suneditor 2.47.7 → 2.47.9

package/package.json

@@ -1,10 +1,16 @@
 {
   "name": "suneditor",
-  "version": "2.47.7",
+  "version": "2.47.9",
   "description": "Vanilla JavaScript WYSIWYG web editor (2.x legacy version, actively maintained)",
   "author": "JiHong.Lee",
   "license": "MIT",
   "main": "src/suneditor.js",
+  "publishConfig": {
+    "tag": "legacy"
+  },
+  "engines": {
+    "node": "<13.0.0"
+  },
   "sideEffects": [
     "./src/assets/css/*.css"
   ],
@@ -18,7 +24,7 @@
   "bugs": {
     "url": "https://github.com/JiHong88/SunEditor/issues"
   },
-  "homepage": "http://suneditor.com",
+  "homepage": "https://legacy.suneditor.com",
   "repository": {
     "type": "git",
     "url": "https://github.com/JiHong88/SunEditor.git"
@@ -44,7 +50,12 @@
     "jshint": "~2.13.4",
     "karma": "~6.3.19",
     "karma-chrome-launcher": "~2.2.0",
+    "karma-firefox-launcher": "^2.1.2",
+    "karma-ie-launcher": "^1.0.0",
     "karma-jasmine": "~1.1.2",
+    "karma-opera-launcher": "^1.0.0",
+    "karma-safari-launcher": "^1.0.0",
+    "karma-webpack": "^4.0.2",
     "katex": "^0.16.21",
     "mini-css-extract-plugin": "~0.4.5",
     "optimize-css-assets-webpack-plugin": "~5.0.4",

package/src/lang/pt_br.js

@@ -33,11 +33,11 @@
             bold: 'Negrito',
             underline: 'Sublinhado',
             italic: 'Itálico',
-            strike: 'Riscado',
-            subscript: 'Subescrito',
+            strike: 'Tachado',
+            subscript: 'Subscrito',
             superscript: 'Sobrescrito',
-            removeFormat: 'Remover Formatação',
-            fontColor: 'Cor da Fonte',
+            removeFormat: 'Remover formatação',
+            fontColor: 'Cor da fonte',
             hiliteColor: 'Cor de destaque',
             indent: 'Recuo',
             outdent: 'Avançar',
@@ -66,7 +66,7 @@
             redo: 'Refazer',
             preview: 'Prever',
             print: 'Imprimir',
-            tag_p: 'Paragráfo',
+            tag_p: 'Parágrafo',
             tag_div: '(DIV) Normal',
             tag_h: 'Cabeçalho',
             tag_blockquote: 'Citar',
@@ -83,9 +83,9 @@
         dialogBox: {
             linkBox: {
                 title: 'Inserir link',
-                url: 'URL para link',
-                text: 'Texto a mostrar',
-                newWindowCheck: 'Abrir em nova guia',
+                url: 'Endereço do link',
+                text: 'Texto exibido',
+                newWindowCheck: 'Abrir em uma nova guia',
                 downloadLinkCheck: 'Link para Download',
                 bookmark: 'marcar páginas'
             },
@@ -109,7 +109,7 @@
             audioBox: {
                 title: 'Inserir áudio',
                 file: 'Selecionar arquivos',
-                url: 'URL da áudio'
+                url: 'URL do áudio'
             },
             browser: {
                 tags: 'Tag',

package/src/lib/core.js

@@ -1057,20 +1057,22 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
          */
         setRange: function (startCon, startOff, endCon, endOff) {
             if (!startCon || !endCon) return;
-            if (startOff > startCon.textContent.length) startOff = startCon.textContent.length;
-            if (endOff > endCon.textContent.length) endOff = endCon.textContent.length;
+            if ((util.isBreak(startCon) || startCon.nodeType === 3) && startOff > startCon.textContent.length) startOff = startCon.textContent.length;
+		    if ((util.isBreak(endCon) || endCon.nodeType === 3) && endOff > endCon.textContent.length) endOff = endCon.textContent.length;
             if (util.isFormatElement(startCon)) {
-                startCon = startCon.childNodes[startOff] || startCon.childNodes[startOff - 1] || startCon;
-                startOff = startOff > 0 ? startCon.nodeType === 1 ? 1 : startCon.textContent ? startCon.textContent.length : 0 : 0;
+                startCon = startCon.childNodes[startOff > 0 ? startCon.childNodes.length - 1 : 0] || startCon;
+                startOff = startOff > 0 ? (startCon.nodeType === 1 && !util.isBreak(startCon) ? 1 : startCon.textContent ? startCon.textContent.length : 0) : 0;
             }
             if (util.isFormatElement(endCon)) {
-                endCon = endCon.childNodes[endOff] || endCon.childNodes[endOff - 1] || endCon;
-                endOff = endOff > 0 ? endCon.nodeType === 1 ? 1 : endCon.textContent ? endCon.textContent.length : 0 : 0;
+                endCon = endCon.childNodes[endOff > 0 ? endCon.childNodes.length - 1 : 0] || endCon;
+                endOff = endOff > 0 ? (endCon.nodeType === 1 && !util.isBreak(endCon) ? 1 : endCon.textContent ? endCon.textContent.length : 0) : 0;
             }
 
             const range = this._wd.createRange();
 
             try {
+                if (startOff > startCon.textContent.length) startOff = startCon.textContent.length;
+                if (endOff > endCon.textContent.length) endOff = endCon.textContent.length;
                 range.setStart(startCon, startOff);
                 range.setEnd(endCon, endOff);
             } catch (error) {
@@ -1574,7 +1576,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
             let formatEl = util.getFormatElement(selectionNode, null);
 
             if (util.isListCell(formatEl)) {
-                this.insertNode(element, selectionNode === formatEl ? null : r.container.nextSibling, false);
+                this.insertNode(element, selectionNode === formatEl ? null : (selectionNode || r.container).nextSibling, false);
                 if (!element.nextSibling) element.parentNode.appendChild(util.createElement('BR'));
             } else {
                 if (this.getRange().collapsed && (r.container.nodeType === 3 || util.isBreak(r.container))) {
@@ -1669,7 +1671,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
             const isList = util.isListCell(container.parentNode);
             let componentTop, wScroll, w;
             // top
-            if (isList ? !container.previousSibling : !util.isFormatElement(container.previousElementSibling)) {
+            if (isList ? !container.previousSibling || util.isComponent(container.previousElementSibling) : !util.isFormatElement(container.previousElementSibling)) {
                 this._variable._lineBreakComp = container;
                 wScroll = context.element.wysiwyg.scrollTop;
                 componentTop = util.getOffset(element, context.element.wysiwygFrame).top + wScroll;
@@ -1682,7 +1684,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
                 t_style.display = 'none';
             }
             // bottom
-            if (isList ? !container.nextSibling : !util.isFormatElement(container.nextElementSibling)) {
+            if (isList ? !container.nextSibling || util.isComponent(container.nextElementSibling)  : !util.isFormatElement(container.nextElementSibling)) {
                 if (!componentTop) {
                     this._variable._lineBreakComp = container;
                     wScroll = context.element.wysiwyg.scrollTop;
@@ -1803,7 +1805,9 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
                     const depthFormat = util.getParentElement(container, function (current) { return this.isRangeFormatElement(current) || this.isListCell(current); }.bind(util));
                     afterNode = util.splitElement(container, r.offset, !depthFormat ? 0 : util.getElementDepth(depthFormat) + 1);
                     if (!afterNode) {
-                        tempAfterNode = afterNode = line;
+                        if (!util.isListCell(line)) {
+                            tempAfterNode = afterNode = line;
+                        }
                     } else if (insertListCell) {
                         if (line.contains(container)) {
                             const subList = util.isList(line.lastElementChild);
@@ -5352,7 +5356,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
 
             // blacklist
             const bAttr = this._attributesTagsBlacklist[tagName];
-            m = m.replace(/\s(?:on[a-z]+)\s*=\s*(")[^"]*\1/ig, '');
+            m = m.replace(/\s(?:on[a-z]+)\s*=\s*(?:(["'])[^"']*\1|\S+)/gi, '');
             if (bAttr) m = m.replace(bAttr, '');
             else m = m.replace(this._attributesBlacklistRegExp, '');
 
@@ -5394,7 +5398,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
             if (v) {
                 for (let i = 0, len = v.length, a; i < len; i++) {
                     // if (lowLevelCheck && /^class="(?!(__se__|se-|katex))/.test(v[i].trim())) continue;
-                    a = (/^(?:href|src)\s*=\s*('|"|\s)*javascript\s*\:/i.test(v[i].trim()) ? '' : v[i]);
+                    a = (_isSafeAttribute(v[i].trim()) ? v[i] : '');
                     t += (/^\s/.test(a) ? '' : ' ') + a;
                 }
             }
@@ -6232,9 +6236,22 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
                     commonCon.parentNode.insertBefore(format, commonCon);
                     format.appendChild(commonCon);
                 }
+
+                if (util.isWysiwygDiv(commonCon)) {
+                    format = util.createElement(formatName || options.defaultTag);
+                    format.innerHTML = commonCon.innerHTML;
+                    commonCon.innerHTML = '';
+                    commonCon.appendChild(format);
+                    this.effectNode = null;
+                    this.setRange(format, 1, format, 1);
+                    return;
+                }
                 
-                if (util.isBreak(format.nextSibling)) util.removeItem(format.nextSibling);
-                if (util.isBreak(format.previousSibling)) util.removeItem(format.previousSibling);
+                if (format) {
+                    if (util.isBreak(format.nextSibling)) util.removeItem(format.nextSibling);
+                    if (util.isBreak(format.previousSibling)) util.removeItem(format.previousSibling);
+                }
+
                 if (util.isBreak(focusNode)) {
                     const zeroWidth = util.createTextNode(util.zeroWidthSpace);
                     focusNode.parentNode.insertBefore(zeroWidth, focusNode);
@@ -7196,16 +7213,20 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
 
                     // component
                     if (!selectRange && formatEl && (range.startOffset === 0 || (selectionNode === formatEl ? !!formatEl.childNodes[range.startOffset] : false))) {
+                        const isList = util.isListCell(formatEl);
                         const sel = selectionNode === formatEl ? formatEl.childNodes[range.startOffset] : selectionNode;
-                        const prev = formatEl.previousSibling;
+                        const prev = isList ? sel.previousSibling : formatEl.previousSibling;
                         // select file component
-                        const ignoreZWS = (commonCon.nodeType === 3 || util.isBreak(commonCon)) && !commonCon.previousSibling && range.startOffset === 0;
-                        if (sel && !sel.previousSibling && ( (commonCon && util.isComponent(commonCon.previousSibling)) || (ignoreZWS && util.isComponent(prev)))) {
+                        const ignoreZWS = isList || (commonCon.nodeType === 3 || util.isBreak(commonCon)) && !commonCon.previousSibling && range.startOffset === 0;
+                        if (sel && ((isList || !sel.previousSibling)) && ((commonCon && util.isComponent(commonCon.previousSibling)) || (ignoreZWS && util.isComponent(prev)))) {
                             const fileComponentInfo = core.getFileComponent(prev);
                             if (fileComponentInfo) {
                                 e.preventDefault();
                                 e.stopPropagation();
-                                if (formatEl.textContent.length === 0) util.removeItem(formatEl);
+                                
+                                if (isList) util.removeItem(sel);
+                                else if (formatEl.textContent.length === 0) util.removeItem(formatEl);
+
                                 if (core.selectComponent(fileComponentInfo.target, fileComponentInfo.pluginName) === false) core.blur();
                             } else if (util.isComponent(prev)) {
                                 e.preventDefault();
@@ -7736,6 +7757,8 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
                     break;
             }
 
+            if (core.currentFileComponentInfo) core.controllersOff();
+
             if (shift && keyCode === 16) {
                 e.preventDefault();
                 e.stopPropagation();
@@ -7876,7 +7899,6 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
 
             const selectedComponentInfo = core.getFileComponent(selectionNodeDeepestFirstChild);
             if (!(e.keyCode === 16 || e.shiftKey) && selectedComponentInfo) core.selectComponent(selectedComponentInfo.target, selectedComponentInfo.pluginName);
-            else if (core.currentFileComponentInfo) core.controllersOff();
 
             /** when format tag deleted */
             if (keyCode === 8 && util.isWysiwygDiv(selectionNode) && selectionNode.textContent === '' && selectionNode.children.length === 0) {
@@ -9430,4 +9452,56 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
     }
 
     return functions;
+}
+
+/** @description Safe URL protocol whitelist */
+const _SAFE_URL_PROTOCOL = /^(?:https?|ftps?|mailto|tel|blob|sms|geo|webcal|callto):|^[#/]|^data:image\//i;
+const _URL_ATTR_PATTERN = /^(?:href|src)\s*=/i;
+const _RE_ATTR_VALUE = /=\s*(?:"([^"]*)"|'([^']*)'|(\S+))/;
+const _RE_COLON = /:/i;
+
+/**
+ * @description Normalize a URL by decoding HTML entities, URL-encoded characters,
+ * and stripping whitespace/control characters. Detects obfuscated dangerous protocols.
+ * @param {string} url
+ * @returns {string}
+ */
+function _normalizeURL(url) {
+    let prev, limit = 5;
+    do {
+        prev = url;
+        url = url.replace(/&(#x([0-9a-f]+)|#([0-9]+)|([a-z]+));/gi, function (_, __, hex, dec) {
+            if (hex) return String.fromCharCode(parseInt(hex, 16));
+            if (dec) return String.fromCharCode(parseInt(dec, 10));
+            return '';
+        });
+    } while (url !== prev && --limit);
+
+    try { url = decodeURIComponent(url); } catch (e) { /* malformed URI */ }
+
+    url = url.replace(/[\u0000-\u0020]+/g, '');
+    return url;
+}
+
+/**
+ * @description Check if a URL is safe (matches the allowed protocol whitelist).
+ * @param {string} url
+ * @returns {boolean}
+ */
+function _isSafeURL(url) {
+    var normalized = _normalizeURL(url);
+    return _SAFE_URL_PROTOCOL.test(normalized) || !_RE_COLON.test(normalized);
+}
+
+/**
+ * @description Check if an attribute string (e.g. 'href="..."') contains a safe URL.
+ * @param {string} attr
+ * @returns {boolean}
+ */
+function _isSafeAttribute(attr) {
+    if (!_URL_ATTR_PATTERN.test(attr)) return true;
+    var urlMatch = attr.match(_RE_ATTR_VALUE);
+    if (!urlMatch) return true;
+    var url = urlMatch[1] || urlMatch[2] || urlMatch[3] || '';
+    return _isSafeURL(url);
 }

package/src/options.d.ts

@@ -452,7 +452,7 @@ export interface SunEditorOptions {
     videoMultipleFile?: boolean;
     /**
      * Define "Attributes" of the video tag. 
-     * @example { poster: "http://suneditor.com/docs/loading.gif", autoplay: true }
+     * @example { poster: "https://suneditor-files.s3.ap-northeast-2.amazonaws.com/sample/v2/docs/loading.gif", autoplay: true }
      */
     videoTagAttrs?: Record<string, string | boolean>;
     /**