suneditor 2.47.8 → 2.47.9

package/package.json

@@ -1,10 +1,16 @@
 {
   "name": "suneditor",
-  "version": "2.47.8",
+  "version": "2.47.9",
   "description": "Vanilla JavaScript WYSIWYG web editor (2.x legacy version, actively maintained)",
   "author": "JiHong.Lee",
   "license": "MIT",
   "main": "src/suneditor.js",
+  "publishConfig": {
+    "tag": "legacy"
+  },
+  "engines": {
+    "node": "<13.0.0"
+  },
   "sideEffects": [
     "./src/assets/css/*.css"
   ],
@@ -18,7 +24,7 @@
   "bugs": {
     "url": "https://github.com/JiHong88/SunEditor/issues"
   },
-  "homepage": "http://suneditor.com",
+  "homepage": "https://legacy.suneditor.com",
   "repository": {
     "type": "git",
     "url": "https://github.com/JiHong88/SunEditor.git"
@@ -44,7 +50,12 @@
     "jshint": "~2.13.4",
     "karma": "~6.3.19",
     "karma-chrome-launcher": "~2.2.0",
+    "karma-firefox-launcher": "^2.1.2",
+    "karma-ie-launcher": "^1.0.0",
     "karma-jasmine": "~1.1.2",
+    "karma-opera-launcher": "^1.0.0",
+    "karma-safari-launcher": "^1.0.0",
+    "karma-webpack": "^4.0.2",
     "katex": "^0.16.21",
     "mini-css-extract-plugin": "~0.4.5",
     "optimize-css-assets-webpack-plugin": "~5.0.4",

package/src/lang/pt_br.js

@@ -33,11 +33,11 @@
             bold: 'Negrito',
             underline: 'Sublinhado',
             italic: 'Itálico',
-            strike: 'Riscado',
-            subscript: 'Subescrito',
+            strike: 'Tachado',
+            subscript: 'Subscrito',
             superscript: 'Sobrescrito',
-            removeFormat: 'Remover Formatação',
-            fontColor: 'Cor da Fonte',
+            removeFormat: 'Remover formatação',
+            fontColor: 'Cor da fonte',
             hiliteColor: 'Cor de destaque',
             indent: 'Recuo',
             outdent: 'Avançar',
@@ -66,7 +66,7 @@
             redo: 'Refazer',
             preview: 'Prever',
             print: 'Imprimir',
-            tag_p: 'Paragráfo',
+            tag_p: 'Parágrafo',
             tag_div: '(DIV) Normal',
             tag_h: 'Cabeçalho',
             tag_blockquote: 'Citar',
@@ -83,9 +83,9 @@
         dialogBox: {
             linkBox: {
                 title: 'Inserir link',
-                url: 'URL para link',
-                text: 'Texto a mostrar',
-                newWindowCheck: 'Abrir em nova guia',
+                url: 'Endereço do link',
+                text: 'Texto exibido',
+                newWindowCheck: 'Abrir em uma nova guia',
                 downloadLinkCheck: 'Link para Download',
                 bookmark: 'marcar páginas'
             },
@@ -109,7 +109,7 @@
             audioBox: {
                 title: 'Inserir áudio',
                 file: 'Selecionar arquivos',
-                url: 'URL da áudio'
+                url: 'URL do áudio'
             },
             browser: {
                 tags: 'Tag',

package/src/lib/core.js

@@ -5356,7 +5356,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
 
             // blacklist
             const bAttr = this._attributesTagsBlacklist[tagName];
-            m = m.replace(/\s(?:on[a-z]+)\s*=\s*(")[^"]*\1/ig, '');
+            m = m.replace(/\s(?:on[a-z]+)\s*=\s*(?:(["'])[^"']*\1|\S+)/gi, '');
             if (bAttr) m = m.replace(bAttr, '');
             else m = m.replace(this._attributesBlacklistRegExp, '');
 
@@ -5398,7 +5398,7 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
             if (v) {
                 for (let i = 0, len = v.length, a; i < len; i++) {
                     // if (lowLevelCheck && /^class="(?!(__se__|se-|katex))/.test(v[i].trim())) continue;
-                    a = (/^(?:href|src)\s*=\s*('|"|\s)*javascript\s*\:/i.test(v[i].trim()) ? '' : v[i]);
+                    a = (_isSafeAttribute(v[i].trim()) ? v[i] : '');
                     t += (/^\s/.test(a) ? '' : ' ') + a;
                 }
             }
@@ -9452,4 +9452,56 @@ export default function (context, pluginCallButtons, plugins, lang, options, _re
     }
 
     return functions;
+}
+
+/** @description Safe URL protocol whitelist */
+const _SAFE_URL_PROTOCOL = /^(?:https?|ftps?|mailto|tel|blob|sms|geo|webcal|callto):|^[#/]|^data:image\//i;
+const _URL_ATTR_PATTERN = /^(?:href|src)\s*=/i;
+const _RE_ATTR_VALUE = /=\s*(?:"([^"]*)"|'([^']*)'|(\S+))/;
+const _RE_COLON = /:/i;
+
+/**
+ * @description Normalize a URL by decoding HTML entities, URL-encoded characters,
+ * and stripping whitespace/control characters. Detects obfuscated dangerous protocols.
+ * @param {string} url
+ * @returns {string}
+ */
+function _normalizeURL(url) {
+    let prev, limit = 5;
+    do {
+        prev = url;
+        url = url.replace(/&(#x([0-9a-f]+)|#([0-9]+)|([a-z]+));/gi, function (_, __, hex, dec) {
+            if (hex) return String.fromCharCode(parseInt(hex, 16));
+            if (dec) return String.fromCharCode(parseInt(dec, 10));
+            return '';
+        });
+    } while (url !== prev && --limit);
+
+    try { url = decodeURIComponent(url); } catch (e) { /* malformed URI */ }
+
+    url = url.replace(/[\u0000-\u0020]+/g, '');
+    return url;
+}
+
+/**
+ * @description Check if a URL is safe (matches the allowed protocol whitelist).
+ * @param {string} url
+ * @returns {boolean}
+ */
+function _isSafeURL(url) {
+    var normalized = _normalizeURL(url);
+    return _SAFE_URL_PROTOCOL.test(normalized) || !_RE_COLON.test(normalized);
+}
+
+/**
+ * @description Check if an attribute string (e.g. 'href="..."') contains a safe URL.
+ * @param {string} attr
+ * @returns {boolean}
+ */
+function _isSafeAttribute(attr) {
+    if (!_URL_ATTR_PATTERN.test(attr)) return true;
+    var urlMatch = attr.match(_RE_ATTR_VALUE);
+    if (!urlMatch) return true;
+    var url = urlMatch[1] || urlMatch[2] || urlMatch[3] || '';
+    return _isSafeURL(url);
 }

package/src/options.d.ts

@@ -452,7 +452,7 @@ export interface SunEditorOptions {
     videoMultipleFile?: boolean;
     /**
      * Define "Attributes" of the video tag. 
-     * @example { poster: "http://suneditor.com/docs/loading.gif", autoplay: true }
+     * @example { poster: "https://suneditor-files.s3.ap-northeast-2.amazonaws.com/sample/v2/docs/loading.gif", autoplay: true }
      */
     videoTagAttrs?: Record<string, string | boolean>;
     /**