diagram-js-direct-editing - npm Package Compare versions

Comparing version 1.4.2 to 1.4.3

CHANGELOG.md

@@ -9,2 +9,10 @@ # Changelog
 
+## 1.4.3
+
+* `FIX`: prevent injection of HTML and JS evaluation on paste ([#13](https://github.com/bpmn-io/diagram-js-direct-editing/issues/13))
+
+## 1.4.2
+
+* `FIX`: only trigger update if text or bounds changed ([#11](https://github.com/bpmn-io/diagram-js-direct-editing/pull/11))
+
 ## 1.4.1
@@ -11,0 +19,0 @@

lib/TextBox.js

@@ -186,4 +186,2 @@ import {
 TextBox.prototype.handlePaste = function(e) {
-  var self = this;
-
   var options = this.options,
@@ -206,73 +204,84 @@ style = this.style;
 
-  // insertHTML command not supported by Internet Explorer
-  var success = document.execCommand('insertHTML', false, text);
+  this.insertText(text);
 
-  if (!success) {
+  if (options.autoResize) {
+    var hasResized = this.autoResize(style);
 
-    // Internet Explorer
-    var range = this.getSelection(),
-        startContainer = range.startContainer,
-        endContainer = range.endContainer,
-        startOffset = range.startOffset,
-        endOffset = range.endOffset,
-        commonAncestorContainer = range.commonAncestorContainer;
+    if (hasResized) {
+      this.resizeHandler(hasResized);
+    }
+  }
+};
 
-    var childNodesArray = toArray(commonAncestorContainer.childNodes);
+TextBox.prototype.insertText = function(text) {
 
-    var container,
-        offset;
+  // insertText command not supported by Internet Explorer
+  var success = document.execCommand('insertText', false, text);
 
-    if (isTextNode(commonAncestorContainer)) {
-      var containerTextContent = startContainer.textContent;
+  if (success) {
+    return;
+  }
 
-      startContainer.textContent =
-        containerTextContent.substring(0, startOffset)
-        + text
-        + containerTextContent.substring(endOffset);
+  this._insertTextIE(text);
+};
 
-      container = startContainer;
-      offset = startOffset + text.length;
+TextBox.prototype._insertTextIE = function(text) {
 
-    } else if (startContainer === this.content && endContainer === this.content) {
-      var textNode = document.createTextNode(text);
+  // Internet Explorer
+  var range = this.getSelection(),
+      startContainer = range.startContainer,
+      endContainer = range.endContainer,
+      startOffset = range.startOffset,
+      endOffset = range.endOffset,
+      commonAncestorContainer = range.commonAncestorContainer;
 
-      this.content.insertBefore(textNode, childNodesArray[startOffset]);
+  var childNodesArray = toArray(commonAncestorContainer.childNodes);
 
-      container = textNode;
-      offset = textNode.textContent.length;
-    } else {
-      var startContainerChildIndex = childNodesArray.indexOf(startContainer),
-          endContainerChildIndex = childNodesArray.indexOf(endContainer);
+  var container,
+      offset;
 
-      childNodesArray.forEach(function(childNode, index) {
+  if (isTextNode(commonAncestorContainer)) {
+    var containerTextContent = startContainer.textContent;
 
-        if (index === startContainerChildIndex) {
-          childNode.textContent =
-            startContainer.textContent.substring(0, startOffset) +
-            text +
-            endContainer.textContent.substring(endOffset);
-        } else if (index > startContainerChildIndex && index <= endContainerChildIndex) {
-          domRemove(childNode);
-        }
-      });
+    startContainer.textContent =
+      containerTextContent.substring(0, startOffset)
+      + text
+      + containerTextContent.substring(endOffset);
 
-      container = startContainer;
-      offset = startOffset + text.length;
-    }
+    container = startContainer;
+    offset = startOffset + text.length;
 
-    if (container && offset !== undefined) {
+  } else if (startContainer === this.content && endContainer === this.content) {
+    var textNode = document.createTextNode(text);
 
-      // is necessary in Internet Explorer
-      setTimeout(function() {
-        self.setSelection(container, offset);
-      });
-    }
+    this.content.insertBefore(textNode, childNodesArray[startOffset]);
+
+    container = textNode;
+    offset = textNode.textContent.length;
+  } else {
+    var startContainerChildIndex = childNodesArray.indexOf(startContainer),
+        endContainerChildIndex = childNodesArray.indexOf(endContainer);
+
+    childNodesArray.forEach(function(childNode, index) {
+
+      if (index === startContainerChildIndex) {
+        childNode.textContent =
+          startContainer.textContent.substring(0, startOffset) +
+          text +
+          endContainer.textContent.substring(endOffset);
+      } else if (index > startContainerChildIndex && index <= endContainerChildIndex) {
+        domRemove(childNode);
+      }
+    });
+
+    container = startContainer;
+    offset = startOffset + text.length;
   }
 
-  if (options.autoResize) {
-    var hasResized = this.autoResize(style);
+  if (container && offset !== undefined) {
 
-    if (hasResized) {
-      this.resizeHandler(hasResized);
-    }
+    // is necessary in Internet Explorer
+    setTimeout(function() {
+      self.setSelection(container, offset);
+    });
   }
@@ -279,0 +288,0 @@ };

package.json

 {
   "name": "diagram-js-direct-editing",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Direct editing support for diagram-js",
@@ -5,0 +5,0 @@ "scripts": {

No alert changes

Improved metrics

Total package byte prevSize

19327

increased by1.81%

Lines of code

505

increased by1.2%

No dependency changes