergeModel)(model, droppedModel_1, context);
+            return true;
+        }, {
+            selectionOverride: {
+                type: 'range',
+                range: range,
+                isReverted: false,
+            },
+        });
+    }
+}
+exports.handleDroppedContent = handleDroppedContent;
+
+
 /***/ },
 
 /***/ "./packages/roosterjs-content-model-plugins/lib/edit/EditPlugin.ts"
@@ -38396,7 +38453,7 @@ exports.updateWrapper = updateWrapper;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.AnnouncePlugin = exports.moveHighlight = exports.replace = exports.find = exports.createFindReplaceContext = exports.FindReplacePlugin = exports.TouchPlugin = exports.HiddenPropertyPlugin = exports.ImageEditPlugin = exports.CustomReplacePlugin = exports.PickerPlugin = exports.HyperlinkPlugin = exports.MarkdownPlugin = exports.isModelEmptyFast = exports.WatermarkPlugin = exports.ContextMenuPluginBase = exports.ShortcutPlugin = exports.ShortcutOutdentList = exports.ShortcutIndentList = exports.ShortcutDecreaseFont = exports.ShortcutIncreaseFont = exports.ShortcutNumbering = exports.ShortcutBullet = exports.ShortcutRedoMacOS = exports.ShortcutRedoAlt = exports.ShortcutRedo = exports.ShortcutUndo2 = exports.ShortcutUndo = exports.ShortcutClearFormat = exports.ShortcutUnderline = exports.ShortcutItalic = exports.ShortcutBold = exports.AutoFormatPlugin = exports.EditPlugin = exports.DefaultSanitizers = exports.PastePlugin = exports.TableEditPlugin = void 0;
+exports.DragAndDropPlugin = exports.AnnouncePlugin = exports.moveHighlight = exports.replace = exports.find = exports.createFindReplaceContext = exports.FindReplacePlugin = exports.TouchPlugin = exports.HiddenPropertyPlugin = exports.ImageEditPlugin = exports.CustomReplacePlugin = exports.PickerPlugin = exports.HyperlinkPlugin = exports.MarkdownPlugin = exports.isModelEmptyFast = exports.WatermarkPlugin = exports.ContextMenuPluginBase = exports.ShortcutPlugin = exports.ShortcutOutdentList = exports.ShortcutIndentList = exports.ShortcutDecreaseFont = exports.ShortcutIncreaseFont = exports.ShortcutNumbering = exports.ShortcutBullet = exports.ShortcutRedoMacOS = exports.ShortcutRedoAlt = exports.ShortcutRedo = exports.ShortcutUndo2 = exports.ShortcutUndo = exports.ShortcutClearFormat = exports.ShortcutUnderline = exports.ShortcutItalic = exports.ShortcutBold = exports.AutoFormatPlugin = exports.EditPlugin = exports.DefaultSanitizers = exports.PastePlugin = exports.TableEditPlugin = void 0;
 var TableEditPlugin_1 = __webpack_require__(/*! ./tableEdit/TableEditPlugin */ "./packages/roosterjs-content-model-plugins/lib/tableEdit/TableEditPlugin.ts");
 Object.defineProperty(exports, "TableEditPlugin", ({ enumerable: true, get: function () { return TableEditPlugin_1.TableEditPlugin; } }));
 var PastePlugin_1 = __webpack_require__(/*! ./paste/PastePlugin */ "./packages/roosterjs-content-model-plugins/lib/paste/PastePlugin.ts");
@@ -38457,6 +38514,8 @@ var moveHighlight_1 = __webpack_require__(/*! ./findReplace/moveHighlight */ "./
 Object.defineProperty(exports, "moveHighlight", ({ enumerable: true, get: function () { return moveHighlight_1.moveHighlight; } }));
 var AnnouncePlugin_1 = __webpack_require__(/*! ./announce/AnnouncePlugin */ "./packages/roosterjs-content-model-plugins/lib/announce/AnnouncePlugin.ts");
 Object.defineProperty(exports, "AnnouncePlugin", ({ enumerable: true, get: function () { return AnnouncePlugin_1.AnnouncePlugin; } }));
+var DragAndDropPlugin_1 = __webpack_require__(/*! ./dragAndDrop/DragAndDropPlugin */ "./packages/roosterjs-content-model-plugins/lib/dragAndDrop/DragAndDropPlugin.ts");
+Object.defineProperty(exports, "DragAndDropPlugin", ({ enumerable: true, get: function () { return DragAndDropPlugin_1.DragAndDropPlugin; } }));
 
 
 /***/ },