@wordpress/rich-text - npm Package Compare versions

Comparing version 3.12.2 to 3.12.3

build-module/create.js

@@ -375,2 +375,18 @@ import _defineProperty from "@babel/runtime/helpers/esm/defineProperty";
 
+    if (type === 'script') {
+      var _value = {
+        formats: [,],
+        replacements: [{
+          type: type,
+          attributes: {
+            'data-rich-text-script': node.getAttribute('data-rich-text-script') || encodeURIComponent(node.innerHTML)
+          }
+        }],
+        text: OBJECT_REPLACEMENT_CHARACTER
+      };
+      accumulateSelection(accumulator, node, range, _value);
+      mergePair(accumulator, _value);
+      return "continue";
+    }
+
     if (type === 'br') {
@@ -395,3 +411,3 @@ accumulateSelection(accumulator, node, range, createEmptyValue());
     if (multilineWrapperTags && multilineWrapperTags.indexOf(type) !== -1) {
-      var _value = createFromMultilineElement({
+      var _value2 = createFromMultilineElement({
         element: node,
@@ -406,4 +422,4 @@ range: range,
 
-      accumulateSelection(accumulator, node, range, _value);
-      mergePair(accumulator, _value);
+      accumulateSelection(accumulator, node, range, _value2);
+      mergePair(accumulator, _value2);
       return "continue";
@@ -561,4 +577,5 @@ }
 
+    var safeName = /^on/i.test(name) ? 'data-disable-rich-text-' + name : name;
     accumulator = accumulator || {};
-    accumulator[name] = value;
+    accumulator[safeName] = value;
   }
@@ -565,0 +582,0 @@

build-module/to-html-string.js

@@ -119,2 +119,6 @@ /**
   return children.map(function (child) {
+    if (child.html !== undefined) {
+      return child.html;
+    }
+
     return child.text === undefined ? createElementHTML(child) : escapeEditableHTML(child.text);
@@ -121,0 +125,0 @@ }).join('');

build-module/to-tree.js

@@ -14,2 +14,22 @@ import _toConsumableArray from "@babel/runtime/helpers/esm/toConsumableArray";
 import { LINE_SEPARATOR, OBJECT_REPLACEMENT_CHARACTER, ZWNBSP } from './special-characters';
+
+function restoreOnAttributes(attributes, isEditableTree) {
+  if (isEditableTree) {
+    return attributes;
+  }
+
+  var newAttributes = {};
+
+  for (var key in attributes) {
+    var newKey = key;
+
+    if (key.startsWith('data-disable-rich-text-')) {
+      newKey = key.slice('data-disable-rich-text-'.length);
+    }
+
+    newAttributes[newKey] = attributes[key];
+  }
+
+  return newAttributes;
+}
 /**
@@ -28,2 +48,3 @@ * Converts a format object to information that can be used to create an element
  *                                             class.
+ * @param  {boolean} $1.isEditableTree
  * @return {Object}                            Information to be used for
@@ -33,2 +54,3 @@ *                                             element creation.
 
+
 function fromFormat(_ref) {
@@ -39,3 +61,4 @@ var type = _ref.type,
       object = _ref.object,
-      boundaryClass = _ref.boundaryClass;
+      boundaryClass = _ref.boundaryClass,
+      isEditableTree = _ref.isEditableTree;
   var formatType = getFormatType(type);
@@ -55,3 +78,3 @@ var elementAttributes = {};
       type: type,
-      attributes: elementAttributes,
+      attributes: restoreOnAttributes(elementAttributes, isEditableTree),
       object: object
@@ -84,3 +107,3 @@ };
     object: formatType.object,
-    attributes: elementAttributes
+    attributes: restoreOnAttributes(elementAttributes, isEditableTree)
   };
@@ -215,3 +238,4 @@ }
           unregisteredAttributes: unregisteredAttributes,
-          boundaryClass: boundaryClass
+          boundaryClass: boundaryClass,
+          isEditableTree: isEditableTree
         }));
@@ -246,6 +270,18 @@
     if (character === OBJECT_REPLACEMENT_CHARACTER) {
-      pointer = append(getParent(pointer), fromFormat(_objectSpread({}, replacements[i], {
-        object: true
-      }))); // Ensure pointer is text node.
+      if (!isEditableTree && replacements[i].type === 'script') {
+        pointer = append(getParent(pointer), fromFormat({
+          type: 'script',
+          isEditableTree: isEditableTree
+        }));
+        append(pointer, {
+          html: decodeURIComponent(replacements[i].attributes['data-rich-text-script'])
+        });
+      } else {
+        pointer = append(getParent(pointer), fromFormat(_objectSpread({}, replacements[i], {
+          object: true,
+          isEditableTree: isEditableTree
+        })));
+      } // Ensure pointer is text node.
 
+
       pointer = append(getParent(pointer), '');
@@ -252,0 +288,0 @@ } else if (!preserveWhiteSpace && character === '\n') {

build/create.js

@@ -384,2 +384,18 @@ "use strict";
 
+    if (type === 'script') {
+      var _value = {
+        formats: [,],
+        replacements: [{
+          type: type,
+          attributes: {
+            'data-rich-text-script': node.getAttribute('data-rich-text-script') || encodeURIComponent(node.innerHTML)
+          }
+        }],
+        text: _specialCharacters.OBJECT_REPLACEMENT_CHARACTER
+      };
+      accumulateSelection(accumulator, node, range, _value);
+      (0, _concat.mergePair)(accumulator, _value);
+      return "continue";
+    }
+
     if (type === 'br') {
@@ -404,3 +420,3 @@ accumulateSelection(accumulator, node, range, createEmptyValue());
     if (multilineWrapperTags && multilineWrapperTags.indexOf(type) !== -1) {
-      var _value = createFromMultilineElement({
+      var _value2 = createFromMultilineElement({
         element: node,
@@ -415,4 +431,4 @@ range: range,
 
-      accumulateSelection(accumulator, node, range, _value);
-      (0, _concat.mergePair)(accumulator, _value);
+      accumulateSelection(accumulator, node, range, _value2);
+      (0, _concat.mergePair)(accumulator, _value2);
       return "continue";
@@ -570,4 +586,5 @@ }
 
+    var safeName = /^on/i.test(name) ? 'data-disable-rich-text-' + name : name;
     accumulator = accumulator || {};
-    accumulator[name] = value;
+    accumulator[safeName] = value;
   }
@@ -574,0 +591,0 @@

build/to-html-string.js

@@ -128,2 +128,6 @@ "use strict";
   return children.map(function (child) {
+    if (child.html !== undefined) {
+      return child.html;
+    }
+
     return child.text === undefined ? createElementHTML(child) : (0, _escapeHtml.escapeEditableHTML)(child.text);
@@ -130,0 +134,0 @@ }).join('');

build/to-tree.js

@@ -24,2 +24,21 @@ "use strict";
 
+function restoreOnAttributes(attributes, isEditableTree) {
+  if (isEditableTree) {
+    return attributes;
+  }
+
+  var newAttributes = {};
+
+  for (var key in attributes) {
+    var newKey = key;
+
+    if (key.startsWith('data-disable-rich-text-')) {
+      newKey = key.slice('data-disable-rich-text-'.length);
+    }
+
+    newAttributes[newKey] = attributes[key];
+  }
+
+  return newAttributes;
+}
 /**
@@ -38,5 +57,8 @@ * Converts a format object to information that can be used to create an element
  *                                             class.
+ * @param  {boolean} $1.isEditableTree
  * @return {Object}                            Information to be used for
  *                                             element creation.
  */
+
+
 function fromFormat(_ref) {
@@ -47,3 +69,4 @@ var type = _ref.type,
       object = _ref.object,
-      boundaryClass = _ref.boundaryClass;
+      boundaryClass = _ref.boundaryClass,
+      isEditableTree = _ref.isEditableTree;
   var formatType = (0, _getFormatType.getFormatType)(type);
@@ -63,3 +86,3 @@ var elementAttributes = {};
       type: type,
-      attributes: elementAttributes,
+      attributes: restoreOnAttributes(elementAttributes, isEditableTree),
       object: object
@@ -92,3 +115,3 @@ };
     object: formatType.object,
-    attributes: elementAttributes
+    attributes: restoreOnAttributes(elementAttributes, isEditableTree)
   };
@@ -223,3 +246,4 @@ }
           unregisteredAttributes: unregisteredAttributes,
-          boundaryClass: boundaryClass
+          boundaryClass: boundaryClass,
+          isEditableTree: isEditableTree
         }));
@@ -254,6 +278,18 @@
     if (character === _specialCharacters.OBJECT_REPLACEMENT_CHARACTER) {
-      pointer = append(getParent(pointer), fromFormat(_objectSpread({}, replacements[i], {
-        object: true
-      }))); // Ensure pointer is text node.
+      if (!isEditableTree && replacements[i].type === 'script') {
+        pointer = append(getParent(pointer), fromFormat({
+          type: 'script',
+          isEditableTree: isEditableTree
+        }));
+        append(pointer, {
+          html: decodeURIComponent(replacements[i].attributes['data-rich-text-script'])
+        });
+      } else {
+        pointer = append(getParent(pointer), fromFormat(_objectSpread({}, replacements[i], {
+          object: true,
+          isEditableTree: isEditableTree
+        })));
+      } // Ensure pointer is text node.
 
+
       pointer = append(getParent(pointer), '');
@@ -260,0 +296,0 @@ } else if (!preserveWhiteSpace && character === '\n') {

package.json

 {
 	"name": "@wordpress/rich-text",
-	"version": "3.12.2",
+	"version": "3.12.3",
 	"description": "Rich text value and manipulation API.",
@@ -40,3 +40,3 @@ "author": "The WordPress Contributors",
 	},
-	"gitHead": "b08f668ddc31ba5ed3c99a70d260e6f864c76dd6"
+	"gitHead": "295a5629f39062033000bc52a66d0b3235c2ef6d"
 }

src/create.js

@@ -380,2 +380,22 @@ /**
 
+		if ( type === 'script' ) {
+			const value = {
+				formats: [ , ],
+				replacements: [
+					{
+						type,
+						attributes: {
+							'data-rich-text-script':
+								node.getAttribute( 'data-rich-text-script' ) ||
+								encodeURIComponent( node.innerHTML ),
+						},
+					},
+				],
+				text: OBJECT_REPLACEMENT_CHARACTER,
+			};
+			accumulateSelection( accumulator, node, range, value );
+			mergePair( accumulator, value );
+			continue;
+		}
+
 		if ( type === 'br' ) {
@@ -567,4 +587,8 @@ accumulateSelection( accumulator, node, range, createEmptyValue() );
 
+		const safeName = /^on/i.test( name )
+			? 'data-disable-rich-text-' + name
+			: name;
+
 		accumulator = accumulator || {};
-		accumulator[ name ] = value;
+		accumulator[ safeName ] = value;
 	}
@@ -571,0 +595,0 @@

src/test/helpers/index.js

@@ -680,2 +680,52 @@ /**
 	},
+	{
+		description: 'should disarm script',
+		html: '<script>alert("1")</script>',
+		createRange: ( element ) => ( {
+			startOffset: 0,
+			startContainer: element,
+			endOffset: 0,
+			endContainer: element,
+		} ),
+		startPath: [ 0, 0 ],
+		endPath: [ 0, 0 ],
+		record: {
+			start: 0,
+			end: 0,
+			formats: [ , ],
+			replacements: [
+				{
+					attributes: { 'data-rich-text-script': 'alert(%221%22)' },
+					type: 'script',
+				},
+			],
+			text: '\ufffc',
+		},
+	},
+	{
+		description: 'should disarm on* attribute',
+		html: '<img onerror="alert(\'1\')">',
+		createRange: ( element ) => ( {
+			startOffset: 0,
+			startContainer: element,
+			endOffset: 0,
+			endContainer: element,
+		} ),
+		startPath: [ 0, 0 ],
+		endPath: [ 0, 0 ],
+		record: {
+			start: 0,
+			end: 0,
+			formats: [ , ],
+			replacements: [
+				{
+					attributes: {
+						'data-disable-rich-text-onerror': "alert('1')",
+					},
+					type: 'img',
+				},
+			],
+			text: '\ufffc',
+		},
+	},
 ];
@@ -682,0 +732,0 @@

src/to-html-string.js

@@ -117,2 +117,6 @@ /**
 		.map( ( child ) => {
+			if ( child.html !== undefined ) {
+				return child.html;
+			}
+
 			return child.text === undefined
@@ -119,0 +123,0 @@ ? createElementHTML( child )

src/to-tree.js

@@ -13,2 +13,21 @@ /**
 
+function restoreOnAttributes( attributes, isEditableTree ) {
+	if ( isEditableTree ) {
+		return attributes;
+	}
+
+	const newAttributes = {};
+
+	for ( const key in attributes ) {
+		let newKey = key;
+		if ( key.startsWith( 'data-disable-rich-text-' ) ) {
+			newKey = key.slice( 'data-disable-rich-text-'.length );
+		}
+
+		newAttributes[ newKey ] = attributes[ key ];
+	}
+
+	return newAttributes;
+}
+
 /**
@@ -27,2 +46,3 @@ * Converts a format object to information that can be used to create an element
  *                                             class.
+ * @param  {boolean} $1.isEditableTree
  * @return {Object}                            Information to be used for
@@ -37,2 +57,3 @@ *                                             element creation.
 	boundaryClass,
+	isEditableTree,
 } ) {
@@ -52,3 +73,10 @@ const formatType = getFormatType( type );
 
-		return { type, attributes: elementAttributes, object };
+		return {
+			type,
+			attributes: restoreOnAttributes(
+				elementAttributes,
+				isEditableTree
+			),
+			object,
+		};
 	}
@@ -81,3 +109,3 @@
 		object: formatType.object,
-		attributes: elementAttributes,
+		attributes: restoreOnAttributes( elementAttributes, isEditableTree ),
 	};
@@ -236,2 +264,3 @@ }
 						boundaryClass,
+						isEditableTree,
 					} )
@@ -267,9 +296,25 @@ );
 		if ( character === OBJECT_REPLACEMENT_CHARACTER ) {
-			pointer = append(
-				getParent( pointer ),
-				fromFormat( {
-					...replacements[ i ],
-					object: true,
-				} )
-			);
+			if ( ! isEditableTree && replacements[ i ].type === 'script' ) {
+				pointer = append(
+					getParent( pointer ),
+					fromFormat( {
+						type: 'script',
+						isEditableTree,
+					} )
+				);
+				append( pointer, {
+					html: decodeURIComponent(
+						replacements[ i ].attributes[ 'data-rich-text-script' ]
+					),
+				} );
+			} else {
+				pointer = append(
+					getParent( pointer ),
+					fromFormat( {
+						...replacements[ i ],
+						object: true,
+						isEditableTree,
+					} )
+				);
+			}
 			// Ensure pointer is text node.
@@ -276,0 +321,0 @@ pointer = append( getParent( pointer ), '' );

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1271763

increased by1.04%

Lines of code

18253

increased by1.16%

Worsened metrics

Published versions last months

5

decreased by-16.67%

Published versions last two months

7

decreased by-12.5%

No dependency changes