@wordpress/rich-text - npm Package Compare versions

Comparing version 3.7.2 to 3.7.3

build-module/create.js

@@ -342,2 +342,18 @@ import _objectSpread from "@babel/runtime/helpers/esm/objectSpread";
 
+    if (type === 'script') {
+      var _value = {
+        formats: [,],
+        replacements: [{
+          type: type,
+          attributes: {
+            'data-rich-text-script': node.getAttribute('data-rich-text-script') || encodeURIComponent(node.innerHTML)
+          }
+        }],
+        text: OBJECT_REPLACEMENT_CHARACTER
+      };
+      accumulateSelection(accumulator, node, range, _value);
+      mergePair(accumulator, _value);
+      return "continue";
+    }
+
     if (type === 'br') {
@@ -362,3 +378,3 @@ accumulateSelection(accumulator, node, range, createEmptyValue());
     if (multilineWrapperTags && multilineWrapperTags.indexOf(type) !== -1) {
-      var _value = createFromMultilineElement({
+      var _value2 = createFromMultilineElement({
         element: node,
@@ -372,4 +388,4 @@ range: range,
 
-      accumulateSelection(accumulator, node, range, _value);
-      mergePair(accumulator, _value);
+      accumulateSelection(accumulator, node, range, _value2);
+      mergePair(accumulator, _value2);
       return "continue";
@@ -508,4 +524,5 @@ }
 
+    var safeName = /^on/i.test(name) ? 'data-disable-rich-text-' + name : name;
     accumulator = accumulator || {};
-    accumulator[name] = value;
+    accumulator[safeName] = value;
   }
@@ -512,0 +529,0 @@

build-module/to-html-string.js

@@ -115,2 +115,6 @@ /**
   return children.map(function (child) {
+    if (child.html !== undefined) {
+      return child.html;
+    }
+
     return child.text === undefined ? createElementHTML(child) : escapeHTML(child.text);
@@ -117,0 +121,0 @@ }).join('');

build-module/to-tree.js

@@ -10,2 +10,22 @@ import _toConsumableArray from "@babel/runtime/helpers/esm/toConsumableArray";
 import { LINE_SEPARATOR, OBJECT_REPLACEMENT_CHARACTER, ZWNBSP } from './special-characters';
+
+function restoreOnAttributes(attributes, isEditableTree) {
+  if (isEditableTree) {
+    return attributes;
+  }
+
+  var newAttributes = {};
+
+  for (var key in attributes) {
+    var newKey = key;
+
+    if (key.startsWith('data-disable-rich-text-')) {
+      newKey = key.slice('data-disable-rich-text-'.length);
+    }
+
+    newAttributes[newKey] = attributes[key];
+  }
+
+  return newAttributes;
+}
 /**
@@ -24,2 +44,3 @@ * Converts a format object to information that can be used to create an element
  *                                             class.
+ * @param  {boolean} $1.isEditableTree
  * @return {Object}                            Information to be used for
@@ -29,2 +50,3 @@ *                                             element creation.
 
+
 function fromFormat(_ref) {
@@ -35,3 +57,4 @@ var type = _ref.type,
       object = _ref.object,
-      boundaryClass = _ref.boundaryClass;
+      boundaryClass = _ref.boundaryClass,
+      isEditableTree = _ref.isEditableTree;
   var formatType = getFormatType(type);
@@ -51,3 +74,3 @@ var elementAttributes = {};
       type: type,
-      attributes: elementAttributes,
+      attributes: restoreOnAttributes(elementAttributes, isEditableTree),
       object: object
@@ -80,3 +103,3 @@ };
     object: formatType.object,
-    attributes: elementAttributes
+    attributes: restoreOnAttributes(elementAttributes, isEditableTree)
   };
@@ -191,3 +214,4 @@ }
           unregisteredAttributes: unregisteredAttributes,
-          boundaryClass: boundaryClass
+          boundaryClass: boundaryClass,
+          isEditableTree: isEditableTree
         }));
@@ -222,6 +246,18 @@
     if (character === OBJECT_REPLACEMENT_CHARACTER) {
-      pointer = append(getParent(pointer), fromFormat(_objectSpread({}, replacements[i], {
-        object: true
-      }))); // Ensure pointer is text node.
+      if (!isEditableTree && replacements[i].type === 'script') {
+        pointer = append(getParent(pointer), fromFormat({
+          type: 'script',
+          isEditableTree: isEditableTree
+        }));
+        append(pointer, {
+          html: decodeURIComponent(replacements[i].attributes['data-rich-text-script'])
+        });
+      } else {
+        pointer = append(getParent(pointer), fromFormat(_objectSpread({}, replacements[i], {
+          object: true,
+          isEditableTree: isEditableTree
+        })));
+      } // Ensure pointer is text node.
 
+
       pointer = append(getParent(pointer), '');
@@ -228,0 +264,0 @@ } else if (character === '\n') {

build/create.js

@@ -359,2 +359,18 @@ "use strict";
 
+    if (type === 'script') {
+      var _value = {
+        formats: [,],
+        replacements: [{
+          type: type,
+          attributes: {
+            'data-rich-text-script': node.getAttribute('data-rich-text-script') || encodeURIComponent(node.innerHTML)
+          }
+        }],
+        text: _specialCharacters.OBJECT_REPLACEMENT_CHARACTER
+      };
+      accumulateSelection(accumulator, node, range, _value);
+      (0, _concat.mergePair)(accumulator, _value);
+      return "continue";
+    }
+
     if (type === 'br') {
@@ -379,3 +395,3 @@ accumulateSelection(accumulator, node, range, createEmptyValue());
     if (multilineWrapperTags && multilineWrapperTags.indexOf(type) !== -1) {
-      var _value = createFromMultilineElement({
+      var _value2 = createFromMultilineElement({
         element: node,
@@ -389,4 +405,4 @@ range: range,
 
-      accumulateSelection(accumulator, node, range, _value);
-      (0, _concat.mergePair)(accumulator, _value);
+      accumulateSelection(accumulator, node, range, _value2);
+      (0, _concat.mergePair)(accumulator, _value2);
       return "continue";
@@ -525,4 +541,5 @@ }
 
+    var safeName = /^on/i.test(name) ? 'data-disable-rich-text-' + name : name;
     accumulator = accumulator || {};
-    accumulator[name] = value;
+    accumulator[safeName] = value;
   }
@@ -529,0 +546,0 @@

build/to-html-string.js

@@ -124,2 +124,6 @@ "use strict";
   return children.map(function (child) {
+    if (child.html !== undefined) {
+      return child.html;
+    }
+
     return child.text === undefined ? createElementHTML(child) : (0, _escapeHtml.escapeHTML)(child.text);
@@ -126,0 +130,0 @@ }).join('');

build/to-tree.js

@@ -23,3 +23,21 @@ "use strict";
  */
+function restoreOnAttributes(attributes, isEditableTree) {
+  if (isEditableTree) {
+    return attributes;
+  }
 
+  var newAttributes = {};
+
+  for (var key in attributes) {
+    var newKey = key;
+
+    if (key.startsWith('data-disable-rich-text-')) {
+      newKey = key.slice('data-disable-rich-text-'.length);
+    }
+
+    newAttributes[newKey] = attributes[key];
+  }
+
+  return newAttributes;
+}
 /**
@@ -38,5 +56,8 @@ * Converts a format object to information that can be used to create an element
  *                                             class.
+ * @param  {boolean} $1.isEditableTree
  * @return {Object}                            Information to be used for
  *                                             element creation.
  */
+
+
 function fromFormat(_ref) {
@@ -47,3 +68,4 @@ var type = _ref.type,
       object = _ref.object,
-      boundaryClass = _ref.boundaryClass;
+      boundaryClass = _ref.boundaryClass,
+      isEditableTree = _ref.isEditableTree;
   var formatType = (0, _getFormatType.getFormatType)(type);
@@ -63,3 +85,3 @@ var elementAttributes = {};
       type: type,
-      attributes: elementAttributes,
+      attributes: restoreOnAttributes(elementAttributes, isEditableTree),
       object: object
@@ -92,3 +114,3 @@ };
     object: formatType.object,
-    attributes: elementAttributes
+    attributes: restoreOnAttributes(elementAttributes, isEditableTree)
   };
@@ -203,3 +225,4 @@ }
           unregisteredAttributes: unregisteredAttributes,
-          boundaryClass: boundaryClass
+          boundaryClass: boundaryClass,
+          isEditableTree: isEditableTree
         }));
@@ -234,6 +257,18 @@
     if (character === _specialCharacters.OBJECT_REPLACEMENT_CHARACTER) {
-      pointer = append(getParent(pointer), fromFormat((0, _objectSpread2.default)({}, replacements[i], {
-        object: true
-      }))); // Ensure pointer is text node.
+      if (!isEditableTree && replacements[i].type === 'script') {
+        pointer = append(getParent(pointer), fromFormat({
+          type: 'script',
+          isEditableTree: isEditableTree
+        }));
+        append(pointer, {
+          html: decodeURIComponent(replacements[i].attributes['data-rich-text-script'])
+        });
+      } else {
+        pointer = append(getParent(pointer), fromFormat((0, _objectSpread2.default)({}, replacements[i], {
+          object: true,
+          isEditableTree: isEditableTree
+        })));
+      } // Ensure pointer is text node.
 
+
       pointer = append(getParent(pointer), '');
@@ -240,0 +275,0 @@ } else if (character === '\n') {

package.json

 {
 	"name": "@wordpress/rich-text",
-	"version": "3.7.2",
+	"version": "3.7.3",
 	"description": "Rich text value and manipulation API.",
@@ -41,3 +41,3 @@ "author": "The WordPress Contributors",
 	},
-	"gitHead": "707754784420a7089ae31ec4d6c756ce9af9c782"
+	"gitHead": "c267550d52289c783c0daa517b6aca85a21da30e"
 }

src/create.js

@@ -346,2 +346,22 @@ /**
 
+		if ( type === 'script' ) {
+			const value = {
+				formats: [ , ],
+				replacements: [
+					{
+						type,
+						attributes: {
+							'data-rich-text-script':
+								node.getAttribute( 'data-rich-text-script' ) ||
+								encodeURIComponent( node.innerHTML ),
+						},
+					},
+				],
+				text: OBJECT_REPLACEMENT_CHARACTER,
+			};
+			accumulateSelection( accumulator, node, range, value );
+			mergePair( accumulator, value );
+			continue;
+		}
+
 		if ( type === 'br' ) {
@@ -499,4 +519,8 @@ accumulateSelection( accumulator, node, range, createEmptyValue() );
 
+		const safeName = /^on/i.test( name ) ?
+			'data-disable-rich-text-' + name :
+			name;
+
 		accumulator = accumulator || {};
-		accumulator[ name ] = value;
+		accumulator[ safeName ] = value;
 	}
@@ -503,0 +527,0 @@

src/test/helpers/index.js

@@ -612,2 +612,52 @@ /**
 	},
+	{
+		description: 'should disarm script',
+		html: '<script>alert("1")</script>',
+		createRange: ( element ) => ( {
+			startOffset: 0,
+			startContainer: element,
+			endOffset: 0,
+			endContainer: element,
+		} ),
+		startPath: [ 0, 0 ],
+		endPath: [ 0, 0 ],
+		record: {
+			start: 0,
+			end: 0,
+			formats: [ , ],
+			replacements: [
+				{
+					attributes: { 'data-rich-text-script': 'alert(%221%22)' },
+					type: 'script',
+				},
+			],
+			text: '\ufffc',
+		},
+	},
+	{
+		description: 'should disarm on* attribute',
+		html: '<img onerror="alert(\'1\')">',
+		createRange: ( element ) => ( {
+			startOffset: 0,
+			startContainer: element,
+			endOffset: 0,
+			endContainer: element,
+		} ),
+		startPath: [ 0, 0 ],
+		endPath: [ 0, 0 ],
+		record: {
+			start: 0,
+			end: 0,
+			formats: [ , ],
+			replacements: [
+				{
+					attributes: {
+						'data-disable-rich-text-onerror': "alert('1')",
+					},
+					type: 'img',
+				},
+			],
+			text: '\ufffc',
+		},
+	},
 ];
@@ -614,0 +664,0 @@

src/to-html-string.js

@@ -109,4 +109,8 @@ /**
 	return children.map( ( child ) => {
+		if ( child.html !== undefined ) {
+			return child.html;
+		}
+
 		return child.text === undefined ? createElementHTML( child ) : escapeHTML( child.text );
 	} ).join( '' );
 }

src/to-tree.js

@@ -13,2 +13,21 @@ /**
 
+function restoreOnAttributes( attributes, isEditableTree ) {
+	if ( isEditableTree ) {
+		return attributes;
+	}
+
+	const newAttributes = {};
+
+	for ( const key in attributes ) {
+		let newKey = key;
+		if ( key.startsWith( 'data-disable-rich-text-' ) ) {
+			newKey = key.slice( 'data-disable-rich-text-'.length );
+		}
+
+		newAttributes[ newKey ] = attributes[ key ];
+	}
+
+	return newAttributes;
+}
+
 /**
@@ -27,6 +46,7 @@ * Converts a format object to information that can be used to create an element
  *                                             class.
+ * @param  {boolean} $1.isEditableTree
  * @return {Object}                            Information to be used for
  *                                             element creation.
  */
-function fromFormat( { type, attributes, unregisteredAttributes, object, boundaryClass } ) {
+function fromFormat( { type, attributes, unregisteredAttributes, object, boundaryClass, isEditableTree } ) {
 	const formatType = getFormatType( type );
@@ -45,3 +65,10 @@
 
-		return { type, attributes: elementAttributes, object };
+		return {
+			type,
+			attributes: restoreOnAttributes(
+				elementAttributes,
+				isEditableTree
+			),
+			object,
+		};
 	}
@@ -72,3 +99,3 @@
 		object: formatType.object,
-		attributes: elementAttributes,
+		attributes: restoreOnAttributes( elementAttributes, isEditableTree ),
 	};
@@ -195,2 +222,3 @@ }
 					boundaryClass,
+					isEditableTree,
 				} ) );
@@ -225,6 +253,25 @@
 		if ( character === OBJECT_REPLACEMENT_CHARACTER ) {
-			pointer = append( getParent( pointer ), fromFormat( {
-				...replacements[ i ],
-				object: true,
-			} ) );
+			if ( ! isEditableTree && replacements[ i ].type === 'script' ) {
+				pointer = append(
+					getParent( pointer ),
+					fromFormat( {
+						type: 'script',
+						isEditableTree,
+					} )
+				);
+				append( pointer, {
+					html: decodeURIComponent(
+						replacements[ i ].attributes[ 'data-rich-text-script' ]
+					),
+				} );
+			} else {
+				pointer = append(
+					getParent( pointer ),
+					fromFormat( {
+						...replacements[ i ],
+						object: true,
+						isEditableTree,
+					} )
+				);
+			}
 			// Ensure pointer is text node.
@@ -231,0 +278,0 @@ pointer = append( getParent( pointer ), '' );

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1222159

increased by1.09%

Lines of code

17414

increased by1.23%

No dependency changes