diff --git a/.changes/unreleased/tinymce-TINY-12056-2025-06-16.yaml b/.changes/unreleased/tinymce-TINY-12056-2025-06-16.yaml new file mode 100644 index 0000000000..8e8143729b --- /dev/null +++ b/.changes/unreleased/tinymce-TINY-12056-2025-06-16.yaml @@ -0,0 +1,7 @@ +project: tinymce +kind: Changed +body: Comments with HTML like content, attributes with HTML + like values, elements with HTML Comment like textContent are no longer retained while content sanitization is active. +time: 2025-06-16T15:59:32.909609+02:00 +custom: + Issue: TINY-12056 diff --git a/NOTICES.txt b/NOTICES.txt index 44a9c74ffe..2109267e88 100644 --- a/NOTICES.txt +++ b/NOTICES.txt @@ -1,10 +1,10 @@ Below is a list of third party libraries that this software uses: ---------------------------------------------------------------- -dompurify - Patched by Tiny +dompurify owner: Mario Heiderich repo: https://github.com/cure53/DOMPurify -version: 3.2.4 +version: 3.2.6 license: MPL-2.0 OR Apache-2.0 prismjs diff --git a/modules/tinymce/Gruntfile.js b/modules/tinymce/Gruntfile.js index 6e1e5cfc88..341d0d8708 100644 --- a/modules/tinymce/Gruntfile.js +++ b/modules/tinymce/Gruntfile.js @@ -497,7 +497,6 @@ module.exports = function (grunt) { 'modules/*/.stylelintrc', 'modules/tinymce/tools', 'bin', - 'patches', '.yarnrc', 'LICENSE.md', 'NOTICES.txt', diff --git a/modules/tinymce/package.json b/modules/tinymce/package.json index ee49e56fad..79293bf921 100644 --- a/modules/tinymce/package.json +++ b/modules/tinymce/package.json @@ -34,7 +34,7 @@ "@tinymce/oxide": "^3.0.0", "@tinymce/oxide-icons-default": "^3.0.0", "@types/prismjs": "^1.16.6", - "dompurify": "3.2.4", + "dompurify": "3.2.6", "prismjs": "^1.27.0" }, "devDependencies": { diff --git a/modules/tinymce/src/core/main/ts/html/Sanitization.ts b/modules/tinymce/src/core/main/ts/html/Sanitization.ts index b6757f3ea0..03c94fbea2 100644 --- a/modules/tinymce/src/core/main/ts/html/Sanitization.ts +++ b/modules/tinymce/src/core/main/ts/html/Sanitization.ts @@ -179,17 +179,14 @@ const setupPurify = (settings: DomParserSettings, schema: Schema, namespaceTrack }; const getPurifyConfig = (settings: DomParserSettings, mimeType: MimeType): Config => { - // Current dompurify types only cover up to 3.0.5 which does not include this new setting - const basePurifyConfig: Config & { SAFE_FOR_XML: boolean } = { + const basePurifyConfig: Config = { IN_PLACE: true, ALLOW_UNKNOWN_PROTOCOLS: true, // Deliberately ban all tags and attributes by default, and then un-ban them on demand in hooks // #comment and #cdata-section are always allowed as they aren't controlled via the schema // body is also allowed due to the DOMPurify checking the root node before sanitizing ALLOWED_TAGS: [ '#comment', '#cdata-section', 'body' ], - ALLOWED_ATTR: [], - // TINY-11332: New settings for dompurify 3.1.7 - SAFE_FOR_XML: false + ALLOWED_ATTR: [] }; const config = { ...basePurifyConfig }; diff --git a/modules/tinymce/src/core/test/ts/browser/dom/SerializerTest.ts b/modules/tinymce/src/core/test/ts/browser/dom/SerializerTest.ts index 73985ecff1..496db2b57d 100644 --- a/modules/tinymce/src/core/test/ts/browser/dom/SerializerTest.ts +++ b/modules/tinymce/src/core/test/ts/browser/dom/SerializerTest.ts @@ -435,7 +435,7 @@ describe('browser.tinymce.core.dom.SerializerTest', () => { }); it('Script with a HTML comment and less than with element_format: xhtml', () => { - const ser = DomSerializer({ fix_list_elements: true, element_format: 'xhtml' }); + const ser = DomSerializer({ fix_list_elements: true, element_format: 'xhtml', sanitize: false }); ser.setRules('script[type|language|src]'); setTestHtml('