Merge branch 'hotfix/20.2.1'

package.json

@@ -84,7 +84,7 @@
     "typescript": "^4.2.4"
   },
   "yoast": {
-    "pluginVersion": "20.2"
+    "pluginVersion": "20.2.1"
   },
   "version": "0.0.0"
 }

packages/js/src/helpers/measureTextWidth.js

@@ -35,6 +35,6 @@ export default function measureTextWidth( text ) {
 	if ( ! element ) {
 		element = createMeasurementElement();
 	}
-	element.innerHTML = text;
+	element.innerText = text;
 	return element.offsetWidth;
 }

packages/yoastseo/src/helpers/createMeasurementElement.js

@@ -35,6 +35,6 @@ export const measureTextWidth = function( text ) {
 	if ( ! element ) {
 		element = createMeasurementElement();
 	}
-	element.innerHTML = text;
+	element.innerText = text;
 	return element.offsetWidth;
 };

packages/yoastseo/src/languageProcessing/helpers/html/normalizeHTML.js

@@ -8,9 +8,8 @@
  * @returns {string} The string with single quotes around HTML attributes replaced with double quotes.
  */
 export default function( str ) {
-	const element = document.createElement( "body" );
-	element.innerHTML = str;
-	const normalizedHTML = element.innerHTML;
+	const doc = new DOMParser().parseFromString( str, "text/html" );
+	const normalizedHTML = doc.body.innerHTML;
 
 	// Replace ` ` with an actual non breaking space (U+00A0).
 	return normalizedHTML.replace( / /g, "\u00A0" );

readme.txt

@@ -247,6 +247,14 @@ Your question has most likely been answered on our help center: [yoast.com/help/
 
 == Changelog ==
 
+= 20.2.1 =
+
+Release date: 2023-03-02
+
+### Bugfix
+
+* Fixes a security issue in the post editor.
+
 = 20.2 =
 
 Release date: 2023-02-28