소스 검색

Docs: Corrected the HTML embed feature guide and API docs.

Anna Tomanek 5 년 전
부모
커밋
d5e87e7794

+ 30 - 23
packages/ckeditor5-html-embed/docs/features/html-embed.md

@@ -7,16 +7,16 @@ menu-title: HTML embed
 
 The {@link module:html-embed/htmlembed~HtmlEmbed} plugin allows embedding an arbitrary HTML snippet in the editor. The feature is targeted at more advanced users who want to directly interact with HTML fragments.
 
-This feature can be used to embed any HTML code and bypass CKEditor 5's filtering mechanisms. Thanks to that it is possible to enrich content produced by CKEditor 5 with fragments of HTML that are not supported by any other CKEditor 5 feature.
+This feature can be used to embed any HTML code and bypass the CKEditor 5's filtering mechanisms. Thanks to that it is possible to enrich content produced by CKEditor 5 with fragments of HTML that are not supported by any other CKEditor 5 feature.
 
-Example of content that can be embedded thanks to the HTML embed feature:
+Some examples of content that can be embedded thanks to the HTML embed feature:
 
-* analytics code (that usually require embedding `<script>` elements),
-* social page widgets (that also require embedding `<script>` elements),
-* content embeddable by `<iframe>`s,
-* HTML media elements such as audio and video,
-* HTML snippets produced by external tools (e.g reports),
-* interactive content that requires a combination of rich HTML and scripts.
+* Analytics code (that usually require embedding `<script>` elements).
+* Social page widgets (that also require embedding `<script>` elements).
+* Content embeddable by `<iframe>` elements.
+* HTML media elements such as `<audio>` and `<video>`.
+* HTML snippets produced by external tools (for example, reports or charts).
+* Interactive content that requires a combination of rich HTML and scripts.
 
 It is recommended to use the {@link features/media-embed media embed} feature for embeddable media that are supported by this feature. The HTML embed feature can be used to handle remaining content.
 
@@ -28,10 +28,17 @@ It is recommended to use the {@link features/media-embed media embed} feature fo
 
 ## Demo
 
-Use the editor below to see the plugin in action. Click the **"Preview editor data"** button below the editor to see a preview of the editor content, including embedded HTML.
+Use the editor below to see the plugin in action. Click the **"Preview editor data"** button below the editor to see a preview of the editor content, including the embedded HTML.
 
 {@snippet features/html-embed}
 
+## Related features
+
+CKEditor 5 supports a wider range of embed and code features, including:
+
+* {@link features/media-embed Media embed} &ndash; Insert embeddable media such as YouTube or Vimeo videos and tweets into your rich text content.
+* {@link features/code-blocks Code blocks} &ndash; Insert longer, multiline listings of pre-formatted code with a programming language assigned.
+
 ## Installation
 
 To add this feature to your rich-text editor, install the [`@ckeditor/ckeditor5-html-embed`](https://www.npmjs.com/package/@ckeditor/ckeditor5-html-embed) package:
@@ -64,7 +71,7 @@ ClassicEditor
 
 The feature is by default configured to not show previews of the HTML snippets. The previews can be enabled by setting the {@link module:html-embed/htmlembed~HtmlEmbedConfig#showPreviews `config.htmlEmbed.showPreviews`} option to `true`.
 
-However, by showing previews of embedded HTML snippets you expose the users of your system to the risk of executing malicious JavaScript code inside the editor. Therefore, it is highly recommended to plug an HTML sanitizier that will strip the malicious code from create snippets before rendering their previous. The sanitizer can be plugged by defining the {@link module:html-embed/htmlembed~HtmlEmbedConfig#sanitizeHtml `config.htmlEmbed.sanitizeHtml`} option.
+However, by showing previews of the embedded HTML snippets, you expose the users of your system to the **risk of executing malicious JavaScript code inside the editor**. Therefore, it is highly recommended to plug some HTML sanitizer that will strip the malicious code from the created snippets before rendering their previews. The sanitizer can be plugged by defining the {@link module:html-embed/htmlembed~HtmlEmbedConfig#sanitizeHtml `config.htmlEmbed.sanitizeHtml`} option.
 
 ```js
 ClassicEditor
@@ -90,44 +97,44 @@ ClassicEditor
 	.catch( ... );
 ```
 
-Currently, the [feature does not execute `<script>` tags](https://github.com/ckeditor/ckeditor5/issues/8326) so content that requires executing JavaScript in order to generate a preview will not show in the editor. However, other JavaScript code – e.g. used in `on*` observers and `scr="javascript:..."` attributes will be executed and therefore a sanitizer still needs to be enabled.
+Currently, the [feature does not execute `<script>` tags](https://github.com/ckeditor/ckeditor5/issues/8326) so the content that requires executing JavaScript in order to generate a preview will not show in the editor. However, other JavaScript code, for example, used in `on*` observers and `src="javascript:..."` attributes will be executed and therefore a sanitizer still needs to be enabled.
 
 Read more about the security aspect in the next section.
 
 ### Security
 
-If the HTML embed feature is configured to [show content previews](#content-previews), the HTML that the user inserts into the HTML embed widget is then rendered back to the user. If the HTML was rendered as-is, any JavaScript code included in these HTML snippets would be executed by the browser in context of your website.
+If the HTML embed feature is configured to [show content previews](#content-previews), the HTML that the user inserts into the HTML embed widget is then rendered back to the user. If the HTML was rendered as-is, any JavaScript code included in these HTML snippets would be executed by the browser in the context of your website.
 
-This, in turn, is a plain security risk. The HTML provided by the user might be mistakenly copied from a malicious website or end up in the users clipboard (as it would usually be copied and pasted) by any other mean.
+This, in turn, is a plain security risk. The HTML provided by the user might be mistakenly copied from a malicious website or end up in the user's clipboard (as it would usually be copied and pasted) by any other means.
 
-In some cases, advanced users can be instructed to never paste HTML code from untrusted sources. However, in most cases, it is highly recommended to properly secure the system by configuring the HTML embed feature to use an HTML sanitizer and, optionally, setting strict CSP rules.
+In some cases, advanced users can be instructed to never paste HTML code from untrusted sources. However, in most cases, it is highly recommended to properly secure the system by configuring the HTML embed feature to use an HTML sanitizer and, optionally, by setting strict CSP rules.
 
 <info-box>
-	The HTML embed feature [does not currently execute code in `<script>` tags](https://github.com/ckeditor/ckeditor5/issues/8326). However, it will execute code in `on*` and `scr="javascript:..."` attributes.
+	The HTML embed feature [does not currently execute code in `<script>` tags](https://github.com/ckeditor/ckeditor5/issues/8326). However, it will execute code in the `on*` and `src="javascript:..."` attributes.
 
-	The tricky part is that some HTML snippets require JavaScript to be executed to render any meaningful previews (e.g. Facebook embeds). Some, in turn, does not make sense to be executed (analytics code).
+	The tricky part is that some HTML snippets require JavaScript to be executed to render any meaningful previews (for example, Facebook embeds). Some, in turn, do not make sense to be executed (analytics code).
 
-	Therefore, when configuring the sanitizer and CSP rules, you can take those situations into consideration and for instance allow `<script>` tags pointing only to certain domains (e.g. a trusted external page that requires JavaScript).
+	Therefore, when configuring the sanitizer and CSP rules, you can take these situations into consideration and for instance, allow `<script>` tags pointing only to certain domains (e.g. a trusted external page that requires JavaScript).
 </info-box>
 
 #### Sanitizer
 
-The {@link module:html-embed/htmlembed~HtmlEmbedConfig#sanitizeHtml `config.htmlEmbed.sanitizeHtml`} option allow plugging an external sanitizer.
+The {@link module:html-embed/htmlembed~HtmlEmbedConfig#sanitizeHtml `config.htmlEmbed.sanitizeHtml`} option allows plugging an external sanitizer.
 
-Some popular JavaScript libraries that can be used include [sanitize-html](https://www.npmjs.com/package/sanitize-html) and [DOMPurify](https://www.npmjs.com/package/dompurify).
+Some popular JavaScript libraries that can be used include [`sanitize-html`](https://www.npmjs.com/package/sanitize-html) and [`DOMPurify`](https://www.npmjs.com/package/dompurify).
 
 The default settings of these libraries usually strip all potentially malicious content including `<iframe>`, `<video>`, etc. elements and JavaScript code coming from trusted sources so you may need to adjust their settings to match your needs.
 
 #### CSP
 
-In addition to using a sanitizer you can use the built browser mechanism called [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). By using CSP you can let the browser know what sources and means to execute JavaScript code and include other resources such as stylesheets, images and fonts are allowed.
+In addition to using a sanitizer, you can use the built-in browser mechanism called [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). By using CSP you can let the browser know the allowed sources and means to execute JavaScript code and include other resources such as stylesheets, images and fonts.
 
 ## Common API
 
 The {@link module:html-embed/htmlembed~HtmlEmbed} plugin registers:
-* the UI button component (`'htmlEmbed'`),
-* the `'updateHtmlEmbed'` command implemented by {@link module:html-embed/updatehtmlembedcommand~UpdateHtmlEmbedCommand}.
-* the `'insertHtmlEmbed'` command implemented by {@link module:html-embed/inserthtmlembedcommand~InsertHtmlEmbedCommand}.
+* The UI button component (`'htmlEmbed'`).
+* The `'updateHtmlEmbed'` command implemented by {@link module:html-embed/updatehtmlembedcommand~UpdateHtmlEmbedCommand}.
+* The `'insertHtmlEmbed'` command implemented by {@link module:html-embed/inserthtmlembedcommand~InsertHtmlEmbedCommand}.
 
 Both commands can be executed using the {@link module:core/editor/editor~Editor#execute `editor.execute()`} method:
 

+ 4 - 4
packages/ckeditor5-html-embed/src/htmlembed.js

@@ -14,7 +14,7 @@ import HtmlEmbedUI from './htmlembedui';
 /**
  * The HTML embed feature.
  *
- * It allows inserting HTML snippets directly to the editor.
+ * It allows inserting HTML snippets directly into the editor.
  *
  * For a detailed overview, check the {@glink features/html-embed HTML embed feature} documentation.
  *
@@ -52,7 +52,7 @@ export default class HtmlEmbed extends Plugin {
  */
 
 /**
- * Whether the feature should render previews of the the embedded HTML.
+ * Whether the feature should render previews of the embedded HTML.
  *
  * When set to `true`, the feature will produce a preview of the inserted HTML based on a sanitized
  * version of the HTML provided by the user.
@@ -67,9 +67,9 @@ export default class HtmlEmbed extends Plugin {
  */
 
 /**
- * Callback used to sanitize HTML provided by the user when generating previews of it in the editor.
+ * Callback used to sanitize the HTML provided by the user when generating previews of it in the editor.
  *
- * We strongly recommend to overwrite the default function to avoid XSS vulnerabilities.
+ * We strongly recommend overwriting the default function to avoid XSS vulnerabilities.
  *
  * Read more about the security aspect of this feature in the {@glink features/html-embed#security "Security"} section of
  * the {@glink features/html-embed HTML embed} feature guide.

+ 2 - 2
packages/ckeditor5-html-embed/src/htmlembedediting.js

@@ -47,8 +47,8 @@ export default class HtmlEmbedEditing extends Plugin {
 			showPreviews: false,
 			sanitizeHtml: rawHtml => {
 				/**
-				 * When using the HTML embed feature with `htmlEmbed.showPreviews=true` option, it is strongly recommended to
-				 * define a sanitize function that will clean up an input HTML in order to avoid XSS vulnerability.
+				 * When using the HTML embed feature with the `htmlEmbed.showPreviews=true` option, it is strongly recommended to
+				 * define a sanitize function that will clean up the input HTML in order to avoid XSS vulnerability.
 				 *
 				 * For a detailed overview, check the {@glink features/html-embed HTML embed feature} documentation.
 				 *

+ 4 - 4
packages/ckeditor5-html-embed/src/inserthtmlembedcommand.js

@@ -11,11 +11,11 @@ import Command from '@ckeditor/ckeditor5-core/src/command';
 import { findOptimalInsertionPosition } from '@ckeditor/ckeditor5-widget/src/utils';
 
 /**
- * The insert raw HTML element command.
+ * The insert HTML embed element command.
  *
  * The command is registered by {@link module:html-embed/htmlembedediting~HtmlEmbedEditing} as `'insertHtmlEmbed'`.
  *
- * To insert the raw HTML element at the current selection, execute the command:
+ * To insert the HTML embed element at the current selection, execute the command:
  *
  *		editor.execute( 'insertHtmlEmbed' );
  *
@@ -30,7 +30,7 @@ export default class InsertHtmlEmbedCommand extends Command {
 	}
 
 	/**
-	 * Executes the command, which creates and inserts a new html element.
+	 * Executes the command, which creates and inserts a new HTML embed element.
 	 *
 	 * @fires execute
 	 */
@@ -58,7 +58,7 @@ function isHtmlEmbedAllowed( model ) {
 		!checkSelectionOnObject( selection, schema );
 }
 
-// Checks if a html embed is allowed by the schema in the optimal insertion parent.
+// Checks if an HTML embed is allowed by the schema in the optimal insertion parent.
 //
 // @param {module:engine/model/selection~Selection|module:engine/model/documentselection~DocumentSelection} selection
 // @param {module:engine/model/schema~Schema} schema

+ 3 - 3
packages/ckeditor5-html-embed/src/updatehtmlembedcommand.js

@@ -10,11 +10,11 @@
 import Command from '@ckeditor/ckeditor5-core/src/command';
 
 /**
- * The update raw HTML value command.
+ * The update HTML embed value command.
  *
  * The command is registered by {@link module:html-embed/htmlembedediting~HtmlEmbedEditing} as `'updateHtmlEmbed'`.
  *
- * To update the value of the raw HTML element at the current selection, execute the command:
+ * To update the value of the HTML embed element at the current selection, execute the command:
  *
  *		editor.execute( 'updateHtmlEmbed', '<b>HTML.</b>' );
  *
@@ -49,7 +49,7 @@ export default class UpdateHtmlEmbedCommand extends Command {
 	}
 }
 
-// Returns a selected raw html element in the model, if any.
+// Returns the selected HTML embed element in the model, if any.
 //
 // @param {module:engine/model/selection~Selection} selection
 // @returns {module:engine/model/element~Element|null}