Merge pull request #173 from FriendsOfREDAXO/update/tinymce-8.5.1

skerbis · web-flow · commit 2ede29757cb1 · 2026-05-26T11:16:36.000+02:00
🔄 Update TinyMCE auf Version 8.5.1
diff --git a/assets/vendor/tinymce/CHANGELOG.md b/assets/vendor/tinymce/CHANGELOG.md
@@ -5,6 +5,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
+## 8.5.1 - 2026-05-19
+
+### Security
+- Fixed media plugin `data-mce-object` injection leading to stored XSS. #TINY-14357
+- Fixed stored XSS vulnerability through `mce:protected` comments. #TINY-14353
+- Fixed stored XSS vulnerability through `data-mce-` prefixed `src`, `href`, `style` attributes. #TINY-14333
+
 ## 8.5.0 - 2026-04-29
 
 ### Added
diff --git a/assets/vendor/tinymce/composer.json b/assets/vendor/tinymce/composer.json
@@ -1,6 +1,6 @@
 {
 	"name": "tinymce/tinymce",
-	"version": "8.5.0",
+	"version": "8.5.1",
 	"description": "Web based JavaScript HTML WYSIWYG editor control.",
 	"license": [
 		"SEE LICENSE IN license.md"
diff --git a/assets/vendor/tinymce/models/dom/model.js b/assets/vendor/tinymce/models/dom/model.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/package.json b/assets/vendor/tinymce/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "tinymce",
-	"version": "8.5.0",
+	"version": "8.5.1",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/tinymce/tinymce.git",
diff --git a/assets/vendor/tinymce/plugins/accordion/plugin.js b/assets/vendor/tinymce/plugins/accordion/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/advlist/plugin.js b/assets/vendor/tinymce/plugins/advlist/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/anchor/plugin.js b/assets/vendor/tinymce/plugins/anchor/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/autolink/plugin.js b/assets/vendor/tinymce/plugins/autolink/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/autoresize/plugin.js b/assets/vendor/tinymce/plugins/autoresize/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/autosave/plugin.js b/assets/vendor/tinymce/plugins/autosave/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/charmap/plugin.js b/assets/vendor/tinymce/plugins/charmap/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/code/plugin.js b/assets/vendor/tinymce/plugins/code/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/codesample/plugin.js b/assets/vendor/tinymce/plugins/codesample/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/directionality/plugin.js b/assets/vendor/tinymce/plugins/directionality/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/emoticons/plugin.js b/assets/vendor/tinymce/plugins/emoticons/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/fullscreen/plugin.js b/assets/vendor/tinymce/plugins/fullscreen/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/help/plugin.js b/assets/vendor/tinymce/plugins/help/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/image/plugin.js b/assets/vendor/tinymce/plugins/image/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/importcss/plugin.js b/assets/vendor/tinymce/plugins/importcss/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/insertdatetime/plugin.js b/assets/vendor/tinymce/plugins/insertdatetime/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/link/plugin.js b/assets/vendor/tinymce/plugins/link/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/lists/plugin.js b/assets/vendor/tinymce/plugins/lists/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/media/plugin.js b/assets/vendor/tinymce/plugins/media/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
@@ -1287,13 +1287,74 @@
         }
     };
 
-    const parseAndSanitize = (editor, context, html) => {
+    const parseAndSanitize = (editor, html) => {
         const getEditorOption = editor.options.get;
         const sanitize = getEditorOption('xss_sanitization');
         const validate = shouldFilterHtml(editor);
-        return Parser(editor.schema, { sanitize, validate }).parse(html, { context });
+        return Parser(editor.schema, { sanitize, validate }).parse(html);
     };
 
+    const buildMediaElement = (editor, node) => {
+        const realElmName = node.attr('data-mce-object');
+        const element = document.createElement(realElmName);
+        // Add width/height to everything but audio
+        if (realElmName !== 'audio') {
+            const className = node.attr('class');
+            const firstChild = node.firstChild;
+            if (className && className.indexOf('mce-preview-object') !== -1 && firstChild) {
+                const width = firstChild.attr('width');
+                const height = firstChild.attr('height');
+                if (isString(width)) {
+                    element.setAttribute('width', width);
+                }
+                if (isString(height)) {
+                    element.setAttribute('height', height);
+                }
+            }
+            else {
+                const width = node.attr('width');
+                const height = node.attr('height');
+                if (isString(width)) {
+                    element.setAttribute('width', width);
+                }
+                if (isString(height)) {
+                    element.setAttribute('height', height);
+                }
+            }
+        }
+        const style = node.attr('style');
+        if (isString(style)) {
+            element.setAttribute('style', style);
+        }
+        // Unprefix all placeholder attributes
+        const attribs = node.attributes ?? [];
+        let ai = attribs.length;
+        while (ai--) {
+            const attrName = attribs[ai].name;
+            if (attrName.indexOf('data-mce-p-') === 0) {
+                element.setAttribute(attrName.substr(11), attribs[ai].value);
+            }
+        }
+        // Inject innerhtml
+        const innerHtml = node.attr('data-mce-html');
+        if (isString(innerHtml)) {
+            element.innerHTML = unescape(innerHtml);
+        }
+        else {
+            element.innerHTML = '\u00a0';
+        }
+        const fragment = parseAndSanitize(editor, element.outerHTML);
+        const newElement = fragment.getAll(realElmName)[0];
+        if (isNonNullable(newElement)) {
+            if (!isString(innerHtml)) {
+                newElement.empty();
+            }
+            return Optional.some(newElement);
+        }
+        else {
+            return Optional.none();
+        }
+    };
     const setup$1 = (editor) => {
         editor.on('PreInit', () => {
             const { schema, serializer, parser } = editor;
@@ -1317,50 +1378,14 @@
             // Converts iframe, video etc into placeholder images
             parser.addNodeFilter('iframe,video,audio,object,embed', placeHolderConverter(editor));
             // Replaces placeholder images with real elements for video, object, iframe etc
-            serializer.addAttributeFilter('data-mce-object', (nodes, name) => {
+            serializer.addAttributeFilter('data-mce-object', (nodes) => {
                 let i = nodes.length;
                 while (i--) {
                     const node = nodes[i];
                     if (!node.parent) {
                         continue;
                     }
-                    const realElmName = node.attr(name);
-                    const realElm = new global$2(realElmName, 1);
-                    // Add width/height to everything but audio
-                    if (realElmName !== 'audio') {
-                        const className = node.attr('class');
-                        if (className && className.indexOf('mce-preview-object') !== -1 && node.firstChild) {
-                            realElm.attr({
-                                width: node.firstChild.attr('width'),
-                                height: node.firstChild.attr('height')
-                            });
-                        }
-                        else {
-                            realElm.attr({
-                                width: node.attr('width'),
-                                height: node.attr('height')
-                            });
-                        }
-                    }
-                    realElm.attr({
-                        style: node.attr('style')
-                    });
-                    // Unprefix all placeholder attributes
-                    const attribs = node.attributes ?? [];
-                    let ai = attribs.length;
-                    while (ai--) {
-                        const attrName = attribs[ai].name;
-                        if (attrName.indexOf('data-mce-p-') === 0) {
-                            realElm.attr(attrName.substr(11), attribs[ai].value);
-                        }
-                    }
-                    // Inject innerhtml
-                    const innerHtml = node.attr('data-mce-html');
-                    if (innerHtml) {
-                        const fragment = parseAndSanitize(editor, realElmName, unescape(innerHtml));
-                        each$1(fragment.children(), (child) => realElm.append(child));
-                    }
-                    node.replace(realElm);
+                    buildMediaElement(editor, node).fold(() => node.remove(), (realElm) => node.replace(realElm));
                 }
             });
         });
diff --git a/assets/vendor/tinymce/plugins/media/plugin.min.js b/assets/vendor/tinymce/plugins/media/plugin.min.js
diff --git a/assets/vendor/tinymce/plugins/nonbreaking/plugin.js b/assets/vendor/tinymce/plugins/nonbreaking/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/pagebreak/plugin.js b/assets/vendor/tinymce/plugins/pagebreak/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/preview/plugin.js b/assets/vendor/tinymce/plugins/preview/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/quickbars/plugin.js b/assets/vendor/tinymce/plugins/quickbars/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/save/plugin.js b/assets/vendor/tinymce/plugins/save/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/searchreplace/plugin.js b/assets/vendor/tinymce/plugins/searchreplace/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/table/plugin.js b/assets/vendor/tinymce/plugins/table/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/visualblocks/plugin.js b/assets/vendor/tinymce/plugins/visualblocks/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/visualchars/plugin.js b/assets/vendor/tinymce/plugins/visualchars/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/plugins/wordcount/plugin.js b/assets/vendor/tinymce/plugins/wordcount/plugin.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/themes/silver/theme.js b/assets/vendor/tinymce/themes/silver/theme.js
@@ -1,5 +1,5 @@
 /**
- * TinyMCE version 8.5.0 (2026-04-29)
+ * TinyMCE version 8.5.1 (2026-05-19)
  */
 
 (function () {
diff --git a/assets/vendor/tinymce/tinymce.js b/assets/vendor/tinymce/tinymce.js
diff --git a/assets/vendor/tinymce/tinymce.min.js b/assets/vendor/tinymce/tinymce.min.js
diff --git a/custom_plugins/for_markdown/dist/for_markdown/plugin.js b/custom_plugins/for_markdown/dist/for_markdown/plugin.js
diff --git a/custom_plugins/for_markdown/dist/for_markdown/plugin.min.js b/custom_plugins/for_markdown/dist/for_markdown/plugin.min.js
diff --git a/custom_plugins/for_markdown/dist/for_markdown/version.txt b/custom_plugins/for_markdown/dist/for_markdown/version.txt
diff --git a/package.json b/package.json

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "tinymce/tinymce",`
`3`		`- "version": "8.5.0",`
	`3`	`+ "version": "8.5.1",`
`4`	`4`	`"description": "Web based JavaScript HTML WYSIWYG editor control.",`
`5`	`5`	`"license": [`
`6`	`6`	`"SEE LICENSE IN license.md"`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "tinymce",`
`3`		`- "version": "8.5.0",`
	`3`	`+ "version": "8.5.1",`
`4`	`4`	`"repository": {`
`5`	`5`	`"type": "git",`
`6`	`6`	`"url": "https://github.com/tinymce/tinymce.git",`