From 9896eace173be1704d1b2ba7117b1c7646ce73a4 Mon Sep 17 00:00:00 2001
From: npt-1707 <npthanh132@gmail.com>
Date: Mon, 17 Aug 2026 04:52:02 +0800
Subject: [PATCH] public/tinymce/plugins/leaui_mindmap/mindmap/main.js: added
 explicit matching for HTML entities to prevent XSS

---
 public/tinymce/plugins/leaui_mindmap/mindmap/main.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/public/tinymce/plugins/leaui_mindmap/mindmap/main.js b/public/tinymce/plugins/leaui_mindmap/mindmap/main.js
index 1ac2be8ee..c565d336f 100644
--- a/public/tinymce/plugins/leaui_mindmap/mindmap/main.js
+++ b/public/tinymce/plugins/leaui_mindmap/mindmap/main.js
@@ -17763,7 +17763,8 @@ function escape(html, encode) {
 }
 
 function unescape(html) {
-  return html.replace(/&([#\w]+);/g, function(_, n) {
+  // explicitly match decimal, hex, and named HTML entities 
+  return html.replace(/&(#(?:\d+)|(?:#x[0-9A-Fa-f]+)|(\w+))/g, function(_, n) {
     n = n.toLowerCase();
     if (n === 'colon') return ':';
     if (n.charAt(0) === '#') {