@appbaseio/reactivesearch-vue 3.3.4 → 3.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/@appbaseio/reactivesearch-vue.umd.js +242 -217
- package/dist/@appbaseio/reactivesearch-vue.umd.js.map +1 -1
- package/dist/@appbaseio/reactivesearch-vue.umd.min.js +5 -5
- package/dist/@appbaseio/reactivesearch-vue.umd.min.js.map +1 -1
- package/dist/cjs/{DropDown-815d458e.js → DropDown-7ee915d1.js} +1 -1
- package/dist/cjs/DynamicRangeSlider.js +1 -1
- package/dist/cjs/MultiDropdownList.js +2 -2
- package/dist/cjs/MultiList.js +1 -1
- package/dist/cjs/MultiRange.js +1 -1
- package/dist/cjs/{Pagination-accd2fbf.js → Pagination-8bda127c.js} +1 -1
- package/dist/cjs/RangeInput.js +1 -1
- package/dist/cjs/RangeSlider.js +1 -1
- package/dist/cjs/ReactiveBase.js +1 -1
- package/dist/cjs/ReactiveComponent.js +1 -1
- package/dist/cjs/ReactiveGoogleMap.js +4 -4
- package/dist/cjs/ReactiveList.js +2 -2
- package/dist/cjs/ResultCard.js +1 -1
- package/dist/cjs/ResultList.js +1 -1
- package/dist/cjs/{SearchBox-376d32c4.js → SearchBox-17eeed1a.js} +1 -1
- package/dist/cjs/SearchBox.js +2 -2
- package/dist/cjs/SelectedFilters.js +1 -1
- package/dist/cjs/SingleDropdownList.js +2 -2
- package/dist/cjs/SingleList.js +1 -1
- package/dist/cjs/SingleRange.js +1 -1
- package/dist/cjs/ToggleButton.js +1 -1
- package/dist/cjs/index.js +5 -5
- package/dist/cjs/{install-b9ecb6e6.js → install-3b410ce1.js} +3 -15
- package/dist/cjs/install.js +5 -5
- package/dist/cjs/version.js +1 -1
- package/dist/cjs/{vueTypes-289a891a.js → vueTypes-adf43075.js} +16 -4
- package/dist/es/{DropDown-f8049812.js → DropDown-0a5b7036.js} +1 -1
- package/dist/es/DynamicRangeSlider.js +1 -1
- package/dist/es/MultiDropdownList.js +2 -2
- package/dist/es/MultiList.js +1 -1
- package/dist/es/MultiRange.js +1 -1
- package/dist/es/{Pagination-b2160aac.js → Pagination-80244481.js} +1 -1
- package/dist/es/RangeInput.js +1 -1
- package/dist/es/RangeSlider.js +1 -1
- package/dist/es/ReactiveBase.js +1 -1
- package/dist/es/ReactiveComponent.js +1 -1
- package/dist/es/ReactiveGoogleMap.js +4 -4
- package/dist/es/ReactiveList.js +2 -2
- package/dist/es/ResultCard.js +1 -1
- package/dist/es/ResultList.js +1 -1
- package/dist/es/{SearchBox-fbe24e59.js → SearchBox-e655a9ad.js} +1 -1
- package/dist/es/SearchBox.js +2 -2
- package/dist/es/SelectedFilters.js +1 -1
- package/dist/es/SingleDropdownList.js +2 -2
- package/dist/es/SingleList.js +1 -1
- package/dist/es/SingleRange.js +1 -1
- package/dist/es/ToggleButton.js +1 -1
- package/dist/es/index.js +6 -6
- package/dist/es/{install-d73241e0.js → install-cb0ab348.js} +3 -15
- package/dist/es/install.js +5 -5
- package/dist/es/version.js +1 -1
- package/dist/es/{vueTypes-f503e267.js → vueTypes-5d575822.js} +16 -4
- package/package.json +1 -1
|
@@ -12516,7 +12516,10 @@
|
|
|
12516
12516
|
var types = {
|
|
12517
12517
|
any: Q.any,
|
|
12518
12518
|
bool: Q.bool,
|
|
12519
|
-
boolRequired:
|
|
12519
|
+
boolRequired: {
|
|
12520
|
+
type: Boolean,
|
|
12521
|
+
required: true
|
|
12522
|
+
},
|
|
12520
12523
|
components: Q.arrayOf(Q.string),
|
|
12521
12524
|
compoundClause: Q.oneOf(['filter', 'must']),
|
|
12522
12525
|
children: Q.any,
|
|
@@ -12532,7 +12535,10 @@
|
|
|
12532
12535
|
excludeFields: Q.arrayOf(Q.string),
|
|
12533
12536
|
fieldWeights: Q.arrayOf(Q.number),
|
|
12534
12537
|
filterLabel: Q.string,
|
|
12535
|
-
func:
|
|
12538
|
+
func: {
|
|
12539
|
+
type: Function,
|
|
12540
|
+
required: false
|
|
12541
|
+
},
|
|
12536
12542
|
funcRequired: Q.func.isRequired,
|
|
12537
12543
|
fuzziness: Q.oneOf([0, 1, 2, 'AUTO']),
|
|
12538
12544
|
headers: Q.object,
|
|
@@ -12568,8 +12574,14 @@
|
|
|
12568
12574
|
})),
|
|
12569
12575
|
sortByWithCount: Q.oneOf(['asc', 'desc', 'count']),
|
|
12570
12576
|
stats: Q.arrayOf(Q.object),
|
|
12571
|
-
string:
|
|
12572
|
-
|
|
12577
|
+
string: {
|
|
12578
|
+
type: String,
|
|
12579
|
+
required: false
|
|
12580
|
+
},
|
|
12581
|
+
stringArray: {
|
|
12582
|
+
type: [String],
|
|
12583
|
+
required: false
|
|
12584
|
+
},
|
|
12573
12585
|
stringOrArray: Q.oneOfType([Q.string, Q.arrayOf(Q.string)]),
|
|
12574
12586
|
stringRequired: Q.string.isRequired,
|
|
12575
12587
|
style: Q.object,
|
|
@@ -17678,7 +17690,7 @@
|
|
|
17678
17690
|
};
|
|
17679
17691
|
|
|
17680
17692
|
/**!
|
|
17681
|
-
* hotkeys-js v3.13.
|
|
17693
|
+
* hotkeys-js v3.13.3
|
|
17682
17694
|
* A simple micro-library for defining and dispatching keyboard shortcuts. It has no dependencies.
|
|
17683
17695
|
*
|
|
17684
17696
|
* Copyright (c) 2023 kenny wong <wowohoo@qq.com>
|
|
@@ -18276,7 +18288,7 @@
|
|
|
18276
18288
|
}
|
|
18277
18289
|
|
|
18278
18290
|
var purify = createCommonjsModule(function (module, exports) {
|
|
18279
|
-
/*! @license DOMPurify 3.0.
|
|
18291
|
+
/*! @license DOMPurify 3.0.8 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.8/LICENSE */
|
|
18280
18292
|
|
|
18281
18293
|
(function (global, factory) {
|
|
18282
18294
|
module.exports = factory() ;
|
|
@@ -18290,7 +18302,6 @@
|
|
|
18290
18302
|
var freeze = Object.freeze,
|
|
18291
18303
|
seal = Object.seal,
|
|
18292
18304
|
create = Object.create; // eslint-disable-line import/no-mutable-exports
|
|
18293
|
-
|
|
18294
18305
|
var _ref = typeof Reflect !== 'undefined' && Reflect,
|
|
18295
18306
|
apply = _ref.apply,
|
|
18296
18307
|
construct = _ref.construct;
|
|
@@ -18325,13 +18336,13 @@
|
|
|
18325
18336
|
var stringTrim = unapply(String.prototype.trim);
|
|
18326
18337
|
var regExpTest = unapply(RegExp.prototype.test);
|
|
18327
18338
|
var typeErrorCreate = unconstruct(TypeError);
|
|
18339
|
+
|
|
18328
18340
|
/**
|
|
18329
18341
|
* Creates a new function that calls the given function with a specified thisArg and arguments.
|
|
18330
18342
|
*
|
|
18331
18343
|
* @param {Function} func - The function to be wrapped and called.
|
|
18332
18344
|
* @returns {Function} A new function that calls the given function with a specified thisArg and arguments.
|
|
18333
18345
|
*/
|
|
18334
|
-
|
|
18335
18346
|
function unapply(func) {
|
|
18336
18347
|
return function (thisArg) {
|
|
18337
18348
|
for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
|
|
@@ -18340,13 +18351,13 @@
|
|
|
18340
18351
|
return apply(func, thisArg, args);
|
|
18341
18352
|
};
|
|
18342
18353
|
}
|
|
18354
|
+
|
|
18343
18355
|
/**
|
|
18344
18356
|
* Creates a new function that constructs an instance of the given constructor function with the provided arguments.
|
|
18345
18357
|
*
|
|
18346
18358
|
* @param {Function} func - The constructor function to be wrapped and called.
|
|
18347
18359
|
* @returns {Function} A new function that constructs an instance of the given constructor function with the provided arguments.
|
|
18348
18360
|
*/
|
|
18349
|
-
|
|
18350
18361
|
function unconstruct(func) {
|
|
18351
18362
|
return function () {
|
|
18352
18363
|
for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
|
|
@@ -18355,6 +18366,7 @@
|
|
|
18355
18366
|
return construct(func, args);
|
|
18356
18367
|
};
|
|
18357
18368
|
}
|
|
18369
|
+
|
|
18358
18370
|
/**
|
|
18359
18371
|
* Add properties to a lookup table
|
|
18360
18372
|
*
|
|
@@ -18363,7 +18375,6 @@
|
|
|
18363
18375
|
* @param {Function} transformCaseFunc - An optional function to transform the case of each element before adding to the set.
|
|
18364
18376
|
* @returns {Object} The modified set with added elements.
|
|
18365
18377
|
*/
|
|
18366
|
-
|
|
18367
18378
|
function addToSet(set, array) {
|
|
18368
18379
|
var transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
|
|
18369
18380
|
if (setPrototypeOf) {
|
|
@@ -18389,13 +18400,28 @@
|
|
|
18389
18400
|
}
|
|
18390
18401
|
return set;
|
|
18391
18402
|
}
|
|
18403
|
+
|
|
18404
|
+
/**
|
|
18405
|
+
* Clean up an array to harden against CSPP
|
|
18406
|
+
*
|
|
18407
|
+
* @param {Array} array - The array to be cleaned.
|
|
18408
|
+
* @returns {Array} The cleaned version of the array
|
|
18409
|
+
*/
|
|
18410
|
+
function cleanArray(array) {
|
|
18411
|
+
for (var index = 0; index < array.length; index++) {
|
|
18412
|
+
if (getOwnPropertyDescriptor(array, index) === undefined) {
|
|
18413
|
+
array[index] = null;
|
|
18414
|
+
}
|
|
18415
|
+
}
|
|
18416
|
+
return array;
|
|
18417
|
+
}
|
|
18418
|
+
|
|
18392
18419
|
/**
|
|
18393
18420
|
* Shallow clone an object
|
|
18394
18421
|
*
|
|
18395
18422
|
* @param {Object} object - The object to be cloned.
|
|
18396
18423
|
* @returns {Object} A new object that copies the original.
|
|
18397
18424
|
*/
|
|
18398
|
-
|
|
18399
18425
|
function clone(object) {
|
|
18400
18426
|
var newObject = create(null);
|
|
18401
18427
|
for (var _iterator = _createForOfIteratorHelperLoose(entries(object)), _step; !(_step = _iterator()).done;) {
|
|
@@ -18403,11 +18429,18 @@
|
|
|
18403
18429
|
property = _step$value[0],
|
|
18404
18430
|
value = _step$value[1];
|
|
18405
18431
|
if (getOwnPropertyDescriptor(object, property) !== undefined) {
|
|
18406
|
-
|
|
18432
|
+
if (Array.isArray(value)) {
|
|
18433
|
+
newObject[property] = cleanArray(value);
|
|
18434
|
+
} else if (value && typeof value === 'object' && value.constructor === Object) {
|
|
18435
|
+
newObject[property] = clone(value);
|
|
18436
|
+
} else {
|
|
18437
|
+
newObject[property] = value;
|
|
18438
|
+
}
|
|
18407
18439
|
}
|
|
18408
18440
|
}
|
|
18409
18441
|
return newObject;
|
|
18410
18442
|
}
|
|
18443
|
+
|
|
18411
18444
|
/**
|
|
18412
18445
|
* This method automatically checks if the prop is function or getter and behaves accordingly.
|
|
18413
18446
|
*
|
|
@@ -18415,7 +18448,6 @@
|
|
|
18415
18448
|
* @param {String} prop - The property name for which to find the getter function.
|
|
18416
18449
|
* @returns {Function} The getter function found in the prototype chain or a fallback function.
|
|
18417
18450
|
*/
|
|
18418
|
-
|
|
18419
18451
|
function lookupGetter(object, prop) {
|
|
18420
18452
|
while (object !== null) {
|
|
18421
18453
|
var desc = getOwnPropertyDescriptor(object, prop);
|
|
@@ -18435,32 +18467,34 @@
|
|
|
18435
18467
|
}
|
|
18436
18468
|
return fallbackValue;
|
|
18437
18469
|
}
|
|
18438
|
-
var html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
18470
|
+
var html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
18439
18471
|
|
|
18472
|
+
// SVG
|
|
18440
18473
|
var svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
|
|
18441
|
-
var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
18474
|
+
var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
18475
|
+
|
|
18476
|
+
// List of SVG elements that are disallowed by default.
|
|
18442
18477
|
// We still need to know them so that we can do namespace
|
|
18443
18478
|
// checks properly in case one wants to add them to
|
|
18444
18479
|
// allow-list.
|
|
18445
|
-
|
|
18446
18480
|
var svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
|
|
18447
|
-
var mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
18448
|
-
// even those that we disallow by default.
|
|
18481
|
+
var mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
18449
18482
|
|
|
18483
|
+
// Similarly to SVG, we want to know all MathML elements,
|
|
18484
|
+
// even those that we disallow by default.
|
|
18450
18485
|
var mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
|
|
18451
18486
|
var text = freeze(['#text']);
|
|
18452
18487
|
var html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
|
|
18453
18488
|
var svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
|
|
18454
18489
|
var mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
|
|
18455
18490
|
var xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
|
|
18456
|
-
var MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
|
|
18457
18491
|
|
|
18492
|
+
// eslint-disable-next-line unicorn/better-regex
|
|
18493
|
+
var MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
|
|
18458
18494
|
var ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
18459
18495
|
var TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
|
|
18460
18496
|
var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
|
|
18461
|
-
|
|
18462
18497
|
var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
|
|
18463
|
-
|
|
18464
18498
|
var IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
|
|
18465
18499
|
);
|
|
18466
18500
|
var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
|
|
@@ -18482,22 +18516,23 @@
|
|
|
18482
18516
|
var getGlobal = function getGlobal() {
|
|
18483
18517
|
return typeof window === 'undefined' ? null : window;
|
|
18484
18518
|
};
|
|
18519
|
+
|
|
18485
18520
|
/**
|
|
18486
18521
|
* Creates a no-op policy for internal use only.
|
|
18487
18522
|
* Don't export this function outside this module!
|
|
18488
|
-
* @param {
|
|
18523
|
+
* @param {TrustedTypePolicyFactory} trustedTypes The policy factory.
|
|
18489
18524
|
* @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
|
|
18490
|
-
* @return {
|
|
18525
|
+
* @return {TrustedTypePolicy} The policy created (or null, if Trusted Types
|
|
18491
18526
|
* are not supported or creating the policy failed).
|
|
18492
18527
|
*/
|
|
18493
|
-
|
|
18494
18528
|
var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
|
|
18495
18529
|
if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
|
|
18496
18530
|
return null;
|
|
18497
|
-
}
|
|
18531
|
+
}
|
|
18532
|
+
|
|
18533
|
+
// Allow the callers to control the unique policy name
|
|
18498
18534
|
// by adding a data-tt-policy-suffix to the script element with the DOMPurify.
|
|
18499
18535
|
// Policy creation with duplicate names throws in Trusted Types.
|
|
18500
|
-
|
|
18501
18536
|
var suffix = null;
|
|
18502
18537
|
var ATTR_NAME = 'data-tt-policy-suffix';
|
|
18503
18538
|
if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
|
|
@@ -18526,17 +18561,17 @@
|
|
|
18526
18561
|
var DOMPurify = function DOMPurify(root) {
|
|
18527
18562
|
return createDOMPurify(root);
|
|
18528
18563
|
};
|
|
18564
|
+
|
|
18529
18565
|
/**
|
|
18530
18566
|
* Version label, exposed for easier checks
|
|
18531
18567
|
* if DOMPurify is up to date or not
|
|
18532
18568
|
*/
|
|
18569
|
+
DOMPurify.version = '3.0.8';
|
|
18533
18570
|
|
|
18534
|
-
DOMPurify.version = '3.0.6';
|
|
18535
18571
|
/**
|
|
18536
18572
|
* Array of elements that DOMPurify removed during sanitation.
|
|
18537
18573
|
* Empty if nothing was removed.
|
|
18538
18574
|
*/
|
|
18539
|
-
|
|
18540
18575
|
DOMPurify.removed = [];
|
|
18541
18576
|
if (!window || !window.document || window.document.nodeType !== 9) {
|
|
18542
18577
|
// Not running in a browser, provide a factory function
|
|
@@ -18561,13 +18596,14 @@
|
|
|
18561
18596
|
var cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
|
|
18562
18597
|
var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
|
|
18563
18598
|
var getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
|
|
18564
|
-
var getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
18599
|
+
var getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
18600
|
+
|
|
18601
|
+
// As per issue #47, the web-components registry is inherited by a
|
|
18565
18602
|
// new document created via createHTMLDocument. As per the spec
|
|
18566
18603
|
// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
|
|
18567
18604
|
// a new empty registry is used when creating a template contents owner
|
|
18568
18605
|
// document, so we use that as our parent document to ensure nothing
|
|
18569
18606
|
// is inherited.
|
|
18570
|
-
|
|
18571
18607
|
if (typeof HTMLTemplateElement === 'function') {
|
|
18572
18608
|
var template = document.createElement('template');
|
|
18573
18609
|
if (template.content && template.content.ownerDocument) {
|
|
@@ -18583,10 +18619,10 @@
|
|
|
18583
18619
|
getElementsByTagName = _document.getElementsByTagName;
|
|
18584
18620
|
var importNode = originalDocument.importNode;
|
|
18585
18621
|
var hooks = {};
|
|
18622
|
+
|
|
18586
18623
|
/**
|
|
18587
18624
|
* Expose whether this browser supports running the full DOMPurify.
|
|
18588
18625
|
*/
|
|
18589
|
-
|
|
18590
18626
|
DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
|
|
18591
18627
|
var MUSTACHE_EXPR = EXPRESSIONS.MUSTACHE_EXPR,
|
|
18592
18628
|
ERB_EXPR = EXPRESSIONS.ERB_EXPR,
|
|
@@ -18596,26 +18632,26 @@
|
|
|
18596
18632
|
IS_SCRIPT_OR_DATA = EXPRESSIONS.IS_SCRIPT_OR_DATA,
|
|
18597
18633
|
ATTR_WHITESPACE = EXPRESSIONS.ATTR_WHITESPACE;
|
|
18598
18634
|
var IS_ALLOWED_URI$1 = EXPRESSIONS.IS_ALLOWED_URI;
|
|
18635
|
+
|
|
18599
18636
|
/**
|
|
18600
18637
|
* We consider the elements and attributes below to be safe. Ideally
|
|
18601
18638
|
* don't add any new ones but feel free to remove unwanted ones.
|
|
18602
18639
|
*/
|
|
18603
18640
|
|
|
18604
18641
|
/* allowed element names */
|
|
18605
|
-
|
|
18606
18642
|
var ALLOWED_TAGS = null;
|
|
18607
18643
|
var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(html$1, svg$1, svgFilters, mathMl$1, text));
|
|
18608
|
-
/* Allowed attribute names */
|
|
18609
18644
|
|
|
18645
|
+
/* Allowed attribute names */
|
|
18610
18646
|
var ALLOWED_ATTR = null;
|
|
18611
18647
|
var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(html, svg, mathMl, xml));
|
|
18648
|
+
|
|
18612
18649
|
/*
|
|
18613
18650
|
* Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
|
|
18614
18651
|
* @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
|
|
18615
18652
|
* @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
|
|
18616
18653
|
* @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
|
|
18617
18654
|
*/
|
|
18618
|
-
|
|
18619
18655
|
var CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
18620
18656
|
tagNameCheck: {
|
|
18621
18657
|
writable: true,
|
|
@@ -18636,59 +18672,60 @@
|
|
|
18636
18672
|
value: false
|
|
18637
18673
|
}
|
|
18638
18674
|
}));
|
|
18639
|
-
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
|
|
18640
18675
|
|
|
18676
|
+
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
|
|
18641
18677
|
var FORBID_TAGS = null;
|
|
18642
|
-
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
|
|
18643
18678
|
|
|
18679
|
+
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
|
|
18644
18680
|
var FORBID_ATTR = null;
|
|
18645
|
-
/* Decide if ARIA attributes are okay */
|
|
18646
18681
|
|
|
18682
|
+
/* Decide if ARIA attributes are okay */
|
|
18647
18683
|
var ALLOW_ARIA_ATTR = true;
|
|
18648
|
-
/* Decide if custom data attributes are okay */
|
|
18649
18684
|
|
|
18685
|
+
/* Decide if custom data attributes are okay */
|
|
18650
18686
|
var ALLOW_DATA_ATTR = true;
|
|
18651
|
-
/* Decide if unknown protocols are okay */
|
|
18652
18687
|
|
|
18688
|
+
/* Decide if unknown protocols are okay */
|
|
18653
18689
|
var ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
18690
|
+
|
|
18654
18691
|
/* Decide if self-closing tags in attributes are allowed.
|
|
18655
18692
|
* Usually removed due to a mXSS issue in jQuery 3.0 */
|
|
18656
|
-
|
|
18657
18693
|
var ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
18694
|
+
|
|
18658
18695
|
/* Output should be safe for common template engines.
|
|
18659
18696
|
* This means, DOMPurify removes data attributes, mustaches and ERB
|
|
18660
18697
|
*/
|
|
18661
|
-
|
|
18662
18698
|
var SAFE_FOR_TEMPLATES = false;
|
|
18663
|
-
/* Decide if document with <html>... should be returned */
|
|
18664
18699
|
|
|
18700
|
+
/* Decide if document with <html>... should be returned */
|
|
18665
18701
|
var WHOLE_DOCUMENT = false;
|
|
18666
|
-
/* Track whether config is already set on this instance of DOMPurify. */
|
|
18667
18702
|
|
|
18703
|
+
/* Track whether config is already set on this instance of DOMPurify. */
|
|
18668
18704
|
var SET_CONFIG = false;
|
|
18705
|
+
|
|
18669
18706
|
/* Decide if all elements (e.g. style, script) must be children of
|
|
18670
18707
|
* document.body. By default, browsers might move them to document.head */
|
|
18671
|
-
|
|
18672
18708
|
var FORCE_BODY = false;
|
|
18709
|
+
|
|
18673
18710
|
/* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
|
|
18674
18711
|
* string (or a TrustedHTML object if Trusted Types are supported).
|
|
18675
18712
|
* If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
|
|
18676
18713
|
*/
|
|
18677
|
-
|
|
18678
18714
|
var RETURN_DOM = false;
|
|
18715
|
+
|
|
18679
18716
|
/* Decide if a DOM `DocumentFragment` should be returned, instead of a html
|
|
18680
18717
|
* string (or a TrustedHTML object if Trusted Types are supported) */
|
|
18681
|
-
|
|
18682
18718
|
var RETURN_DOM_FRAGMENT = false;
|
|
18719
|
+
|
|
18683
18720
|
/* Try to return a Trusted Type object instead of a string, return a string in
|
|
18684
18721
|
* case Trusted Types are not supported */
|
|
18685
|
-
|
|
18686
18722
|
var RETURN_TRUSTED_TYPE = false;
|
|
18723
|
+
|
|
18687
18724
|
/* Output should be free from DOM clobbering attacks?
|
|
18688
18725
|
* This sanitizes markups named with colliding, clobberable built-in DOM APIs.
|
|
18689
18726
|
*/
|
|
18690
|
-
|
|
18691
18727
|
var SANITIZE_DOM = true;
|
|
18728
|
+
|
|
18692
18729
|
/* Achieve full DOM Clobbering protection by isolating the namespace of named
|
|
18693
18730
|
* properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
|
|
18694
18731
|
*
|
|
@@ -18702,86 +18739,85 @@
|
|
|
18702
18739
|
* Namespace isolation is implemented by prefixing `id` and `name` attributes
|
|
18703
18740
|
* with a constant string, i.e., `user-content-`
|
|
18704
18741
|
*/
|
|
18705
|
-
|
|
18706
18742
|
var SANITIZE_NAMED_PROPS = false;
|
|
18707
18743
|
var SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
|
|
18708
|
-
/* Keep element content when removing element? */
|
|
18709
18744
|
|
|
18745
|
+
/* Keep element content when removing element? */
|
|
18710
18746
|
var KEEP_CONTENT = true;
|
|
18747
|
+
|
|
18711
18748
|
/* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
|
|
18712
18749
|
* of importing it into a new Document and returning a sanitized copy */
|
|
18713
|
-
|
|
18714
18750
|
var IN_PLACE = false;
|
|
18715
|
-
/* Allow usage of profiles like html, svg and mathMl */
|
|
18716
18751
|
|
|
18752
|
+
/* Allow usage of profiles like html, svg and mathMl */
|
|
18717
18753
|
var USE_PROFILES = {};
|
|
18718
|
-
/* Tags to ignore content of when KEEP_CONTENT is true */
|
|
18719
18754
|
|
|
18755
|
+
/* Tags to ignore content of when KEEP_CONTENT is true */
|
|
18720
18756
|
var FORBID_CONTENTS = null;
|
|
18721
18757
|
var DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
|
|
18722
|
-
/* Tags that are safe for data: URIs */
|
|
18723
18758
|
|
|
18759
|
+
/* Tags that are safe for data: URIs */
|
|
18724
18760
|
var DATA_URI_TAGS = null;
|
|
18725
18761
|
var DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
|
|
18726
|
-
/* Attributes safe for values like "javascript:" */
|
|
18727
18762
|
|
|
18763
|
+
/* Attributes safe for values like "javascript:" */
|
|
18728
18764
|
var URI_SAFE_ATTRIBUTES = null;
|
|
18729
18765
|
var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
|
|
18730
18766
|
var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
|
|
18731
18767
|
var SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
|
|
18732
18768
|
var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
|
|
18733
18769
|
/* Document namespace */
|
|
18734
|
-
|
|
18735
18770
|
var NAMESPACE = HTML_NAMESPACE;
|
|
18736
18771
|
var IS_EMPTY_INPUT = false;
|
|
18737
|
-
/* Allowed XHTML+XML namespaces */
|
|
18738
18772
|
|
|
18773
|
+
/* Allowed XHTML+XML namespaces */
|
|
18739
18774
|
var ALLOWED_NAMESPACES = null;
|
|
18740
18775
|
var DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
|
|
18741
|
-
/* Parsing of strict XHTML documents */
|
|
18742
18776
|
|
|
18777
|
+
/* Parsing of strict XHTML documents */
|
|
18743
18778
|
var PARSER_MEDIA_TYPE = null;
|
|
18744
18779
|
var SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
|
|
18745
18780
|
var DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
|
|
18746
18781
|
var transformCaseFunc = null;
|
|
18747
|
-
/* Keep a reference to config to pass to hooks */
|
|
18748
18782
|
|
|
18783
|
+
/* Keep a reference to config to pass to hooks */
|
|
18749
18784
|
var CONFIG = null;
|
|
18750
|
-
/* Ideally, do not touch anything below this line */
|
|
18751
18785
|
|
|
18786
|
+
/* Ideally, do not touch anything below this line */
|
|
18752
18787
|
/* ______________________________________________ */
|
|
18753
18788
|
|
|
18754
18789
|
var formElement = document.createElement('form');
|
|
18755
18790
|
var isRegexOrFunction = function isRegexOrFunction(testValue) {
|
|
18756
18791
|
return testValue instanceof RegExp || testValue instanceof Function;
|
|
18757
18792
|
};
|
|
18793
|
+
|
|
18758
18794
|
/**
|
|
18759
18795
|
* _parseConfig
|
|
18760
18796
|
*
|
|
18761
18797
|
* @param {Object} cfg optional config literal
|
|
18762
18798
|
*/
|
|
18763
18799
|
// eslint-disable-next-line complexity
|
|
18764
|
-
|
|
18765
18800
|
var _parseConfig = function _parseConfig() {
|
|
18766
18801
|
var cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
18767
18802
|
if (CONFIG && CONFIG === cfg) {
|
|
18768
18803
|
return;
|
|
18769
18804
|
}
|
|
18770
|
-
/* Shield configuration object from tampering */
|
|
18771
18805
|
|
|
18806
|
+
/* Shield configuration object from tampering */
|
|
18772
18807
|
if (!cfg || typeof cfg !== 'object') {
|
|
18773
18808
|
cfg = {};
|
|
18774
18809
|
}
|
|
18775
|
-
/* Shield configuration object from prototype pollution */
|
|
18776
18810
|
|
|
18811
|
+
/* Shield configuration object from prototype pollution */
|
|
18777
18812
|
cfg = clone(cfg);
|
|
18778
18813
|
PARSER_MEDIA_TYPE =
|
|
18779
18814
|
// eslint-disable-next-line unicorn/prefer-includes
|
|
18780
|
-
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ?
|
|
18815
|
+
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
|
|
18781
18816
|
|
|
18817
|
+
// HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
|
|
18782
18818
|
transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
|
|
18783
|
-
/* Set configuration parameters */
|
|
18784
18819
|
|
|
18820
|
+
/* Set configuration parameters */
|
|
18785
18821
|
ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
|
|
18786
18822
|
ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
|
|
18787
18823
|
ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
|
|
@@ -18804,33 +18840,19 @@
|
|
|
18804
18840
|
FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
|
|
18805
18841
|
USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
|
|
18806
18842
|
ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
|
|
18807
|
-
|
|
18808
18843
|
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
|
|
18809
|
-
|
|
18810
18844
|
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
|
|
18811
|
-
|
|
18812
18845
|
ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
|
|
18813
|
-
|
|
18814
18846
|
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
|
|
18815
|
-
|
|
18816
18847
|
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
|
|
18817
|
-
|
|
18818
18848
|
RETURN_DOM = cfg.RETURN_DOM || false; // Default false
|
|
18819
|
-
|
|
18820
18849
|
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
|
|
18821
|
-
|
|
18822
18850
|
RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
|
|
18823
|
-
|
|
18824
18851
|
FORCE_BODY = cfg.FORCE_BODY || false; // Default false
|
|
18825
|
-
|
|
18826
18852
|
SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
|
|
18827
|
-
|
|
18828
18853
|
SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
|
|
18829
|
-
|
|
18830
18854
|
KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
|
|
18831
|
-
|
|
18832
18855
|
IN_PLACE = cfg.IN_PLACE || false; // Default false
|
|
18833
|
-
|
|
18834
18856
|
IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
|
|
18835
18857
|
NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
|
|
18836
18858
|
CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
|
|
@@ -18849,10 +18871,10 @@
|
|
|
18849
18871
|
if (RETURN_DOM_FRAGMENT) {
|
|
18850
18872
|
RETURN_DOM = true;
|
|
18851
18873
|
}
|
|
18852
|
-
/* Parse profile info */
|
|
18853
18874
|
|
|
18875
|
+
/* Parse profile info */
|
|
18854
18876
|
if (USE_PROFILES) {
|
|
18855
|
-
ALLOWED_TAGS = addToSet({},
|
|
18877
|
+
ALLOWED_TAGS = addToSet({}, text);
|
|
18856
18878
|
ALLOWED_ATTR = [];
|
|
18857
18879
|
if (USE_PROFILES.html === true) {
|
|
18858
18880
|
addToSet(ALLOWED_TAGS, html$1);
|
|
@@ -18874,8 +18896,8 @@
|
|
|
18874
18896
|
addToSet(ALLOWED_ATTR, xml);
|
|
18875
18897
|
}
|
|
18876
18898
|
}
|
|
18877
|
-
/* Merge configuration parameters */
|
|
18878
18899
|
|
|
18900
|
+
/* Merge configuration parameters */
|
|
18879
18901
|
if (cfg.ADD_TAGS) {
|
|
18880
18902
|
if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
|
|
18881
18903
|
ALLOWED_TAGS = clone(ALLOWED_TAGS);
|
|
@@ -18897,18 +18919,18 @@
|
|
|
18897
18919
|
}
|
|
18898
18920
|
addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
|
|
18899
18921
|
}
|
|
18900
|
-
/* Add #text in case KEEP_CONTENT is set to true */
|
|
18901
18922
|
|
|
18923
|
+
/* Add #text in case KEEP_CONTENT is set to true */
|
|
18902
18924
|
if (KEEP_CONTENT) {
|
|
18903
18925
|
ALLOWED_TAGS['#text'] = true;
|
|
18904
18926
|
}
|
|
18905
|
-
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
|
|
18906
18927
|
|
|
18928
|
+
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
|
|
18907
18929
|
if (WHOLE_DOCUMENT) {
|
|
18908
18930
|
addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
|
|
18909
18931
|
}
|
|
18910
|
-
/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
|
|
18911
18932
|
|
|
18933
|
+
/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
|
|
18912
18934
|
if (ALLOWED_TAGS.table) {
|
|
18913
18935
|
addToSet(ALLOWED_TAGS, ['tbody']);
|
|
18914
18936
|
delete FORBID_TAGS.tbody;
|
|
@@ -18919,55 +18941,58 @@
|
|
|
18919
18941
|
}
|
|
18920
18942
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
|
|
18921
18943
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
|
|
18922
|
-
}
|
|
18944
|
+
}
|
|
18923
18945
|
|
|
18924
|
-
|
|
18946
|
+
// Overwrite existing TrustedTypes policy.
|
|
18947
|
+
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
|
|
18925
18948
|
|
|
18949
|
+
// Sign local variables required by `sanitize`.
|
|
18926
18950
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
18927
18951
|
} else {
|
|
18928
18952
|
// Uninitialized policy, attempt to initialize the internal dompurify policy.
|
|
18929
18953
|
if (trustedTypesPolicy === undefined) {
|
|
18930
18954
|
trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
|
|
18931
|
-
}
|
|
18955
|
+
}
|
|
18932
18956
|
|
|
18957
|
+
// If creating the internal policy succeeded sign internal variables.
|
|
18933
18958
|
if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
|
|
18934
18959
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
18935
18960
|
}
|
|
18936
|
-
}
|
|
18937
|
-
// Not available in IE8, Safari 5, etc.
|
|
18961
|
+
}
|
|
18938
18962
|
|
|
18963
|
+
// Prevent further manipulation of configuration.
|
|
18964
|
+
// Not available in IE8, Safari 5, etc.
|
|
18939
18965
|
if (freeze) {
|
|
18940
18966
|
freeze(cfg);
|
|
18941
18967
|
}
|
|
18942
18968
|
CONFIG = cfg;
|
|
18943
18969
|
};
|
|
18944
18970
|
var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
18945
|
-
var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']);
|
|
18971
|
+
var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']);
|
|
18972
|
+
|
|
18973
|
+
// Certain elements are allowed in both SVG and HTML
|
|
18946
18974
|
// namespace. We need to specify them explicitly
|
|
18947
18975
|
// so that they don't get erroneously deleted from
|
|
18948
18976
|
// HTML namespace.
|
|
18949
|
-
|
|
18950
18977
|
var COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
18978
|
+
|
|
18951
18979
|
/* Keep track of all possible SVG and MathML tags
|
|
18952
18980
|
* so that we can perform the namespace checks
|
|
18953
18981
|
* correctly. */
|
|
18982
|
+
var ALL_SVG_TAGS = addToSet({}, [].concat(svg$1, svgFilters, svgDisallowed));
|
|
18983
|
+
var ALL_MATHML_TAGS = addToSet({}, [].concat(mathMl$1, mathMlDisallowed));
|
|
18954
18984
|
|
|
18955
|
-
var ALL_SVG_TAGS = addToSet({}, svg$1);
|
|
18956
|
-
addToSet(ALL_SVG_TAGS, svgFilters);
|
|
18957
|
-
addToSet(ALL_SVG_TAGS, svgDisallowed);
|
|
18958
|
-
var ALL_MATHML_TAGS = addToSet({}, mathMl$1);
|
|
18959
|
-
addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
|
|
18960
18985
|
/**
|
|
18961
18986
|
* @param {Element} element a DOM element whose namespace is being checked
|
|
18962
18987
|
* @returns {boolean} Return false if the element has a
|
|
18963
18988
|
* namespace that a spec-compliant parser would never
|
|
18964
18989
|
* return. Return true otherwise.
|
|
18965
18990
|
*/
|
|
18966
|
-
|
|
18967
18991
|
var _checkValidNamespace = function _checkValidNamespace(element) {
|
|
18968
|
-
var parent = getParentNode(element);
|
|
18969
|
-
// can be null. We just simulate parent in this case.
|
|
18992
|
+
var parent = getParentNode(element);
|
|
18970
18993
|
|
|
18994
|
+
// In JSDOM, if we're inside shadow DOM, then parentNode
|
|
18995
|
+
// can be null. We just simulate parent in this case.
|
|
18971
18996
|
if (!parent || !parent.tagName) {
|
|
18972
18997
|
parent = {
|
|
18973
18998
|
namespaceURI: NAMESPACE,
|
|
@@ -18985,15 +19010,17 @@
|
|
|
18985
19010
|
// it should be killed.
|
|
18986
19011
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
18987
19012
|
return tagName === 'svg';
|
|
18988
|
-
}
|
|
19013
|
+
}
|
|
19014
|
+
|
|
19015
|
+
// The only way to switch from MathML to SVG is via`
|
|
18989
19016
|
// svg if parent is either <annotation-xml> or MathML
|
|
18990
19017
|
// text integration points.
|
|
18991
|
-
|
|
18992
19018
|
if (parent.namespaceURI === MATHML_NAMESPACE) {
|
|
18993
19019
|
return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
|
|
18994
|
-
}
|
|
18995
|
-
// spec. All others are disallowed in SVG namespace.
|
|
19020
|
+
}
|
|
18996
19021
|
|
|
19022
|
+
// We only allow elements that are defined in SVG
|
|
19023
|
+
// spec. All others are disallowed in SVG namespace.
|
|
18997
19024
|
return Boolean(ALL_SVG_TAGS[tagName]);
|
|
18998
19025
|
}
|
|
18999
19026
|
if (element.namespaceURI === MATHML_NAMESPACE) {
|
|
@@ -19002,14 +19029,16 @@
|
|
|
19002
19029
|
// it should be killed.
|
|
19003
19030
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
19004
19031
|
return tagName === 'math';
|
|
19005
|
-
}
|
|
19006
|
-
// <math> and HTML integration points
|
|
19032
|
+
}
|
|
19007
19033
|
|
|
19034
|
+
// The only way to switch from SVG to MathML is via
|
|
19035
|
+
// <math> and HTML integration points
|
|
19008
19036
|
if (parent.namespaceURI === SVG_NAMESPACE) {
|
|
19009
19037
|
return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
|
|
19010
|
-
}
|
|
19011
|
-
// spec. All others are disallowed in MathML namespace.
|
|
19038
|
+
}
|
|
19012
19039
|
|
|
19040
|
+
// We only allow elements that are defined in MathML
|
|
19041
|
+
// spec. All others are disallowed in MathML namespace.
|
|
19013
19042
|
return Boolean(ALL_MATHML_TAGS[tagName]);
|
|
19014
19043
|
}
|
|
19015
19044
|
if (element.namespaceURI === HTML_NAMESPACE) {
|
|
@@ -19021,27 +19050,30 @@
|
|
|
19021
19050
|
}
|
|
19022
19051
|
if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
|
|
19023
19052
|
return false;
|
|
19024
|
-
}
|
|
19025
|
-
// or SVG and should never appear in HTML namespace
|
|
19053
|
+
}
|
|
19026
19054
|
|
|
19055
|
+
// We disallow tags that are specific for MathML
|
|
19056
|
+
// or SVG and should never appear in HTML namespace
|
|
19027
19057
|
return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
|
|
19028
|
-
}
|
|
19058
|
+
}
|
|
19029
19059
|
|
|
19060
|
+
// For XHTML and XML documents that support custom namespaces
|
|
19030
19061
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
19031
19062
|
return true;
|
|
19032
|
-
}
|
|
19063
|
+
}
|
|
19064
|
+
|
|
19065
|
+
// The code should never reach this place (this means
|
|
19033
19066
|
// that the element somehow got namespace that is not
|
|
19034
19067
|
// HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
|
|
19035
19068
|
// Return false just in case.
|
|
19036
|
-
|
|
19037
19069
|
return false;
|
|
19038
19070
|
};
|
|
19071
|
+
|
|
19039
19072
|
/**
|
|
19040
19073
|
* _forceRemove
|
|
19041
19074
|
*
|
|
19042
19075
|
* @param {Node} node a DOM node
|
|
19043
19076
|
*/
|
|
19044
|
-
|
|
19045
19077
|
var _forceRemove = function _forceRemove(node) {
|
|
19046
19078
|
arrayPush(DOMPurify.removed, {
|
|
19047
19079
|
element: node
|
|
@@ -19053,13 +19085,13 @@
|
|
|
19053
19085
|
node.remove();
|
|
19054
19086
|
}
|
|
19055
19087
|
};
|
|
19088
|
+
|
|
19056
19089
|
/**
|
|
19057
19090
|
* _removeAttribute
|
|
19058
19091
|
*
|
|
19059
19092
|
* @param {String} name an Attribute name
|
|
19060
19093
|
* @param {Node} node a DOM node
|
|
19061
19094
|
*/
|
|
19062
|
-
|
|
19063
19095
|
var _removeAttribute = function _removeAttribute(name, node) {
|
|
19064
19096
|
try {
|
|
19065
19097
|
arrayPush(DOMPurify.removed, {
|
|
@@ -19072,8 +19104,9 @@
|
|
|
19072
19104
|
from: node
|
|
19073
19105
|
});
|
|
19074
19106
|
}
|
|
19075
|
-
node.removeAttribute(name);
|
|
19107
|
+
node.removeAttribute(name);
|
|
19076
19108
|
|
|
19109
|
+
// We void attribute values for unremovable "is"" attributes
|
|
19077
19110
|
if (name === 'is' && !ALLOWED_ATTR[name]) {
|
|
19078
19111
|
if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
|
|
19079
19112
|
try {
|
|
@@ -19086,13 +19119,13 @@
|
|
|
19086
19119
|
}
|
|
19087
19120
|
}
|
|
19088
19121
|
};
|
|
19122
|
+
|
|
19089
19123
|
/**
|
|
19090
19124
|
* _initDocument
|
|
19091
19125
|
*
|
|
19092
19126
|
* @param {String} dirty a string of dirty markup
|
|
19093
19127
|
* @return {Document} a DOM, filled with the dirty markup
|
|
19094
19128
|
*/
|
|
19095
|
-
|
|
19096
19129
|
var _initDocument = function _initDocument(dirty) {
|
|
19097
19130
|
/* Create a HTML document */
|
|
19098
19131
|
var doc = null;
|
|
@@ -19113,64 +19146,65 @@
|
|
|
19113
19146
|
* Use the DOMParser API by default, fallback later if needs be
|
|
19114
19147
|
* DOMParser not work for svg when has multiple root element.
|
|
19115
19148
|
*/
|
|
19116
|
-
|
|
19117
19149
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
19118
19150
|
try {
|
|
19119
19151
|
doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
|
|
19120
19152
|
} catch (_) {}
|
|
19121
19153
|
}
|
|
19122
|
-
/* Use createHTMLDocument in case DOMParser is not available */
|
|
19123
19154
|
|
|
19155
|
+
/* Use createHTMLDocument in case DOMParser is not available */
|
|
19124
19156
|
if (!doc || !doc.documentElement) {
|
|
19125
19157
|
doc = implementation.createDocument(NAMESPACE, 'template', null);
|
|
19126
19158
|
try {
|
|
19127
19159
|
doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
|
|
19128
|
-
} catch (_) {
|
|
19160
|
+
} catch (_) {
|
|
19161
|
+
// Syntax error if dirtyPayload is invalid xml
|
|
19129
19162
|
}
|
|
19130
19163
|
}
|
|
19131
19164
|
var body = doc.body || doc.documentElement;
|
|
19132
19165
|
if (dirty && leadingWhitespace) {
|
|
19133
19166
|
body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
|
|
19134
19167
|
}
|
|
19135
|
-
/* Work on whole document or just its body */
|
|
19136
19168
|
|
|
19169
|
+
/* Work on whole document or just its body */
|
|
19137
19170
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
19138
19171
|
return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
|
|
19139
19172
|
}
|
|
19140
19173
|
return WHOLE_DOCUMENT ? doc.documentElement : body;
|
|
19141
19174
|
};
|
|
19175
|
+
|
|
19142
19176
|
/**
|
|
19143
19177
|
* Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
|
|
19144
19178
|
*
|
|
19145
19179
|
* @param {Node} root The root element or node to start traversing on.
|
|
19146
19180
|
* @return {NodeIterator} The created NodeIterator
|
|
19147
19181
|
*/
|
|
19148
|
-
|
|
19149
19182
|
var _createNodeIterator = function _createNodeIterator(root) {
|
|
19150
19183
|
return createNodeIterator.call(root.ownerDocument || root, root,
|
|
19151
19184
|
// eslint-disable-next-line no-bitwise
|
|
19152
19185
|
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null);
|
|
19153
19186
|
};
|
|
19187
|
+
|
|
19154
19188
|
/**
|
|
19155
19189
|
* _isClobbered
|
|
19156
19190
|
*
|
|
19157
19191
|
* @param {Node} elm element to check for clobbering attacks
|
|
19158
19192
|
* @return {Boolean} true if clobbered, false if safe
|
|
19159
19193
|
*/
|
|
19160
|
-
|
|
19161
19194
|
var _isClobbered = function _isClobbered(elm) {
|
|
19162
19195
|
return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
|
|
19163
19196
|
};
|
|
19197
|
+
|
|
19164
19198
|
/**
|
|
19165
19199
|
* Checks whether the given object is a DOM node.
|
|
19166
19200
|
*
|
|
19167
19201
|
* @param {Node} object object to check whether it's a DOM node
|
|
19168
19202
|
* @return {Boolean} true is object is a DOM node
|
|
19169
19203
|
*/
|
|
19170
|
-
|
|
19171
19204
|
var _isNode = function _isNode(object) {
|
|
19172
19205
|
return typeof Node === 'function' && object instanceof Node;
|
|
19173
19206
|
};
|
|
19207
|
+
|
|
19174
19208
|
/**
|
|
19175
19209
|
* _executeHook
|
|
19176
19210
|
* Execute user configurable hooks
|
|
@@ -19179,7 +19213,6 @@
|
|
|
19179
19213
|
* @param {Node} currentNode node to work on with the hook
|
|
19180
19214
|
* @param {Object} data additional hook parameters
|
|
19181
19215
|
*/
|
|
19182
|
-
|
|
19183
19216
|
var _executeHook = function _executeHook(entryPoint, currentNode, data) {
|
|
19184
19217
|
if (!hooks[entryPoint]) {
|
|
19185
19218
|
return;
|
|
@@ -19188,6 +19221,7 @@
|
|
|
19188
19221
|
hook.call(DOMPurify, currentNode, data, CONFIG);
|
|
19189
19222
|
});
|
|
19190
19223
|
};
|
|
19224
|
+
|
|
19191
19225
|
/**
|
|
19192
19226
|
* _sanitizeElements
|
|
19193
19227
|
*
|
|
@@ -19198,35 +19232,34 @@
|
|
|
19198
19232
|
* @param {Node} currentNode to check for permission to exist
|
|
19199
19233
|
* @return {Boolean} true if node was killed, false if left alive
|
|
19200
19234
|
*/
|
|
19201
|
-
|
|
19202
19235
|
var _sanitizeElements = function _sanitizeElements(currentNode) {
|
|
19203
19236
|
var content = null;
|
|
19204
|
-
/* Execute a hook if present */
|
|
19205
19237
|
|
|
19238
|
+
/* Execute a hook if present */
|
|
19206
19239
|
_executeHook('beforeSanitizeElements', currentNode, null);
|
|
19207
|
-
/* Check if element is clobbered or can clobber */
|
|
19208
19240
|
|
|
19241
|
+
/* Check if element is clobbered or can clobber */
|
|
19209
19242
|
if (_isClobbered(currentNode)) {
|
|
19210
19243
|
_forceRemove(currentNode);
|
|
19211
19244
|
return true;
|
|
19212
19245
|
}
|
|
19213
|
-
/* Now let's check the element's type and name */
|
|
19214
19246
|
|
|
19247
|
+
/* Now let's check the element's type and name */
|
|
19215
19248
|
var tagName = transformCaseFunc(currentNode.nodeName);
|
|
19216
|
-
/* Execute a hook if present */
|
|
19217
19249
|
|
|
19250
|
+
/* Execute a hook if present */
|
|
19218
19251
|
_executeHook('uponSanitizeElement', currentNode, {
|
|
19219
19252
|
tagName: tagName,
|
|
19220
19253
|
allowedTags: ALLOWED_TAGS
|
|
19221
19254
|
});
|
|
19222
|
-
/* Detect mXSS attempts abusing namespace confusion */
|
|
19223
19255
|
|
|
19256
|
+
/* Detect mXSS attempts abusing namespace confusion */
|
|
19224
19257
|
if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
|
|
19225
19258
|
_forceRemove(currentNode);
|
|
19226
19259
|
return true;
|
|
19227
19260
|
}
|
|
19228
|
-
/* Remove element if anything forbids its presence */
|
|
19229
19261
|
|
|
19262
|
+
/* Remove element if anything forbids its presence */
|
|
19230
19263
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
19231
19264
|
/* Check if we have a custom element to handle */
|
|
19232
19265
|
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
|
|
@@ -19237,8 +19270,8 @@
|
|
|
19237
19270
|
return false;
|
|
19238
19271
|
}
|
|
19239
19272
|
}
|
|
19240
|
-
/* Keep content except for bad-listed elements */
|
|
19241
19273
|
|
|
19274
|
+
/* Keep content except for bad-listed elements */
|
|
19242
19275
|
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
|
|
19243
19276
|
var parentNode = getParentNode(currentNode) || currentNode.parentNode;
|
|
19244
19277
|
var childNodes = getChildNodes(currentNode) || currentNode.childNodes;
|
|
@@ -19252,20 +19285,20 @@
|
|
|
19252
19285
|
_forceRemove(currentNode);
|
|
19253
19286
|
return true;
|
|
19254
19287
|
}
|
|
19255
|
-
/* Check whether element has a valid namespace */
|
|
19256
19288
|
|
|
19289
|
+
/* Check whether element has a valid namespace */
|
|
19257
19290
|
if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
|
|
19258
19291
|
_forceRemove(currentNode);
|
|
19259
19292
|
return true;
|
|
19260
19293
|
}
|
|
19261
|
-
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
19262
19294
|
|
|
19295
|
+
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
19263
19296
|
if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
19264
19297
|
_forceRemove(currentNode);
|
|
19265
19298
|
return true;
|
|
19266
19299
|
}
|
|
19267
|
-
/* Sanitize element content to be template-safe */
|
|
19268
19300
|
|
|
19301
|
+
/* Sanitize element content to be template-safe */
|
|
19269
19302
|
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
|
|
19270
19303
|
/* Get the element's text content */
|
|
19271
19304
|
content = currentNode.textContent;
|
|
@@ -19279,11 +19312,12 @@
|
|
|
19279
19312
|
currentNode.textContent = content;
|
|
19280
19313
|
}
|
|
19281
19314
|
}
|
|
19282
|
-
/* Execute a hook if present */
|
|
19283
19315
|
|
|
19316
|
+
/* Execute a hook if present */
|
|
19284
19317
|
_executeHook('afterSanitizeElements', currentNode, null);
|
|
19285
19318
|
return false;
|
|
19286
19319
|
};
|
|
19320
|
+
|
|
19287
19321
|
/**
|
|
19288
19322
|
* _isValidAttribute
|
|
19289
19323
|
*
|
|
@@ -19293,17 +19327,16 @@
|
|
|
19293
19327
|
* @return {Boolean} Returns true if `value` is valid, otherwise false.
|
|
19294
19328
|
*/
|
|
19295
19329
|
// eslint-disable-next-line complexity
|
|
19296
|
-
|
|
19297
19330
|
var _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
|
|
19298
19331
|
/* Make sure attribute cannot clobber */
|
|
19299
19332
|
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
|
|
19300
19333
|
return false;
|
|
19301
19334
|
}
|
|
19335
|
+
|
|
19302
19336
|
/* Allow valid data-* attributes: At least one character after "-"
|
|
19303
19337
|
(https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
|
|
19304
19338
|
XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
|
|
19305
19339
|
We don't need to check the value; it's always URI safe. */
|
|
19306
|
-
|
|
19307
19340
|
if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ;else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ;else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
|
|
19308
19341
|
if (
|
|
19309
19342
|
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
@@ -19321,6 +19354,7 @@
|
|
|
19321
19354
|
}
|
|
19322
19355
|
return true;
|
|
19323
19356
|
};
|
|
19357
|
+
|
|
19324
19358
|
/**
|
|
19325
19359
|
* _isBasicCustomElement
|
|
19326
19360
|
* checks if at least one dash is included in tagName, and it's not the first char
|
|
@@ -19329,10 +19363,10 @@
|
|
|
19329
19363
|
* @param {string} tagName name of the tag of the node to sanitize
|
|
19330
19364
|
* @returns {boolean} Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
|
|
19331
19365
|
*/
|
|
19332
|
-
|
|
19333
19366
|
var _isBasicCustomElement = function _isBasicCustomElement(tagName) {
|
|
19334
19367
|
return tagName.indexOf('-') > 0;
|
|
19335
19368
|
};
|
|
19369
|
+
|
|
19336
19370
|
/**
|
|
19337
19371
|
* _sanitizeAttributes
|
|
19338
19372
|
*
|
|
@@ -19343,13 +19377,12 @@
|
|
|
19343
19377
|
*
|
|
19344
19378
|
* @param {Node} currentNode to sanitize
|
|
19345
19379
|
*/
|
|
19346
|
-
|
|
19347
19380
|
var _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
|
|
19348
19381
|
/* Execute a hook if present */
|
|
19349
19382
|
_executeHook('beforeSanitizeAttributes', currentNode, null);
|
|
19350
19383
|
var attributes = currentNode.attributes;
|
|
19351
|
-
/* Check if we have attributes; if not we might have a text node */
|
|
19352
19384
|
|
|
19385
|
+
/* Check if we have attributes; if not we might have a text node */
|
|
19353
19386
|
if (!attributes) {
|
|
19354
19387
|
return;
|
|
19355
19388
|
}
|
|
@@ -19360,6 +19393,7 @@
|
|
|
19360
19393
|
allowedAttributes: ALLOWED_ATTR
|
|
19361
19394
|
};
|
|
19362
19395
|
var l = attributes.length;
|
|
19396
|
+
|
|
19363
19397
|
/* Go backwards over all attributes; safely remove bad ones */
|
|
19364
19398
|
var _loop = function _loop() {
|
|
19365
19399
|
var attr = attributes[l];
|
|
@@ -19368,59 +19402,58 @@
|
|
|
19368
19402
|
attrValue = attr.value;
|
|
19369
19403
|
var lcName = transformCaseFunc(name);
|
|
19370
19404
|
var value = name === 'value' ? attrValue : stringTrim(attrValue);
|
|
19371
|
-
/* Execute a hook if present */
|
|
19372
19405
|
|
|
19406
|
+
/* Execute a hook if present */
|
|
19373
19407
|
hookEvent.attrName = lcName;
|
|
19374
19408
|
hookEvent.attrValue = value;
|
|
19375
19409
|
hookEvent.keepAttr = true;
|
|
19376
19410
|
hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
|
|
19377
|
-
|
|
19378
19411
|
_executeHook('uponSanitizeAttribute', currentNode, hookEvent);
|
|
19379
19412
|
value = hookEvent.attrValue;
|
|
19380
19413
|
/* Did the hooks approve of the attribute? */
|
|
19381
|
-
|
|
19382
19414
|
if (hookEvent.forceKeepAttr) {
|
|
19383
19415
|
return 0; // continue
|
|
19384
19416
|
}
|
|
19385
|
-
/* Remove attribute */
|
|
19386
19417
|
|
|
19418
|
+
/* Remove attribute */
|
|
19387
19419
|
_removeAttribute(name, currentNode);
|
|
19388
|
-
/* Did the hooks approve of the attribute? */
|
|
19389
19420
|
|
|
19421
|
+
/* Did the hooks approve of the attribute? */
|
|
19390
19422
|
if (!hookEvent.keepAttr) {
|
|
19391
19423
|
return 0; // continue
|
|
19392
19424
|
}
|
|
19393
|
-
/* Work around a security issue in jQuery 3.0 */
|
|
19394
19425
|
|
|
19426
|
+
/* Work around a security issue in jQuery 3.0 */
|
|
19395
19427
|
if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
|
|
19396
19428
|
_removeAttribute(name, currentNode);
|
|
19397
19429
|
return 0; // continue
|
|
19398
19430
|
}
|
|
19399
|
-
/* Sanitize attribute content to be template-safe */
|
|
19400
19431
|
|
|
19432
|
+
/* Sanitize attribute content to be template-safe */
|
|
19401
19433
|
if (SAFE_FOR_TEMPLATES) {
|
|
19402
19434
|
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], function (expr) {
|
|
19403
19435
|
value = stringReplace(value, expr, ' ');
|
|
19404
19436
|
});
|
|
19405
19437
|
}
|
|
19406
|
-
/* Is `value` valid for this attribute? */
|
|
19407
19438
|
|
|
19439
|
+
/* Is `value` valid for this attribute? */
|
|
19408
19440
|
var lcTag = transformCaseFunc(currentNode.nodeName);
|
|
19409
19441
|
if (!_isValidAttribute(lcTag, lcName, value)) {
|
|
19410
19442
|
return 0; // continue
|
|
19411
19443
|
}
|
|
19444
|
+
|
|
19412
19445
|
/* Full DOM Clobbering protection via namespace isolation,
|
|
19413
19446
|
* Prefix id and name attributes with `user-content-`
|
|
19414
19447
|
*/
|
|
19415
|
-
|
|
19416
19448
|
if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
|
|
19417
19449
|
// Remove the attribute with this value
|
|
19418
|
-
_removeAttribute(name, currentNode);
|
|
19450
|
+
_removeAttribute(name, currentNode);
|
|
19419
19451
|
|
|
19452
|
+
// Prefix the value and later re-create the attribute with the sanitized value
|
|
19420
19453
|
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
19421
19454
|
}
|
|
19422
|
-
/* Handle attributes that require Trusted Types */
|
|
19423
19455
|
|
|
19456
|
+
/* Handle attributes that require Trusted Types */
|
|
19424
19457
|
if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
|
|
19425
19458
|
if (namespaceURI) ;else {
|
|
19426
19459
|
switch (trustedTypes.getAttributeType(lcTag, lcName)) {
|
|
@@ -19437,8 +19470,8 @@
|
|
|
19437
19470
|
}
|
|
19438
19471
|
}
|
|
19439
19472
|
}
|
|
19440
|
-
/* Handle invalid data-* attribute set by try-catching it */
|
|
19441
19473
|
|
|
19474
|
+
/* Handle invalid data-* attribute set by try-catching it */
|
|
19442
19475
|
try {
|
|
19443
19476
|
if (namespaceURI) {
|
|
19444
19477
|
currentNode.setAttributeNS(namespaceURI, name, value);
|
|
@@ -19454,43 +19487,44 @@
|
|
|
19454
19487
|
_ret = _loop();
|
|
19455
19488
|
if (_ret === 0) continue;
|
|
19456
19489
|
}
|
|
19457
|
-
/* Execute a hook if present */
|
|
19458
19490
|
|
|
19491
|
+
/* Execute a hook if present */
|
|
19459
19492
|
_executeHook('afterSanitizeAttributes', currentNode, null);
|
|
19460
19493
|
};
|
|
19494
|
+
|
|
19461
19495
|
/**
|
|
19462
19496
|
* _sanitizeShadowDOM
|
|
19463
19497
|
*
|
|
19464
19498
|
* @param {DocumentFragment} fragment to iterate over recursively
|
|
19465
19499
|
*/
|
|
19466
|
-
|
|
19467
19500
|
var _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
|
|
19468
19501
|
var shadowNode = null;
|
|
19469
19502
|
var shadowIterator = _createNodeIterator(fragment);
|
|
19470
|
-
/* Execute a hook if present */
|
|
19471
19503
|
|
|
19504
|
+
/* Execute a hook if present */
|
|
19472
19505
|
_executeHook('beforeSanitizeShadowDOM', fragment, null);
|
|
19473
19506
|
while (shadowNode = shadowIterator.nextNode()) {
|
|
19474
19507
|
/* Execute a hook if present */
|
|
19475
19508
|
_executeHook('uponSanitizeShadowNode', shadowNode, null);
|
|
19476
|
-
/* Sanitize tags and elements */
|
|
19477
19509
|
|
|
19510
|
+
/* Sanitize tags and elements */
|
|
19478
19511
|
if (_sanitizeElements(shadowNode)) {
|
|
19479
19512
|
continue;
|
|
19480
19513
|
}
|
|
19481
|
-
/* Deep shadow DOM detected */
|
|
19482
19514
|
|
|
19515
|
+
/* Deep shadow DOM detected */
|
|
19483
19516
|
if (shadowNode.content instanceof DocumentFragment) {
|
|
19484
19517
|
_sanitizeShadowDOM(shadowNode.content);
|
|
19485
19518
|
}
|
|
19486
|
-
/* Check attributes, sanitize if necessary */
|
|
19487
19519
|
|
|
19520
|
+
/* Check attributes, sanitize if necessary */
|
|
19488
19521
|
_sanitizeAttributes(shadowNode);
|
|
19489
19522
|
}
|
|
19490
|
-
/* Execute a hook if present */
|
|
19491
19523
|
|
|
19524
|
+
/* Execute a hook if present */
|
|
19492
19525
|
_executeHook('afterSanitizeShadowDOM', fragment, null);
|
|
19493
19526
|
};
|
|
19527
|
+
|
|
19494
19528
|
/**
|
|
19495
19529
|
* Sanitize
|
|
19496
19530
|
* Public method providing core sanitation functionality
|
|
@@ -19499,7 +19533,6 @@
|
|
|
19499
19533
|
* @param {Object} cfg object
|
|
19500
19534
|
*/
|
|
19501
19535
|
// eslint-disable-next-line complexity
|
|
19502
|
-
|
|
19503
19536
|
DOMPurify.sanitize = function (dirty) {
|
|
19504
19537
|
var cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
|
|
19505
19538
|
var body = null;
|
|
@@ -19509,13 +19542,12 @@
|
|
|
19509
19542
|
/* Make sure we have a string to sanitize.
|
|
19510
19543
|
DO NOT return early, as this will return the wrong type if
|
|
19511
19544
|
the user has requested a DOM object rather than a string */
|
|
19512
|
-
|
|
19513
19545
|
IS_EMPTY_INPUT = !dirty;
|
|
19514
19546
|
if (IS_EMPTY_INPUT) {
|
|
19515
19547
|
dirty = '<!-->';
|
|
19516
19548
|
}
|
|
19517
|
-
/* Stringify, in case dirty is an object */
|
|
19518
19549
|
|
|
19550
|
+
/* Stringify, in case dirty is an object */
|
|
19519
19551
|
if (typeof dirty !== 'string' && !_isNode(dirty)) {
|
|
19520
19552
|
if (typeof dirty.toString === 'function') {
|
|
19521
19553
|
dirty = dirty.toString();
|
|
@@ -19526,21 +19558,21 @@
|
|
|
19526
19558
|
throw typeErrorCreate('toString is not a function');
|
|
19527
19559
|
}
|
|
19528
19560
|
}
|
|
19529
|
-
/* Return dirty HTML if DOMPurify cannot run */
|
|
19530
19561
|
|
|
19562
|
+
/* Return dirty HTML if DOMPurify cannot run */
|
|
19531
19563
|
if (!DOMPurify.isSupported) {
|
|
19532
19564
|
return dirty;
|
|
19533
19565
|
}
|
|
19534
|
-
/* Assign config vars */
|
|
19535
19566
|
|
|
19567
|
+
/* Assign config vars */
|
|
19536
19568
|
if (!SET_CONFIG) {
|
|
19537
19569
|
_parseConfig(cfg);
|
|
19538
19570
|
}
|
|
19539
|
-
/* Clean up removed elements */
|
|
19540
19571
|
|
|
19572
|
+
/* Clean up removed elements */
|
|
19541
19573
|
DOMPurify.removed = [];
|
|
19542
|
-
/* Check if dirty is correctly typed for IN_PLACE */
|
|
19543
19574
|
|
|
19575
|
+
/* Check if dirty is correctly typed for IN_PLACE */
|
|
19544
19576
|
if (typeof dirty === 'string') {
|
|
19545
19577
|
IN_PLACE = false;
|
|
19546
19578
|
}
|
|
@@ -19573,46 +19605,46 @@
|
|
|
19573
19605
|
dirty.indexOf('<') === -1) {
|
|
19574
19606
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
19575
19607
|
}
|
|
19576
|
-
/* Initialize the document to work on */
|
|
19577
19608
|
|
|
19609
|
+
/* Initialize the document to work on */
|
|
19578
19610
|
body = _initDocument(dirty);
|
|
19579
|
-
/* Check we have a DOM node from the data */
|
|
19580
19611
|
|
|
19612
|
+
/* Check we have a DOM node from the data */
|
|
19581
19613
|
if (!body) {
|
|
19582
19614
|
return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
|
|
19583
19615
|
}
|
|
19584
19616
|
}
|
|
19585
|
-
/* Remove first element node (ours) if FORCE_BODY is set */
|
|
19586
19617
|
|
|
19618
|
+
/* Remove first element node (ours) if FORCE_BODY is set */
|
|
19587
19619
|
if (body && FORCE_BODY) {
|
|
19588
19620
|
_forceRemove(body.firstChild);
|
|
19589
19621
|
}
|
|
19590
|
-
/* Get node iterator */
|
|
19591
19622
|
|
|
19623
|
+
/* Get node iterator */
|
|
19592
19624
|
var nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
|
|
19593
|
-
/* Now start iterating over the created document */
|
|
19594
19625
|
|
|
19626
|
+
/* Now start iterating over the created document */
|
|
19595
19627
|
while (currentNode = nodeIterator.nextNode()) {
|
|
19596
19628
|
/* Sanitize tags and elements */
|
|
19597
19629
|
if (_sanitizeElements(currentNode)) {
|
|
19598
19630
|
continue;
|
|
19599
19631
|
}
|
|
19600
|
-
/* Shadow DOM detected, sanitize it */
|
|
19601
19632
|
|
|
19633
|
+
/* Shadow DOM detected, sanitize it */
|
|
19602
19634
|
if (currentNode.content instanceof DocumentFragment) {
|
|
19603
19635
|
_sanitizeShadowDOM(currentNode.content);
|
|
19604
19636
|
}
|
|
19605
|
-
/* Check attributes, sanitize if necessary */
|
|
19606
19637
|
|
|
19638
|
+
/* Check attributes, sanitize if necessary */
|
|
19607
19639
|
_sanitizeAttributes(currentNode);
|
|
19608
19640
|
}
|
|
19609
|
-
/* If we sanitized `dirty` in-place, return it. */
|
|
19610
19641
|
|
|
19642
|
+
/* If we sanitized `dirty` in-place, return it. */
|
|
19611
19643
|
if (IN_PLACE) {
|
|
19612
19644
|
return dirty;
|
|
19613
19645
|
}
|
|
19614
|
-
/* Return sanitized string or DOM */
|
|
19615
19646
|
|
|
19647
|
+
/* Return sanitized string or DOM */
|
|
19616
19648
|
if (RETURN_DOM) {
|
|
19617
19649
|
if (RETURN_DOM_FRAGMENT) {
|
|
19618
19650
|
returnNode = createDocumentFragment.call(body.ownerDocument);
|
|
@@ -19636,13 +19668,13 @@
|
|
|
19636
19668
|
return returnNode;
|
|
19637
19669
|
}
|
|
19638
19670
|
var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
|
19639
|
-
/* Serialize doctype if allowed */
|
|
19640
19671
|
|
|
19672
|
+
/* Serialize doctype if allowed */
|
|
19641
19673
|
if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
|
|
19642
19674
|
serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
|
|
19643
19675
|
}
|
|
19644
|
-
/* Sanitize final string template-safe */
|
|
19645
19676
|
|
|
19677
|
+
/* Sanitize final string template-safe */
|
|
19646
19678
|
if (SAFE_FOR_TEMPLATES) {
|
|
19647
19679
|
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], function (expr) {
|
|
19648
19680
|
serializedHTML = stringReplace(serializedHTML, expr, ' ');
|
|
@@ -19650,28 +19682,29 @@
|
|
|
19650
19682
|
}
|
|
19651
19683
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
|
|
19652
19684
|
};
|
|
19685
|
+
|
|
19653
19686
|
/**
|
|
19654
19687
|
* Public method to set the configuration once
|
|
19655
19688
|
* setConfig
|
|
19656
19689
|
*
|
|
19657
19690
|
* @param {Object} cfg configuration object
|
|
19658
19691
|
*/
|
|
19659
|
-
|
|
19660
19692
|
DOMPurify.setConfig = function () {
|
|
19661
19693
|
var cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
19662
19694
|
_parseConfig(cfg);
|
|
19663
19695
|
SET_CONFIG = true;
|
|
19664
19696
|
};
|
|
19697
|
+
|
|
19665
19698
|
/**
|
|
19666
19699
|
* Public method to remove the configuration
|
|
19667
19700
|
* clearConfig
|
|
19668
19701
|
*
|
|
19669
19702
|
*/
|
|
19670
|
-
|
|
19671
19703
|
DOMPurify.clearConfig = function () {
|
|
19672
19704
|
CONFIG = null;
|
|
19673
19705
|
SET_CONFIG = false;
|
|
19674
19706
|
};
|
|
19707
|
+
|
|
19675
19708
|
/**
|
|
19676
19709
|
* Public method to check if an attribute value is valid.
|
|
19677
19710
|
* Uses last set config, if any. Otherwise, uses config defaults.
|
|
@@ -19682,7 +19715,6 @@
|
|
|
19682
19715
|
* @param {String} value Attribute value.
|
|
19683
19716
|
* @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
|
|
19684
19717
|
*/
|
|
19685
|
-
|
|
19686
19718
|
DOMPurify.isValidAttribute = function (tag, attr, value) {
|
|
19687
19719
|
/* Initialize shared config vars if necessary. */
|
|
19688
19720
|
if (!CONFIG) {
|
|
@@ -19692,6 +19724,7 @@
|
|
|
19692
19724
|
var lcName = transformCaseFunc(attr);
|
|
19693
19725
|
return _isValidAttribute(lcTag, lcName, value);
|
|
19694
19726
|
};
|
|
19727
|
+
|
|
19695
19728
|
/**
|
|
19696
19729
|
* AddHook
|
|
19697
19730
|
* Public method to add DOMPurify hooks
|
|
@@ -19699,7 +19732,6 @@
|
|
|
19699
19732
|
* @param {String} entryPoint entry point for the hook to add
|
|
19700
19733
|
* @param {Function} hookFunction function to execute
|
|
19701
19734
|
*/
|
|
19702
|
-
|
|
19703
19735
|
DOMPurify.addHook = function (entryPoint, hookFunction) {
|
|
19704
19736
|
if (typeof hookFunction !== 'function') {
|
|
19705
19737
|
return;
|
|
@@ -19707,6 +19739,7 @@
|
|
|
19707
19739
|
hooks[entryPoint] = hooks[entryPoint] || [];
|
|
19708
19740
|
arrayPush(hooks[entryPoint], hookFunction);
|
|
19709
19741
|
};
|
|
19742
|
+
|
|
19710
19743
|
/**
|
|
19711
19744
|
* RemoveHook
|
|
19712
19745
|
* Public method to remove a DOMPurify hook at a given entryPoint
|
|
@@ -19715,29 +19748,28 @@
|
|
|
19715
19748
|
* @param {String} entryPoint entry point for the hook to remove
|
|
19716
19749
|
* @return {Function} removed(popped) hook
|
|
19717
19750
|
*/
|
|
19718
|
-
|
|
19719
19751
|
DOMPurify.removeHook = function (entryPoint) {
|
|
19720
19752
|
if (hooks[entryPoint]) {
|
|
19721
19753
|
return arrayPop(hooks[entryPoint]);
|
|
19722
19754
|
}
|
|
19723
19755
|
};
|
|
19756
|
+
|
|
19724
19757
|
/**
|
|
19725
19758
|
* RemoveHooks
|
|
19726
19759
|
* Public method to remove all DOMPurify hooks at a given entryPoint
|
|
19727
19760
|
*
|
|
19728
19761
|
* @param {String} entryPoint entry point for the hooks to remove
|
|
19729
19762
|
*/
|
|
19730
|
-
|
|
19731
19763
|
DOMPurify.removeHooks = function (entryPoint) {
|
|
19732
19764
|
if (hooks[entryPoint]) {
|
|
19733
19765
|
hooks[entryPoint] = [];
|
|
19734
19766
|
}
|
|
19735
19767
|
};
|
|
19768
|
+
|
|
19736
19769
|
/**
|
|
19737
19770
|
* RemoveAllHooks
|
|
19738
19771
|
* Public method to remove all DOMPurify hooks
|
|
19739
19772
|
*/
|
|
19740
|
-
|
|
19741
19773
|
DOMPurify.removeAllHooks = function () {
|
|
19742
19774
|
hooks = {};
|
|
19743
19775
|
};
|
|
@@ -29371,8 +29403,6 @@
|
|
|
29371
29403
|
enableAI: Q.bool.def(true),
|
|
29372
29404
|
AIConfig: types.AIConfig,
|
|
29373
29405
|
iconPosition: types.iconPosition.def('left'),
|
|
29374
|
-
themePreset: types.themePreset,
|
|
29375
|
-
theme: types.style,
|
|
29376
29406
|
icon: types.children,
|
|
29377
29407
|
iconURL: Q.string.def(''),
|
|
29378
29408
|
renderMic: types.func,
|
|
@@ -29380,27 +29410,17 @@
|
|
|
29380
29410
|
innerClass: types.style,
|
|
29381
29411
|
placeholder: Q.string.def('Ask a question'),
|
|
29382
29412
|
title: types.title,
|
|
29383
|
-
AIResponse: types.componentObject,
|
|
29384
|
-
isAIResponseLoading: Q.bool.def(false),
|
|
29385
|
-
AIResponseError: types.componentObject,
|
|
29386
|
-
getAIResponse: types.func.isRequired,
|
|
29387
29413
|
enterButton: types.bool,
|
|
29388
29414
|
renderEnterButton: types.title,
|
|
29389
29415
|
showInput: Q.bool.def(true),
|
|
29390
29416
|
clearSessionOnDestroy: Q.bool.def(true),
|
|
29391
|
-
rawData: types.rawData,
|
|
29392
29417
|
render: types.func,
|
|
29393
29418
|
onError: types.func,
|
|
29394
29419
|
renderError: types.title,
|
|
29395
|
-
isLoading: types.boolRequired,
|
|
29396
|
-
sessionIdFromStore: Q.string,
|
|
29397
|
-
showComponent: types.boolRequired,
|
|
29398
|
-
componentError: types.componentObject,
|
|
29399
29420
|
style: types.style,
|
|
29400
29421
|
showSourceDocuments: Q.bool.def(false),
|
|
29401
29422
|
renderSourceDocument: types.func,
|
|
29402
29423
|
onSourceClick: types.func,
|
|
29403
|
-
isAITyping: types.boolRequired,
|
|
29404
29424
|
triggerOn: Q.string.def(AI_TRIGGER_MODES.ALWAYS),
|
|
29405
29425
|
renderTriggerMessage: types.func
|
|
29406
29426
|
},
|
|
@@ -29450,7 +29470,7 @@
|
|
|
29450
29470
|
this.$emit('on-data', {
|
|
29451
29471
|
data: this.messages,
|
|
29452
29472
|
rawData: newVal,
|
|
29453
|
-
loading: this
|
|
29473
|
+
loading: this.isAIResponseLoading || this.$props.isLoading,
|
|
29454
29474
|
error: this.$props.AIResponseError
|
|
29455
29475
|
});
|
|
29456
29476
|
if (newVal && newVal.hits && newVal.hits.hits) {
|
|
@@ -42913,7 +42933,8 @@
|
|
|
42913
42933
|
searchAsMove: props.defaultSearchAsMove,
|
|
42914
42934
|
currentPageState: currentPageState,
|
|
42915
42935
|
mapBoxBounds: null,
|
|
42916
|
-
markersData: null
|
|
42936
|
+
markersData: null,
|
|
42937
|
+
filteredResults: null
|
|
42917
42938
|
};
|
|
42918
42939
|
return this.__state;
|
|
42919
42940
|
},
|
|
@@ -44651,7 +44672,6 @@
|
|
|
44651
44672
|
var openMarkers = this.openMarkers;
|
|
44652
44673
|
var markerProps = {
|
|
44653
44674
|
openMarkers: openMarkers,
|
|
44654
|
-
setMarkerOnTop: this.setMarkerOnTop,
|
|
44655
44675
|
setOpenMarkers: this.setOpenMarkers,
|
|
44656
44676
|
getPosition: this.getPosition,
|
|
44657
44677
|
renderItem: this.renderItem,
|
|
@@ -44915,15 +44935,11 @@
|
|
|
44915
44935
|
|
|
44916
44936
|
var _PatchFlagNames, _slotFlagsText;
|
|
44917
44937
|
function makeMap(str, expectsLowerCase) {
|
|
44918
|
-
var
|
|
44919
|
-
var list = str.split(",");
|
|
44920
|
-
for (var i = 0; i < list.length; i++) {
|
|
44921
|
-
map[list[i]] = true;
|
|
44922
|
-
}
|
|
44938
|
+
var set = new Set(str.split(","));
|
|
44923
44939
|
return expectsLowerCase ? function (val) {
|
|
44924
|
-
return
|
|
44940
|
+
return set.has(val.toLowerCase());
|
|
44925
44941
|
} : function (val) {
|
|
44926
|
-
return
|
|
44942
|
+
return set.has(val);
|
|
44927
44943
|
};
|
|
44928
44944
|
}
|
|
44929
44945
|
var EMPTY_OBJ = Object.freeze({}) ;
|
|
@@ -45173,15 +45189,24 @@
|
|
|
45173
45189
|
targetBuffer.splice(bufferIndex, 0, teleportContent);
|
|
45174
45190
|
parentPush("<!--teleport end-->");
|
|
45175
45191
|
}
|
|
45176
|
-
var ErrorTypeStrings = (_ErrorTypeStrings = {}, _ErrorTypeStrings["sp"] = "serverPrefetch hook", _ErrorTypeStrings["bc"] = "beforeCreate hook", _ErrorTypeStrings["c"] = "created hook", _ErrorTypeStrings["bm"] = "beforeMount hook", _ErrorTypeStrings["m"] = "mounted hook", _ErrorTypeStrings["bu"] = "beforeUpdate hook", _ErrorTypeStrings["u"] = "updated", _ErrorTypeStrings["bum"] = "beforeUnmount hook", _ErrorTypeStrings["um"] = "unmounted hook", _ErrorTypeStrings["a"] = "activated hook", _ErrorTypeStrings["da"] = "deactivated hook", _ErrorTypeStrings["ec"] = "errorCaptured hook", _ErrorTypeStrings["rtc"] = "renderTracked hook", _ErrorTypeStrings["rtg"] = "renderTriggered hook", _ErrorTypeStrings[0] = "setup function", _ErrorTypeStrings[1] = "render function", _ErrorTypeStrings[2] = "watcher getter", _ErrorTypeStrings[3] = "watcher callback", _ErrorTypeStrings[4] = "watcher cleanup function", _ErrorTypeStrings[5] = "native event handler", _ErrorTypeStrings[6] = "component event handler", _ErrorTypeStrings[7] = "vnode hook", _ErrorTypeStrings[8] = "directive hook", _ErrorTypeStrings[9] = "transition hook", _ErrorTypeStrings[10] = "app errorHandler", _ErrorTypeStrings[11] = "app warnHandler", _ErrorTypeStrings[12] = "ref function", _ErrorTypeStrings[13] = "async component loader", _ErrorTypeStrings[14] = "scheduler flush. This is likely a Vue internals bug. Please open an issue at https://
|
|
45177
|
-
var globalCurrentInstanceSetters;
|
|
45178
|
-
var settersKey = "__VUE_INSTANCE_SETTERS__";
|
|
45192
|
+
var ErrorTypeStrings = (_ErrorTypeStrings = {}, _ErrorTypeStrings["sp"] = "serverPrefetch hook", _ErrorTypeStrings["bc"] = "beforeCreate hook", _ErrorTypeStrings["c"] = "created hook", _ErrorTypeStrings["bm"] = "beforeMount hook", _ErrorTypeStrings["m"] = "mounted hook", _ErrorTypeStrings["bu"] = "beforeUpdate hook", _ErrorTypeStrings["u"] = "updated", _ErrorTypeStrings["bum"] = "beforeUnmount hook", _ErrorTypeStrings["um"] = "unmounted hook", _ErrorTypeStrings["a"] = "activated hook", _ErrorTypeStrings["da"] = "deactivated hook", _ErrorTypeStrings["ec"] = "errorCaptured hook", _ErrorTypeStrings["rtc"] = "renderTracked hook", _ErrorTypeStrings["rtg"] = "renderTriggered hook", _ErrorTypeStrings[0] = "setup function", _ErrorTypeStrings[1] = "render function", _ErrorTypeStrings[2] = "watcher getter", _ErrorTypeStrings[3] = "watcher callback", _ErrorTypeStrings[4] = "watcher cleanup function", _ErrorTypeStrings[5] = "native event handler", _ErrorTypeStrings[6] = "component event handler", _ErrorTypeStrings[7] = "vnode hook", _ErrorTypeStrings[8] = "directive hook", _ErrorTypeStrings[9] = "transition hook", _ErrorTypeStrings[10] = "app errorHandler", _ErrorTypeStrings[11] = "app warnHandler", _ErrorTypeStrings[12] = "ref function", _ErrorTypeStrings[13] = "async component loader", _ErrorTypeStrings[14] = "scheduler flush. This is likely a Vue internals bug. Please open an issue at https://github.com/vuejs/core .", _ErrorTypeStrings);
|
|
45179
45193
|
{
|
|
45180
|
-
|
|
45181
|
-
|
|
45182
|
-
|
|
45183
|
-
|
|
45184
|
-
|
|
45194
|
+
var g$2 = getGlobalThis();
|
|
45195
|
+
var registerGlobalSetter = function registerGlobalSetter(key, setter) {
|
|
45196
|
+
var setters;
|
|
45197
|
+
if (!(setters = g$2[key])) setters = g$2[key] = [];
|
|
45198
|
+
setters.push(setter);
|
|
45199
|
+
return function (v) {
|
|
45200
|
+
if (setters.length > 1) setters.forEach(function (set) {
|
|
45201
|
+
return set(v);
|
|
45202
|
+
});else setters[0](v);
|
|
45203
|
+
};
|
|
45204
|
+
};
|
|
45205
|
+
registerGlobalSetter("__VUE_INSTANCE_SETTERS__", function (v) {
|
|
45206
|
+
return v;
|
|
45207
|
+
});
|
|
45208
|
+
registerGlobalSetter("__VUE_SSR_SETTERS__", function (v) {
|
|
45209
|
+
return v;
|
|
45185
45210
|
});
|
|
45186
45211
|
}
|
|
45187
45212
|
function ssrCompile(template, instance) {
|
|
@@ -47178,7 +47203,7 @@
|
|
|
47178
47203
|
}, queryString, renderFunction);
|
|
47179
47204
|
}
|
|
47180
47205
|
|
|
47181
|
-
var version = "3.3.
|
|
47206
|
+
var version = "3.3.5";
|
|
47182
47207
|
|
|
47183
47208
|
var components = [RLConnected, ResultCard, ResultList, ReactiveBase, SBConnected, ListConnected, ListConnected$1, RangeConnected$1, RangeConnected$2, RangeConnected$3, RangeConnected, RcConnected, RcConnected$1, RcConnected$2, TBConnected, ListConnected$2, ListConnected$3, StateProviderConnected, RangeConnected$4, TreeListConnected, AIConnected];
|
|
47184
47209
|
function install$1 (Vue) {
|