zuora_connect_ui 0.8.3 → 0.9.0

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah.rb

@@ -0,0 +1,83 @@
+$LOAD_PATH.unshift(File.expand_path(File.dirname(__FILE__))) unless $LOAD_PATH.include?(File.expand_path(File.dirname(__FILE__)))
+
+require "nokogiri"
+
+require "loofah/metahelpers"
+require "loofah/elements"
+
+require "loofah/html5/safelist"
+require "loofah/html5/libxml2_workarounds"
+require "loofah/html5/scrub"
+
+require "loofah/scrubber"
+require "loofah/scrubbers"
+
+require "loofah/instance_methods"
+require "loofah/xml/document"
+require "loofah/xml/document_fragment"
+require "loofah/html/document"
+require "loofah/html/document_fragment"
+
+# == Strings and IO Objects as Input
+#
+# Loofah.document and Loofah.fragment accept any IO object in addition
+# to accepting a string. That IO object could be a file, or a socket,
+# or a StringIO, or anything that responds to +read+ and
+# +close+. Which makes it particularly easy to sanitize mass
+# quantities of docs.
+#
+module Loofah
+  # The version of Loofah you are using
+  VERSION = "2.3.0"
+
+  class << self
+    # Shortcut for Loofah::HTML::Document.parse
+    # This method accepts the same parameters as Nokogiri::HTML::Document.parse
+    def document(*args, &block)
+      Loofah::HTML::Document.parse(*args, &block)
+    end
+
+    # Shortcut for Loofah::HTML::DocumentFragment.parse
+    # This method accepts the same parameters as Nokogiri::HTML::DocumentFragment.parse
+    def fragment(*args, &block)
+      Loofah::HTML::DocumentFragment.parse(*args, &block)
+    end
+
+    # Shortcut for Loofah.fragment(string_or_io).scrub!(method)
+    def scrub_fragment(string_or_io, method)
+      Loofah.fragment(string_or_io).scrub!(method)
+    end
+
+    # Shortcut for Loofah.document(string_or_io).scrub!(method)
+    def scrub_document(string_or_io, method)
+      Loofah.document(string_or_io).scrub!(method)
+    end
+
+    # Shortcut for Loofah::XML::Document.parse
+    # This method accepts the same parameters as Nokogiri::XML::Document.parse
+    def xml_document(*args, &block)
+      Loofah::XML::Document.parse(*args, &block)
+    end
+
+    # Shortcut for Loofah::XML::DocumentFragment.parse
+    # This method accepts the same parameters as Nokogiri::XML::DocumentFragment.parse
+    def xml_fragment(*args, &block)
+      Loofah::XML::DocumentFragment.parse(*args, &block)
+    end
+
+    # Shortcut for Loofah.xml_fragment(string_or_io).scrub!(method)
+    def scrub_xml_fragment(string_or_io, method)
+      Loofah.xml_fragment(string_or_io).scrub!(method)
+    end
+
+    # Shortcut for Loofah.xml_document(string_or_io).scrub!(method)
+    def scrub_xml_document(string_or_io, method)
+      Loofah.xml_document(string_or_io).scrub!(method)
+    end
+
+    # A helper to remove extraneous whitespace from text-ified HTML
+    def remove_extraneous_whitespace(string)
+      string.gsub(/\n\s*\n\s*\n/, "\n\n")
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah/elements.rb

@@ -0,0 +1,92 @@
+require 'set'
+
+module Loofah
+  module Elements
+    STRICT_BLOCK_LEVEL_HTML4 = Set.new %w[
+      address
+      blockquote
+      center
+      dir
+      div
+      dl
+      fieldset
+      form
+      h1
+      h2
+      h3
+      h4
+      h5
+      h6
+      hr
+      isindex
+      menu
+      noframes
+      noscript
+      ol
+      p
+      pre
+      table
+      ul
+    ]
+
+    # https://developer.mozilla.org/en-US/docs/Web/HTML/Block-level_elements
+    STRICT_BLOCK_LEVEL_HTML5 = Set.new %w[
+      address
+      article
+      aside
+      blockquote
+      canvas
+      dd
+      div
+      dl
+      dt
+      fieldset
+      figcaption
+      figure
+      footer
+      form
+      h1
+      h2
+      h3
+      h4
+      h5
+      h6
+      header
+      hgroup
+      hr
+      li
+      main
+      nav
+      noscript
+      ol
+      output
+      p
+      pre
+      section
+      table
+      tfoot
+      ul
+      video
+    ]
+
+    STRICT_BLOCK_LEVEL = STRICT_BLOCK_LEVEL_HTML4 + STRICT_BLOCK_LEVEL_HTML5
+
+    # The following elements may also be considered block-level
+    # elements since they may contain block-level elements
+    LOOSE_BLOCK_LEVEL = Set.new %w[dd
+      dt
+      frameset
+      li
+      tbody
+      td
+      tfoot
+      th
+      thead
+      tr
+    ]
+
+    BLOCK_LEVEL = STRICT_BLOCK_LEVEL + LOOSE_BLOCK_LEVEL
+  end
+
+  ::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants ::Loofah::Elements
+end

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah/helpers.rb

@@ -0,0 +1,103 @@
+module Loofah
+  module Helpers
+    class << self
+      #
+      #  A replacement for Rails's built-in +strip_tags+ helper.
+      #
+      #   Loofah::Helpers.strip_tags("<div>Hello <b>there</b></div>") # => "Hello there"
+      #
+      def strip_tags(string_or_io)
+        Loofah.fragment(string_or_io).text
+      end
+
+      #
+      #  A replacement for Rails's built-in +sanitize+ helper.
+      #
+      #   Loofah::Helpers.sanitize("<script src=http://ha.ckers.org/xss.js></script>") # => "&lt;script src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;"
+      #
+      def sanitize(string_or_io)
+        loofah_fragment = Loofah.fragment(string_or_io)
+        loofah_fragment.scrub!(:strip)
+        loofah_fragment.xpath("./form").each { |form| form.remove }
+        loofah_fragment.to_s
+      end
+
+      #
+      #  A replacement for Rails's built-in +sanitize_css+ helper.
+      #
+      #    Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg)") # => "display: block;"
+      #
+      def sanitize_css style_string
+        ::Loofah::HTML5::Scrub.scrub_css style_string
+      end
+
+      #
+      #  A helper to remove extraneous whitespace from text-ified HTML
+      #  TODO: remove this in a future major-point-release.
+      #
+      def remove_extraneous_whitespace(string)
+        Loofah.remove_extraneous_whitespace string
+      end
+    end
+
+    module ActionView
+      module ClassMethods # :nodoc:
+        def full_sanitizer
+          @full_sanitizer ||= ::Loofah::Helpers::ActionView::FullSanitizer.new
+        end
+
+        def safe_list_sanitizer
+          @safe_list_sanitizer ||= ::Loofah::Helpers::ActionView::SafeListSanitizer.new
+        end
+
+        def white_list_sanitizer
+          warn "warning: white_list_sanitizer is deprecated, please use safe_list_sanitizer instead."
+          safe_list_sanitizer
+        end
+      end
+
+      #
+      #  Replacement class for Rails's HTML::FullSanitizer.
+      #
+      #  To use by default, call this in an application initializer:
+      #
+      #    ActionView::Helpers::SanitizeHelper.full_sanitizer = ::Loofah::Helpers::ActionView::FullSanitizer.new
+      #
+      #  Or, to generally opt-in to Loofah's view sanitizers:
+      #
+      #    Loofah::Helpers::ActionView.set_as_default_sanitizer
+      #
+      class FullSanitizer
+        def sanitize html, *args
+          Loofah::Helpers.strip_tags html
+        end
+      end
+
+      #
+      #  Replacement class for Rails's HTML::WhiteListSanitizer.
+      #
+      #  To use by default, call this in an application initializer:
+      #
+      #    ActionView::Helpers::SanitizeHelper.safe_list_sanitizer = ::Loofah::Helpers::ActionView::SafeListSanitizer.new
+      #
+      #  Or, to generally opt-in to Loofah's view sanitizers:
+      #
+      #    Loofah::Helpers::ActionView.set_as_default_sanitizer
+      #
+      class SafeListSanitizer
+        def sanitize html, *args
+          Loofah::Helpers.sanitize html
+        end
+
+        def sanitize_css style_string, *args
+          Loofah::Helpers.sanitize_css style_string
+        end
+      end
+
+      WhiteListSanitizer = SafeListSanitizer
+      if Object.respond_to?(:deprecate_constant)
+        deprecate_constant :WhiteListSanitizer
+      end
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah/html/document.rb

@@ -0,0 +1,18 @@
+module Loofah
+  module HTML # :nodoc:
+    #
+    #  Subclass of Nokogiri::HTML::Document.
+    #
+    #  See Loofah::ScrubBehavior and Loofah::TextBehavior for additional methods.
+    #
+    class Document < Nokogiri::HTML::Document
+      include Loofah::ScrubBehavior::Node
+      include Loofah::DocumentDecorator
+      include Loofah::TextBehavior
+
+      def serialize_root
+        at_xpath("/html/body")
+      end
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah/html/document_fragment.rb

@@ -0,0 +1,40 @@
+module Loofah
+  module HTML # :nodoc:
+    #
+    #  Subclass of Nokogiri::HTML::DocumentFragment.
+    #
+    #  See Loofah::ScrubBehavior and Loofah::TextBehavior for additional methods.
+    #
+    class DocumentFragment < Nokogiri::HTML::DocumentFragment
+      include Loofah::TextBehavior
+
+      class << self
+        #
+        #  Overridden Nokogiri::HTML::DocumentFragment
+        #  constructor. Applications should use Loofah.fragment to
+        #  parse a fragment.
+        #
+        def parse tags, encoding = nil
+          doc = Loofah::HTML::Document.new
+
+          encoding ||= tags.respond_to?(:encoding) ? tags.encoding.name : 'UTF-8'
+          doc.encoding = encoding
+
+          new(doc, tags)
+        end
+      end
+
+      #
+      #  Returns the HTML markup contained by the fragment
+      #
+      def to_s
+        serialize_root.children.to_s
+      end
+      alias :serialize :to_s
+
+      def serialize_root
+        at_xpath("./body") || self
+      end
+    end
+  end
+end

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah/html5/libxml2_workarounds.rb

@@ -0,0 +1,26 @@
+# coding: utf-8
+require 'set'
+
+module Loofah
+  #
+  #  constants related to working around unhelpful libxml2 behavior
+  #
+  #  ಠ_ಠ
+  #
+  module LibxmlWorkarounds
+    #
+    #  these attributes and qualifying parent tags are determined by the code at:
+    #
+    #    https://git.gnome.org/browse/libxml2/tree/HTMLtree.c?h=v2.9.2#n714
+    #
+    #  see comments about CVE-2018-8048 within the tests for more information
+    #
+    BROKEN_ESCAPING_ATTRIBUTES = Set.new %w[
+        href
+        action
+        src
+        name
+      ]
+    BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = {"name" => "a"}
+  end
+end

data/vendor/ruby/2.6.0/gems/loofah-2.3.0/lib/loofah/html5/safelist.rb

@@ -0,0 +1,800 @@
+require 'set'
+
+module Loofah
+  module HTML5 # :nodoc:
+    #
+    #  HTML safelist lifted from HTML5lib sanitizer code:
+    #
+    #    http://code.google.com/p/html5lib/
+    #
+    # <html5_license>
+    #
+    #   Copyright (c) 2006-2008 The Authors
+    #
+    #   Contributors:
+    #   James Graham - jg307@cam.ac.uk
+    #   Anne van Kesteren - annevankesteren@gmail.com
+    #   Lachlan Hunt - lachlan.hunt@lachy.id.au
+    #   Matt McDonald - kanashii@kanashii.ca
+    #   Sam Ruby - rubys@intertwingly.net
+    #   Ian Hickson (Google) - ian@hixie.ch
+    #   Thomas Broyer - t.broyer@ltgt.net
+    #   Jacques Distler - distler@golem.ph.utexas.edu
+    #   Henri Sivonen - hsivonen@iki.fi
+    #   The Mozilla Foundation (contributions from Henri Sivonen since 2008)
+    #
+    #   Permission is hereby granted, free of charge, to any person
+    #   obtaining a copy of this software and associated documentation
+    #   files (the "Software"), to deal in the Software without
+    #   restriction, including without limitation the rights to use, copy,
+    #   modify, merge, publish, distribute, sublicense, and/or sell copies
+    #   of the Software, and to permit persons to whom the Software is
+    #   furnished to do so, subject to the following conditions:
+    #
+    #   The above copyright notice and this permission notice shall be
+    #   included in all copies or substantial portions of the Software.
+    #
+    #   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    #   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    #   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+    #   NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+    #   HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+    #   WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    #   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+    #   DEALINGS IN THE SOFTWARE.
+    #
+    # </html5_license>
+    module SafeList
+
+      ACCEPTABLE_ELEMENTS = Set.new([
+                                      "a",
+                                      "abbr",
+                                      "acronym",
+                                      "address",
+                                      "area",
+                                      "article",
+                                      "aside",
+                                      "audio",
+                                      "b",
+                                      "bdi",
+                                      "bdo",
+                                      "big",
+                                      "blockquote",
+                                      "br",
+                                      "button",
+                                      "canvas",
+                                      "caption",
+                                      "center",
+                                      "cite",
+                                      "code",
+                                      "col",
+                                      "colgroup",
+                                      "command",
+                                      "datalist",
+                                      "dd",
+                                      "del",
+                                      "details",
+                                      "dfn",
+                                      "dir",
+                                      "div",
+                                      "dl",
+                                      "dt",
+                                      "em",
+                                      "fieldset",
+                                      "figcaption",
+                                      "figure",
+                                      "font",
+                                      "footer",
+                                      "form",
+                                      "h1",
+                                      "h2",
+                                      "h3",
+                                      "h4",
+                                      "h5",
+                                      "h6",
+                                      "header",
+                                      "hr",
+                                      "i",
+                                      "img",
+                                      "input",
+                                      "ins",
+                                      "kbd",
+                                      "label",
+                                      "legend",
+                                      "li",
+                                      "main",
+                                      "map",
+                                      "mark",
+                                      "menu",
+                                      "meter",
+                                      "nav",
+                                      "ol",
+                                      "optgroup",
+                                      "option",
+                                      "output",
+                                      "p",
+                                      "pre",
+                                      "q",
+                                      "s",
+                                      "samp",
+                                      "section",
+                                      "select",
+                                      "small",
+                                      "span",
+                                      "strike",
+                                      "strong",
+                                      "sub",
+                                      "summary",
+                                      "sup",
+                                      "table",
+                                      "tbody",
+                                      "td",
+                                      "textarea",
+                                      "tfoot",
+                                      "th",
+                                      "thead",
+                                      "time",
+                                      "tr",
+                                      "tt",
+                                      "u",
+                                      "ul",
+                                      "var",
+                                      "video",
+                                    ])
+
+      MATHML_ELEMENTS = Set.new([
+                                  "annotation",
+                                  "annotation-xml",
+                                  "maction",
+                                  "math",
+                                  "merror",
+                                  "mfenced",
+                                  "mfrac",
+                                  "mi",
+                                  "mmultiscripts",
+                                  "mn",
+                                  "mo",
+                                  "mover",
+                                  "mpadded",
+                                  "mphantom",
+                                  "mprescripts",
+                                  "mroot",
+                                  "mrow",
+                                  "mspace",
+                                  "msqrt",
+                                  "mstyle",
+                                  "msub",
+                                  "msubsup",
+                                  "msup",
+                                  "mtable",
+                                  "mtd",
+                                  "mtext",
+                                  "mtr",
+                                  "munder",
+                                  "munderover",
+                                  "none",
+                                  "semantics",
+                                ])
+
+      SVG_ELEMENTS = Set.new([
+                               "a",
+                               "animate",
+                               "animateColor",
+                               "animateMotion",
+                               "animateTransform",
+                               "circle",
+                               "clipPath",
+                               "defs",
+                               "desc",
+                               "ellipse",
+                               "feGaussianBlur",
+                               "filter",
+                               "font-face",
+                               "font-face-name",
+                               "font-face-src",
+                               "foreignObject",
+                               "g",
+                               "glyph",
+                               "hkern",
+                               "line",
+                               "linearGradient",
+                               "marker",
+                               "mask",
+                               "metadata",
+                               "missing-glyph",
+                               "mpath",
+                               "path",
+                               "polygon",
+                               "polyline",
+                               "radialGradient",
+                               "rect",
+                               "set",
+                               "stop",
+                               "svg",
+                               "switch",
+                               "symbol",
+                               "text",
+                               "textPath",
+                               "title",
+                               "tspan",
+                               "use",
+                             ])
+
+      ACCEPTABLE_ATTRIBUTES = Set.new([
+                                        "abbr",
+                                        "accept",
+                                        "accept-charset",
+                                        "accesskey",
+                                        "action",
+                                        "align",
+                                        "alt",
+                                        "axis",
+                                        "border",
+                                        "cellpadding",
+                                        "cellspacing",
+                                        "char",
+                                        "charoff",
+                                        "charset",
+                                        "checked",
+                                        "cite",
+                                        "class",
+                                        "clear",
+                                        "color",
+                                        "cols",
+                                        "colspan",
+                                        "compact",
+                                        "contenteditable",
+                                        "coords",
+                                        "datetime",
+                                        "dir",
+                                        "disabled",
+                                        "enctype",
+                                        "for",
+                                        "frame",
+                                        "headers",
+                                        "height",
+                                        "href",
+                                        "hreflang",
+                                        "hspace",
+                                        "id",
+                                        "ismap",
+                                        "label",
+                                        "lang",
+                                        "longdesc",
+                                        "loop",
+                                        "loopcount",
+                                        "loopend",
+                                        "loopstart",
+                                        "maxlength",
+                                        "media",
+                                        "method",
+                                        "multiple",
+                                        "name",
+                                        "nohref",
+                                        "noshade",
+                                        "nowrap",
+                                        "poster",
+                                        "preload",
+                                        "prompt",
+                                        "readonly",
+                                        "rel",
+                                        "rev",
+                                        "rows",
+                                        "rowspan",
+                                        "rules",
+                                        "scope",
+                                        "selected",
+                                        "shape",
+                                        "size",
+                                        "span",
+                                        "src",
+                                        "start",
+                                        "style",
+                                        "summary",
+                                        "tabindex",
+                                        "target",
+                                        "title",
+                                        "type",
+                                        "usemap",
+                                        "valign",
+                                        "value",
+                                        "vspace",
+                                        "width",
+                                        "xml:lang",
+                                      ])
+
+      MATHML_ATTRIBUTES = Set.new([
+                                    "actiontype",
+                                    "align",
+                                    "close",
+                                    "columnalign",
+                                    "columnlines",
+                                    "columnspacing",
+                                    "columnspan",
+                                    "depth",
+                                    "display",
+                                    "displaystyle",
+                                    "encoding",
+                                    "equalcolumns",
+                                    "equalrows",
+                                    "fence",
+                                    "fontstyle",
+                                    "fontweight",
+                                    "frame",
+                                    "height",
+                                    "linethickness",
+                                    "lspace",
+                                    "mathbackground",
+                                    "mathcolor",
+                                    "mathvariant",
+                                    "maxsize",
+                                    "minsize",
+                                    "open",
+                                    "other",
+                                    "rowalign",
+                                    "rowlines",
+                                    "rowspacing",
+                                    "rowspan",
+                                    "rspace",
+                                    "scriptlevel",
+                                    "selection",
+                                    "separator",
+                                    "separators",
+                                    "stretchy",
+                                    "width",
+                                    "xlink:href",
+                                    "xlink:show",
+                                    "xlink:type",
+                                    "xmlns",
+                                    "xmlns:xlink",
+                                  ])
+
+      SVG_ATTRIBUTES = Set.new([
+                                 "accent-height",
+                                 "accumulate",
+                                 "additive",
+                                 "alphabetic",
+                                 "arabic-form",
+                                 "ascent",
+                                 "attributeName",
+                                 "attributeType",
+                                 "baseProfile",
+                                 "bbox",
+                                 "begin",
+                                 "by",
+                                 "calcMode",
+                                 "cap-height",
+                                 "class",
+                                 "clip-path",
+                                 "clip-rule",
+                                 "color",
+                                 "color-interpolation-filters",
+                                 "color-rendering",
+                                 "content",
+                                 "cx",
+                                 "cy",
+                                 "d",
+                                 "descent",
+                                 "display",
+                                 "dur",
+                                 "dx",
+                                 "dy",
+                                 "end",
+                                 "fill",
+                                 "fill-opacity",
+                                 "fill-rule",
+                                 "filterRes",
+                                 "filterUnits",
+                                 "font-family",
+                                 "font-size",
+                                 "font-stretch",
+                                 "font-style",
+                                 "font-variant",
+                                 "font-weight",
+                                 "fx",
+                                 "fy",
+                                 "g1",
+                                 "g2",
+                                 "glyph-name",
+                                 "gradientUnits",
+                                 "hanging",
+                                 "height",
+                                 "horiz-adv-x",
+                                 "horiz-origin-x",
+                                 "id",
+                                 "ideographic",
+                                 "k",
+                                 "keyPoints",
+                                 "keySplines",
+                                 "keyTimes",
+                                 "lang",
+                                 "marker-end",
+                                 "marker-mid",
+                                 "marker-start",
+                                 "markerHeight",
+                                 "markerUnits",
+                                 "markerWidth",
+                                 "maskContentUnits",
+                                 "maskUnits",
+                                 "mathematical",
+                                 "max",
+                                 "method",
+                                 "min",
+                                 "name",
+                                 "offset",
+                                 "opacity",
+                                 "orient",
+                                 "origin",
+                                 "overline-position",
+                                 "overline-thickness",
+                                 "panose-1",
+                                 "path",
+                                 "pathLength",
+                                 "patternContentUnits",
+                                 "patternTransform",
+                                 "patternUnits",
+                                 "points",
+                                 "preserveAspectRatio",
+                                 "primitiveUnits",
+                                 "r",
+                                 "refX",
+                                 "refY",
+                                 "repeatCount",
+                                 "repeatDur",
+                                 "requiredExtensions",
+                                 "requiredFeatures",
+                                 "restart",
+                                 "rotate",
+                                 "rx",
+                                 "ry",
+                                 "slope",
+                                 "spacing",
+                                 "startOffset",
+                                 "stdDeviation",
+                                 "stemh",
+                                 "stemv",
+                                 "stop-color",
+                                 "stop-opacity",
+                                 "strikethrough-position",
+                                 "strikethrough-thickness",
+                                 "stroke",
+                                 "stroke-dasharray",
+                                 "stroke-dashoffset",
+                                 "stroke-linecap",
+                                 "stroke-linejoin",
+                                 "stroke-miterlimit",
+                                 "stroke-opacity",
+                                 "stroke-width",
+                                 "systemLanguage",
+                                 "target",
+                                 "text-anchor",
+                                 "to",
+                                 "transform",
+                                 "type",
+                                 "u1",
+                                 "u2",
+                                 "underline-position",
+                                 "underline-thickness",
+                                 "unicode",
+                                 "unicode-range",
+                                 "units-per-em",
+                                 "values",
+                                 "version",
+                                 "viewBox",
+                                 "visibility",
+                                 "width",
+                                 "widths",
+                                 "x",
+                                 "x-height",
+                                 "x1",
+                                 "x2",
+                                 "xlink:actuate",
+                                 "xlink:arcrole",
+                                 "xlink:href",
+                                 "xlink:role",
+                                 "xlink:show",
+                                 "xlink:title",
+                                 "xlink:type",
+                                 "xml:base",
+                                 "xml:lang",
+                                 "xml:space",
+                                 "xmlns",
+                                 "xmlns:xlink",
+                                 "y",
+                                 "y1",
+                                 "y2",
+                                 "zoomAndPan",
+                               ])
+
+      ATTR_VAL_IS_URI = Set.new([
+                                  "action",
+                                  "cite",
+                                  "href",
+                                  "longdesc",
+                                  "poster",
+                                  "preload",
+                                  "src",
+                                  "xlink:href",
+                                  "xml:base",
+                                ])
+
+      SVG_ATTR_VAL_ALLOWS_REF = Set.new([
+                                          "clip-path",
+                                          "color-profile",
+                                          "cursor",
+                                          "fill",
+                                          "filter",
+                                          "marker",
+                                          "marker-end",
+                                          "marker-mid",
+                                          "marker-start",
+                                          "mask",
+                                          "stroke",
+                                        ])
+
+      SVG_ALLOW_LOCAL_HREF = Set.new([
+                                       "altGlyph",
+                                       "animate",
+                                       "animateColor",
+                                       "animateMotion",
+                                       "animateTransform",
+                                       "cursor",
+                                       "feImage",
+                                       "filter",
+                                       "linearGradient",
+                                       "pattern",
+                                       "radialGradient",
+                                       "set",
+                                       "textpath",
+                                       "tref",
+                                       "use",
+                                     ])
+
+      ACCEPTABLE_CSS_PROPERTIES = Set.new([
+                                            "azimuth",
+                                            "background-color",
+                                            "border-bottom-color",
+                                            "border-collapse",
+                                            "border-color",
+                                            "border-left-color",
+                                            "border-right-color",
+                                            "border-top-color",
+                                            "clear",
+                                            "color",
+                                            "cursor",
+                                            "direction",
+                                            "display",
+                                            "elevation",
+                                            "float",
+                                            "font",
+                                            "font-family",
+                                            "font-size",
+                                            "font-style",
+                                            "font-variant",
+                                            "font-weight",
+                                            "height",
+                                            "letter-spacing",
+                                            "line-height",
+                                            "list-style",
+                                            "list-style-type",
+                                            "overflow",
+                                            "pause",
+                                            "pause-after",
+                                            "pause-before",
+                                            "pitch",
+                                            "pitch-range",
+                                            "richness",
+                                            "speak",
+                                            "speak-header",
+                                            "speak-numeral",
+                                            "speak-punctuation",
+                                            "speech-rate",
+                                            "stress",
+                                            "text-align",
+                                            "text-decoration",
+                                            "text-indent",
+                                            "unicode-bidi",
+                                            "vertical-align",
+                                            "voice-family",
+                                            "volume",
+                                            "white-space",
+                                            "width",
+                                          ])
+
+      ACCEPTABLE_CSS_KEYWORDS = Set.new([
+                                          "!important",
+                                          "aqua",
+                                          "auto",
+                                          "black",
+                                          "block",
+                                          "blue",
+                                          "bold",
+                                          "both",
+                                          "bottom",
+                                          "brown",
+                                          "center",
+                                          "collapse",
+                                          "dashed",
+                                          "dotted",
+                                          "fuchsia",
+                                          "gray",
+                                          "green",
+                                          "italic",
+                                          "left",
+                                          "lime",
+                                          "maroon",
+                                          "medium",
+                                          "navy",
+                                          "none",
+                                          "normal",
+                                          "nowrap",
+                                          "olive",
+                                          "pointer",
+                                          "purple",
+                                          "red",
+                                          "right",
+                                          "silver",
+                                          "solid",
+                                          "teal",
+                                          "thin",
+                                          "thick",
+                                          "top",
+                                          "transparent",
+                                          "underline",
+                                          "white",
+                                          "yellow",
+                                        ])
+
+      # see https://www.quackit.com/css/functions/
+      # omit `url` and `image` from that list
+      ACCEPTABLE_CSS_FUNCTIONS = Set.new([
+                                           "attr",
+                                           "blur",
+                                           "brightness",
+                                           "calc",
+                                           "circle",
+                                           "contrast",
+                                           "counter",
+                                           "counters",
+                                           "cubic-bezier",
+                                           "drop-shadow",
+                                           "ellipse",
+                                           "grayscale",
+                                           "hsl",
+                                           "hsla",
+                                           "hue-rotate",
+                                           "hwb",
+                                           "inset",
+                                           "invert",
+                                           "linear-gradient",
+                                           "matrix",
+                                           "matrix3d",
+                                           "opacity",
+                                           "perspective",
+                                           "polygon",
+                                           "radial-gradient",
+                                           "repeating-linear-gradient",
+                                           "repeating-radial-gradient",
+                                           "rgb",
+                                           "rgba",
+                                           "rotate",
+                                           "rotate3d",
+                                           "rotateX",
+                                           "rotateY",
+                                           "rotateZ",
+                                           "saturate",
+                                           "sepia",
+                                           "scale",
+                                           "scale3d",
+                                           "scaleX",
+                                           "scaleY",
+                                           "scaleZ",
+                                           "skew",
+                                           "skewX",
+                                           "skewY",
+                                           "symbols",
+                                           "translate",
+                                           "translate3d",
+                                           "translateX",
+                                           "translateY",
+                                           "translateZ",
+                                         ])
+
+      SHORTHAND_CSS_PROPERTIES = Set.new([
+                                           "background",
+                                           "border",
+                                           "margin",
+                                           "padding",
+                                         ])
+
+      ACCEPTABLE_SVG_PROPERTIES = Set.new([
+                                            "fill",
+                                            "fill-opacity",
+                                            "fill-rule",
+                                            "stroke",
+                                            "stroke-width",
+                                            "stroke-linecap",
+                                            "stroke-linejoin",
+                                            "stroke-opacity",
+                                          ])
+
+      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i
+
+      ACCEPTABLE_PROTOCOLS = Set.new([
+                                       "afs",
+                                       "aim",
+                                       "callto",
+                                       "data",
+                                       "ed2k",
+                                       "feed",
+                                       "ftp",
+                                       "gopher",
+                                       "http",
+                                       "https",
+                                       "irc",
+                                       "line",
+                                       "mailto",
+                                       "news",
+                                       "nntp",
+                                       "rsync",
+                                       "rtsp",
+                                       "sftp",
+                                       "ssh",
+                                       "tag",
+                                       "tel",
+                                       "telnet",
+                                       "urn",
+                                       "webcal",
+                                       "xmpp",
+                                     ])
+
+      ACCEPTABLE_URI_DATA_MEDIATYPES = Set.new([
+                                                 "image/gif",
+                                                 "image/jpeg",
+                                                 "image/png",
+                                                 "image/svg+xml",
+                                                 "text/css",
+                                                 "text/plain",
+                                               ])
+
+      # subclasses may define their own versions of these constants
+      ALLOWED_ELEMENTS = ACCEPTABLE_ELEMENTS + MATHML_ELEMENTS + SVG_ELEMENTS
+      ALLOWED_ATTRIBUTES = ACCEPTABLE_ATTRIBUTES + MATHML_ATTRIBUTES + SVG_ATTRIBUTES
+      ALLOWED_CSS_PROPERTIES = ACCEPTABLE_CSS_PROPERTIES
+      ALLOWED_CSS_KEYWORDS = ACCEPTABLE_CSS_KEYWORDS
+      ALLOWED_CSS_FUNCTIONS = ACCEPTABLE_CSS_FUNCTIONS
+      ALLOWED_SVG_PROPERTIES = ACCEPTABLE_SVG_PROPERTIES
+      ALLOWED_PROTOCOLS = ACCEPTABLE_PROTOCOLS
+      ALLOWED_URI_DATA_MEDIATYPES = ACCEPTABLE_URI_DATA_MEDIATYPES
+
+      VOID_ELEMENTS = Set.new([
+                                "area",
+                                "base",
+                                "br",
+                                "col",
+                                "embed",
+                                "hr",
+                                "img",
+                                "input",
+                                "link",
+                                "meta",
+                                "param",
+                              ])
+
+      # additional tags we should consider safe since we have libxml2 fixing up our documents.
+      TAGS_SAFE_WITH_LIBXML2 = Set.new([
+                                         "body",
+                                         "head",
+                                         "html",
+                                       ])
+      ALLOWED_ELEMENTS_WITH_LIBXML2 = ALLOWED_ELEMENTS + TAGS_SAFE_WITH_LIBXML2
+    end
+
+    WhiteList = SafeList
+    if Object.respond_to?(:deprecate_constant)
+      deprecate_constant :WhiteList
+    end
+
+    ::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants ::Loofah::HTML5::SafeList
+  end
+end