mirror/tiptap
1
0
Fork 0
mirror of https://github.com/ueberdosis/tiptap.git synced 2024-12-15 11:09:01 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug fix for issue #724; XSS issue when importing through getHTML() function; remove usage of innerHTML and pre-parse the string using native JS DOMParser

Browse Source
This commit is contained in:
John Nguyen 2020-07-01 14:01:31 -07:00
parent 4954f8297c
commit 5d17f68c0c
1 changed files with 29 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
packages/tiptap/src/Editor.js
View File

@ -52,20 +52,13 @@ export default class Editor extends Emitter {
dropCursor: {}, dropCursor: {},
parseOptions: {}, parseOptions: {},
injectCSS: true, injectCSS: true,
onInit: () => { onInit: () => {},
}, onTransaction: () => {},
onTransaction: () => { onUpdate: () => {},
}, onFocus: () => {},
onUpdate: () => { onBlur: () => {},
}, onPaste: () => {},
onFocus: () => { onDrop: () => {},
},
onBlur: () => {
},
onPaste: () => {
},
onDrop: () => {
},
} }
this.events = [ this.events = [
@ -110,8 +103,7 @@ export default class Editor extends Emitter {
} }
this.events.forEach(name => { this.events.forEach(name => {
this.on(name, this.options[camelCase(`on ${name}`)] || (() => { this.on(name, this.options[camelCase(`on ${name}`)] || (() => {}))
}))
}) })
this.emit('init', { this.emit('init', {
@ -283,7 +275,6 @@ export default class Editor extends Emitter {
const htmlString = `<div>${content}</div>`; const htmlString = `<div>${content}</div>`;
const parser = new window.DOMParser; const parser = new window.DOMParser;
const element = parser.parseFromString(htmlString, "text/html").body.firstChild; const element = parser.parseFromString(htmlString, "text/html").body.firstChild;
return DOMParser.fromSchema(this.schema).parse(element, parseOptions) return DOMParser.fromSchema(this.schema).parse(element, parseOptions)
} }
@ -293,12 +284,8 @@ export default class Editor extends Emitter {
createView() { createView() {
return new EditorView(this.element, { return new EditorView(this.element, {
state: this.createState(), state: this.createState(),
handlePaste: (...args) => { handlePaste: (...args) => { this.emit('paste', ...args) },
this.emit('paste', ...args) handleDrop: (...args) => { this.emit('drop', ...args) },
},
handleDrop: (...args) => {
this.emit('drop', ...args)
},
dispatchTransaction: this.dispatchTransaction.bind(this), dispatchTransaction: this.dispatchTransaction.bind(this),
}) })
} }