@aurumjs/html 0.10.12

package/prebuilt/esnext/utilities/sanitize.js

@@ -0,0 +1,191 @@
+const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+// These elements either execute code, create a new parsing context, alter URL
+// resolution, or can activate content that was not inspected by this sanitizer.
+const UNSAFE_ELEMENTS = new Set([
+    'base',
+    'embed',
+    'frame',
+    'frameset',
+    'iframe',
+    'link',
+    'meta',
+    'noembed',
+    'noframes',
+    'noscript',
+    'object',
+    'plaintext',
+    'script',
+    'style',
+    'template',
+    'xmp'
+]);
+const URL_ATTRIBUTES = new Set([
+    'action',
+    'background',
+    'cite',
+    'formaction',
+    'href',
+    'longdesc',
+    'poster',
+    'src',
+    'xlink:href'
+]);
+const SAFE_URL_PROTOCOLS = new Set(['http:', 'https:', 'mailto:', 'tel:']);
+const UNSAFE_STYLE = /(?:url\s*\(|image-set\s*\(|@import|expression\s*\(|-moz-binding|behavior\s*:|javascript\s*:|\\)/i;
+/**
+ * Sanitizes HTML and returns its serialized representation.
+ *
+ * Prefer setSanitizedHTML when inserting the result into the DOM. Sanitization
+ * is context-sensitive, so serializing and reparsing HTML in a different
+ * element can reintroduce mutation-XSS hazards.
+ */
+export function sanitizeHTML(html, config = {}) {
+    const container = document.createElement('div');
+    setSanitizedHTML(container, html, config);
+    return container.innerHTML;
+}
+/**
+ * Safely replaces an element's children with sanitized HTML.
+ *
+ * The native safe HTML Sanitizer API is used when available. Browsers without
+ * it parse into a detached element and apply the same mandatory safety policy
+ * before any nodes are connected to the document.
+ */
+export function setSanitizedHTML(target, html, config = {}) {
+    const normalizedConfig = normalizeConfig(config);
+    if (setHTMLNatively(target, html)) {
+        applyPolicy(target, normalizedConfig);
+        return;
+    }
+    const staging = target.cloneNode(false);
+    staging.innerHTML = html;
+    applyPolicy(staging, normalizedConfig);
+    target.replaceChildren(...Array.from(staging.childNodes));
+}
+/** Safely appends or prepends sanitized HTML without rebuilding existing nodes. */
+export function insertSanitizedHTML(target, html, position, config = {}) {
+    const staging = target.cloneNode(false);
+    setSanitizedHTML(staging, html, config);
+    const fragment = target.ownerDocument.createDocumentFragment();
+    fragment.append(...Array.from(staging.childNodes));
+    if (position === 'append') {
+        target.append(fragment);
+    }
+    else {
+        target.prepend(fragment);
+    }
+}
+function setHTMLNatively(target, html) {
+    const setHTML = target.setHTML;
+    if (typeof setHTML !== 'function') {
+        return false;
+    }
+    try {
+        // setHTML always applies the browser's XSS-safe baseline, even when a
+        // custom removal configuration is supplied.
+        setHTML.call(target, html, {
+            sanitizer: {
+                removeElements: Array.from(UNSAFE_ELEMENTS)
+            }
+        });
+    }
+    catch {
+        // Early implementations used a different configuration shape. Their
+        // default safe sanitizer is preferable to falling back to innerHTML.
+        setHTML.call(target, html);
+    }
+    return true;
+}
+function applyPolicy(root, config) {
+    const elements = Array.from(root.querySelectorAll('*'));
+    for (const element of elements) {
+        if (!root.contains(element)) {
+            continue;
+        }
+        const tag = element.localName.toLowerCase();
+        if (element.namespaceURI !== HTML_NAMESPACE || UNSAFE_ELEMENTS.has(tag)) {
+            element.remove();
+            continue;
+        }
+        if (!isAllowed(tag, config.tagWhitelist, config.tagBlacklist)) {
+            element.replaceWith(...Array.from(element.childNodes));
+            continue;
+        }
+        sanitizeAttributes(element, config);
+    }
+}
+function sanitizeAttributes(element, config) {
+    var _a, _b;
+    for (const attribute of Array.from(element.attributes)) {
+        const name = attribute.name.toLowerCase();
+        const localName = attribute.localName.toLowerCase();
+        if (!isAllowed(name, config.attributeWhitelist, config.attributeBlacklist)) {
+            element.removeAttributeNode(attribute);
+            continue;
+        }
+        if (localName.startsWith('on') || localName === 'srcdoc') {
+            element.removeAttributeNode(attribute);
+            continue;
+        }
+        if (URL_ATTRIBUTES.has(name) && !isSafeURL(attribute.value, element.ownerDocument)) {
+            element.removeAttributeNode(attribute);
+            continue;
+        }
+        if (localName === 'srcset' && !isSafeSrcSet(attribute.value, element.ownerDocument)) {
+            element.removeAttributeNode(attribute);
+            continue;
+        }
+        if (localName === 'style' && UNSAFE_STYLE.test(attribute.value)) {
+            element.removeAttributeNode(attribute);
+        }
+    }
+    if (element.localName === 'a' && ((_a = element.getAttribute('target')) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === '_blank') {
+        const rel = new Set(((_b = element.getAttribute('rel')) !== null && _b !== void 0 ? _b : '').toLowerCase().split(/\s+/).filter(Boolean));
+        rel.add('noopener');
+        rel.add('noreferrer');
+        element.setAttribute('rel', Array.from(rel).join(' '));
+    }
+}
+function isSafeURL(value, document) {
+    const normalized = value.replace(/[\u0000-\u0020\u007f-\u009f]/g, '');
+    if (normalized === '' || normalized.startsWith('#')) {
+        return true;
+    }
+    if (/^(?:javascript|vbscript|data):/i.test(normalized)) {
+        return false;
+    }
+    try {
+        return SAFE_URL_PROTOCOLS.has(new URL(normalized, document.baseURI).protocol);
+    }
+    catch {
+        return false;
+    }
+}
+function isSafeSrcSet(value, document) {
+    if (/(?:javascript|vbscript|data)\s*:/i.test(value.replace(/[\u0000-\u0020\u007f-\u009f]/g, ''))) {
+        return false;
+    }
+    return value
+        .split(',')
+        .map((candidate) => candidate.trim().split(/\s+/)[0])
+        .filter(Boolean)
+        .every((candidate) => isSafeURL(candidate, document));
+}
+function normalizeConfig(config) {
+    return {
+        attributeBlacklist: toLowerCaseSet(config.attributeBlacklist),
+        attributeWhitelist: toLowerCaseSet(config.attributeWhitelist),
+        tagBlacklist: toLowerCaseSet(config.tagBlacklist),
+        tagWhitelist: toLowerCaseSet(config.tagWhitelist)
+    };
+}
+function toLowerCaseSet(values) {
+    return values ? new Set(values.map((value) => value.toLowerCase())) : undefined;
+}
+function isAllowed(value, allowList, rejectList) {
+    if (rejectList === null || rejectList === void 0 ? void 0 : rejectList.has(value)) {
+        return false;
+    }
+    return !allowList || allowList.has(value);
+}
+//# sourceMappingURL=sanitize.js.map

package/prebuilt/esnext/utilities/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/utilities/sanitize.ts"],"names":[],"mappings":"AAOA,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,UAAU;IACV,UAAU;IACV,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,OAAO;IACP,UAAU;IACV,KAAK;CACR,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC3B,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,YAAY;IACZ,MAAM;IACN,UAAU;IACV,QAAQ;IACR,KAAK;IACL,YAAY;CACf,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,MAAM,YAAY,GAAG,kGAAkG,CAAC;AASxH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAA6B,EAAE;IACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAChD,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,SAAS,CAAC,SAAS,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,IAAY,EAAE,SAA6B,EAAE;IAC/F,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACtC,OAAO;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAgB,CAAC;IACvD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvC,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAC/B,MAAmB,EACnB,IAAY,EACZ,QAA8B,EAC9B,SAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAgB,CAAC;IACvD,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC;IAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACJ,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,MAAmB,EAAE,IAAY;IACtD,MAAM,OAAO,GAAI,MAAgF,CAAC,OAAO,CAAC;IAC1G,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACD,sEAAsE;QACtE,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;YACvB,SAAS,EAAE;gBACP,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;aAC9C;SACJ,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACL,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB,EAAE,MAAgC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,SAAS;QACb,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,YAAY,KAAK,cAAc,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,SAAS;QACb,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACvD,SAAS;QACb,CAAC;QAED,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAgC;;IAC1E,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAEpD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS;QACb,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS;QACb,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACjF,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS;QACb,CAAC;QACD,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS;QACb,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,IAAI,CAAA,MAAA,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,0CAAE,WAAW,EAAE,MAAK,QAAQ,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,MAAA,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtB,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,QAAkB;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAkB;IACnD,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,KAAK;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,OAAO,CAAC;SACf,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IAC/C,OAAO;QACH,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC7D,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC7D,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;QACjD,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;KACpD,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACrC,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,SAAuB,EAAE,UAAwB;IAC/E,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}