Skip to content

Commit

Permalink
Update docs/updating/update-to-43.md
Browse files Browse the repository at this point in the history
Co-authored-by: Dariusz Jarzębski <[email protected]>
  • Loading branch information
godai78 and Dumluregn authored Sep 4, 2024
1 parent aeafee9 commit b2021fa
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion docs/updating/update-to-43.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ In v43.0.0 we made a decision to move {@link module:html-embed/htmlembedconfig~H

However, we realized that it was a wrong decision to expose such a sensitive property in a top-level configuration property. We are worried that integrators may be confused and incorrectly assume that this callback would sanitize the entire output from CKEditor. Therefore, we decided to revert that change, so the sanitization callback is related strictly with the features that use it.

Starting with v43.1.0 you should again use `config.htmlEmbed.sanitizeHtml` and newly introduced `config.mergeFields.sanitizeHtml`. The editor will throw an error if `config.sanitizeHtml` is used.
Starting with v43.1.0, you should again use {@link module:html-embed/htmlembedconfig~HtmlEmbedConfig#sanitizeHtml `config.htmlEmbed.sanitizeHtml`} and newly introduced {@link module:merge-fields/mergefieldsconfig~MergeFieldsConfig#sanitizeHtml `config.mergeFields.sanitizeHtml`}. The editor will throw an error if `config.sanitizeHtml` is used.

Note: CKEditor&nbsp;5, by default, prevents execution of scripts in the editor content, while the content is being edited inside the editor. However, there are features (such as General HTML support or HTML embed) that can be configured to make CKEditor&nbsp;5 produce HTML output that contains executable scripts. Please remember, that CKEditor&nbsp;5 is a frontend component working in a browser. As an integrator, it is your responsibility to sanitize the content before it is displayed on your website or on other potentially vulnerable medium.

Expand Down

0 comments on commit b2021fa

Please sign in to comment.