When I want to clear a class in the RadEditor the class is cleared in the hyperlink manager, but not in the area in the footer of the RadEditor.

If 'clear class' is selected nothing happens.

When using Metro skin, if I click on a disabled button (Undo, Redo, Unlink and so on), its icon disappears until I click outside it.

https://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx?skin=Metro

This does not happen with MetroTouch, Silk or Default skin. How do I replicate the same behavior with Metro skin?

There are issues with the cursor location when clicking at the end (or to the right) of a line in bullet lists with multiple levels.

When clicking at the end of the line the cursor is unexpectedly placed at the beginning of the line instead of at the end.

This does not happen if you click on some of the actual text or hit the exact location of the last character of the line, but when you naturally click just to the right of the end of the line.

It seems that it does not happen on all levels, but only some, as I have tried to depict in the attached screenshot.

This behavior was replicated on the latest WebForms Editor demo at https://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx

Uncaught TypeError: Failed to execute 'createObjectURL' on 'URL': Overload resolution failed error is thrown when pasting an image or a chart image from MS Word in RadEditor in Chrome / MS Edge.

The problem can be reproduced in the live demos too: https://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx. 

The error also prevents the execution of the OnClientPasteHtml event of the control.

The XHTML validator in the editor control is not working.

As per attached screenshot, when you click it and opens the window it simply states the following.

"Sorry! This document cannot be checked."

"Sorry, this type of URL scheme (undefined) is not supported by this service. Please check that you entered the URL correctly"

Can someone tell me why this is happening? It's also broken on the editor demos on your site. Maybe something on the W3C validator has changed making it no longer compatible/viable?

https://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx

https://demos.telerik.com/aspnet-ajax/editor/examples/built-in-dialogs/defaultcs.aspx 

The editor does not work at all in Chrome for iOS.

You can reproduce it in this demo:

https://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx

Using the latest 2022.3.1109.45, our web application is catching "Invalid Resource Request" exceptions when the Windows7 or Vista (maybe others too) loads the "Editor" control in "Classic" mode.    By decoding the URL, the control is having problems locating the image below

WebResource.axd?d=ZHkUja8e5EF7zNoz8IiY_kAGH7MBQgCnq0BEYT2AtFLv57GDfGbEymwRG8H68WuiE_6l2fpZpqb_FzVc_OItknX-LMTzvQOwC0Mk8HaCtGvNzWl-5nNlZ6xpbOjNSk4A0QtPGtyV0UA-BWX4bOfPU8EI30eAVg8UO6p7yERiuEbCUoiZOGUevYGPdrNVvPel0&t=638034624000000000
Error Message: This is an invalid webresource request.

Telerik.Web.UI.Skins|Telerik.Web.UI.Skins.Vista.Editor.ToolbarVerticalSprites.gif

Telerik.Web.UI.Skins|Telerik.Web.UI.Skins.Windows7.Editor.ToolbarSprites.gif

Change the skin of the radeditor in the default.aspx to another skin such as "metro" and the problem will not happen.    It works OK at least on Black, Metro and Silk but haven't tested others, you can tell it doesn't work when the divider bars in the editor toolbar don't appear properly.

Steps to reproduce the text highlighting issue:

1. Go to https://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx
2. Delete the content and write a single line
3. Use the mouse to highlight a portion of text starting at the end (right side) of the text and dragging toward the beginning (left side).
4. Stop about halfway to the beginning of the text.
5. Now, while the text is still highlighted, press shift and left arrow to continue selecting. This will work for some time until the highlight gets near the beginning, then, the highlight will start moving from the right side.

The execution of the getContextMenuByTagName inside the oncontextmenu event of RadEditor hides the context menu once it is shown. This happens in Lightweight render mode only and when the UseRadContextMenu is enabled:

<telerik:RadEditor ID="RadEditor1" runat="server" ContentAreaMode="iframe" OnClientLoad="OnClientLoad">
    <Content>
        <table>
            <tr>
                <td>test</td>
            </tr>
                <tr>
                <td>test</td>
            </tr>
                <tr>
                <td>test</td>
            </tr>
        </table>
    </Content>
</telerik:RadEditor>
<script>
    function OnClientLoad(editor, args) {
        editor.attachEventHandler("oncontextmenu", function (e) {
            var oSelection = editor.getSelectedElement();

            setTimeout(function () {
                var tdMenu = editor.getContextMenuByTagName("TD"); //the call of getContextMenuByTagName closes the context menu when lightweight render mode is used. You can slow down the closing with the setTimeout function or by settign UseRadContextMenu to false.

            }, 1000);
        });

    }
</script>

If the table is not part of the visible part of the content area and you have to scroll to see it, then the X select table button does not appear (its display="none" property does not get updated). So technically the span element is available in the DOM but hidden:

When a textbox element is disabled in the content area under Chrome and Edge Chromium, the editor loses cursor and its toolbar/commands stop working.

Steps to repro:

1. Set the following content in HTML mode:
   

   test <textarea disabled="disabled">Text Box</textarea> test

2. Switch to Design mode
3. Click on the textbox
4. Click outside the textbox and you'll see that the cursor (selection) is missing
5. the majority of the toolbar features that rely on selection also do not work

1. Create a Word document and indent a few lines in it
2. Copy the content with Ctrl+A and Ctrl+V
3. Open our Telerik Editor tool in that open Paste from word, Strip font option
4. Paste the content and insert it

You will see that the text-indent inline styles are stripped down and the indentation is missing.

Hi,

when using the StripCssExpressions Content Filter, it's working as expected in most cases, but when there's a linebreak inside of the style it breaks.

<telerik:RadEditor ContentFilters="RemoveScripts,StripCssExpressions,StripDomEventAttributes" />

<span style="width: expression((document.body.offsetWidth / 4 + 30) + 'px'); background-color: green;">text in a span</span>

<span style="width: 
expression((document.body.offsetWidth / 4 + 30) + 'px'); background-color: green;">text in a span</span>

The usage for the content filter is to prevent XSS attacks, and in our solution used besides several other means to avoid malicious code execution.

As expected, the filter not working is a security risk.

Does anyone have a good workaround available? (or is there a timeline on an official bugfix?)

Hi,

I am contacting you today to let you know I have found cross-site scripting vectors within the latest version of the RadEditor. I have attached images of the payloads that seem to bypass the XSS filter.

The second payload only works on Firefox browsers, but the first works on Chrome browsers too. While it still requires users to click on the link to trigger XSS, it can be easily social engineered in most situations.

The table wizard dialog of RadEditor does not function properly when there is a table having more than 500 columns.

Video: http://somup.com/crXlln0eIi