7.10.3: Fix #388, #380, #349

microsoft · Mar 10, 2020 · 0f90011 · 0f90011
1 parent 777ea28
commit 0f90011
Show file tree

Hide file tree

Showing 5 changed files with 34 additions and 15 deletions.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "roosterjs",
-    "version": "7.10.2",
+    "version": "7.10.3",
     "description": "Framework-independent javascript editor",
     "repository": {
         "type": "git",

diff --git a/packages/roosterjs-editor-api/lib/format/createLink.ts b/packages/roosterjs-editor-api/lib/format/createLink.ts
@@ -1,5 +1,6 @@
 import { ChangeSource, DocumentCommand, QueryScope } from 'roosterjs-editor-types';
 import { Editor } from 'roosterjs-editor-core';
+import { HtmlSanitizer } from 'roosterjs-html-sanitizer';
 import { matchLink } from 'roosterjs-editor-dom';
 
 // Regex matching Uri scheme
@@ -54,7 +55,7 @@ export default function createLink(
     displayText?: string
 ) {
     editor.focus();
-    let url = link ? link.trim() : '';
+    let url = (checkXss(link) || '').trim();
     if (url) {
         let linkData = matchLink(url);
         // matchLink can match most links, but not all, i.e. if you pass link a link as "abc", it won't match
@@ -109,3 +110,13 @@ function updateAnchorDisplayText(anchor: HTMLAnchorElement, displayText: string)
         anchor.textContent = displayText;
     }
 }
+
+function checkXss(link: string): string {
+    const santizer = new HtmlSanitizer();
+    const doc = new DOMParser().parseFromString('<a></a>', 'text/html');
+    const a = doc.body.firstChild as HTMLAnchorElement;
+
+    a.href = link || '';
+    santizer.sanitize(doc.body);
+    return a.href;
+}
diff --git a/packages/roosterjs-editor-api/lib/format/toggleHeader.ts b/packages/roosterjs-editor-api/lib/format/toggleHeader.ts
@@ -1,6 +1,6 @@
 import { ChangeSource, DocumentCommand, QueryScope } from 'roosterjs-editor-types';
 import { Editor } from 'roosterjs-editor-core';
-import { findClosestElementAncestor } from 'roosterjs-editor-dom';
+import { HtmlSanitizer } from 'roosterjs-html-sanitizer';
 
 /**
  * Toggle header at selection
@@ -31,13 +31,16 @@ export default function toggleHeader(editor: Editor, level: number) {
 
         if (level > 0) {
             let traverser = editor.getSelectionTraverser();
-            let inlineElement = traverser ? traverser.currentInlineElement : null;
-            while (inlineElement) {
-                let element = findClosestElementAncestor(inlineElement.getContainerNode());
-                if (element) {
-                    element.style.fontSize = '';
-                }
-                inlineElement = traverser.getNextInlineElement();
+            let blockElement = traverser ? traverser.currentBlockElement : null;
+            let sanitizer = new HtmlSanitizer({
+                styleCallbacks: {
+                    'font-size': () => false,
+                },
+            });
+            while (blockElement) {
+                let element = blockElement.collapseToSingleElement();
+                sanitizer.sanitize(element);
+                blockElement = traverser.getNextBlockElement();
             }
             editor.getDocument().execCommand(DocumentCommand.FormatBlock, false, `<H${level}>`);
         }

diff --git a/packages/roosterjs-editor-core/lib/corePlugins/FirefoxTypeAfterLink.ts b/packages/roosterjs-editor-core/lib/corePlugins/FirefoxTypeAfterLink.ts
@@ -1,13 +1,15 @@
 import Editor from '../editor/Editor';
 import EditorPlugin from '../interfaces/EditorPlugin';
+import { Browser, LinkInlineElement, Position } from 'roosterjs-editor-dom';
 import { cacheGetContentSearcher } from '../eventApi/cacheGetContentSearcher';
-import { LinkInlineElement, Position } from 'roosterjs-editor-dom';
 import { PluginEvent, PluginEventType, PositionType } from 'roosterjs-editor-types';
 
 /**
  * FirefoxTypeAfterLink Component helps handle typing event when cursor is right after a link.
- * When typing after a link, Firefox will always put the new charactor inside link.
- * This plugin overrides this behavior to make it consistent with other browsers.
+ * When typing/pasting after a link, browser may put the new charactor inside link.
+ * This plugin overrides this behavior to always insert outside of link.
+ *
+ * TODO: Rename this file in next major release since it is not only applied to Firefox now
  */
 export default class FirefoxTypeAfterLink implements EditorPlugin {
     private editor: Editor;
@@ -29,7 +31,10 @@ export default class FirefoxTypeAfterLink implements EditorPlugin {
      * @param event PluginEvent object
      */
     onPluginEvent(event: PluginEvent) {
-        if (event.eventType == PluginEventType.KeyPress) {
+        if (
+            (Browser.isFirefox && event.eventType == PluginEventType.KeyPress) ||
+            event.eventType == PluginEventType.BeforePaste
+        ) {
             let range = this.editor.getSelectionRange();
             if (range && range.collapsed && this.editor.getElementAtCursor('A[href]')) {
                 let searcher = cacheGetContentSearcher(event, this.editor);

diff --git a/packages/roosterjs-editor-core/lib/editor/createEditorCore.ts b/packages/roosterjs-editor-core/lib/editor/createEditorCore.ts
@@ -36,7 +36,7 @@ export default function createEditorCore(
         typeInContainer: new TypeInContainerPlugin(),
         mouseUp: new MouseUpPlugin(),
         domEvent: new DOMEventPlugin(options.disableRestoreSelectionOnFocus),
-        firefoxTypeAfterLink: Browser.isFirefox && new FirefoxTypeAfterLink(),
+        firefoxTypeAfterLink: new FirefoxTypeAfterLink(),
         copyPlugin: !Browser.isIE && new CopyPlugin(),
     };
     let allPlugins = buildPluginList(corePlugins, options.plugins);