xdan/jodit 4.19.11

on GitHub

🐛 Bug Fix

• Security: isHtmlFromWord and isHTML, which run on every paste, used regexes that backtracked quadratically on crafted clipboard HTML (a long run of <meta or <a), so a 256 KB paste froze the tab for half a minute (CWE-1333, ReDoS). Both are single indexOf scans now, as are the other tag searches on the paste and value paths: the <meta> and Word wrapper clean-up, the selection marker, temporary element, media and iframe wrapper removal, the iframe document marker clean-up, trim and the mso- style filter. Reported by Jiawei Guo.