notesnook/packages/editor/patches/prosemirror-model+1.22.3.patch

diff --git a/node_modules/prosemirror-model/dist/index.cjs b/node_modules/prosemirror-model/dist/index.cjs
index aa31355..1409b46 100644
--- a/node_modules/prosemirror-model/dist/index.cjs
+++ b/node_modules/prosemirror-model/dist/index.cjs
@@ -95,6 +95,7 @@ var Fragment = function () {
       var nodeStart = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : 0;
       var parent = arguments.length > 4 ? arguments[4] : undefined;
       for (var i = 0, pos = 0; pos < to; i++) {
+        if (i >= this.content.length) break;
         var child = this.content[i],
           end = pos + child.nodeSize;
         if (end > from && f(child, nodeStart + pos, parent || null, i) !== false && child.content.size) {
@@ -2817,7 +2818,7 @@ function _renderSpec(doc, structure, xmlNS, blockArraysIn) {
   var tagName = structure[0],
     suspicious;
   if (typeof tagName != "string") throw new RangeError("Invalid array passed to renderSpec");
-  if (blockArraysIn && (suspicious = suspiciousAttributes(blockArraysIn)) && suspicious.indexOf(structure) > -1) throw new RangeError("Using an array from an attribute object as a DOM spec. This may be an attempted cross site scripting attack.");
+  // if (blockArraysIn && (suspicious = suspiciousAttributes(blockArraysIn)) && suspicious.indexOf(structure) > -1) throw new RangeError("Using an array from an attribute object as a DOM spec. This may be an attempted cross site scripting attack.");
   var space = tagName.indexOf(" ");
   if (space > 0) {
     xmlNS = tagName.slice(0, space);
diff --git a/node_modules/prosemirror-model/dist/index.js b/node_modules/prosemirror-model/dist/index.js
index 0097d9f..19d7031 100644
--- a/node_modules/prosemirror-model/dist/index.js
+++ b/node_modules/prosemirror-model/dist/index.js
@@ -84,6 +84,7 @@ class Fragment {
     */
     nodesBetween(from, to, f, nodeStart = 0, parent) {
         for (let i = 0, pos = 0; pos < to; i++) {
+            if (i >= this.content.length) break;
             let child = this.content[i], end = pos + child.nodeSize;
             if (end > from && f(child, nodeStart + pos, parent || null, i) !== false && child.content.size) {
                 let start = pos + 1;
@@ -3397,9 +3398,9 @@ function renderSpec(doc, structure, xmlNS, blockArraysIn) {
     let tagName = structure[0], suspicious;
     if (typeof tagName != "string")
         throw new RangeError("Invalid array passed to renderSpec");
-    if (blockArraysIn && (suspicious = suspiciousAttributes(blockArraysIn)) &&
-        suspicious.indexOf(structure) > -1)
-        throw new RangeError("Using an array from an attribute object as a DOM spec. This may be an attempted cross site scripting attack.");
+    // if (blockArraysIn && (suspicious = suspiciousAttributes(blockArraysIn)) &&
+    //     suspicious.indexOf(structure) > -1)
+    //     throw new RangeError("Using an array from an attribute object as a DOM spec. This may be an attempted cross site scripting attack.");
     let space = tagName.indexOf(" ");
     if (space > 0) {
         xmlNS = tagName.slice(0, space);