[SECURITY] Mitigate XSS in CKEditor4 plugin wordcount

See
https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4

yarn add ckeditor-wordcount-plugin@^1.17.12

Resolves: #101234
Releases: 11.5
Change-Id: I7400bc7405a91e62fb7dc5b3565ee2f9d5b4cc06
Security-Bulletin: TYPO3-CORE-SA-2023-004
Security-References: CVE-2023-37905
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80157


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Build/package.json

@@ -87,7 +87,7 @@
     "broadcastchannel-polyfill": "^1.0.0",
     "chart.js": "^2.9.3",
     "chosen-js": "^1.8.7",
-    "ckeditor-wordcount-plugin": "^1.17.6",
+    "ckeditor-wordcount-plugin": "^1.17.12",
     "ckeditor4": "^4.18.0",
     "codemirror": "^5.58.1",
     "cropperjs": "^1.5.9",

Build/yarn.lock

@@ -1929,10 +1929,10 @@ circular-json@^0.3.1:
   resolved "https://registry.yarnpkg.com/circular-json/-/circular-json-0.3.3.tgz#815c99ea84f6809529d2f45791bdf82711352d66"
   integrity sha512-UZK3NBx2Mca+b5LsG7bY183pHWt5Y1xts4P3Pz7ENTwGVnJOUWbRb3ocjvX7hx9tq/yTAdclXm9sZ38gNuem4A==
 
-ckeditor-wordcount-plugin@^1.17.6:
-  version "1.17.6"
-  resolved "https://registry.yarnpkg.com/ckeditor-wordcount-plugin/-/ckeditor-wordcount-plugin-1.17.6.tgz#cb1a2a988ce8c3f29cd701f38b120c3a03daef85"
-  integrity sha512-73Q0/W445UoToQ8fyaBhXxhsZXMOxoeGGaIZ1HyiPc1nisK1gbIGAFi1ksgKoavQhri0+sOfpnYSFXDEC608EQ==
+ckeditor-wordcount-plugin@^1.17.12:
+  version "1.17.12"
+  resolved "https://registry.yarnpkg.com/ckeditor-wordcount-plugin/-/ckeditor-wordcount-plugin-1.17.12.tgz#09452308b460398d7b045efb69b240242a5150f5"
+  integrity sha512-UU6ZpNoJvo6TQ7LoiV1hcEWboHKwqoLKK0CW951ZXH2QywMX+b4FkYNk3ajdrkCWbe2jVT2kbyMHf/H4FK+u8w==
 
 ckeditor4@^4.18.0:
   version "4.18.0"

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/ar.js

@@ -2,8 +2,11 @@
 
 CKEDITOR.plugins.setLang('wordcount', 'ar', {
     WordCount: 'كلمات:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'حروف:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'حروف مع إتش تي إم إل',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'فقرات',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'لا يمكن اضافة هذا المحتوى لانه تجاوز الحد الاقصى',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/ca.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'ca', {
     WordCount: 'Paraules:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'Caràcters:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'Caràcters (including HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'Paragraphs:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'Content can not be pasted because it is above the allowed limit',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/cs.js

@@ -2,14 +2,16 @@
 Copyright (c) 2003-2012, CKSource - Frederico Knabben. All rights reserved.
 For licensing, see LICENSE.html or http://ckeditor.com/license
 */
-CKEDITOR.plugins.setLang('wordcount', 'cs',
-    {
-        WordCount: 'Slov: ',
-        CharCount: 'Znaků: ',
-        CharCountWithHTML: 'Znaků (s HTML): ',
-        Paragraphs: 'Odstavců: ',
-        ParagraphsRemaining: 'Paragraphs remaining',
-        pasteWarning: 'Obsah nelze vložit',
-        Selected: 'Výběr: ',
-        title: 'Statistika'
-    });
+CKEDITOR.plugins.setLang('wordcount', 'cs', {
+    WordCount: 'Slov: ',
+    WordCountRemaining: 'Words remaining',
+    CharCount: 'Znaků: ',
+    CharCountRemaining: 'Characters remaining',
+    CharCountWithHTML: 'Znaků (s HTML): ',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
+    Paragraphs: 'Odstavců: ',
+    ParagraphsRemaining: 'Paragraphs remaining',
+    pasteWarning: 'Obsah nelze vložit',
+    Selected: 'Výběr: ',
\ No newline at end of file
+    title: 'Statistika'
+});
\ No newline at end of file

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/da.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'da', {
     WordCount: 'Ord:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'Karakterer:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'Karakterer (med HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'Afsnit:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'Indholdet kan ikke indsættes da det er længere end den tilladte grænse.',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/de.js

@@ -4,11 +4,14 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'de', {
     WordCount: 'Wörter:',
+    WordCountRemaining: 'Verbleibende Wörter',
     CharCount: 'Zeichen:',
+    CharCountRemaining: 'Verbleibende Zeichen',
     CharCountWithHTML: 'Zeichen (inkl. HTML):',
+    CharCountWithHTMLRemaining: 'Verbleibende Zeichen (inkl. HTML)',
     Paragraphs: 'Absätze:',
-    ParagraphsRemaining: 'Paragraphs remaining',
-    pasteWarning: 'Content can not be pasted because it is above the allowed limit',
-    Selected: 'Selected: ',
+    ParagraphsRemaining: 'Verbleibende Absätze',
+    pasteWarning: 'Text kann nicht eingefügt werden. Text ist zu lang.',
+    Selected: 'Ausgewählt: ',
     title: 'Statistik'
 });

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/el.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'el', {
     WordCount: 'Λέξεις:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'Χαρακτήρες:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'Χαρακτήρες (μαζί με HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'Paragraphs:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'Content can not be pasted because it is above the allowed limit',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/es.js

@@ -4,10 +4,13 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'es', {
     WordCount: 'Palabras:',
-    CharCount: 'Carácteres:',
-    CharCountWithHTML: 'Carácteres (con HTML):',
+    WordCountRemaining: 'Palabras restantes',
+    CharCount: 'Caracteres:',
+    CharCountRemaining: 'Caracteres restantes',
+    CharCountWithHTML: 'Caracteres (con HTML):',
+    CharCountWithHTMLRemaining: 'Caracteres (con HTML) restantes',
     Paragraphs: 'Párrafos:',
-    ParagraphsRemaining: 'Paragraphs remaining',
+    ParagraphsRemaining: 'Párrafos restantes',
     pasteWarning: 'El contenido no se puede pegar, ya que se encuentra fuera del límite permitido',
     Selected: 'Seleccionado: ',
     title: 'Estadísticas'

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/fa.js

@@ -3,8 +3,12 @@ Its The Persian (Farsi) Language Translate For Iranian By "Mohsen Esmaili"
 */
 CKEDITOR.plugins.setLang('wordcount', 'fa', {
     WordCount: 'لغت:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'کاراکتر:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'کاراکترها (با HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'پاراگراف:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'محتوای مورد نظر را نمی توان چسباند. زیرا این بیشتر از حد مجاز است.',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/fi.js

@@ -5,8 +5,11 @@
  */
 CKEDITOR.plugins.setLang('wordcount', 'fi', {
     WordCount: 'Sanoja:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'Merkkejä:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'Merkkejä (ml. HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'Kappaleita:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'Sisältöä ei voida liittää, koska se ylittää sallitun rajan.',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/fr.js

@@ -2,10 +2,13 @@
 
 CKEDITOR.plugins.setLang('wordcount', 'fr', {
     WordCount: 'Mots :',
+    WordCountRemaining: 'mots restants',
     CharCount: 'Caractères :',
+    CharCountRemaining: 'caractères restants',
     CharCountWithHTML: 'Caractères (incluant HTML) :',
+    CharCountWithHTMLRemaining: 'caractères (avec HTML) restants',
     Paragraphs: 'Paragraphes :',
-    ParagraphsRemaining: 'Paragraphs remaining',
+    ParagraphsRemaining: 'paragraphes restants',
     pasteWarning: 'Le contenu ne peut pas être collé car il dépasse la limite autorisée',
     Selected: 'Sélectionné :',
     title: 'Statistiques'

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/he.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'he', {
     WordCount: 'מילים:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'תווים:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'תווים (כולל HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'פסקאות:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'לא ניתן להדביק תוכן בשל עודף תווים',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/hr.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang("wordcount", "hr", {
     WordCount: "Riječi:",
+    WordCountRemaining: 'Words remaining',
     CharCount: "Znakova:",
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: "Znakova (uključujući HTML):",
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: "Paragraphs:",
     ParagraphsRemaining: "Paragraphs remaining",
     pasteWarning: "Content can not be pasted because it is above the allowed limit",

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/hu.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'hu', {
     WordCount: 'Szavak:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'Karakaterek:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'Karakterek (HTML tagekkel):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'Bekezdések:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'A szöveget nem lehet beilleszteni, mert a megadott limit felett van',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/it.js

@@ -5,10 +5,13 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'it', {
     WordCount: 'Parole:',
+    WordCountRemaining: 'Parole rimanenti',
     CharCount: 'Caratteri:',
+    CharCountRemaining: 'Caratteri rimanenti',
     CharCountWithHTML: 'Caratteri (HTML incluso):',
+    CharCountWithHTMLRemaining: 'Caratteri (con HTML) rimanenti',
     Paragraphs: 'Paragrafi:',
-    ParagraphsRemaining: 'Paragraphs remaining',
+    ParagraphsRemaining: 'Paragrafi rimanenti',
     pasteWarning: 'Il contenuto non può essere incollato poiché supera il limite massimo di caratteri disponibili',
     Selected: 'Selezionato: ',
     title: 'Statistiche'

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/ja.js

@@ -4,8 +4,11 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'ja', {
     WordCount: '単語数:',
+    WordCountRemaining: 'Words remaining',
     CharCount: '文字数:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: '文字数 (HTMLタグを含む):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: '段落数:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: '文字数/単語数の上限を超えるため、貼り付けできません。',

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/ka.js

+/*
+Copyright (c) 2003-2012, CKSource - Frederico Knabben. All rights reserved.
+For licensing, see LICENSE.html or http://ckeditor.com/license
+GEO Translation by E404R
+*/
+CKEDITOR.plugins.setLang('wordcount', 'ka', {
+    WordCount: 'სიტყვები:',
+    WordCountRemaining: 'დარჩენილი სიტყვები',
+    CharCount: 'სიმბოლო:',
+    CharCountRemaining: 'დარჩენილი სიმბოლო',
+    CharCountWithHTML: 'სიმბოლოები (HTML ით):',
+    CharCountWithHTMLRemaining: 'სიმბოლოები (HTML ით) დარჩენილი',
+    Paragraphs: 'პარაგრაფი:',
+    ParagraphsRemaining: 'დარჩენილი პარაგრაფი',
+    pasteWarning: 'ჩასმა შეუძლებელია, რადგან ის აღემატება დასაშვებ ლიმიტს',
+    Selected: 'არჩეული: ',
+    title: 'სტატისტიკა'
+});

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/nl.js

@@ -4,10 +4,13 @@ For licensing, see LICENSE.html or http://ckeditor.com/license
 */
 CKEDITOR.plugins.setLang('wordcount', 'nl', {
     WordCount: 'Woorden:',
+    WordCountRemaining: 'Resterende woorden',
     CharCount: 'Tekens:',
+    CharCountRemaining: 'Resterende tekens',
     CharCountWithHTML: 'Tekens (inclusief HTML):',
+    CharCountWithHTMLRemaining: 'Resterende tekens (met HTML)',
     Paragraphs: 'Paragrafen:',
-    ParagraphsRemaining: 'Paragraphs remaining',
+    ParagraphsRemaining: 'Resterende paragrafen',
     pasteWarning: 'De tekst kan niet worden geplakt omdat de limiet is overschreden',
     Selected: 'Geselecteerd: ',
     title: 'Statistieken'

typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/plugins/wordcount/lang/no.js

 // Norwegian translation by Vegard S.
 CKEDITOR.plugins.setLang('wordcount', 'no', {
     WordCount: 'Ord:',
+    WordCountRemaining: 'Words remaining',
     CharCount: 'Tegn:',
+    CharCountRemaining: 'Characters remaining',
     CharCountWithHTML: 'Tegn (including HTML):',
+    CharCountWithHTMLRemaining: 'Characters (with HTML) remaining',
     Paragraphs: 'Paragraphs:',
     ParagraphsRemaining: 'Paragraphs remaining',
     pasteWarning: 'Content can not be pasted because it is above the allowed limit',