OutputData is wrongly manipulated and does not match expected output

Current Setup

Documented and prepared in this codesandbox example.

Note: It doesn’t matter if this is tested with or without react (I’ve prepared both, see links below)

Current Setup

Let’s assume I’ve a the following data object:

export const data = {
  blocks: [
    {
      type: 'header',
      data: {
        text: 'Editor.js',
        level: 2,
      },
    },
    {
      type: 'react',
      data: {
        url: 'remote.adjust.rotate=0&remote.size.w=5575&remote.size.h=3717',
      },
    },
  ],
}

When passing this later on to EditorJS everything works fine (note: tested in a react setup, but it does not really matter if it’s plain js or not).

Current Problem

When I now get the data from the editor with await editor.save() the data is corrupt and looks like this:

	{
      type: 'react',
      data: {
        url: 'remote.adjust.rotate=0&remote.size.w=5575&remote.size.h=3717',
      },
    },

remote.adjust.rotate=0& vs. remote.adjust.rotate=0&remote... 😕

This only happens since @editorjs/editorjs@2.17.0 in the latest 2.16 release everything works still (see codesandbox with 2.16.1).

Example Apps

• @editorjs/editorjs@2.17 with the bug: https://codesandbox.io/s/vibrant-sun-ggivk
• @editorjs/editorjs@2.16 without the bug: https://codesandbox.io/s/vigilant-cookies-1o7bj
• @editorjs/editorjs@2.17 (without react): https://codepen.io/natterstefan/pen/dyPjaVx?editors=1111

[gohabereg]

Hi @natterstefan

Thanks for the reminder 😃

A method that sanitizes blocks after save called is here — https://github.com/codex-team/editor.js/blob/master/src/components/modules/sanitizer.ts#L59

As you can see, if there is no sanitize config of any kind, it returns data as it is. But the problem is there is always sanitize config for inline-tools as this method appends br and wbr tags (2.17 changes).

The solution is actually simple — if a tool doesn’t provide inlineToolbar option, return an empty object from getInlineToolsConfig.

The second step would be to decode HTML entities after sanitize, but as we include inline tags to Editor’s output, it would break the markup

[gohabereg]

Hi @natterstefan Thanks for the report! It seems we need to escape entities after saving as html-janitor inserts data to temp DOM nodes on sanitizing