@bigbinary/neeto-molecules 4.0.18 → 4.0.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (372) hide show
  1. package/dist/AuditLogs.js +5 -5
  2. package/dist/AuditLogs.js.map +1 -1
  3. package/dist/BoardView.js +6 -6
  4. package/dist/BoardView.js.map +1 -1
  5. package/dist/Breadcrumbs.js +1 -1
  6. package/dist/Breadcrumbs.js.map +1 -1
  7. package/dist/BrowserPreview.js +1 -1
  8. package/dist/BrowserPreview.js.map +1 -1
  9. package/dist/BrowserSupport.js +2 -2
  10. package/dist/BrowserSupport.js.map +1 -1
  11. package/dist/Builder.js +7 -7
  12. package/dist/Builder.js.map +1 -1
  13. package/dist/ButtonGroup.js +2 -2
  14. package/dist/ButtonGroup.js.map +1 -1
  15. package/dist/CalendarView.js +4 -4
  16. package/dist/CalendarView.js.map +1 -1
  17. package/dist/CardLayout.js.map +1 -1
  18. package/dist/{Chevron-DEQtNhrI.js → Chevron-BFX_mIg6.js} +5 -5
  19. package/dist/{Chevron-DEQtNhrI.js.map → Chevron-BFX_mIg6.js.map} +1 -1
  20. package/dist/Codeblock.js +2 -2
  21. package/dist/Codeblock.js.map +1 -1
  22. package/dist/{Columns-CwbG5wLv.js → Columns-xoAs08GC.js} +6 -6
  23. package/dist/{Columns-CwbG5wLv.js.map → Columns-xoAs08GC.js.map} +1 -1
  24. package/dist/Columns.js +2 -2
  25. package/dist/ConfigurePageSidebar.js +2 -2
  26. package/dist/ConfigurePageSidebar.js.map +1 -1
  27. package/dist/ConfirmationModal.js.map +1 -1
  28. package/dist/Container.js +1 -1
  29. package/dist/Container.js.map +1 -1
  30. package/dist/CopyToClipboardButton.js +2 -2
  31. package/dist/CopyToClipboardButton.js.map +1 -1
  32. package/dist/Currency.js +2 -2
  33. package/dist/Currency.js.map +1 -1
  34. package/dist/DateFormat.js +1 -1
  35. package/dist/DateFormat.js.map +1 -1
  36. package/dist/DateRangeFilter.js +1 -1
  37. package/dist/DateRangeFilter.js.map +1 -1
  38. package/dist/DeleteArchiveModal.js.map +1 -1
  39. package/dist/DeviceIncompatibilityMessage.js.map +1 -1
  40. package/dist/DocumentEditor.js +2 -2
  41. package/dist/DocumentEditor.js.map +1 -1
  42. package/dist/DownloadMobileAppCallout.js.map +1 -1
  43. package/dist/DynamicVariables.js +2 -2
  44. package/dist/DynamicVariables.js.map +1 -1
  45. package/dist/EmailForm.js +5 -5
  46. package/dist/EmailForm.js.map +1 -1
  47. package/dist/EmailPreview.js.map +1 -1
  48. package/dist/EmojiPicker.js +1 -1
  49. package/dist/EmojiPicker.js.map +1 -1
  50. package/dist/EmojiReactions.js.map +1 -1
  51. package/dist/Engagements.js +2 -2
  52. package/dist/Engagements.js.map +1 -1
  53. package/dist/ErrorPage.js +369 -657
  54. package/dist/ErrorPage.js.map +1 -1
  55. package/dist/FileUpload.js +14 -14
  56. package/dist/FileUpload.js.map +1 -1
  57. package/dist/FinderModal.js +3 -3
  58. package/dist/FinderModal.js.map +1 -1
  59. package/dist/FloatingActionMenu.js +7 -7
  60. package/dist/FloatingActionMenu.js.map +1 -1
  61. package/dist/GoogleFontPicker.js +21 -21
  62. package/dist/GoogleFontPicker.js.map +1 -1
  63. package/dist/Header.js +2 -2
  64. package/dist/Header.js.map +1 -1
  65. package/dist/HelpPopover.js +1 -1
  66. package/dist/HelpPopover.js.map +1 -1
  67. package/dist/IconPicker.js +2 -2
  68. package/dist/IconPicker.js.map +1 -1
  69. package/dist/ImageWithFallback.js +2 -2
  70. package/dist/ImageWithFallback.js.map +1 -1
  71. package/dist/InlineInput.js +17 -17
  72. package/dist/InlineInput.js.map +1 -1
  73. package/dist/Insights.js +2 -8
  74. package/dist/Insights.js.map +1 -1
  75. package/dist/IntegrationCard.js +3 -3
  76. package/dist/IntegrationCard.js.map +1 -1
  77. package/dist/IpRestriction.js +574 -488
  78. package/dist/IpRestriction.js.map +1 -1
  79. package/dist/KeyboardShortcuts.js +2 -4
  80. package/dist/KeyboardShortcuts.js.map +1 -1
  81. package/dist/LoginPage.js +23 -24
  82. package/dist/LoginPage.js.map +1 -1
  83. package/dist/MadeWith.js +2 -2
  84. package/dist/MadeWith.js.map +1 -1
  85. package/dist/MenuBar.js +6 -6
  86. package/dist/MenuBar.js.map +1 -1
  87. package/dist/Metadata.js +1 -1
  88. package/dist/Metadata.js.map +1 -1
  89. package/dist/MobilePreviewHeader.js.map +1 -1
  90. package/dist/MoreDropdown.js +4 -4
  91. package/dist/MoreDropdown.js.map +1 -1
  92. package/dist/NavigationHeader.js +4 -4
  93. package/dist/NavigationHeader.js.map +1 -1
  94. package/dist/NeetoWidget.js +5 -5
  95. package/dist/NeetoWidget.js.map +1 -1
  96. package/dist/Onboarding.js +4 -4
  97. package/dist/Onboarding.js.map +1 -1
  98. package/dist/OptionFields.js +7 -7
  99. package/dist/OptionFields.js.map +1 -1
  100. package/dist/PageLoader.js +2 -2
  101. package/dist/PageLoader.js.map +1 -1
  102. package/dist/PhoneNumber.js +5 -6
  103. package/dist/PhoneNumber.js.map +1 -1
  104. package/dist/ProductEmbed.js +6 -6
  105. package/dist/ProductEmbed.js.map +1 -1
  106. package/dist/PublishBlock.js +3 -3
  107. package/dist/PublishBlock.js.map +1 -1
  108. package/dist/PublishYourItem.js.map +1 -1
  109. package/dist/Rename.js +5 -5
  110. package/dist/Rename.js.map +1 -1
  111. package/dist/ResponsiveDevicePicker.js +2 -2
  112. package/dist/ResponsiveDevicePicker.js.map +1 -1
  113. package/dist/Schedule.js +3 -3
  114. package/dist/Schedule.js.map +1 -1
  115. package/dist/Scrollable.js +2 -2
  116. package/dist/Scrollable.js.map +1 -1
  117. package/dist/Search.js +2 -2
  118. package/dist/Search.js.map +1 -1
  119. package/dist/SendToFields.js +93 -70
  120. package/dist/SendToFields.js.map +1 -1
  121. package/dist/SessionEnvironment.js +3 -4
  122. package/dist/SessionEnvironment.js.map +1 -1
  123. package/dist/Settings.js +6 -6
  124. package/dist/Settings.js.map +1 -1
  125. package/dist/ShareRecordingPane.js +2 -2
  126. package/dist/ShareRecordingPane.js.map +1 -1
  127. package/dist/ShareViaEmail.js +3 -3
  128. package/dist/ShareViaEmail.js.map +1 -1
  129. package/dist/ShareViaLink.js +30 -30
  130. package/dist/ShareViaLink.js.map +1 -1
  131. package/dist/Sidebar.js +6 -6
  132. package/dist/Sidebar.js.map +1 -1
  133. package/dist/StatusDropdown.js +2 -2
  134. package/dist/StatusDropdown.js.map +1 -1
  135. package/dist/StickyRibbonsContainer.js +10 -12
  136. package/dist/StickyRibbonsContainer.js.map +1 -1
  137. package/dist/SubHeader.js +5 -5
  138. package/dist/SubHeader.js.map +1 -1
  139. package/dist/SubscriptionNotificationsContainer.js +1 -1
  140. package/dist/SubscriptionNotificationsContainer.js.map +1 -1
  141. package/dist/SuffixedInput.js +2 -2
  142. package/dist/SuffixedInput.js.map +1 -1
  143. package/dist/TableWrapper.js +1 -1
  144. package/dist/TableWrapper.js.map +1 -1
  145. package/dist/Taxonomy.js +16 -16
  146. package/dist/Taxonomy.js.map +1 -1
  147. package/dist/TimeFormat.js.map +1 -1
  148. package/dist/TimezoneMismatchModal.js.map +1 -1
  149. package/dist/ToggleFeatureCard.js +3 -3
  150. package/dist/ToggleFeatureCard.js.map +1 -1
  151. package/dist/VersionHistory.js +3 -3
  152. package/dist/VersionHistory.js.map +1 -1
  153. package/dist/cjs/AuditLogs.js +5 -5
  154. package/dist/cjs/AuditLogs.js.map +1 -1
  155. package/dist/cjs/BoardView.js +6 -6
  156. package/dist/cjs/BoardView.js.map +1 -1
  157. package/dist/cjs/Breadcrumbs.js +1 -1
  158. package/dist/cjs/Breadcrumbs.js.map +1 -1
  159. package/dist/cjs/BrowserPreview.js +1 -1
  160. package/dist/cjs/BrowserPreview.js.map +1 -1
  161. package/dist/cjs/BrowserSupport.js +2 -2
  162. package/dist/cjs/BrowserSupport.js.map +1 -1
  163. package/dist/cjs/Builder.js +6 -6
  164. package/dist/cjs/Builder.js.map +1 -1
  165. package/dist/cjs/ButtonGroup.js +2 -2
  166. package/dist/cjs/ButtonGroup.js.map +1 -1
  167. package/dist/cjs/CalendarView.js +4 -4
  168. package/dist/cjs/CalendarView.js.map +1 -1
  169. package/dist/cjs/CardLayout.js.map +1 -1
  170. package/dist/cjs/{Chevron-u-rD2gAf.js → Chevron-ClvaNo3d.js} +5 -5
  171. package/dist/cjs/{Chevron-u-rD2gAf.js.map → Chevron-ClvaNo3d.js.map} +1 -1
  172. package/dist/cjs/Codeblock.js +2 -2
  173. package/dist/cjs/Codeblock.js.map +1 -1
  174. package/dist/cjs/{Columns-CZDLxh70.js → Columns-C95kM2yL.js} +6 -6
  175. package/dist/cjs/{Columns-CZDLxh70.js.map → Columns-C95kM2yL.js.map} +1 -1
  176. package/dist/cjs/Columns.js +2 -2
  177. package/dist/cjs/ConfigurePageSidebar.js +2 -2
  178. package/dist/cjs/ConfigurePageSidebar.js.map +1 -1
  179. package/dist/cjs/ConfirmationModal.js.map +1 -1
  180. package/dist/cjs/Container.js +1 -1
  181. package/dist/cjs/Container.js.map +1 -1
  182. package/dist/cjs/CopyToClipboardButton.js +2 -2
  183. package/dist/cjs/CopyToClipboardButton.js.map +1 -1
  184. package/dist/cjs/Currency.js +2 -2
  185. package/dist/cjs/Currency.js.map +1 -1
  186. package/dist/cjs/DateFormat.js +1 -1
  187. package/dist/cjs/DateFormat.js.map +1 -1
  188. package/dist/cjs/DateRangeFilter.js +1 -1
  189. package/dist/cjs/DateRangeFilter.js.map +1 -1
  190. package/dist/cjs/DeleteArchiveModal.js.map +1 -1
  191. package/dist/cjs/DeviceIncompatibilityMessage.js.map +1 -1
  192. package/dist/cjs/DocumentEditor.js +2 -2
  193. package/dist/cjs/DocumentEditor.js.map +1 -1
  194. package/dist/cjs/DownloadMobileAppCallout.js.map +1 -1
  195. package/dist/cjs/DynamicVariables.js +2 -2
  196. package/dist/cjs/DynamicVariables.js.map +1 -1
  197. package/dist/cjs/EmailForm.js +5 -5
  198. package/dist/cjs/EmailForm.js.map +1 -1
  199. package/dist/cjs/EmailPreview.js.map +1 -1
  200. package/dist/cjs/EmojiPicker.js +1 -1
  201. package/dist/cjs/EmojiPicker.js.map +1 -1
  202. package/dist/cjs/EmojiReactions.js.map +1 -1
  203. package/dist/cjs/Engagements.js +2 -2
  204. package/dist/cjs/Engagements.js.map +1 -1
  205. package/dist/cjs/ErrorPage.js +369 -657
  206. package/dist/cjs/ErrorPage.js.map +1 -1
  207. package/dist/cjs/FileUpload.js +14 -14
  208. package/dist/cjs/FileUpload.js.map +1 -1
  209. package/dist/cjs/FinderModal.js +3 -3
  210. package/dist/cjs/FinderModal.js.map +1 -1
  211. package/dist/cjs/FloatingActionMenu.js +6 -6
  212. package/dist/cjs/FloatingActionMenu.js.map +1 -1
  213. package/dist/cjs/GoogleFontPicker.js +21 -21
  214. package/dist/cjs/GoogleFontPicker.js.map +1 -1
  215. package/dist/cjs/Header.js +2 -2
  216. package/dist/cjs/Header.js.map +1 -1
  217. package/dist/cjs/HelpPopover.js +1 -1
  218. package/dist/cjs/HelpPopover.js.map +1 -1
  219. package/dist/cjs/IconPicker.js +2 -2
  220. package/dist/cjs/IconPicker.js.map +1 -1
  221. package/dist/cjs/ImageWithFallback.js +2 -2
  222. package/dist/cjs/ImageWithFallback.js.map +1 -1
  223. package/dist/cjs/InlineInput.js +17 -17
  224. package/dist/cjs/InlineInput.js.map +1 -1
  225. package/dist/cjs/Insights.js +2 -8
  226. package/dist/cjs/Insights.js.map +1 -1
  227. package/dist/cjs/IntegrationCard.js +3 -3
  228. package/dist/cjs/IntegrationCard.js.map +1 -1
  229. package/dist/cjs/IpRestriction.js +574 -488
  230. package/dist/cjs/IpRestriction.js.map +1 -1
  231. package/dist/cjs/KeyboardShortcuts.js +2 -4
  232. package/dist/cjs/KeyboardShortcuts.js.map +1 -1
  233. package/dist/cjs/LoginPage.js +23 -24
  234. package/dist/cjs/LoginPage.js.map +1 -1
  235. package/dist/cjs/MadeWith.js +2 -2
  236. package/dist/cjs/MadeWith.js.map +1 -1
  237. package/dist/cjs/MenuBar.js +6 -6
  238. package/dist/cjs/MenuBar.js.map +1 -1
  239. package/dist/cjs/Metadata.js +1 -1
  240. package/dist/cjs/Metadata.js.map +1 -1
  241. package/dist/cjs/MobilePreviewHeader.js.map +1 -1
  242. package/dist/cjs/MoreDropdown.js +4 -4
  243. package/dist/cjs/MoreDropdown.js.map +1 -1
  244. package/dist/cjs/NavigationHeader.js +4 -4
  245. package/dist/cjs/NavigationHeader.js.map +1 -1
  246. package/dist/cjs/NeetoWidget.js +5 -5
  247. package/dist/cjs/NeetoWidget.js.map +1 -1
  248. package/dist/cjs/Onboarding.js +3 -3
  249. package/dist/cjs/Onboarding.js.map +1 -1
  250. package/dist/cjs/OptionFields.js +6 -6
  251. package/dist/cjs/OptionFields.js.map +1 -1
  252. package/dist/cjs/PageLoader.js +2 -2
  253. package/dist/cjs/PageLoader.js.map +1 -1
  254. package/dist/cjs/PhoneNumber.js +4 -5
  255. package/dist/cjs/PhoneNumber.js.map +1 -1
  256. package/dist/cjs/ProductEmbed.js +5 -5
  257. package/dist/cjs/ProductEmbed.js.map +1 -1
  258. package/dist/cjs/PublishBlock.js +3 -3
  259. package/dist/cjs/PublishBlock.js.map +1 -1
  260. package/dist/cjs/PublishYourItem.js.map +1 -1
  261. package/dist/cjs/Rename.js +5 -5
  262. package/dist/cjs/Rename.js.map +1 -1
  263. package/dist/cjs/ResponsiveDevicePicker.js +2 -2
  264. package/dist/cjs/ResponsiveDevicePicker.js.map +1 -1
  265. package/dist/cjs/Schedule.js +3 -3
  266. package/dist/cjs/Schedule.js.map +1 -1
  267. package/dist/cjs/Scrollable.js +2 -2
  268. package/dist/cjs/Scrollable.js.map +1 -1
  269. package/dist/cjs/Search.js +2 -2
  270. package/dist/cjs/Search.js.map +1 -1
  271. package/dist/cjs/SendToFields.js +93 -70
  272. package/dist/cjs/SendToFields.js.map +1 -1
  273. package/dist/cjs/SessionEnvironment.js +3 -4
  274. package/dist/cjs/SessionEnvironment.js.map +1 -1
  275. package/dist/cjs/Settings.js +6 -6
  276. package/dist/cjs/Settings.js.map +1 -1
  277. package/dist/cjs/ShareRecordingPane.js +2 -2
  278. package/dist/cjs/ShareRecordingPane.js.map +1 -1
  279. package/dist/cjs/ShareViaEmail.js +3 -3
  280. package/dist/cjs/ShareViaEmail.js.map +1 -1
  281. package/dist/cjs/ShareViaLink.js +24 -24
  282. package/dist/cjs/ShareViaLink.js.map +1 -1
  283. package/dist/cjs/Sidebar.js +5 -5
  284. package/dist/cjs/Sidebar.js.map +1 -1
  285. package/dist/cjs/StatusDropdown.js +2 -2
  286. package/dist/cjs/StatusDropdown.js.map +1 -1
  287. package/dist/cjs/StickyRibbonsContainer.js +10 -12
  288. package/dist/cjs/StickyRibbonsContainer.js.map +1 -1
  289. package/dist/cjs/SubHeader.js +5 -5
  290. package/dist/cjs/SubHeader.js.map +1 -1
  291. package/dist/cjs/SubscriptionNotificationsContainer.js +1 -1
  292. package/dist/cjs/SubscriptionNotificationsContainer.js.map +1 -1
  293. package/dist/cjs/SuffixedInput.js +2 -2
  294. package/dist/cjs/SuffixedInput.js.map +1 -1
  295. package/dist/cjs/TableWrapper.js +1 -1
  296. package/dist/cjs/TableWrapper.js.map +1 -1
  297. package/dist/cjs/Taxonomy.js +16 -16
  298. package/dist/cjs/Taxonomy.js.map +1 -1
  299. package/dist/cjs/TimeFormat.js.map +1 -1
  300. package/dist/cjs/TimezoneMismatchModal.js.map +1 -1
  301. package/dist/cjs/ToggleFeatureCard.js +3 -3
  302. package/dist/cjs/ToggleFeatureCard.js.map +1 -1
  303. package/dist/cjs/VersionHistory.js +3 -3
  304. package/dist/cjs/VersionHistory.js.map +1 -1
  305. package/dist/cjs/index-JY2zVpnv.js.map +1 -1
  306. package/dist/cjs/inject-css-B6qYtOJe.js +6 -0
  307. package/dist/cjs/inject-css-B6qYtOJe.js.map +1 -0
  308. package/dist/cjs/{phone-number-C93qn93_.js → phone-number-1EDAr56u.js} +34 -24
  309. package/dist/cjs/phone-number-1EDAr56u.js.map +1 -0
  310. package/dist/cjs/platform-BUcCb8Jx.js.map +1 -1
  311. package/dist/cjs/useKeyboardShortcutsPaneState-YnXpWOcs.js.map +1 -1
  312. package/dist/index-DAYCJu79.js.map +1 -1
  313. package/dist/inject-css-C2dztUxs.js +4 -0
  314. package/dist/inject-css-C2dztUxs.js.map +1 -0
  315. package/dist/{phone-number-CSXPpNBP.js → phone-number-BDkpXCIq.js} +36 -26
  316. package/dist/phone-number-BDkpXCIq.js.map +1 -0
  317. package/dist/platform-F44zJ4Xh.js.map +1 -1
  318. package/dist/useKeyboardShortcutsPaneState-C_eLceJQ.js.map +1 -1
  319. package/package.json +12 -14
  320. package/types/ButtonGroup.d.ts +2 -1
  321. package/types/CopyToClipboardButton.d.ts +2 -1
  322. package/types/EmailPreview.d.ts +2 -1
  323. package/types/FileUpload.d.ts +2 -1
  324. package/types/Header.d.ts +2 -1
  325. package/types/HelpPopover.d.ts +2 -1
  326. package/types/InlineInput.d.ts +2 -1
  327. package/types/IntegrationCard.d.ts +2 -1
  328. package/types/MoreDropdown.d.ts +1 -1
  329. package/types/PhoneNumber.d.ts +2 -1
  330. package/types/PublishBlock.d.ts +1 -1
  331. package/types/SubHeader.d.ts +1 -1
  332. package/types/ToggleFeatureCard.d.ts +1 -1
  333. package/dist/cjs/inject-css-vQvjPR2x.js +0 -6
  334. package/dist/cjs/inject-css-vQvjPR2x.js.map +0 -1
  335. package/dist/cjs/phone-number-C93qn93_.js.map +0 -1
  336. package/dist/inject-css-DmrvuTKK.js +0 -4
  337. package/dist/inject-css-DmrvuTKK.js.map +0 -1
  338. package/dist/phone-number-CSXPpNBP.js.map +0 -1
  339. package/src/translations/ar.json +0 -867
  340. package/src/translations/bg.json +0 -119
  341. package/src/translations/ca.json +0 -867
  342. package/src/translations/cs.json +0 -867
  343. package/src/translations/da.json +0 -867
  344. package/src/translations/de.json +0 -867
  345. package/src/translations/en.json +0 -867
  346. package/src/translations/es-MX.json +0 -867
  347. package/src/translations/es.json +0 -867
  348. package/src/translations/et.json +0 -867
  349. package/src/translations/fi.json +0 -867
  350. package/src/translations/fil.json +0 -867
  351. package/src/translations/fr.json +0 -867
  352. package/src/translations/hi.json +0 -119
  353. package/src/translations/hr.json +0 -867
  354. package/src/translations/id.json +0 -867
  355. package/src/translations/it.json +0 -867
  356. package/src/translations/ja.json +0 -867
  357. package/src/translations/ko.json +0 -867
  358. package/src/translations/nl.json +0 -867
  359. package/src/translations/pl.json +0 -867
  360. package/src/translations/pt-BR.json +0 -867
  361. package/src/translations/pt.json +0 -867
  362. package/src/translations/ro.json +0 -867
  363. package/src/translations/ru.json +0 -867
  364. package/src/translations/sk.json +0 -867
  365. package/src/translations/sl.json +0 -867
  366. package/src/translations/sv.json +0 -867
  367. package/src/translations/th.json +0 -867
  368. package/src/translations/tr.json +0 -867
  369. package/src/translations/uk.json +0 -867
  370. package/src/translations/vi.json +0 -867
  371. package/src/translations/zh-CN.json +0 -867
  372. package/src/translations/zh-TW.json +0 -867
@@ -8,7 +8,7 @@ var Button = require('@bigbinary/neetoui/Button');
8
8
  var Typography = require('@bigbinary/neetoui/Typography');
9
9
  var reactHelmet = require('react-helmet');
10
10
  var reactI18next = require('react-i18next');
11
- var injectCss = require('./inject-css-vQvjPR2x.js');
11
+ var injectCss = require('./inject-css-B6qYtOJe.js');
12
12
  var jsxRuntime = require('react/jsx-runtime');
13
13
 
14
14
  function _interopNamespaceDefault(e) {
@@ -30,7 +30,7 @@ function _interopNamespaceDefault(e) {
30
30
 
31
31
  var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
32
32
 
33
- /*! @license DOMPurify 3.0.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.3/LICENSE */
33
+ /*! @license DOMPurify 3.2.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.6/LICENSE */
34
34
 
35
35
  const {
36
36
  entries,
@@ -44,227 +44,259 @@ let {
44
44
  seal,
45
45
  create
46
46
  } = Object; // eslint-disable-line import/no-mutable-exports
47
-
48
47
  let {
49
48
  apply,
50
49
  construct
51
50
  } = typeof Reflect !== 'undefined' && Reflect;
52
-
53
- if (!apply) {
54
- apply = function apply(fun, thisValue, args) {
55
- return fun.apply(thisValue, args);
56
- };
57
- }
58
-
59
51
  if (!freeze) {
60
52
  freeze = function freeze(x) {
61
53
  return x;
62
54
  };
63
55
  }
64
-
65
56
  if (!seal) {
66
57
  seal = function seal(x) {
67
58
  return x;
68
59
  };
69
60
  }
70
-
61
+ if (!apply) {
62
+ apply = function apply(fun, thisValue, args) {
63
+ return fun.apply(thisValue, args);
64
+ };
65
+ }
71
66
  if (!construct) {
72
67
  construct = function construct(Func, args) {
73
68
  return new Func(...args);
74
69
  };
75
70
  }
76
-
77
71
  const arrayForEach = unapply(Array.prototype.forEach);
72
+ const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
78
73
  const arrayPop = unapply(Array.prototype.pop);
79
74
  const arrayPush = unapply(Array.prototype.push);
75
+ const arraySplice = unapply(Array.prototype.splice);
80
76
  const stringToLowerCase = unapply(String.prototype.toLowerCase);
81
77
  const stringToString = unapply(String.prototype.toString);
82
78
  const stringMatch = unapply(String.prototype.match);
83
79
  const stringReplace = unapply(String.prototype.replace);
84
80
  const stringIndexOf = unapply(String.prototype.indexOf);
85
81
  const stringTrim = unapply(String.prototype.trim);
82
+ const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
86
83
  const regExpTest = unapply(RegExp.prototype.test);
87
84
  const typeErrorCreate = unconstruct(TypeError);
85
+ /**
86
+ * Creates a new function that calls the given function with a specified thisArg and arguments.
87
+ *
88
+ * @param func - The function to be wrapped and called.
89
+ * @returns A new function that calls the given function with a specified thisArg and arguments.
90
+ */
88
91
  function unapply(func) {
89
92
  return function (thisArg) {
93
+ if (thisArg instanceof RegExp) {
94
+ thisArg.lastIndex = 0;
95
+ }
90
96
  for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
91
97
  args[_key - 1] = arguments[_key];
92
98
  }
93
-
94
99
  return apply(func, thisArg, args);
95
100
  };
96
101
  }
102
+ /**
103
+ * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
104
+ *
105
+ * @param func - The constructor function to be wrapped and called.
106
+ * @returns A new function that constructs an instance of the given constructor function with the provided arguments.
107
+ */
97
108
  function unconstruct(func) {
98
109
  return function () {
99
110
  for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
100
111
  args[_key2] = arguments[_key2];
101
112
  }
102
-
103
113
  return construct(func, args);
104
114
  };
105
115
  }
106
- /* Add properties to a lookup table */
107
-
108
- function addToSet(set, array, transformCaseFunc) {
109
- var _transformCaseFunc;
110
-
111
- transformCaseFunc = (_transformCaseFunc = transformCaseFunc) !== null && _transformCaseFunc !== void 0 ? _transformCaseFunc : stringToLowerCase;
112
-
116
+ /**
117
+ * Add properties to a lookup table
118
+ *
119
+ * @param set - The set to which elements will be added.
120
+ * @param array - The array containing elements to be added to the set.
121
+ * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
122
+ * @returns The modified set with added elements.
123
+ */
124
+ function addToSet(set, array) {
125
+ let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
113
126
  if (setPrototypeOf) {
114
127
  // Make 'in' and truthy checks like Boolean(set.constructor)
115
128
  // independent of any properties defined on Object.prototype.
116
129
  // Prevent prototype setters from intercepting set as a this value.
117
130
  setPrototypeOf(set, null);
118
131
  }
119
-
120
132
  let l = array.length;
121
-
122
133
  while (l--) {
123
134
  let element = array[l];
124
-
125
135
  if (typeof element === 'string') {
126
136
  const lcElement = transformCaseFunc(element);
127
-
128
137
  if (lcElement !== element) {
129
138
  // Config presets (e.g. tags.js, attrs.js) are immutable.
130
139
  if (!isFrozen(array)) {
131
140
  array[l] = lcElement;
132
141
  }
133
-
134
142
  element = lcElement;
135
143
  }
136
144
  }
137
-
138
145
  set[element] = true;
139
146
  }
140
-
141
147
  return set;
142
148
  }
143
- /* Shallow clone an object */
144
-
149
+ /**
150
+ * Clean up an array to harden against CSPP
151
+ *
152
+ * @param array - The array to be cleaned.
153
+ * @returns The cleaned version of the array
154
+ */
155
+ function cleanArray(array) {
156
+ for (let index = 0; index < array.length; index++) {
157
+ const isPropertyExist = objectHasOwnProperty(array, index);
158
+ if (!isPropertyExist) {
159
+ array[index] = null;
160
+ }
161
+ }
162
+ return array;
163
+ }
164
+ /**
165
+ * Shallow clone an object
166
+ *
167
+ * @param object - The object to be cloned.
168
+ * @returns A new object that copies the original.
169
+ */
145
170
  function clone(object) {
146
171
  const newObject = create(null);
147
-
148
172
  for (const [property, value] of entries(object)) {
149
- newObject[property] = value;
173
+ const isPropertyExist = objectHasOwnProperty(object, property);
174
+ if (isPropertyExist) {
175
+ if (Array.isArray(value)) {
176
+ newObject[property] = cleanArray(value);
177
+ } else if (value && typeof value === 'object' && value.constructor === Object) {
178
+ newObject[property] = clone(value);
179
+ } else {
180
+ newObject[property] = value;
181
+ }
182
+ }
150
183
  }
151
-
152
184
  return newObject;
153
185
  }
154
- /* This method automatically checks if the prop is function
155
- * or getter and behaves accordingly. */
156
-
186
+ /**
187
+ * This method automatically checks if the prop is function or getter and behaves accordingly.
188
+ *
189
+ * @param object - The object to look up the getter function in its prototype chain.
190
+ * @param prop - The property name for which to find the getter function.
191
+ * @returns The getter function found in the prototype chain or a fallback function.
192
+ */
157
193
  function lookupGetter(object, prop) {
158
194
  while (object !== null) {
159
195
  const desc = getOwnPropertyDescriptor(object, prop);
160
-
161
196
  if (desc) {
162
197
  if (desc.get) {
163
198
  return unapply(desc.get);
164
199
  }
165
-
166
200
  if (typeof desc.value === 'function') {
167
201
  return unapply(desc.value);
168
202
  }
169
203
  }
170
-
171
204
  object = getPrototypeOf(object);
172
205
  }
173
-
174
- function fallbackValue(element) {
175
- console.warn('fallback value for', element);
206
+ function fallbackValue() {
176
207
  return null;
177
208
  }
178
-
179
209
  return fallbackValue;
180
210
  }
181
211
 
182
- const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
183
-
212
+ const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
184
213
  const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
185
- const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
214
+ const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
215
+ // List of SVG elements that are disallowed by default.
186
216
  // We still need to know them so that we can do namespace
187
217
  // checks properly in case one wants to add them to
188
218
  // allow-list.
189
-
190
219
  const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
191
- const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']); // Similarly to SVG, we want to know all MathML elements,
220
+ const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
221
+ // Similarly to SVG, we want to know all MathML elements,
192
222
  // even those that we disallow by default.
193
-
194
223
  const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
195
224
  const text = freeze(['#text']);
196
225
 
197
- const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
198
- const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
226
+ const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
227
+ const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
199
228
  const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
200
229
  const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
201
230
 
231
+ // eslint-disable-next-line unicorn/better-regex
202
232
  const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
203
-
204
233
  const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
205
- const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
206
- const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
207
-
234
+ const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm); // eslint-disable-line unicorn/better-regex
235
+ const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
208
236
  const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
209
-
210
- const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
237
+ const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
211
238
  );
212
239
  const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
213
240
  const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
214
241
  );
215
242
  const DOCTYPE_NAME = seal(/^html$/i);
243
+ const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
216
244
 
217
245
  var EXPRESSIONS = /*#__PURE__*/Object.freeze({
218
246
  __proto__: null,
219
- MUSTACHE_EXPR: MUSTACHE_EXPR,
220
- ERB_EXPR: ERB_EXPR,
221
- TMPLIT_EXPR: TMPLIT_EXPR,
222
- DATA_ATTR: DATA_ATTR,
223
247
  ARIA_ATTR: ARIA_ATTR,
248
+ ATTR_WHITESPACE: ATTR_WHITESPACE,
249
+ CUSTOM_ELEMENT: CUSTOM_ELEMENT,
250
+ DATA_ATTR: DATA_ATTR,
251
+ DOCTYPE_NAME: DOCTYPE_NAME,
252
+ ERB_EXPR: ERB_EXPR,
224
253
  IS_ALLOWED_URI: IS_ALLOWED_URI,
225
254
  IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
226
- ATTR_WHITESPACE: ATTR_WHITESPACE,
227
- DOCTYPE_NAME: DOCTYPE_NAME
255
+ MUSTACHE_EXPR: MUSTACHE_EXPR,
256
+ TMPLIT_EXPR: TMPLIT_EXPR
228
257
  });
229
258
 
230
- const getGlobal = () => typeof window === 'undefined' ? null : window;
259
+ /* eslint-disable @typescript-eslint/indent */
260
+ // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
261
+ const NODE_TYPE = {
262
+ element: 1,
263
+ text: 3,
264
+ // Deprecated
265
+ progressingInstruction: 7,
266
+ comment: 8,
267
+ document: 9};
268
+ const getGlobal = function getGlobal() {
269
+ return typeof window === 'undefined' ? null : window;
270
+ };
231
271
  /**
232
272
  * Creates a no-op policy for internal use only.
233
273
  * Don't export this function outside this module!
234
- * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
235
- * @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
236
- * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
274
+ * @param trustedTypes The policy factory.
275
+ * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
276
+ * @return The policy created (or null, if Trusted Types
237
277
  * are not supported or creating the policy failed).
238
278
  */
239
-
240
-
241
279
  const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
242
280
  if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
243
281
  return null;
244
- } // Allow the callers to control the unique policy name
282
+ }
283
+ // Allow the callers to control the unique policy name
245
284
  // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
246
285
  // Policy creation with duplicate names throws in Trusted Types.
247
-
248
-
249
286
  let suffix = null;
250
287
  const ATTR_NAME = 'data-tt-policy-suffix';
251
-
252
288
  if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
253
289
  suffix = purifyHostElement.getAttribute(ATTR_NAME);
254
290
  }
255
-
256
291
  const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
257
-
258
292
  try {
259
293
  return trustedTypes.createPolicy(policyName, {
260
294
  createHTML(html) {
261
295
  return html;
262
296
  },
263
-
264
297
  createScriptURL(scriptUrl) {
265
298
  return scriptUrl;
266
299
  }
267
-
268
300
  });
269
301
  } catch (_) {
270
302
  // Policy creation failed (most likely another DOMPurify script has
@@ -274,37 +306,35 @@ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedType
274
306
  return null;
275
307
  }
276
308
  };
277
-
309
+ const _createHooksMap = function _createHooksMap() {
310
+ return {
311
+ afterSanitizeAttributes: [],
312
+ afterSanitizeElements: [],
313
+ afterSanitizeShadowDOM: [],
314
+ beforeSanitizeAttributes: [],
315
+ beforeSanitizeElements: [],
316
+ beforeSanitizeShadowDOM: [],
317
+ uponSanitizeAttribute: [],
318
+ uponSanitizeElement: [],
319
+ uponSanitizeShadowNode: []
320
+ };
321
+ };
278
322
  function createDOMPurify() {
279
323
  let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
280
-
281
324
  const DOMPurify = root => createDOMPurify(root);
282
- /**
283
- * Version label, exposed for easier checks
284
- * if DOMPurify is up to date or not
285
- */
286
-
287
-
288
- DOMPurify.version = '3.0.3';
289
- /**
290
- * Array of elements that DOMPurify removed during sanitation.
291
- * Empty if nothing was removed.
292
- */
293
-
325
+ DOMPurify.version = '3.2.6';
294
326
  DOMPurify.removed = [];
295
-
296
- if (!window || !window.document || window.document.nodeType !== 9) {
327
+ if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
297
328
  // Not running in a browser, provide a factory function
298
329
  // so that you can pass your own Window
299
330
  DOMPurify.isSupported = false;
300
331
  return DOMPurify;
301
332
  }
302
-
303
- const originalDocument = window.document;
304
- const currentScript = originalDocument.currentScript;
305
333
  let {
306
334
  document
307
335
  } = window;
336
+ const originalDocument = document;
337
+ const currentScript = originalDocument.currentScript;
308
338
  const {
309
339
  DocumentFragment,
310
340
  HTMLTemplateElement,
@@ -318,23 +348,22 @@ function createDOMPurify() {
318
348
  } = window;
319
349
  const ElementPrototype = Element.prototype;
320
350
  const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
351
+ const remove = lookupGetter(ElementPrototype, 'remove');
321
352
  const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
322
353
  const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
323
- const getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
354
+ const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
355
+ // As per issue #47, the web-components registry is inherited by a
324
356
  // new document created via createHTMLDocument. As per the spec
325
357
  // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
326
358
  // a new empty registry is used when creating a template contents owner
327
359
  // document, so we use that as our parent document to ensure nothing
328
360
  // is inherited.
329
-
330
361
  if (typeof HTMLTemplateElement === 'function') {
331
362
  const template = document.createElement('template');
332
-
333
363
  if (template.content && template.content.ownerDocument) {
334
364
  document = template.content.ownerDocument;
335
365
  }
336
366
  }
337
-
338
367
  let trustedTypesPolicy;
339
368
  let emptyHTML = '';
340
369
  const {
@@ -346,11 +375,10 @@ function createDOMPurify() {
346
375
  const {
347
376
  importNode
348
377
  } = originalDocument;
349
- let hooks = {};
378
+ let hooks = _createHooksMap();
350
379
  /**
351
380
  * Expose whether this browser supports running the full DOMPurify.
352
381
  */
353
-
354
382
  DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
355
383
  const {
356
384
  MUSTACHE_EXPR,
@@ -359,7 +387,8 @@ function createDOMPurify() {
359
387
  DATA_ATTR,
360
388
  ARIA_ATTR,
361
389
  IS_SCRIPT_OR_DATA,
362
- ATTR_WHITESPACE
390
+ ATTR_WHITESPACE,
391
+ CUSTOM_ELEMENT
363
392
  } = EXPRESSIONS;
364
393
  let {
365
394
  IS_ALLOWED_URI: IS_ALLOWED_URI$1
@@ -368,23 +397,19 @@ function createDOMPurify() {
368
397
  * We consider the elements and attributes below to be safe. Ideally
369
398
  * don't add any new ones but feel free to remove unwanted ones.
370
399
  */
371
-
372
400
  /* allowed element names */
373
-
374
401
  let ALLOWED_TAGS = null;
375
402
  const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
376
403
  /* Allowed attribute names */
377
-
378
404
  let ALLOWED_ATTR = null;
379
405
  const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
380
406
  /*
381
- * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
407
+ * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
382
408
  * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
383
409
  * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
384
410
  * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
385
411
  */
386
-
387
- let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
412
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
388
413
  tagNameCheck: {
389
414
  writable: true,
390
415
  configurable: false,
@@ -405,57 +430,47 @@ function createDOMPurify() {
405
430
  }
406
431
  }));
407
432
  /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
408
-
409
433
  let FORBID_TAGS = null;
410
434
  /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
411
-
412
435
  let FORBID_ATTR = null;
413
436
  /* Decide if ARIA attributes are okay */
414
-
415
437
  let ALLOW_ARIA_ATTR = true;
416
438
  /* Decide if custom data attributes are okay */
417
-
418
439
  let ALLOW_DATA_ATTR = true;
419
440
  /* Decide if unknown protocols are okay */
420
-
421
441
  let ALLOW_UNKNOWN_PROTOCOLS = false;
422
442
  /* Decide if self-closing tags in attributes are allowed.
423
443
  * Usually removed due to a mXSS issue in jQuery 3.0 */
424
-
425
444
  let ALLOW_SELF_CLOSE_IN_ATTR = true;
426
445
  /* Output should be safe for common template engines.
427
446
  * This means, DOMPurify removes data attributes, mustaches and ERB
428
447
  */
429
-
430
448
  let SAFE_FOR_TEMPLATES = false;
449
+ /* Output should be safe even for XML used within HTML and alike.
450
+ * This means, DOMPurify removes comments when containing risky content.
451
+ */
452
+ let SAFE_FOR_XML = true;
431
453
  /* Decide if document with <html>... should be returned */
432
-
433
454
  let WHOLE_DOCUMENT = false;
434
455
  /* Track whether config is already set on this instance of DOMPurify. */
435
-
436
456
  let SET_CONFIG = false;
437
457
  /* Decide if all elements (e.g. style, script) must be children of
438
458
  * document.body. By default, browsers might move them to document.head */
439
-
440
459
  let FORCE_BODY = false;
441
460
  /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
442
461
  * string (or a TrustedHTML object if Trusted Types are supported).
443
462
  * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
444
463
  */
445
-
446
464
  let RETURN_DOM = false;
447
465
  /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
448
466
  * string (or a TrustedHTML object if Trusted Types are supported) */
449
-
450
467
  let RETURN_DOM_FRAGMENT = false;
451
468
  /* Try to return a Trusted Type object instead of a string, return a string in
452
469
  * case Trusted Types are not supported */
453
-
454
470
  let RETURN_TRUSTED_TYPE = false;
455
471
  /* Output should be free from DOM clobbering attacks?
456
472
  * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
457
473
  */
458
-
459
474
  let SANITIZE_DOM = true;
460
475
  /* Achieve full DOM Clobbering protection by isolating the namespace of named
461
476
  * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
@@ -470,180 +485,138 @@ function createDOMPurify() {
470
485
  * Namespace isolation is implemented by prefixing `id` and `name` attributes
471
486
  * with a constant string, i.e., `user-content-`
472
487
  */
473
-
474
488
  let SANITIZE_NAMED_PROPS = false;
475
489
  const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
476
490
  /* Keep element content when removing element? */
477
-
478
491
  let KEEP_CONTENT = true;
479
492
  /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
480
493
  * of importing it into a new Document and returning a sanitized copy */
481
-
482
494
  let IN_PLACE = false;
483
495
  /* Allow usage of profiles like html, svg and mathMl */
484
-
485
496
  let USE_PROFILES = {};
486
497
  /* Tags to ignore content of when KEEP_CONTENT is true */
487
-
488
498
  let FORBID_CONTENTS = null;
489
499
  const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
490
500
  /* Tags that are safe for data: URIs */
491
-
492
501
  let DATA_URI_TAGS = null;
493
502
  const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
494
503
  /* Attributes safe for values like "javascript:" */
495
-
496
504
  let URI_SAFE_ATTRIBUTES = null;
497
505
  const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
498
506
  const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
499
507
  const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
500
508
  const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
501
509
  /* Document namespace */
502
-
503
510
  let NAMESPACE = HTML_NAMESPACE;
504
511
  let IS_EMPTY_INPUT = false;
505
512
  /* Allowed XHTML+XML namespaces */
506
-
507
513
  let ALLOWED_NAMESPACES = null;
508
514
  const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
515
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
516
+ let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
517
+ // Certain elements are allowed in both SVG and HTML
518
+ // namespace. We need to specify them explicitly
519
+ // so that they don't get erroneously deleted from
520
+ // HTML namespace.
521
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
509
522
  /* Parsing of strict XHTML documents */
510
-
511
- let PARSER_MEDIA_TYPE;
523
+ let PARSER_MEDIA_TYPE = null;
512
524
  const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
513
525
  const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
514
- let transformCaseFunc;
526
+ let transformCaseFunc = null;
515
527
  /* Keep a reference to config to pass to hooks */
516
-
517
528
  let CONFIG = null;
518
529
  /* Ideally, do not touch anything below this line */
519
-
520
530
  /* ______________________________________________ */
521
-
522
531
  const formElement = document.createElement('form');
523
-
524
532
  const isRegexOrFunction = function isRegexOrFunction(testValue) {
525
533
  return testValue instanceof RegExp || testValue instanceof Function;
526
534
  };
527
535
  /**
528
536
  * _parseConfig
529
537
  *
530
- * @param {Object} cfg optional config literal
538
+ * @param cfg optional config literal
531
539
  */
532
540
  // eslint-disable-next-line complexity
533
-
534
-
535
- const _parseConfig = function _parseConfig(cfg) {
541
+ const _parseConfig = function _parseConfig() {
542
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
536
543
  if (CONFIG && CONFIG === cfg) {
537
544
  return;
538
545
  }
539
546
  /* Shield configuration object from tampering */
540
-
541
-
542
547
  if (!cfg || typeof cfg !== 'object') {
543
548
  cfg = {};
544
549
  }
545
550
  /* Shield configuration object from prototype pollution */
546
-
547
-
548
551
  cfg = clone(cfg);
549
- PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
550
- SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
551
-
552
+ PARSER_MEDIA_TYPE =
553
+ // eslint-disable-next-line unicorn/prefer-includes
554
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
555
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
552
556
  transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
553
557
  /* Set configuration parameters */
554
-
555
- ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
556
- ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
557
- ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
558
- URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent
559
- cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent
560
- transformCaseFunc // eslint-disable-line indent
561
- ) // eslint-disable-line indent
562
- : DEFAULT_URI_SAFE_ATTRIBUTES;
563
- DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
564
- cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
565
- transformCaseFunc // eslint-disable-line indent
566
- ) // eslint-disable-line indent
567
- : DEFAULT_DATA_URI_TAGS;
568
- FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
569
- FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
570
- FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
571
- USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
558
+ ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
559
+ ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
560
+ ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
561
+ URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
562
+ DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
563
+ FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
564
+ FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
565
+ FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
566
+ USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
572
567
  ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
573
-
574
568
  ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
575
-
576
569
  ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
577
-
578
570
  ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
579
-
580
571
  SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
581
-
572
+ SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
582
573
  WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
583
-
584
574
  RETURN_DOM = cfg.RETURN_DOM || false; // Default false
585
-
586
575
  RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
587
-
588
576
  RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
589
-
590
577
  FORCE_BODY = cfg.FORCE_BODY || false; // Default false
591
-
592
578
  SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
593
-
594
579
  SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
595
-
596
580
  KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
597
-
598
581
  IN_PLACE = cfg.IN_PLACE || false; // Default false
599
-
600
582
  IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
601
583
  NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
584
+ MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
585
+ HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
602
586
  CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
603
-
604
587
  if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
605
588
  CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
606
589
  }
607
-
608
590
  if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
609
591
  CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
610
592
  }
611
-
612
593
  if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
613
594
  CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
614
595
  }
615
-
616
596
  if (SAFE_FOR_TEMPLATES) {
617
597
  ALLOW_DATA_ATTR = false;
618
598
  }
619
-
620
599
  if (RETURN_DOM_FRAGMENT) {
621
600
  RETURN_DOM = true;
622
601
  }
623
602
  /* Parse profile info */
624
-
625
-
626
603
  if (USE_PROFILES) {
627
- ALLOWED_TAGS = addToSet({}, [...text]);
604
+ ALLOWED_TAGS = addToSet({}, text);
628
605
  ALLOWED_ATTR = [];
629
-
630
606
  if (USE_PROFILES.html === true) {
631
607
  addToSet(ALLOWED_TAGS, html$1);
632
608
  addToSet(ALLOWED_ATTR, html);
633
609
  }
634
-
635
610
  if (USE_PROFILES.svg === true) {
636
611
  addToSet(ALLOWED_TAGS, svg$1);
637
612
  addToSet(ALLOWED_ATTR, svg);
638
613
  addToSet(ALLOWED_ATTR, xml);
639
614
  }
640
-
641
615
  if (USE_PROFILES.svgFilters === true) {
642
616
  addToSet(ALLOWED_TAGS, svgFilters);
643
617
  addToSet(ALLOWED_ATTR, svg);
644
618
  addToSet(ALLOWED_ATTR, xml);
645
619
  }
646
-
647
620
  if (USE_PROFILES.mathMl === true) {
648
621
  addToSet(ALLOWED_TAGS, mathMl$1);
649
622
  addToSet(ALLOWED_ATTR, mathMl);
@@ -651,171 +624,127 @@ function createDOMPurify() {
651
624
  }
652
625
  }
653
626
  /* Merge configuration parameters */
654
-
655
-
656
627
  if (cfg.ADD_TAGS) {
657
628
  if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
658
629
  ALLOWED_TAGS = clone(ALLOWED_TAGS);
659
630
  }
660
-
661
631
  addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
662
632
  }
663
-
664
633
  if (cfg.ADD_ATTR) {
665
634
  if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
666
635
  ALLOWED_ATTR = clone(ALLOWED_ATTR);
667
636
  }
668
-
669
637
  addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
670
638
  }
671
-
672
639
  if (cfg.ADD_URI_SAFE_ATTR) {
673
640
  addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
674
641
  }
675
-
676
642
  if (cfg.FORBID_CONTENTS) {
677
643
  if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
678
644
  FORBID_CONTENTS = clone(FORBID_CONTENTS);
679
645
  }
680
-
681
646
  addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
682
647
  }
683
648
  /* Add #text in case KEEP_CONTENT is set to true */
684
-
685
-
686
649
  if (KEEP_CONTENT) {
687
650
  ALLOWED_TAGS['#text'] = true;
688
651
  }
689
652
  /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
690
-
691
-
692
653
  if (WHOLE_DOCUMENT) {
693
654
  addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
694
655
  }
695
656
  /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
696
-
697
-
698
657
  if (ALLOWED_TAGS.table) {
699
658
  addToSet(ALLOWED_TAGS, ['tbody']);
700
659
  delete FORBID_TAGS.tbody;
701
660
  }
702
-
703
661
  if (cfg.TRUSTED_TYPES_POLICY) {
704
662
  if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
705
663
  throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
706
664
  }
707
-
708
665
  if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
709
666
  throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
710
- } // Overwrite existing TrustedTypes policy.
711
-
712
-
713
- trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; // Sign local variables required by `sanitize`.
714
-
667
+ }
668
+ // Overwrite existing TrustedTypes policy.
669
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
670
+ // Sign local variables required by `sanitize`.
715
671
  emptyHTML = trustedTypesPolicy.createHTML('');
716
672
  } else {
717
673
  // Uninitialized policy, attempt to initialize the internal dompurify policy.
718
674
  if (trustedTypesPolicy === undefined) {
719
675
  trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
720
- } // If creating the internal policy succeeded sign internal variables.
721
-
722
-
676
+ }
677
+ // If creating the internal policy succeeded sign internal variables.
723
678
  if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
724
679
  emptyHTML = trustedTypesPolicy.createHTML('');
725
680
  }
726
- } // Prevent further manipulation of configuration.
681
+ }
682
+ // Prevent further manipulation of configuration.
727
683
  // Not available in IE8, Safari 5, etc.
728
-
729
-
730
684
  if (freeze) {
731
685
  freeze(cfg);
732
686
  }
733
-
734
687
  CONFIG = cfg;
735
688
  };
736
-
737
- const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
738
- const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
739
- // namespace. We need to specify them explicitly
740
- // so that they don't get erroneously deleted from
741
- // HTML namespace.
742
-
743
- const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
744
689
  /* Keep track of all possible SVG and MathML tags
745
690
  * so that we can perform the namespace checks
746
691
  * correctly. */
747
-
748
- const ALL_SVG_TAGS = addToSet({}, svg$1);
749
- addToSet(ALL_SVG_TAGS, svgFilters);
750
- addToSet(ALL_SVG_TAGS, svgDisallowed);
751
- const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
752
- addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
692
+ const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
693
+ const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
753
694
  /**
754
- *
755
- *
756
- * @param {Element} element a DOM element whose namespace is being checked
757
- * @returns {boolean} Return false if the element has a
695
+ * @param element a DOM element whose namespace is being checked
696
+ * @returns Return false if the element has a
758
697
  * namespace that a spec-compliant parser would never
759
698
  * return. Return true otherwise.
760
699
  */
761
-
762
700
  const _checkValidNamespace = function _checkValidNamespace(element) {
763
- let parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
701
+ let parent = getParentNode(element);
702
+ // In JSDOM, if we're inside shadow DOM, then parentNode
764
703
  // can be null. We just simulate parent in this case.
765
-
766
704
  if (!parent || !parent.tagName) {
767
705
  parent = {
768
706
  namespaceURI: NAMESPACE,
769
707
  tagName: 'template'
770
708
  };
771
709
  }
772
-
773
710
  const tagName = stringToLowerCase(element.tagName);
774
711
  const parentTagName = stringToLowerCase(parent.tagName);
775
-
776
712
  if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
777
713
  return false;
778
714
  }
779
-
780
715
  if (element.namespaceURI === SVG_NAMESPACE) {
781
716
  // The only way to switch from HTML namespace to SVG
782
717
  // is via <svg>. If it happens via any other tag, then
783
718
  // it should be killed.
784
719
  if (parent.namespaceURI === HTML_NAMESPACE) {
785
720
  return tagName === 'svg';
786
- } // The only way to switch from MathML to SVG is via`
721
+ }
722
+ // The only way to switch from MathML to SVG is via`
787
723
  // svg if parent is either <annotation-xml> or MathML
788
724
  // text integration points.
789
-
790
-
791
725
  if (parent.namespaceURI === MATHML_NAMESPACE) {
792
726
  return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
793
- } // We only allow elements that are defined in SVG
727
+ }
728
+ // We only allow elements that are defined in SVG
794
729
  // spec. All others are disallowed in SVG namespace.
795
-
796
-
797
730
  return Boolean(ALL_SVG_TAGS[tagName]);
798
731
  }
799
-
800
732
  if (element.namespaceURI === MATHML_NAMESPACE) {
801
733
  // The only way to switch from HTML namespace to MathML
802
734
  // is via <math>. If it happens via any other tag, then
803
735
  // it should be killed.
804
736
  if (parent.namespaceURI === HTML_NAMESPACE) {
805
737
  return tagName === 'math';
806
- } // The only way to switch from SVG to MathML is via
738
+ }
739
+ // The only way to switch from SVG to MathML is via
807
740
  // <math> and HTML integration points
808
-
809
-
810
741
  if (parent.namespaceURI === SVG_NAMESPACE) {
811
742
  return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
812
- } // We only allow elements that are defined in MathML
743
+ }
744
+ // We only allow elements that are defined in MathML
813
745
  // spec. All others are disallowed in MathML namespace.
814
-
815
-
816
746
  return Boolean(ALL_MATHML_TAGS[tagName]);
817
747
  }
818
-
819
748
  if (element.namespaceURI === HTML_NAMESPACE) {
820
749
  // The only way to switch from SVG to HTML is via
821
750
  // HTML integration points, and from MathML to HTML
@@ -823,77 +752,67 @@ function createDOMPurify() {
823
752
  if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
824
753
  return false;
825
754
  }
826
-
827
755
  if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
828
756
  return false;
829
- } // We disallow tags that are specific for MathML
757
+ }
758
+ // We disallow tags that are specific for MathML
830
759
  // or SVG and should never appear in HTML namespace
831
-
832
-
833
760
  return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
834
- } // For XHTML and XML documents that support custom namespaces
835
-
836
-
761
+ }
762
+ // For XHTML and XML documents that support custom namespaces
837
763
  if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
838
764
  return true;
839
- } // The code should never reach this place (this means
765
+ }
766
+ // The code should never reach this place (this means
840
767
  // that the element somehow got namespace that is not
841
768
  // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
842
769
  // Return false just in case.
843
-
844
-
845
770
  return false;
846
771
  };
847
772
  /**
848
773
  * _forceRemove
849
774
  *
850
- * @param {Node} node a DOM node
775
+ * @param node a DOM node
851
776
  */
852
-
853
-
854
777
  const _forceRemove = function _forceRemove(node) {
855
778
  arrayPush(DOMPurify.removed, {
856
779
  element: node
857
780
  });
858
-
859
781
  try {
860
782
  // eslint-disable-next-line unicorn/prefer-dom-node-remove
861
- node.parentNode.removeChild(node);
783
+ getParentNode(node).removeChild(node);
862
784
  } catch (_) {
863
- node.remove();
785
+ remove(node);
864
786
  }
865
787
  };
866
788
  /**
867
789
  * _removeAttribute
868
790
  *
869
- * @param {String} name an Attribute name
870
- * @param {Node} node a DOM node
791
+ * @param name an Attribute name
792
+ * @param element a DOM node
871
793
  */
872
-
873
-
874
- const _removeAttribute = function _removeAttribute(name, node) {
794
+ const _removeAttribute = function _removeAttribute(name, element) {
875
795
  try {
876
796
  arrayPush(DOMPurify.removed, {
877
- attribute: node.getAttributeNode(name),
878
- from: node
797
+ attribute: element.getAttributeNode(name),
798
+ from: element
879
799
  });
880
800
  } catch (_) {
881
801
  arrayPush(DOMPurify.removed, {
882
802
  attribute: null,
883
- from: node
803
+ from: element
884
804
  });
885
805
  }
886
-
887
- node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
888
-
889
- if (name === 'is' && !ALLOWED_ATTR[name]) {
806
+ element.removeAttribute(name);
807
+ // We void attribute values for unremovable "is" attributes
808
+ if (name === 'is') {
890
809
  if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
891
810
  try {
892
- _forceRemove(node);
811
+ _forceRemove(element);
893
812
  } catch (_) {}
894
813
  } else {
895
814
  try {
896
- node.setAttribute(name, '');
815
+ element.setAttribute(name, '');
897
816
  } catch (_) {}
898
817
  }
899
818
  }
@@ -901,16 +820,13 @@ function createDOMPurify() {
901
820
  /**
902
821
  * _initDocument
903
822
  *
904
- * @param {String} dirty a string of dirty markup
905
- * @return {Document} a DOM, filled with the dirty markup
823
+ * @param dirty - a string of dirty markup
824
+ * @return a DOM, filled with the dirty markup
906
825
  */
907
-
908
-
909
826
  const _initDocument = function _initDocument(dirty) {
910
827
  /* Create a HTML document */
911
- let doc;
912
- let leadingWhitespace;
913
-
828
+ let doc = null;
829
+ let leadingWhitespace = null;
914
830
  if (FORCE_BODY) {
915
831
  dirty = '<remove></remove>' + dirty;
916
832
  } else {
@@ -918,200 +834,157 @@ function createDOMPurify() {
918
834
  const matches = stringMatch(dirty, /^[\r\n\t ]+/);
919
835
  leadingWhitespace = matches && matches[0];
920
836
  }
921
-
922
837
  if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
923
838
  // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
924
839
  dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
925
840
  }
926
-
927
841
  const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
928
842
  /*
929
843
  * Use the DOMParser API by default, fallback later if needs be
930
844
  * DOMParser not work for svg when has multiple root element.
931
845
  */
932
-
933
846
  if (NAMESPACE === HTML_NAMESPACE) {
934
847
  try {
935
848
  doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
936
849
  } catch (_) {}
937
850
  }
938
851
  /* Use createHTMLDocument in case DOMParser is not available */
939
-
940
-
941
852
  if (!doc || !doc.documentElement) {
942
853
  doc = implementation.createDocument(NAMESPACE, 'template', null);
943
-
944
854
  try {
945
855
  doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
946
- } catch (_) {// Syntax error if dirtyPayload is invalid xml
856
+ } catch (_) {
857
+ // Syntax error if dirtyPayload is invalid xml
947
858
  }
948
859
  }
949
-
950
860
  const body = doc.body || doc.documentElement;
951
-
952
861
  if (dirty && leadingWhitespace) {
953
862
  body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
954
863
  }
955
864
  /* Work on whole document or just its body */
956
-
957
-
958
865
  if (NAMESPACE === HTML_NAMESPACE) {
959
866
  return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
960
867
  }
961
-
962
868
  return WHOLE_DOCUMENT ? doc.documentElement : body;
963
869
  };
964
870
  /**
965
- * _createIterator
871
+ * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
966
872
  *
967
- * @param {Document} root document/fragment to create iterator for
968
- * @return {Iterator} iterator instance
873
+ * @param root The root element or node to start traversing on.
874
+ * @return The created NodeIterator
969
875
  */
970
-
971
-
972
- const _createIterator = function _createIterator(root) {
973
- return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
974
- NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
876
+ const _createNodeIterator = function _createNodeIterator(root) {
877
+ return createNodeIterator.call(root.ownerDocument || root, root,
878
+ // eslint-disable-next-line no-bitwise
879
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
975
880
  };
976
881
  /**
977
882
  * _isClobbered
978
883
  *
979
- * @param {Node} elm element to check for clobbering attacks
980
- * @return {Boolean} true if clobbered, false if safe
884
+ * @param element element to check for clobbering attacks
885
+ * @return true if clobbered, false if safe
981
886
  */
982
-
983
-
984
- const _isClobbered = function _isClobbered(elm) {
985
- return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
887
+ const _isClobbered = function _isClobbered(element) {
888
+ return element instanceof HTMLFormElement && (typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function');
986
889
  };
987
890
  /**
988
- * _isNode
891
+ * Checks whether the given object is a DOM node.
989
892
  *
990
- * @param {Node} obj object to check whether it's a DOM node
991
- * @return {Boolean} true is object is a DOM node
893
+ * @param value object to check whether it's a DOM node
894
+ * @return true is object is a DOM node
992
895
  */
993
-
994
-
995
- const _isNode = function _isNode(object) {
996
- return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
896
+ const _isNode = function _isNode(value) {
897
+ return typeof Node === 'function' && value instanceof Node;
997
898
  };
998
- /**
999
- * _executeHook
1000
- * Execute user configurable hooks
1001
- *
1002
- * @param {String} entryPoint Name of the hook's entry point
1003
- * @param {Node} currentNode node to work on with the hook
1004
- * @param {Object} data additional hook parameters
1005
- */
1006
-
1007
-
1008
- const _executeHook = function _executeHook(entryPoint, currentNode, data) {
1009
- if (!hooks[entryPoint]) {
1010
- return;
1011
- }
1012
-
1013
- arrayForEach(hooks[entryPoint], hook => {
899
+ function _executeHooks(hooks, currentNode, data) {
900
+ arrayForEach(hooks, hook => {
1014
901
  hook.call(DOMPurify, currentNode, data, CONFIG);
1015
902
  });
1016
- };
903
+ }
1017
904
  /**
1018
905
  * _sanitizeElements
1019
906
  *
1020
907
  * @protect nodeName
1021
908
  * @protect textContent
1022
909
  * @protect removeChild
1023
- *
1024
- * @param {Node} currentNode to check for permission to exist
1025
- * @return {Boolean} true if node was killed, false if left alive
910
+ * @param currentNode to check for permission to exist
911
+ * @return true if node was killed, false if left alive
1026
912
  */
1027
-
1028
-
1029
913
  const _sanitizeElements = function _sanitizeElements(currentNode) {
1030
- let content;
914
+ let content = null;
1031
915
  /* Execute a hook if present */
1032
-
1033
- _executeHook('beforeSanitizeElements', currentNode, null);
916
+ _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
1034
917
  /* Check if element is clobbered or can clobber */
1035
-
1036
-
1037
918
  if (_isClobbered(currentNode)) {
1038
919
  _forceRemove(currentNode);
1039
-
1040
920
  return true;
1041
921
  }
1042
922
  /* Now let's check the element's type and name */
1043
-
1044
-
1045
923
  const tagName = transformCaseFunc(currentNode.nodeName);
1046
924
  /* Execute a hook if present */
1047
-
1048
- _executeHook('uponSanitizeElement', currentNode, {
925
+ _executeHooks(hooks.uponSanitizeElement, currentNode, {
1049
926
  tagName,
1050
927
  allowedTags: ALLOWED_TAGS
1051
928
  });
1052
929
  /* Detect mXSS attempts abusing namespace confusion */
1053
-
1054
-
1055
- if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
930
+ if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
931
+ _forceRemove(currentNode);
932
+ return true;
933
+ }
934
+ /* Remove any occurrence of processing instructions */
935
+ if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
936
+ _forceRemove(currentNode);
937
+ return true;
938
+ }
939
+ /* Remove any kind of possibly harmful comments */
940
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
1056
941
  _forceRemove(currentNode);
1057
-
1058
942
  return true;
1059
943
  }
1060
944
  /* Remove element if anything forbids its presence */
1061
-
1062
-
1063
945
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1064
946
  /* Check if we have a custom element to handle */
1065
- if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
1066
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
1067
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
947
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
948
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
949
+ return false;
950
+ }
951
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
952
+ return false;
953
+ }
1068
954
  }
1069
955
  /* Keep content except for bad-listed elements */
1070
-
1071
-
1072
956
  if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
1073
957
  const parentNode = getParentNode(currentNode) || currentNode.parentNode;
1074
958
  const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
1075
-
1076
959
  if (childNodes && parentNode) {
1077
960
  const childCount = childNodes.length;
1078
-
1079
961
  for (let i = childCount - 1; i >= 0; --i) {
1080
- parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
962
+ const childClone = cloneNode(childNodes[i], true);
963
+ childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
964
+ parentNode.insertBefore(childClone, getNextSibling(currentNode));
1081
965
  }
1082
966
  }
1083
967
  }
1084
-
1085
968
  _forceRemove(currentNode);
1086
-
1087
969
  return true;
1088
970
  }
1089
971
  /* Check whether element has a valid namespace */
1090
-
1091
-
1092
972
  if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
1093
973
  _forceRemove(currentNode);
1094
-
1095
974
  return true;
1096
975
  }
1097
- /* Make sure that older browsers don't get noscript mXSS */
1098
-
1099
-
1100
- if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
976
+ /* Make sure that older browsers don't get fallback-tag mXSS */
977
+ if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
1101
978
  _forceRemove(currentNode);
1102
-
1103
979
  return true;
1104
980
  }
1105
981
  /* Sanitize element content to be template-safe */
1106
-
1107
-
1108
- if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
982
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
1109
983
  /* Get the element's text content */
1110
984
  content = currentNode.textContent;
1111
- content = stringReplace(content, MUSTACHE_EXPR, ' ');
1112
- content = stringReplace(content, ERB_EXPR, ' ');
1113
- content = stringReplace(content, TMPLIT_EXPR, ' ');
1114
-
985
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
986
+ content = stringReplace(content, expr, ' ');
987
+ });
1115
988
  if (currentNode.textContent !== content) {
1116
989
  arrayPush(DOMPurify.removed, {
1117
990
  element: currentNode.cloneNode()
@@ -1120,23 +993,18 @@ function createDOMPurify() {
1120
993
  }
1121
994
  }
1122
995
  /* Execute a hook if present */
1123
-
1124
-
1125
- _executeHook('afterSanitizeElements', currentNode, null);
1126
-
996
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
1127
997
  return false;
1128
998
  };
1129
999
  /**
1130
1000
  * _isValidAttribute
1131
1001
  *
1132
- * @param {string} lcTag Lowercase tag name of containing element.
1133
- * @param {string} lcName Lowercase attribute name.
1134
- * @param {string} value Attribute value.
1135
- * @return {Boolean} Returns true if `value` is valid, otherwise false.
1002
+ * @param lcTag Lowercase tag name of containing element.
1003
+ * @param lcName Lowercase attribute name.
1004
+ * @param value Attribute value.
1005
+ * @return Returns true if `value` is valid, otherwise false.
1136
1006
  */
1137
1007
  // eslint-disable-next-line complexity
1138
-
1139
-
1140
1008
  const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
1141
1009
  /* Make sure attribute cannot clobber */
1142
1010
  if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
@@ -1146,35 +1014,33 @@ function createDOMPurify() {
1146
1014
  (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
1147
1015
  XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
1148
1016
  We don't need to check the value; it's always URI safe. */
1149
-
1150
-
1151
1017
  if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
1152
- if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
1018
+ if (
1019
+ // First condition does a very basic check if a) it's basically a valid custom element tagname AND
1153
1020
  // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1154
1021
  // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
1155
- _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
1022
+ _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
1023
+ // Alternative, second condition checks if it's an `is`-attribute, AND
1156
1024
  // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1157
1025
  lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
1158
1026
  return false;
1159
1027
  }
1160
1028
  /* Check value is safe. First, is attr inert? If so, is safe */
1161
-
1162
1029
  } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
1163
1030
  return false;
1164
1031
  } else ;
1165
-
1166
1032
  return true;
1167
1033
  };
1168
1034
  /**
1169
- * _basicCustomElementCheck
1035
+ * _isBasicCustomElement
1170
1036
  * checks if at least one dash is included in tagName, and it's not the first char
1171
1037
  * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
1172
- * @param {string} tagName name of the tag of the node to sanitize
1038
+ *
1039
+ * @param tagName name of the tag of the node to sanitize
1040
+ * @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
1173
1041
  */
1174
-
1175
-
1176
- const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
1177
- return tagName.indexOf('-') > 0;
1042
+ const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
1043
+ return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
1178
1044
  };
1179
1045
  /**
1180
1046
  * _sanitizeAttributes
@@ -1184,109 +1050,85 @@ function createDOMPurify() {
1184
1050
  * @protect removeAttribute
1185
1051
  * @protect setAttribute
1186
1052
  *
1187
- * @param {Node} currentNode to sanitize
1053
+ * @param currentNode to sanitize
1188
1054
  */
1189
-
1190
-
1191
1055
  const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
1192
- let attr;
1193
- let value;
1194
- let lcName;
1195
- let l;
1196
1056
  /* Execute a hook if present */
1197
-
1198
- _executeHook('beforeSanitizeAttributes', currentNode, null);
1199
-
1057
+ _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
1200
1058
  const {
1201
1059
  attributes
1202
1060
  } = currentNode;
1203
1061
  /* Check if we have attributes; if not we might have a text node */
1204
-
1205
- if (!attributes) {
1062
+ if (!attributes || _isClobbered(currentNode)) {
1206
1063
  return;
1207
1064
  }
1208
-
1209
1065
  const hookEvent = {
1210
1066
  attrName: '',
1211
1067
  attrValue: '',
1212
1068
  keepAttr: true,
1213
- allowedAttributes: ALLOWED_ATTR
1069
+ allowedAttributes: ALLOWED_ATTR,
1070
+ forceKeepAttr: undefined
1214
1071
  };
1215
- l = attributes.length;
1072
+ let l = attributes.length;
1216
1073
  /* Go backwards over all attributes; safely remove bad ones */
1217
-
1218
1074
  while (l--) {
1219
- attr = attributes[l];
1075
+ const attr = attributes[l];
1220
1076
  const {
1221
1077
  name,
1222
- namespaceURI
1078
+ namespaceURI,
1079
+ value: attrValue
1223
1080
  } = attr;
1224
- value = name === 'value' ? attr.value : stringTrim(attr.value);
1225
- lcName = transformCaseFunc(name);
1081
+ const lcName = transformCaseFunc(name);
1082
+ const initValue = attrValue;
1083
+ let value = name === 'value' ? initValue : stringTrim(initValue);
1226
1084
  /* Execute a hook if present */
1227
-
1228
1085
  hookEvent.attrName = lcName;
1229
1086
  hookEvent.attrValue = value;
1230
1087
  hookEvent.keepAttr = true;
1231
1088
  hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
1232
-
1233
- _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
1234
-
1089
+ _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
1235
1090
  value = hookEvent.attrValue;
1091
+ /* Full DOM Clobbering protection via namespace isolation,
1092
+ * Prefix id and name attributes with `user-content-`
1093
+ */
1094
+ if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
1095
+ // Remove the attribute with this value
1096
+ _removeAttribute(name, currentNode);
1097
+ // Prefix the value and later re-create the attribute with the sanitized value
1098
+ value = SANITIZE_NAMED_PROPS_PREFIX + value;
1099
+ }
1100
+ /* Work around a security issue with comments inside attributes */
1101
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
1102
+ _removeAttribute(name, currentNode);
1103
+ continue;
1104
+ }
1236
1105
  /* Did the hooks approve of the attribute? */
1237
-
1238
1106
  if (hookEvent.forceKeepAttr) {
1239
1107
  continue;
1240
1108
  }
1241
- /* Remove attribute */
1242
-
1243
-
1244
- _removeAttribute(name, currentNode);
1245
1109
  /* Did the hooks approve of the attribute? */
1246
-
1247
-
1248
1110
  if (!hookEvent.keepAttr) {
1111
+ _removeAttribute(name, currentNode);
1249
1112
  continue;
1250
1113
  }
1251
1114
  /* Work around a security issue in jQuery 3.0 */
1252
-
1253
-
1254
1115
  if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
1255
1116
  _removeAttribute(name, currentNode);
1256
-
1257
1117
  continue;
1258
1118
  }
1259
1119
  /* Sanitize attribute content to be template-safe */
1260
-
1261
-
1262
1120
  if (SAFE_FOR_TEMPLATES) {
1263
- value = stringReplace(value, MUSTACHE_EXPR, ' ');
1264
- value = stringReplace(value, ERB_EXPR, ' ');
1265
- value = stringReplace(value, TMPLIT_EXPR, ' ');
1121
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
1122
+ value = stringReplace(value, expr, ' ');
1123
+ });
1266
1124
  }
1267
1125
  /* Is `value` valid for this attribute? */
1268
-
1269
-
1270
1126
  const lcTag = transformCaseFunc(currentNode.nodeName);
1271
-
1272
1127
  if (!_isValidAttribute(lcTag, lcName, value)) {
1128
+ _removeAttribute(name, currentNode);
1273
1129
  continue;
1274
1130
  }
1275
- /* Full DOM Clobbering protection via namespace isolation,
1276
- * Prefix id and name attributes with `user-content-`
1277
- */
1278
-
1279
-
1280
- if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
1281
- // Remove the attribute with this value
1282
- _removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
1283
-
1284
-
1285
- value = SANITIZE_NAMED_PROPS_PREFIX + value;
1286
- }
1287
1131
  /* Handle attributes that require Trusted Types */
1288
-
1289
-
1290
1132
  if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
1291
1133
  if (namespaceURI) ; else {
1292
1134
  switch (trustedTypes.getAttributeType(lcTag, lcName)) {
@@ -1295,7 +1137,6 @@ function createDOMPurify() {
1295
1137
  value = trustedTypesPolicy.createHTML(value);
1296
1138
  break;
1297
1139
  }
1298
-
1299
1140
  case 'TrustedScriptURL':
1300
1141
  {
1301
1142
  value = trustedTypesPolicy.createScriptURL(value);
@@ -1305,97 +1146,70 @@ function createDOMPurify() {
1305
1146
  }
1306
1147
  }
1307
1148
  /* Handle invalid data-* attribute set by try-catching it */
1308
-
1309
-
1310
- try {
1311
- if (namespaceURI) {
1312
- currentNode.setAttributeNS(namespaceURI, name, value);
1313
- } else {
1314
- /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1315
- currentNode.setAttribute(name, value);
1149
+ if (value !== initValue) {
1150
+ try {
1151
+ if (namespaceURI) {
1152
+ currentNode.setAttributeNS(namespaceURI, name, value);
1153
+ } else {
1154
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1155
+ currentNode.setAttribute(name, value);
1156
+ }
1157
+ if (_isClobbered(currentNode)) {
1158
+ _forceRemove(currentNode);
1159
+ } else {
1160
+ arrayPop(DOMPurify.removed);
1161
+ }
1162
+ } catch (_) {
1163
+ _removeAttribute(name, currentNode);
1316
1164
  }
1317
-
1318
- arrayPop(DOMPurify.removed);
1319
- } catch (_) {}
1165
+ }
1320
1166
  }
1321
1167
  /* Execute a hook if present */
1322
-
1323
-
1324
- _executeHook('afterSanitizeAttributes', currentNode, null);
1168
+ _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
1325
1169
  };
1326
1170
  /**
1327
1171
  * _sanitizeShadowDOM
1328
1172
  *
1329
- * @param {DocumentFragment} fragment to iterate over recursively
1173
+ * @param fragment to iterate over recursively
1330
1174
  */
1331
-
1332
-
1333
1175
  const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
1334
- let shadowNode;
1335
-
1336
- const shadowIterator = _createIterator(fragment);
1176
+ let shadowNode = null;
1177
+ const shadowIterator = _createNodeIterator(fragment);
1337
1178
  /* Execute a hook if present */
1338
-
1339
-
1340
- _executeHook('beforeSanitizeShadowDOM', fragment, null);
1341
-
1179
+ _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
1342
1180
  while (shadowNode = shadowIterator.nextNode()) {
1343
1181
  /* Execute a hook if present */
1344
- _executeHook('uponSanitizeShadowNode', shadowNode, null);
1182
+ _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
1345
1183
  /* Sanitize tags and elements */
1346
-
1347
-
1348
- if (_sanitizeElements(shadowNode)) {
1349
- continue;
1350
- }
1184
+ _sanitizeElements(shadowNode);
1185
+ /* Check attributes next */
1186
+ _sanitizeAttributes(shadowNode);
1351
1187
  /* Deep shadow DOM detected */
1352
-
1353
-
1354
1188
  if (shadowNode.content instanceof DocumentFragment) {
1355
1189
  _sanitizeShadowDOM(shadowNode.content);
1356
1190
  }
1357
- /* Check attributes, sanitize if necessary */
1358
-
1359
-
1360
- _sanitizeAttributes(shadowNode);
1361
1191
  }
1362
1192
  /* Execute a hook if present */
1363
-
1364
-
1365
- _executeHook('afterSanitizeShadowDOM', fragment, null);
1193
+ _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
1366
1194
  };
1367
- /**
1368
- * Sanitize
1369
- * Public method providing core sanitation functionality
1370
- *
1371
- * @param {String|Node} dirty string or DOM node
1372
- * @param {Object} configuration object
1373
- */
1374
1195
  // eslint-disable-next-line complexity
1375
-
1376
-
1377
1196
  DOMPurify.sanitize = function (dirty) {
1378
1197
  let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
1379
- let body;
1380
- let importedNode;
1381
- let currentNode;
1382
- let returnNode;
1198
+ let body = null;
1199
+ let importedNode = null;
1200
+ let currentNode = null;
1201
+ let returnNode = null;
1383
1202
  /* Make sure we have a string to sanitize.
1384
1203
  DO NOT return early, as this will return the wrong type if
1385
1204
  the user has requested a DOM object rather than a string */
1386
-
1387
1205
  IS_EMPTY_INPUT = !dirty;
1388
-
1389
1206
  if (IS_EMPTY_INPUT) {
1390
1207
  dirty = '<!-->';
1391
1208
  }
1392
1209
  /* Stringify, in case dirty is an object */
1393
-
1394
-
1395
1210
  if (typeof dirty !== 'string' && !_isNode(dirty)) {
1396
1211
  if (typeof dirty.toString === 'function') {
1397
1212
  dirty = dirty.toString();
1398
-
1399
1213
  if (typeof dirty !== 'string') {
1400
1214
  throw typeErrorCreate('dirty is not a string, aborting');
1401
1215
  }
@@ -1404,32 +1218,23 @@ function createDOMPurify() {
1404
1218
  }
1405
1219
  }
1406
1220
  /* Return dirty HTML if DOMPurify cannot run */
1407
-
1408
-
1409
1221
  if (!DOMPurify.isSupported) {
1410
1222
  return dirty;
1411
1223
  }
1412
1224
  /* Assign config vars */
1413
-
1414
-
1415
1225
  if (!SET_CONFIG) {
1416
1226
  _parseConfig(cfg);
1417
1227
  }
1418
1228
  /* Clean up removed elements */
1419
-
1420
-
1421
1229
  DOMPurify.removed = [];
1422
1230
  /* Check if dirty is correctly typed for IN_PLACE */
1423
-
1424
1231
  if (typeof dirty === 'string') {
1425
1232
  IN_PLACE = false;
1426
1233
  }
1427
-
1428
1234
  if (IN_PLACE) {
1429
1235
  /* Do some early pre-sanitization to avoid unsafe root nodes */
1430
1236
  if (dirty.nodeName) {
1431
1237
  const tagName = transformCaseFunc(dirty.nodeName);
1432
-
1433
1238
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1434
1239
  throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
1435
1240
  }
@@ -1439,8 +1244,7 @@ function createDOMPurify() {
1439
1244
  elements being stripped by the parser */
1440
1245
  body = _initDocument('<!---->');
1441
1246
  importedNode = body.ownerDocument.importNode(dirty, true);
1442
-
1443
- if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
1247
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
1444
1248
  /* Node is already a body, use as is */
1445
1249
  body = importedNode;
1446
1250
  } else if (importedNode.nodeName === 'HTML') {
@@ -1451,62 +1255,43 @@ function createDOMPurify() {
1451
1255
  }
1452
1256
  } else {
1453
1257
  /* Exit directly if we have nothing to do */
1454
- if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
1258
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
1259
+ // eslint-disable-next-line unicorn/prefer-includes
1455
1260
  dirty.indexOf('<') === -1) {
1456
1261
  return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
1457
1262
  }
1458
1263
  /* Initialize the document to work on */
1459
-
1460
-
1461
1264
  body = _initDocument(dirty);
1462
1265
  /* Check we have a DOM node from the data */
1463
-
1464
1266
  if (!body) {
1465
1267
  return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
1466
1268
  }
1467
1269
  }
1468
1270
  /* Remove first element node (ours) if FORCE_BODY is set */
1469
-
1470
-
1471
1271
  if (body && FORCE_BODY) {
1472
1272
  _forceRemove(body.firstChild);
1473
1273
  }
1474
1274
  /* Get node iterator */
1475
-
1476
-
1477
- const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
1275
+ const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
1478
1276
  /* Now start iterating over the created document */
1479
-
1480
-
1481
1277
  while (currentNode = nodeIterator.nextNode()) {
1482
1278
  /* Sanitize tags and elements */
1483
- if (_sanitizeElements(currentNode)) {
1484
- continue;
1485
- }
1279
+ _sanitizeElements(currentNode);
1280
+ /* Check attributes next */
1281
+ _sanitizeAttributes(currentNode);
1486
1282
  /* Shadow DOM detected, sanitize it */
1487
-
1488
-
1489
1283
  if (currentNode.content instanceof DocumentFragment) {
1490
1284
  _sanitizeShadowDOM(currentNode.content);
1491
1285
  }
1492
- /* Check attributes, sanitize if necessary */
1493
-
1494
-
1495
- _sanitizeAttributes(currentNode);
1496
1286
  }
1497
1287
  /* If we sanitized `dirty` in-place, return it. */
1498
-
1499
-
1500
1288
  if (IN_PLACE) {
1501
1289
  return dirty;
1502
1290
  }
1503
1291
  /* Return sanitized string or DOM */
1504
-
1505
-
1506
1292
  if (RETURN_DOM) {
1507
1293
  if (RETURN_DOM_FRAGMENT) {
1508
1294
  returnNode = createDocumentFragment.call(body.ownerDocument);
1509
-
1510
1295
  while (body.firstChild) {
1511
1296
  // eslint-disable-next-line unicorn/prefer-dom-node-append
1512
1297
  returnNode.appendChild(body.firstChild);
@@ -1514,8 +1299,7 @@ function createDOMPurify() {
1514
1299
  } else {
1515
1300
  returnNode = body;
1516
1301
  }
1517
-
1518
- if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {
1302
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
1519
1303
  /*
1520
1304
  AdoptNode() is not used because internal state is not reset
1521
1305
  (e.g. the past names map of a HTMLFormElement), this is safe
@@ -1525,132 +1309,60 @@ function createDOMPurify() {
1525
1309
  */
1526
1310
  returnNode = importNode.call(originalDocument, returnNode, true);
1527
1311
  }
1528
-
1529
1312
  return returnNode;
1530
1313
  }
1531
-
1532
1314
  let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1533
1315
  /* Serialize doctype if allowed */
1534
-
1535
1316
  if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1536
1317
  serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
1537
1318
  }
1538
1319
  /* Sanitize final string template-safe */
1539
-
1540
-
1541
1320
  if (SAFE_FOR_TEMPLATES) {
1542
- serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');
1543
- serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');
1544
- serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');
1321
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
1322
+ serializedHTML = stringReplace(serializedHTML, expr, ' ');
1323
+ });
1545
1324
  }
1546
-
1547
1325
  return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1548
1326
  };
1549
- /**
1550
- * Public method to set the configuration once
1551
- * setConfig
1552
- *
1553
- * @param {Object} cfg configuration object
1554
- */
1555
-
1556
-
1557
- DOMPurify.setConfig = function (cfg) {
1327
+ DOMPurify.setConfig = function () {
1328
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
1558
1329
  _parseConfig(cfg);
1559
-
1560
1330
  SET_CONFIG = true;
1561
1331
  };
1562
- /**
1563
- * Public method to remove the configuration
1564
- * clearConfig
1565
- *
1566
- */
1567
-
1568
-
1569
1332
  DOMPurify.clearConfig = function () {
1570
1333
  CONFIG = null;
1571
1334
  SET_CONFIG = false;
1572
1335
  };
1573
- /**
1574
- * Public method to check if an attribute value is valid.
1575
- * Uses last set config, if any. Otherwise, uses config defaults.
1576
- * isValidAttribute
1577
- *
1578
- * @param {string} tag Tag name of containing element.
1579
- * @param {string} attr Attribute name.
1580
- * @param {string} value Attribute value.
1581
- * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
1582
- */
1583
-
1584
-
1585
1336
  DOMPurify.isValidAttribute = function (tag, attr, value) {
1586
1337
  /* Initialize shared config vars if necessary. */
1587
1338
  if (!CONFIG) {
1588
1339
  _parseConfig({});
1589
1340
  }
1590
-
1591
1341
  const lcTag = transformCaseFunc(tag);
1592
1342
  const lcName = transformCaseFunc(attr);
1593
1343
  return _isValidAttribute(lcTag, lcName, value);
1594
1344
  };
1595
- /**
1596
- * AddHook
1597
- * Public method to add DOMPurify hooks
1598
- *
1599
- * @param {String} entryPoint entry point for the hook to add
1600
- * @param {Function} hookFunction function to execute
1601
- */
1602
-
1603
-
1604
1345
  DOMPurify.addHook = function (entryPoint, hookFunction) {
1605
1346
  if (typeof hookFunction !== 'function') {
1606
1347
  return;
1607
1348
  }
1608
-
1609
- hooks[entryPoint] = hooks[entryPoint] || [];
1610
1349
  arrayPush(hooks[entryPoint], hookFunction);
1611
1350
  };
1612
- /**
1613
- * RemoveHook
1614
- * Public method to remove a DOMPurify hook at a given entryPoint
1615
- * (pops it from the stack of hooks if more are present)
1616
- *
1617
- * @param {String} entryPoint entry point for the hook to remove
1618
- * @return {Function} removed(popped) hook
1619
- */
1620
-
1621
-
1622
- DOMPurify.removeHook = function (entryPoint) {
1623
- if (hooks[entryPoint]) {
1624
- return arrayPop(hooks[entryPoint]);
1351
+ DOMPurify.removeHook = function (entryPoint, hookFunction) {
1352
+ if (hookFunction !== undefined) {
1353
+ const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
1354
+ return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
1625
1355
  }
1356
+ return arrayPop(hooks[entryPoint]);
1626
1357
  };
1627
- /**
1628
- * RemoveHooks
1629
- * Public method to remove all DOMPurify hooks at a given entryPoint
1630
- *
1631
- * @param {String} entryPoint entry point for the hooks to remove
1632
- */
1633
-
1634
-
1635
1358
  DOMPurify.removeHooks = function (entryPoint) {
1636
- if (hooks[entryPoint]) {
1637
- hooks[entryPoint] = [];
1638
- }
1359
+ hooks[entryPoint] = [];
1639
1360
  };
1640
- /**
1641
- * RemoveAllHooks
1642
- * Public method to remove all DOMPurify hooks
1643
- *
1644
- */
1645
-
1646
-
1647
1361
  DOMPurify.removeAllHooks = function () {
1648
- hooks = {};
1362
+ hooks = _createHooksMap();
1649
1363
  };
1650
-
1651
1364
  return DOMPurify;
1652
1365
  }
1653
-
1654
1366
  var purify = createDOMPurify();
1655
1367
 
1656
1368
  var _path$2, _path2$1;
@@ -1666,7 +1378,7 @@ var SvgInternalServerError = function SvgInternalServerError(props) {
1666
1378
  })), _path2$1 || (_path2$1 = /*#__PURE__*/React__namespace.createElement("path", {
1667
1379
  fill: "#000",
1668
1380
  fillRule: "evenodd",
1669
- d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.915Zm9.19-32.132-.107.159h-.313l5.399-48.437h54.54V2.043H8.976L2.403 63.94h6.025c.94-1.643 2.035-3.208 3.287-4.538 6.338-7.904 15.806-12.364 26.448-12.364 18.076 0 31.77 13.85 31.77 31.926v.157c0 18.388-13.85 31.926-32.552 31.926-15.963 0-28.874-10.251-30.674-23.163l-.078-.547H.447l.078.704c1.878 16.041 17.293 28.561 36.778 28.561 22.379 0 38.812-15.885 38.812-37.638v-.156c0-21.284-15.963-37.247-37.247-37.247-12.213 0-23.498 5.49-29.55 14.395Zm87.03 45.232C89.42 91.053 85.656 76.469 85.656 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C103.286 5.645 113.384 0 125.963 0c12.58 0 22.697 5.685 29.654 15.844 6.947 10.143 10.732 24.727 10.732 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.076 15.725-29.654 15.725-12.58 0-22.678-5.665-29.615-15.814m54.063-4.51c5.736-9 8.878-22.023 8.878-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.736 9.01-8.878 22.033-8.878 38.03v.235c0 16.036 3.142 29.059 8.878 38.059 5.724 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.448-13.968m36.162 4.51c-6.927-10.134-10.692-24.718-10.692-42.569v-.235c0-17.89 3.765-32.474 10.692-42.598C193.511 5.645 203.609 0 216.188 0c12.581 0 22.698 5.685 29.655 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.075 15.725-29.654 15.725-12.58 0-22.677-5.665-29.615-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.448 13.968 10.414 0 18.724-4.984 24.449-13.968m-114.674 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C86.055 22.701 101.08.4 125.963.4c24.883 0 39.986 22.458 39.986 57.983v.235c0 35.839-15.103 57.983-39.986 57.983m0-5.555c21.127 0 33.726-20.267 33.726-52.428v-.235c0-32.317-12.599-52.427-33.726-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428m50.318-52.428c0 35.604 15.024 57.983 39.907 57.983 24.884 0 39.986-22.144 39.986-57.983v-.235C256.174 22.858 241.072.4 216.188.4c-24.883 0-39.907 22.301-39.907 57.983zm73.633 0c0 32.16-12.598 52.428-33.726 52.428-21.127 0-33.725-20.267-33.725-52.428v-.235c0-32.082 12.598-52.427 33.725-52.427 21.128 0 33.726 20.11 33.726 52.427z",
1381
+ d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.915m9.19-32.132-.107.159h-.313l5.399-48.437h54.54V2.043H8.976L2.403 63.94h6.025c.94-1.643 2.035-3.208 3.287-4.538 6.338-7.904 15.806-12.364 26.448-12.364 18.076 0 31.77 13.85 31.77 31.926v.157c0 18.388-13.85 31.926-32.552 31.926-15.963 0-28.874-10.251-30.674-23.163l-.078-.547H.447l.078.704c1.878 16.041 17.293 28.561 36.778 28.561 22.379 0 38.812-15.885 38.812-37.638v-.156c0-21.284-15.963-37.247-37.247-37.247-12.213 0-23.498 5.49-29.55 14.395m87.03 45.232C89.42 91.053 85.656 76.469 85.656 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C103.286 5.645 113.384 0 125.963 0c12.58 0 22.697 5.685 29.654 15.844 6.947 10.143 10.732 24.727 10.732 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.076 15.725-29.654 15.725-12.58 0-22.678-5.665-29.615-15.814m54.063-4.51c5.736-9 8.878-22.023 8.878-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.736 9.01-8.878 22.033-8.878 38.03v.235c0 16.036 3.142 29.059 8.878 38.059 5.724 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.448-13.968m36.162 4.51c-6.927-10.134-10.692-24.718-10.692-42.569v-.235c0-17.89 3.765-32.474 10.692-42.598C193.511 5.645 203.609 0 216.188 0c12.581 0 22.698 5.685 29.655 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.075 15.725-29.654 15.725s-22.677-5.665-29.615-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.449-13.968m-114.674 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C86.055 22.701 101.08.4 125.963.4c24.883 0 39.986 22.458 39.986 57.983v.235c0 35.839-15.103 57.983-39.986 57.983m0-5.555c21.127 0 33.726-20.267 33.726-52.428v-.235c0-32.317-12.599-52.427-33.726-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428m50.318-52.428c0 35.604 15.024 57.983 39.907 57.983 24.884 0 39.986-22.144 39.986-57.983v-.235C256.174 22.858 241.072.4 216.188.4s-39.907 22.301-39.907 57.983zm73.633 0c0 32.16-12.598 52.428-33.726 52.428-21.127 0-33.725-20.267-33.725-52.428v-.235c0-32.082 12.598-52.427 33.725-52.427s33.726 20.11 33.726 52.427z",
1670
1382
  clipRule: "evenodd"
1671
1383
  })));
1672
1384
  };
@@ -1682,7 +1394,7 @@ var SvgPageNotFound = function SvgPageNotFound(props) {
1682
1394
  fill: "#000",
1683
1395
  stroke: "#000",
1684
1396
  strokeWidth: 0.4,
1685
- d: "M58.94 115.558v.2h6.503V87.51H83.363V81.476H65.442V2.443H56.22l-.06.085L.836 81.483l-.036.051v5.976h58.14v28.048Zm179.355 0v.2h6.503V87.51H262.718V81.476H244.798V2.443H235.574l-.06.085-55.323 78.955-.036.051v5.976h58.14zM58.94 9.182v72.294H8.005L58.93 9.182h.009Zm32.32 50.036c0 17.826 3.76 32.366 10.657 42.456 6.902 10.097 16.94 15.727 29.451 15.727 12.51 0 22.567-5.57 29.489-15.639 6.916-10.06 10.696-24.6 10.696-42.544v-.235c0-17.787-3.78-32.327-10.696-42.426C153.935 6.45 143.879.8 131.368.8s-22.548 5.61-29.451 15.698c-6.896 10.08-10.657 24.62-10.657 42.485v.235Zm73.633 0c0 16.058-3.145 29.123-8.908 38.167-5.758 9.035-14.129 14.06-24.617 14.06-10.489 0-18.86-5.025-24.617-14.06-5.763-9.044-8.91-22.109-8.91-38.167v-.235c0-16.019 3.147-29.084 8.91-38.137 5.757-9.045 14.128-14.09 24.617-14.09s18.859 4.987 24.617 14.002c5.762 9.024 8.908 22.089 8.908 38.225zm73.402-50.037v72.295H187.36l50.926-72.294h.009Z"
1397
+ d: "M58.94 115.558v.2h6.503V87.51h17.92v-6.034h-17.92V2.443H56.22l-.06.085L.836 81.483l-.036.051v5.976h58.14zm179.355 0v.2h6.503V87.51h17.92v-6.034h-17.92V2.443h-9.224l-.06.085-55.323 78.955-.036.051v5.976h58.14zM58.94 9.182v72.294H8.005L58.93 9.182zm32.32 50.036c0 17.826 3.76 32.366 10.657 42.456 6.902 10.097 16.94 15.727 29.451 15.727s22.567-5.57 29.489-15.639c6.916-10.06 10.696-24.6 10.696-42.544v-.235c0-17.787-3.78-32.327-10.696-42.426C153.935 6.45 143.879.8 131.368.8s-22.548 5.61-29.451 15.698c-6.896 10.08-10.657 24.62-10.657 42.485zm73.633 0c0 16.058-3.145 29.123-8.908 38.167-5.758 9.035-14.129 14.06-24.617 14.06s-18.86-5.025-24.617-14.06c-5.763-9.044-8.91-22.109-8.91-38.167v-.235c0-16.019 3.147-29.084 8.91-38.137 5.757-9.045 14.128-14.09 24.617-14.09s18.859 4.987 24.617 14.002c5.762 9.024 8.908 22.089 8.908 38.225zm73.402-50.037v72.295H187.36l50.926-72.294z"
1686
1398
  })));
1687
1399
  };
1688
1400
 
@@ -1695,11 +1407,11 @@ var SvgUnauthorized = function SvgUnauthorized(props) {
1695
1407
  viewBox: "0 0 258 117"
1696
1408
  }, props), _path || (_path = /*#__PURE__*/React__namespace.createElement("path", {
1697
1409
  fill: "#000",
1698
- d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.248H58.54M7.13 81.076h51.41V8.382h-.313L7.129 80.919v.157M130.768 116.601c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428M218.958 116.601c-21.91 0-35.682-12.676-37.794-29.344l-.079-.704h6.026l.078.626c2.113 13.537 13.537 23.867 31.769 23.867 18.233 0 31.535-11.269 31.535-26.606v-.156c0-15.885-12.598-25.275-33.413-25.275h-12.754v-5.477h12.598c17.137 0 29.031-9.86 29.031-23.866v-.157c0-13.694-11.425-23.553-27.779-23.553-16.276 0-27.153 9.781-28.405 22.536l-.078.782h-6.025l.078-.782C185.233 12.45 198.379.4 218.176.4c19.875 0 34.039 12.129 34.039 28.561v.157c0 13.928-9.39 23.866-24.18 26.761v.313c17.294 1.174 28.718 11.973 28.718 28.014v.156c0 18.624-15.963 32.239-37.795 32.239"
1410
+ d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.248zM7.13 81.076h51.41V8.382h-.313L7.129 80.919zM130.768 116.601c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428M218.958 116.601c-21.91 0-35.682-12.676-37.794-29.344l-.079-.704h6.026l.078.626c2.113 13.537 13.537 23.867 31.769 23.867 18.233 0 31.535-11.269 31.535-26.606v-.156c0-15.885-12.598-25.275-33.413-25.275h-12.754v-5.477h12.598c17.137 0 29.031-9.86 29.031-23.866v-.157c0-13.694-11.425-23.553-27.779-23.553-16.276 0-27.153 9.781-28.405 22.536l-.078.782h-6.025l.078-.782C185.233 12.45 198.379.4 218.176.4c19.875 0 34.039 12.129 34.039 28.561v.157c0 13.928-9.39 23.866-24.18 26.761v.313c17.294 1.174 28.718 11.973 28.718 28.014v.156c0 18.624-15.963 32.239-37.795 32.239"
1699
1411
  })), _path2 || (_path2 = /*#__PURE__*/React__namespace.createElement("path", {
1700
1412
  fill: "#000",
1701
1413
  fillRule: "evenodd",
1702
- d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.248H58.14m6.503-28.648h17.92v-5.634h-17.92V2.043h-8.92L.4 80.998v5.712h58.14v28.248h6.103V86.71m116.124.598-.001-.006-.127-1.149h6.825l.12.965.001.006c2.081 13.313 13.313 23.521 31.373 23.521 18.078 0 31.135-11.15 31.135-26.204v-.157c0-7.824-3.096-14.021-8.741-18.275-5.66-4.264-13.918-6.6-24.272-6.6h-13.154v-6.277h12.998c8.494 0 15.656-2.443 20.687-6.59 5.026-4.141 7.944-9.995 7.944-16.876v-.157c0-13.415-11.183-23.153-27.379-23.153-16.106 0-26.778 9.658-28.007 22.175l-.114 1.143h-6.829l.122-1.22C184.856 12.182 198.2 0 218.176 0c20.03 0 34.439 12.247 34.439 28.961v.157c0 7.059-2.382 13.123-6.649 17.788-3.96 4.33-9.528 7.436-16.281 9.027 8.003.838 14.694 3.783 19.472 8.403 5.102 4.932 7.996 11.749 7.996 19.87v.156c0 18.902-16.204 32.639-38.195 32.639-22.083 0-36.05-12.799-38.191-29.693m47.619-31.09a46.445 46.445 0 0 0-.351-.026v-.313l.022-.004.303-.06c14.602-2.977 23.855-12.871 23.855-26.697v-.157C252.215 12.53 238.051.4 218.176.4c-19.797 0-32.943 12.05-34.43 28.092l-.078.782h6.025l.078-.782c1.252-12.755 12.129-22.536 28.405-22.536 16.354 0 27.779 9.86 27.779 23.553v.157c0 14.006-11.894 23.866-29.031 23.866h-12.598v5.477h12.754c20.815 0 33.413 9.39 33.413 25.275v.156c0 15.338-13.302 26.606-31.535 26.606-18.232 0-29.656-10.33-31.769-23.867l-.078-.626h-6.026l.079.704c2.112 16.668 15.884 29.344 37.794 29.344 21.832 0 37.795-13.615 37.795-32.239v-.156c0-15.933-11.27-26.694-28.367-27.989M58.54 81.075H7.13v-.157L58.226 8.382h.313v72.694ZM58.14 9.2 7.79 80.676h50.35V9.2m43.012 91.987C94.225 91.053 90.46 76.469 90.46 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C108.09 5.645 118.188 0 130.768 0c12.58 0 22.697 5.685 29.654 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.784 32.553-10.732 42.658-6.957 10.12-17.075 15.725-29.653 15.725-12.58 0-22.678-5.665-29.616-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.448-13.91-10.413 0-18.724 5.004-24.449 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.449 13.968 10.413 0 18.723-4.984 24.448-13.968m-24.448 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428",
1414
+ d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.248zm6.503-28.648h17.92v-5.634h-17.92V2.043h-8.92L.4 80.998v5.712h58.14v28.248h6.103zm116.124.598-.001-.006-.127-1.149h6.825l.12.965.001.006c2.081 13.313 13.313 23.521 31.373 23.521 18.078 0 31.135-11.15 31.135-26.204v-.157c0-7.824-3.096-14.021-8.741-18.275-5.66-4.264-13.918-6.6-24.272-6.6h-13.154v-6.277h12.998c8.494 0 15.656-2.443 20.687-6.59 5.026-4.141 7.944-9.995 7.944-16.876v-.157c0-13.415-11.183-23.153-27.379-23.153-16.106 0-26.778 9.658-28.007 22.175l-.114 1.143h-6.829l.122-1.22C184.856 12.182 198.2 0 218.176 0c20.03 0 34.439 12.247 34.439 28.961v.157c0 7.059-2.382 13.123-6.649 17.788-3.96 4.33-9.528 7.436-16.281 9.027 8.003.838 14.694 3.783 19.472 8.403 5.102 4.932 7.996 11.749 7.996 19.87v.156c0 18.902-16.204 32.639-38.195 32.639-22.083 0-36.05-12.799-38.191-29.693m47.619-31.09-.351-.026v-.313l.022-.004.303-.06c14.602-2.977 23.855-12.871 23.855-26.697v-.157C252.215 12.53 238.051.4 218.176.4c-19.797 0-32.943 12.05-34.43 28.092l-.078.782h6.025l.078-.782c1.252-12.755 12.129-22.536 28.405-22.536 16.354 0 27.779 9.86 27.779 23.553v.157c0 14.006-11.894 23.866-29.031 23.866h-12.598v5.477h12.754c20.815 0 33.413 9.39 33.413 25.275v.156c0 15.338-13.302 26.606-31.535 26.606-18.232 0-29.656-10.33-31.769-23.867l-.078-.626h-6.026l.079.704c2.112 16.668 15.884 29.344 37.794 29.344 21.832 0 37.795-13.615 37.795-32.239v-.156c0-15.933-11.27-26.694-28.367-27.989M58.54 81.075H7.13v-.157L58.226 8.382h.313zM58.14 9.2 7.79 80.676h50.35zm43.012 91.987C94.225 91.053 90.46 76.469 90.46 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C108.09 5.645 118.188 0 130.768 0s22.697 5.685 29.654 15.844c6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.784 32.553-10.732 42.658-6.957 10.12-17.075 15.725-29.653 15.725-12.58 0-22.678-5.665-29.616-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.448-13.91s-18.724 5.004-24.449 13.997c-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.449 13.968 10.413 0 18.723-4.984 24.448-13.968m-24.448 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428",
1703
1415
  clipRule: "evenodd"
1704
1416
  })));
1705
1417
  };
@@ -1726,7 +1438,7 @@ var css = ".neeto-molecules-error-page__wrapper{align-items:center;container-nam
1726
1438
  injectCss.n(css,{});
1727
1439
 
1728
1440
  function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
1729
- function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
1441
+ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
1730
1442
  var sanitize = purify.sanitize;
1731
1443
  var ErrorPage = function ErrorPage(_ref) {
1732
1444
  var _ref$homeUrl = _ref.homeUrl,