@bigbinary/neeto-molecules 4.0.18 → 4.0.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/AuditLogs.js +5 -5
- package/dist/AuditLogs.js.map +1 -1
- package/dist/BoardView.js +6 -6
- package/dist/BoardView.js.map +1 -1
- package/dist/Breadcrumbs.js +1 -1
- package/dist/Breadcrumbs.js.map +1 -1
- package/dist/BrowserPreview.js +1 -1
- package/dist/BrowserPreview.js.map +1 -1
- package/dist/BrowserSupport.js +2 -2
- package/dist/BrowserSupport.js.map +1 -1
- package/dist/Builder.js +7 -7
- package/dist/Builder.js.map +1 -1
- package/dist/ButtonGroup.js +2 -2
- package/dist/ButtonGroup.js.map +1 -1
- package/dist/CalendarView.js +4 -4
- package/dist/CalendarView.js.map +1 -1
- package/dist/CardLayout.js.map +1 -1
- package/dist/{Chevron-DEQtNhrI.js → Chevron-BFX_mIg6.js} +5 -5
- package/dist/{Chevron-DEQtNhrI.js.map → Chevron-BFX_mIg6.js.map} +1 -1
- package/dist/Codeblock.js +2 -2
- package/dist/Codeblock.js.map +1 -1
- package/dist/{Columns-CwbG5wLv.js → Columns-xoAs08GC.js} +6 -6
- package/dist/{Columns-CwbG5wLv.js.map → Columns-xoAs08GC.js.map} +1 -1
- package/dist/Columns.js +2 -2
- package/dist/ConfigurePageSidebar.js +2 -2
- package/dist/ConfigurePageSidebar.js.map +1 -1
- package/dist/ConfirmationModal.js.map +1 -1
- package/dist/Container.js +1 -1
- package/dist/Container.js.map +1 -1
- package/dist/CopyToClipboardButton.js +2 -2
- package/dist/CopyToClipboardButton.js.map +1 -1
- package/dist/Currency.js +2 -2
- package/dist/Currency.js.map +1 -1
- package/dist/DateFormat.js +1 -1
- package/dist/DateFormat.js.map +1 -1
- package/dist/DateRangeFilter.js +1 -1
- package/dist/DateRangeFilter.js.map +1 -1
- package/dist/DeleteArchiveModal.js.map +1 -1
- package/dist/DeviceIncompatibilityMessage.js.map +1 -1
- package/dist/DocumentEditor.js +2 -2
- package/dist/DocumentEditor.js.map +1 -1
- package/dist/DownloadMobileAppCallout.js.map +1 -1
- package/dist/DynamicVariables.js +2 -2
- package/dist/DynamicVariables.js.map +1 -1
- package/dist/EmailForm.js +5 -5
- package/dist/EmailForm.js.map +1 -1
- package/dist/EmailPreview.js.map +1 -1
- package/dist/EmojiPicker.js +1 -1
- package/dist/EmojiPicker.js.map +1 -1
- package/dist/EmojiReactions.js.map +1 -1
- package/dist/Engagements.js +2 -2
- package/dist/Engagements.js.map +1 -1
- package/dist/ErrorPage.js +369 -657
- package/dist/ErrorPage.js.map +1 -1
- package/dist/FileUpload.js +14 -14
- package/dist/FileUpload.js.map +1 -1
- package/dist/FinderModal.js +3 -3
- package/dist/FinderModal.js.map +1 -1
- package/dist/FloatingActionMenu.js +7 -7
- package/dist/FloatingActionMenu.js.map +1 -1
- package/dist/GoogleFontPicker.js +21 -21
- package/dist/GoogleFontPicker.js.map +1 -1
- package/dist/Header.js +2 -2
- package/dist/Header.js.map +1 -1
- package/dist/HelpPopover.js +1 -1
- package/dist/HelpPopover.js.map +1 -1
- package/dist/IconPicker.js +2 -2
- package/dist/IconPicker.js.map +1 -1
- package/dist/ImageWithFallback.js +2 -2
- package/dist/ImageWithFallback.js.map +1 -1
- package/dist/InlineInput.js +17 -17
- package/dist/InlineInput.js.map +1 -1
- package/dist/Insights.js +2 -8
- package/dist/Insights.js.map +1 -1
- package/dist/IntegrationCard.js +3 -3
- package/dist/IntegrationCard.js.map +1 -1
- package/dist/IpRestriction.js +574 -488
- package/dist/IpRestriction.js.map +1 -1
- package/dist/KeyboardShortcuts.js +2 -4
- package/dist/KeyboardShortcuts.js.map +1 -1
- package/dist/LoginPage.js +23 -24
- package/dist/LoginPage.js.map +1 -1
- package/dist/MadeWith.js +2 -2
- package/dist/MadeWith.js.map +1 -1
- package/dist/MenuBar.js +6 -6
- package/dist/MenuBar.js.map +1 -1
- package/dist/Metadata.js +1 -1
- package/dist/Metadata.js.map +1 -1
- package/dist/MobilePreviewHeader.js.map +1 -1
- package/dist/MoreDropdown.js +4 -4
- package/dist/MoreDropdown.js.map +1 -1
- package/dist/NavigationHeader.js +4 -4
- package/dist/NavigationHeader.js.map +1 -1
- package/dist/NeetoWidget.js +5 -5
- package/dist/NeetoWidget.js.map +1 -1
- package/dist/Onboarding.js +4 -4
- package/dist/Onboarding.js.map +1 -1
- package/dist/OptionFields.js +7 -7
- package/dist/OptionFields.js.map +1 -1
- package/dist/PageLoader.js +2 -2
- package/dist/PageLoader.js.map +1 -1
- package/dist/PhoneNumber.js +5 -6
- package/dist/PhoneNumber.js.map +1 -1
- package/dist/ProductEmbed.js +6 -6
- package/dist/ProductEmbed.js.map +1 -1
- package/dist/PublishBlock.js +3 -3
- package/dist/PublishBlock.js.map +1 -1
- package/dist/PublishYourItem.js.map +1 -1
- package/dist/Rename.js +5 -5
- package/dist/Rename.js.map +1 -1
- package/dist/ResponsiveDevicePicker.js +2 -2
- package/dist/ResponsiveDevicePicker.js.map +1 -1
- package/dist/Schedule.js +3 -3
- package/dist/Schedule.js.map +1 -1
- package/dist/Scrollable.js +2 -2
- package/dist/Scrollable.js.map +1 -1
- package/dist/Search.js +2 -2
- package/dist/Search.js.map +1 -1
- package/dist/SendToFields.js +93 -70
- package/dist/SendToFields.js.map +1 -1
- package/dist/SessionEnvironment.js +3 -4
- package/dist/SessionEnvironment.js.map +1 -1
- package/dist/Settings.js +6 -6
- package/dist/Settings.js.map +1 -1
- package/dist/ShareRecordingPane.js +2 -2
- package/dist/ShareRecordingPane.js.map +1 -1
- package/dist/ShareViaEmail.js +3 -3
- package/dist/ShareViaEmail.js.map +1 -1
- package/dist/ShareViaLink.js +30 -30
- package/dist/ShareViaLink.js.map +1 -1
- package/dist/Sidebar.js +6 -6
- package/dist/Sidebar.js.map +1 -1
- package/dist/StatusDropdown.js +2 -2
- package/dist/StatusDropdown.js.map +1 -1
- package/dist/StickyRibbonsContainer.js +10 -12
- package/dist/StickyRibbonsContainer.js.map +1 -1
- package/dist/SubHeader.js +5 -5
- package/dist/SubHeader.js.map +1 -1
- package/dist/SubscriptionNotificationsContainer.js +1 -1
- package/dist/SubscriptionNotificationsContainer.js.map +1 -1
- package/dist/SuffixedInput.js +2 -2
- package/dist/SuffixedInput.js.map +1 -1
- package/dist/TableWrapper.js +1 -1
- package/dist/TableWrapper.js.map +1 -1
- package/dist/Taxonomy.js +16 -16
- package/dist/Taxonomy.js.map +1 -1
- package/dist/TimeFormat.js.map +1 -1
- package/dist/TimezoneMismatchModal.js.map +1 -1
- package/dist/ToggleFeatureCard.js +3 -3
- package/dist/ToggleFeatureCard.js.map +1 -1
- package/dist/VersionHistory.js +3 -3
- package/dist/VersionHistory.js.map +1 -1
- package/dist/cjs/AuditLogs.js +5 -5
- package/dist/cjs/AuditLogs.js.map +1 -1
- package/dist/cjs/BoardView.js +6 -6
- package/dist/cjs/BoardView.js.map +1 -1
- package/dist/cjs/Breadcrumbs.js +1 -1
- package/dist/cjs/Breadcrumbs.js.map +1 -1
- package/dist/cjs/BrowserPreview.js +1 -1
- package/dist/cjs/BrowserPreview.js.map +1 -1
- package/dist/cjs/BrowserSupport.js +2 -2
- package/dist/cjs/BrowserSupport.js.map +1 -1
- package/dist/cjs/Builder.js +6 -6
- package/dist/cjs/Builder.js.map +1 -1
- package/dist/cjs/ButtonGroup.js +2 -2
- package/dist/cjs/ButtonGroup.js.map +1 -1
- package/dist/cjs/CalendarView.js +4 -4
- package/dist/cjs/CalendarView.js.map +1 -1
- package/dist/cjs/CardLayout.js.map +1 -1
- package/dist/cjs/{Chevron-u-rD2gAf.js → Chevron-ClvaNo3d.js} +5 -5
- package/dist/cjs/{Chevron-u-rD2gAf.js.map → Chevron-ClvaNo3d.js.map} +1 -1
- package/dist/cjs/Codeblock.js +2 -2
- package/dist/cjs/Codeblock.js.map +1 -1
- package/dist/cjs/{Columns-CZDLxh70.js → Columns-C95kM2yL.js} +6 -6
- package/dist/cjs/{Columns-CZDLxh70.js.map → Columns-C95kM2yL.js.map} +1 -1
- package/dist/cjs/Columns.js +2 -2
- package/dist/cjs/ConfigurePageSidebar.js +2 -2
- package/dist/cjs/ConfigurePageSidebar.js.map +1 -1
- package/dist/cjs/ConfirmationModal.js.map +1 -1
- package/dist/cjs/Container.js +1 -1
- package/dist/cjs/Container.js.map +1 -1
- package/dist/cjs/CopyToClipboardButton.js +2 -2
- package/dist/cjs/CopyToClipboardButton.js.map +1 -1
- package/dist/cjs/Currency.js +2 -2
- package/dist/cjs/Currency.js.map +1 -1
- package/dist/cjs/DateFormat.js +1 -1
- package/dist/cjs/DateFormat.js.map +1 -1
- package/dist/cjs/DateRangeFilter.js +1 -1
- package/dist/cjs/DateRangeFilter.js.map +1 -1
- package/dist/cjs/DeleteArchiveModal.js.map +1 -1
- package/dist/cjs/DeviceIncompatibilityMessage.js.map +1 -1
- package/dist/cjs/DocumentEditor.js +2 -2
- package/dist/cjs/DocumentEditor.js.map +1 -1
- package/dist/cjs/DownloadMobileAppCallout.js.map +1 -1
- package/dist/cjs/DynamicVariables.js +2 -2
- package/dist/cjs/DynamicVariables.js.map +1 -1
- package/dist/cjs/EmailForm.js +5 -5
- package/dist/cjs/EmailForm.js.map +1 -1
- package/dist/cjs/EmailPreview.js.map +1 -1
- package/dist/cjs/EmojiPicker.js +1 -1
- package/dist/cjs/EmojiPicker.js.map +1 -1
- package/dist/cjs/EmojiReactions.js.map +1 -1
- package/dist/cjs/Engagements.js +2 -2
- package/dist/cjs/Engagements.js.map +1 -1
- package/dist/cjs/ErrorPage.js +369 -657
- package/dist/cjs/ErrorPage.js.map +1 -1
- package/dist/cjs/FileUpload.js +14 -14
- package/dist/cjs/FileUpload.js.map +1 -1
- package/dist/cjs/FinderModal.js +3 -3
- package/dist/cjs/FinderModal.js.map +1 -1
- package/dist/cjs/FloatingActionMenu.js +6 -6
- package/dist/cjs/FloatingActionMenu.js.map +1 -1
- package/dist/cjs/GoogleFontPicker.js +21 -21
- package/dist/cjs/GoogleFontPicker.js.map +1 -1
- package/dist/cjs/Header.js +2 -2
- package/dist/cjs/Header.js.map +1 -1
- package/dist/cjs/HelpPopover.js +1 -1
- package/dist/cjs/HelpPopover.js.map +1 -1
- package/dist/cjs/IconPicker.js +2 -2
- package/dist/cjs/IconPicker.js.map +1 -1
- package/dist/cjs/ImageWithFallback.js +2 -2
- package/dist/cjs/ImageWithFallback.js.map +1 -1
- package/dist/cjs/InlineInput.js +17 -17
- package/dist/cjs/InlineInput.js.map +1 -1
- package/dist/cjs/Insights.js +2 -8
- package/dist/cjs/Insights.js.map +1 -1
- package/dist/cjs/IntegrationCard.js +3 -3
- package/dist/cjs/IntegrationCard.js.map +1 -1
- package/dist/cjs/IpRestriction.js +574 -488
- package/dist/cjs/IpRestriction.js.map +1 -1
- package/dist/cjs/KeyboardShortcuts.js +2 -4
- package/dist/cjs/KeyboardShortcuts.js.map +1 -1
- package/dist/cjs/LoginPage.js +23 -24
- package/dist/cjs/LoginPage.js.map +1 -1
- package/dist/cjs/MadeWith.js +2 -2
- package/dist/cjs/MadeWith.js.map +1 -1
- package/dist/cjs/MenuBar.js +6 -6
- package/dist/cjs/MenuBar.js.map +1 -1
- package/dist/cjs/Metadata.js +1 -1
- package/dist/cjs/Metadata.js.map +1 -1
- package/dist/cjs/MobilePreviewHeader.js.map +1 -1
- package/dist/cjs/MoreDropdown.js +4 -4
- package/dist/cjs/MoreDropdown.js.map +1 -1
- package/dist/cjs/NavigationHeader.js +4 -4
- package/dist/cjs/NavigationHeader.js.map +1 -1
- package/dist/cjs/NeetoWidget.js +5 -5
- package/dist/cjs/NeetoWidget.js.map +1 -1
- package/dist/cjs/Onboarding.js +3 -3
- package/dist/cjs/Onboarding.js.map +1 -1
- package/dist/cjs/OptionFields.js +6 -6
- package/dist/cjs/OptionFields.js.map +1 -1
- package/dist/cjs/PageLoader.js +2 -2
- package/dist/cjs/PageLoader.js.map +1 -1
- package/dist/cjs/PhoneNumber.js +4 -5
- package/dist/cjs/PhoneNumber.js.map +1 -1
- package/dist/cjs/ProductEmbed.js +5 -5
- package/dist/cjs/ProductEmbed.js.map +1 -1
- package/dist/cjs/PublishBlock.js +3 -3
- package/dist/cjs/PublishBlock.js.map +1 -1
- package/dist/cjs/PublishYourItem.js.map +1 -1
- package/dist/cjs/Rename.js +5 -5
- package/dist/cjs/Rename.js.map +1 -1
- package/dist/cjs/ResponsiveDevicePicker.js +2 -2
- package/dist/cjs/ResponsiveDevicePicker.js.map +1 -1
- package/dist/cjs/Schedule.js +3 -3
- package/dist/cjs/Schedule.js.map +1 -1
- package/dist/cjs/Scrollable.js +2 -2
- package/dist/cjs/Scrollable.js.map +1 -1
- package/dist/cjs/Search.js +2 -2
- package/dist/cjs/Search.js.map +1 -1
- package/dist/cjs/SendToFields.js +93 -70
- package/dist/cjs/SendToFields.js.map +1 -1
- package/dist/cjs/SessionEnvironment.js +3 -4
- package/dist/cjs/SessionEnvironment.js.map +1 -1
- package/dist/cjs/Settings.js +6 -6
- package/dist/cjs/Settings.js.map +1 -1
- package/dist/cjs/ShareRecordingPane.js +2 -2
- package/dist/cjs/ShareRecordingPane.js.map +1 -1
- package/dist/cjs/ShareViaEmail.js +3 -3
- package/dist/cjs/ShareViaEmail.js.map +1 -1
- package/dist/cjs/ShareViaLink.js +24 -24
- package/dist/cjs/ShareViaLink.js.map +1 -1
- package/dist/cjs/Sidebar.js +5 -5
- package/dist/cjs/Sidebar.js.map +1 -1
- package/dist/cjs/StatusDropdown.js +2 -2
- package/dist/cjs/StatusDropdown.js.map +1 -1
- package/dist/cjs/StickyRibbonsContainer.js +10 -12
- package/dist/cjs/StickyRibbonsContainer.js.map +1 -1
- package/dist/cjs/SubHeader.js +5 -5
- package/dist/cjs/SubHeader.js.map +1 -1
- package/dist/cjs/SubscriptionNotificationsContainer.js +1 -1
- package/dist/cjs/SubscriptionNotificationsContainer.js.map +1 -1
- package/dist/cjs/SuffixedInput.js +2 -2
- package/dist/cjs/SuffixedInput.js.map +1 -1
- package/dist/cjs/TableWrapper.js +1 -1
- package/dist/cjs/TableWrapper.js.map +1 -1
- package/dist/cjs/Taxonomy.js +16 -16
- package/dist/cjs/Taxonomy.js.map +1 -1
- package/dist/cjs/TimeFormat.js.map +1 -1
- package/dist/cjs/TimezoneMismatchModal.js.map +1 -1
- package/dist/cjs/ToggleFeatureCard.js +3 -3
- package/dist/cjs/ToggleFeatureCard.js.map +1 -1
- package/dist/cjs/VersionHistory.js +3 -3
- package/dist/cjs/VersionHistory.js.map +1 -1
- package/dist/cjs/index-JY2zVpnv.js.map +1 -1
- package/dist/cjs/inject-css-B6qYtOJe.js +6 -0
- package/dist/cjs/inject-css-B6qYtOJe.js.map +1 -0
- package/dist/cjs/{phone-number-C93qn93_.js → phone-number-1EDAr56u.js} +34 -24
- package/dist/cjs/phone-number-1EDAr56u.js.map +1 -0
- package/dist/cjs/platform-BUcCb8Jx.js.map +1 -1
- package/dist/cjs/useKeyboardShortcutsPaneState-YnXpWOcs.js.map +1 -1
- package/dist/index-DAYCJu79.js.map +1 -1
- package/dist/inject-css-C2dztUxs.js +4 -0
- package/dist/inject-css-C2dztUxs.js.map +1 -0
- package/dist/{phone-number-CSXPpNBP.js → phone-number-BDkpXCIq.js} +36 -26
- package/dist/phone-number-BDkpXCIq.js.map +1 -0
- package/dist/platform-F44zJ4Xh.js.map +1 -1
- package/dist/useKeyboardShortcutsPaneState-C_eLceJQ.js.map +1 -1
- package/package.json +12 -14
- package/types/ButtonGroup.d.ts +2 -1
- package/types/CopyToClipboardButton.d.ts +2 -1
- package/types/EmailPreview.d.ts +2 -1
- package/types/FileUpload.d.ts +2 -1
- package/types/Header.d.ts +2 -1
- package/types/HelpPopover.d.ts +2 -1
- package/types/InlineInput.d.ts +2 -1
- package/types/IntegrationCard.d.ts +2 -1
- package/types/MoreDropdown.d.ts +1 -1
- package/types/PhoneNumber.d.ts +2 -1
- package/types/PublishBlock.d.ts +1 -1
- package/types/SubHeader.d.ts +1 -1
- package/types/ToggleFeatureCard.d.ts +1 -1
- package/dist/cjs/inject-css-vQvjPR2x.js +0 -6
- package/dist/cjs/inject-css-vQvjPR2x.js.map +0 -1
- package/dist/cjs/phone-number-C93qn93_.js.map +0 -1
- package/dist/inject-css-DmrvuTKK.js +0 -4
- package/dist/inject-css-DmrvuTKK.js.map +0 -1
- package/dist/phone-number-CSXPpNBP.js.map +0 -1
- package/src/translations/ar.json +0 -867
- package/src/translations/bg.json +0 -119
- package/src/translations/ca.json +0 -867
- package/src/translations/cs.json +0 -867
- package/src/translations/da.json +0 -867
- package/src/translations/de.json +0 -867
- package/src/translations/en.json +0 -867
- package/src/translations/es-MX.json +0 -867
- package/src/translations/es.json +0 -867
- package/src/translations/et.json +0 -867
- package/src/translations/fi.json +0 -867
- package/src/translations/fil.json +0 -867
- package/src/translations/fr.json +0 -867
- package/src/translations/hi.json +0 -119
- package/src/translations/hr.json +0 -867
- package/src/translations/id.json +0 -867
- package/src/translations/it.json +0 -867
- package/src/translations/ja.json +0 -867
- package/src/translations/ko.json +0 -867
- package/src/translations/nl.json +0 -867
- package/src/translations/pl.json +0 -867
- package/src/translations/pt-BR.json +0 -867
- package/src/translations/pt.json +0 -867
- package/src/translations/ro.json +0 -867
- package/src/translations/ru.json +0 -867
- package/src/translations/sk.json +0 -867
- package/src/translations/sl.json +0 -867
- package/src/translations/sv.json +0 -867
- package/src/translations/th.json +0 -867
- package/src/translations/tr.json +0 -867
- package/src/translations/uk.json +0 -867
- package/src/translations/vi.json +0 -867
- package/src/translations/zh-CN.json +0 -867
- package/src/translations/zh-TW.json +0 -867
package/dist/cjs/ErrorPage.js
CHANGED
|
@@ -8,7 +8,7 @@ var Button = require('@bigbinary/neetoui/Button');
|
|
|
8
8
|
var Typography = require('@bigbinary/neetoui/Typography');
|
|
9
9
|
var reactHelmet = require('react-helmet');
|
|
10
10
|
var reactI18next = require('react-i18next');
|
|
11
|
-
var injectCss = require('./inject-css-
|
|
11
|
+
var injectCss = require('./inject-css-B6qYtOJe.js');
|
|
12
12
|
var jsxRuntime = require('react/jsx-runtime');
|
|
13
13
|
|
|
14
14
|
function _interopNamespaceDefault(e) {
|
|
@@ -30,7 +30,7 @@ function _interopNamespaceDefault(e) {
|
|
|
30
30
|
|
|
31
31
|
var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
|
|
32
32
|
|
|
33
|
-
/*! @license DOMPurify 3.
|
|
33
|
+
/*! @license DOMPurify 3.2.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.6/LICENSE */
|
|
34
34
|
|
|
35
35
|
const {
|
|
36
36
|
entries,
|
|
@@ -44,227 +44,259 @@ let {
|
|
|
44
44
|
seal,
|
|
45
45
|
create
|
|
46
46
|
} = Object; // eslint-disable-line import/no-mutable-exports
|
|
47
|
-
|
|
48
47
|
let {
|
|
49
48
|
apply,
|
|
50
49
|
construct
|
|
51
50
|
} = typeof Reflect !== 'undefined' && Reflect;
|
|
52
|
-
|
|
53
|
-
if (!apply) {
|
|
54
|
-
apply = function apply(fun, thisValue, args) {
|
|
55
|
-
return fun.apply(thisValue, args);
|
|
56
|
-
};
|
|
57
|
-
}
|
|
58
|
-
|
|
59
51
|
if (!freeze) {
|
|
60
52
|
freeze = function freeze(x) {
|
|
61
53
|
return x;
|
|
62
54
|
};
|
|
63
55
|
}
|
|
64
|
-
|
|
65
56
|
if (!seal) {
|
|
66
57
|
seal = function seal(x) {
|
|
67
58
|
return x;
|
|
68
59
|
};
|
|
69
60
|
}
|
|
70
|
-
|
|
61
|
+
if (!apply) {
|
|
62
|
+
apply = function apply(fun, thisValue, args) {
|
|
63
|
+
return fun.apply(thisValue, args);
|
|
64
|
+
};
|
|
65
|
+
}
|
|
71
66
|
if (!construct) {
|
|
72
67
|
construct = function construct(Func, args) {
|
|
73
68
|
return new Func(...args);
|
|
74
69
|
};
|
|
75
70
|
}
|
|
76
|
-
|
|
77
71
|
const arrayForEach = unapply(Array.prototype.forEach);
|
|
72
|
+
const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
|
|
78
73
|
const arrayPop = unapply(Array.prototype.pop);
|
|
79
74
|
const arrayPush = unapply(Array.prototype.push);
|
|
75
|
+
const arraySplice = unapply(Array.prototype.splice);
|
|
80
76
|
const stringToLowerCase = unapply(String.prototype.toLowerCase);
|
|
81
77
|
const stringToString = unapply(String.prototype.toString);
|
|
82
78
|
const stringMatch = unapply(String.prototype.match);
|
|
83
79
|
const stringReplace = unapply(String.prototype.replace);
|
|
84
80
|
const stringIndexOf = unapply(String.prototype.indexOf);
|
|
85
81
|
const stringTrim = unapply(String.prototype.trim);
|
|
82
|
+
const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
|
|
86
83
|
const regExpTest = unapply(RegExp.prototype.test);
|
|
87
84
|
const typeErrorCreate = unconstruct(TypeError);
|
|
85
|
+
/**
|
|
86
|
+
* Creates a new function that calls the given function with a specified thisArg and arguments.
|
|
87
|
+
*
|
|
88
|
+
* @param func - The function to be wrapped and called.
|
|
89
|
+
* @returns A new function that calls the given function with a specified thisArg and arguments.
|
|
90
|
+
*/
|
|
88
91
|
function unapply(func) {
|
|
89
92
|
return function (thisArg) {
|
|
93
|
+
if (thisArg instanceof RegExp) {
|
|
94
|
+
thisArg.lastIndex = 0;
|
|
95
|
+
}
|
|
90
96
|
for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
|
|
91
97
|
args[_key - 1] = arguments[_key];
|
|
92
98
|
}
|
|
93
|
-
|
|
94
99
|
return apply(func, thisArg, args);
|
|
95
100
|
};
|
|
96
101
|
}
|
|
102
|
+
/**
|
|
103
|
+
* Creates a new function that constructs an instance of the given constructor function with the provided arguments.
|
|
104
|
+
*
|
|
105
|
+
* @param func - The constructor function to be wrapped and called.
|
|
106
|
+
* @returns A new function that constructs an instance of the given constructor function with the provided arguments.
|
|
107
|
+
*/
|
|
97
108
|
function unconstruct(func) {
|
|
98
109
|
return function () {
|
|
99
110
|
for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
|
|
100
111
|
args[_key2] = arguments[_key2];
|
|
101
112
|
}
|
|
102
|
-
|
|
103
113
|
return construct(func, args);
|
|
104
114
|
};
|
|
105
115
|
}
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
116
|
+
/**
|
|
117
|
+
* Add properties to a lookup table
|
|
118
|
+
*
|
|
119
|
+
* @param set - The set to which elements will be added.
|
|
120
|
+
* @param array - The array containing elements to be added to the set.
|
|
121
|
+
* @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
|
|
122
|
+
* @returns The modified set with added elements.
|
|
123
|
+
*/
|
|
124
|
+
function addToSet(set, array) {
|
|
125
|
+
let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
|
|
113
126
|
if (setPrototypeOf) {
|
|
114
127
|
// Make 'in' and truthy checks like Boolean(set.constructor)
|
|
115
128
|
// independent of any properties defined on Object.prototype.
|
|
116
129
|
// Prevent prototype setters from intercepting set as a this value.
|
|
117
130
|
setPrototypeOf(set, null);
|
|
118
131
|
}
|
|
119
|
-
|
|
120
132
|
let l = array.length;
|
|
121
|
-
|
|
122
133
|
while (l--) {
|
|
123
134
|
let element = array[l];
|
|
124
|
-
|
|
125
135
|
if (typeof element === 'string') {
|
|
126
136
|
const lcElement = transformCaseFunc(element);
|
|
127
|
-
|
|
128
137
|
if (lcElement !== element) {
|
|
129
138
|
// Config presets (e.g. tags.js, attrs.js) are immutable.
|
|
130
139
|
if (!isFrozen(array)) {
|
|
131
140
|
array[l] = lcElement;
|
|
132
141
|
}
|
|
133
|
-
|
|
134
142
|
element = lcElement;
|
|
135
143
|
}
|
|
136
144
|
}
|
|
137
|
-
|
|
138
145
|
set[element] = true;
|
|
139
146
|
}
|
|
140
|
-
|
|
141
147
|
return set;
|
|
142
148
|
}
|
|
143
|
-
|
|
144
|
-
|
|
149
|
+
/**
|
|
150
|
+
* Clean up an array to harden against CSPP
|
|
151
|
+
*
|
|
152
|
+
* @param array - The array to be cleaned.
|
|
153
|
+
* @returns The cleaned version of the array
|
|
154
|
+
*/
|
|
155
|
+
function cleanArray(array) {
|
|
156
|
+
for (let index = 0; index < array.length; index++) {
|
|
157
|
+
const isPropertyExist = objectHasOwnProperty(array, index);
|
|
158
|
+
if (!isPropertyExist) {
|
|
159
|
+
array[index] = null;
|
|
160
|
+
}
|
|
161
|
+
}
|
|
162
|
+
return array;
|
|
163
|
+
}
|
|
164
|
+
/**
|
|
165
|
+
* Shallow clone an object
|
|
166
|
+
*
|
|
167
|
+
* @param object - The object to be cloned.
|
|
168
|
+
* @returns A new object that copies the original.
|
|
169
|
+
*/
|
|
145
170
|
function clone(object) {
|
|
146
171
|
const newObject = create(null);
|
|
147
|
-
|
|
148
172
|
for (const [property, value] of entries(object)) {
|
|
149
|
-
|
|
173
|
+
const isPropertyExist = objectHasOwnProperty(object, property);
|
|
174
|
+
if (isPropertyExist) {
|
|
175
|
+
if (Array.isArray(value)) {
|
|
176
|
+
newObject[property] = cleanArray(value);
|
|
177
|
+
} else if (value && typeof value === 'object' && value.constructor === Object) {
|
|
178
|
+
newObject[property] = clone(value);
|
|
179
|
+
} else {
|
|
180
|
+
newObject[property] = value;
|
|
181
|
+
}
|
|
182
|
+
}
|
|
150
183
|
}
|
|
151
|
-
|
|
152
184
|
return newObject;
|
|
153
185
|
}
|
|
154
|
-
|
|
155
|
-
* or getter and behaves accordingly.
|
|
156
|
-
|
|
186
|
+
/**
|
|
187
|
+
* This method automatically checks if the prop is function or getter and behaves accordingly.
|
|
188
|
+
*
|
|
189
|
+
* @param object - The object to look up the getter function in its prototype chain.
|
|
190
|
+
* @param prop - The property name for which to find the getter function.
|
|
191
|
+
* @returns The getter function found in the prototype chain or a fallback function.
|
|
192
|
+
*/
|
|
157
193
|
function lookupGetter(object, prop) {
|
|
158
194
|
while (object !== null) {
|
|
159
195
|
const desc = getOwnPropertyDescriptor(object, prop);
|
|
160
|
-
|
|
161
196
|
if (desc) {
|
|
162
197
|
if (desc.get) {
|
|
163
198
|
return unapply(desc.get);
|
|
164
199
|
}
|
|
165
|
-
|
|
166
200
|
if (typeof desc.value === 'function') {
|
|
167
201
|
return unapply(desc.value);
|
|
168
202
|
}
|
|
169
203
|
}
|
|
170
|
-
|
|
171
204
|
object = getPrototypeOf(object);
|
|
172
205
|
}
|
|
173
|
-
|
|
174
|
-
function fallbackValue(element) {
|
|
175
|
-
console.warn('fallback value for', element);
|
|
206
|
+
function fallbackValue() {
|
|
176
207
|
return null;
|
|
177
208
|
}
|
|
178
|
-
|
|
179
209
|
return fallbackValue;
|
|
180
210
|
}
|
|
181
211
|
|
|
182
|
-
const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
183
|
-
|
|
212
|
+
const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
184
213
|
const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
|
|
185
|
-
const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
214
|
+
const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
215
|
+
// List of SVG elements that are disallowed by default.
|
|
186
216
|
// We still need to know them so that we can do namespace
|
|
187
217
|
// checks properly in case one wants to add them to
|
|
188
218
|
// allow-list.
|
|
189
|
-
|
|
190
219
|
const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
|
|
191
|
-
const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
220
|
+
const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
221
|
+
// Similarly to SVG, we want to know all MathML elements,
|
|
192
222
|
// even those that we disallow by default.
|
|
193
|
-
|
|
194
223
|
const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
|
|
195
224
|
const text = freeze(['#text']);
|
|
196
225
|
|
|
197
|
-
const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
|
|
198
|
-
const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
|
|
226
|
+
const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
|
|
227
|
+
const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
|
|
199
228
|
const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
|
|
200
229
|
const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
|
|
201
230
|
|
|
231
|
+
// eslint-disable-next-line unicorn/better-regex
|
|
202
232
|
const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
|
|
203
|
-
|
|
204
233
|
const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
205
|
-
const TMPLIT_EXPR = seal(
|
|
206
|
-
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]
|
|
207
|
-
|
|
234
|
+
const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm); // eslint-disable-line unicorn/better-regex
|
|
235
|
+
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
|
|
208
236
|
const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
|
|
209
|
-
|
|
210
|
-
const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
|
|
237
|
+
const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
|
|
211
238
|
);
|
|
212
239
|
const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
|
|
213
240
|
const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
|
|
214
241
|
);
|
|
215
242
|
const DOCTYPE_NAME = seal(/^html$/i);
|
|
243
|
+
const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
|
|
216
244
|
|
|
217
245
|
var EXPRESSIONS = /*#__PURE__*/Object.freeze({
|
|
218
246
|
__proto__: null,
|
|
219
|
-
MUSTACHE_EXPR: MUSTACHE_EXPR,
|
|
220
|
-
ERB_EXPR: ERB_EXPR,
|
|
221
|
-
TMPLIT_EXPR: TMPLIT_EXPR,
|
|
222
|
-
DATA_ATTR: DATA_ATTR,
|
|
223
247
|
ARIA_ATTR: ARIA_ATTR,
|
|
248
|
+
ATTR_WHITESPACE: ATTR_WHITESPACE,
|
|
249
|
+
CUSTOM_ELEMENT: CUSTOM_ELEMENT,
|
|
250
|
+
DATA_ATTR: DATA_ATTR,
|
|
251
|
+
DOCTYPE_NAME: DOCTYPE_NAME,
|
|
252
|
+
ERB_EXPR: ERB_EXPR,
|
|
224
253
|
IS_ALLOWED_URI: IS_ALLOWED_URI,
|
|
225
254
|
IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
|
|
226
|
-
|
|
227
|
-
|
|
255
|
+
MUSTACHE_EXPR: MUSTACHE_EXPR,
|
|
256
|
+
TMPLIT_EXPR: TMPLIT_EXPR
|
|
228
257
|
});
|
|
229
258
|
|
|
230
|
-
|
|
259
|
+
/* eslint-disable @typescript-eslint/indent */
|
|
260
|
+
// https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
|
|
261
|
+
const NODE_TYPE = {
|
|
262
|
+
element: 1,
|
|
263
|
+
text: 3,
|
|
264
|
+
// Deprecated
|
|
265
|
+
progressingInstruction: 7,
|
|
266
|
+
comment: 8,
|
|
267
|
+
document: 9};
|
|
268
|
+
const getGlobal = function getGlobal() {
|
|
269
|
+
return typeof window === 'undefined' ? null : window;
|
|
270
|
+
};
|
|
231
271
|
/**
|
|
232
272
|
* Creates a no-op policy for internal use only.
|
|
233
273
|
* Don't export this function outside this module!
|
|
234
|
-
* @param
|
|
235
|
-
* @param
|
|
236
|
-
* @return
|
|
274
|
+
* @param trustedTypes The policy factory.
|
|
275
|
+
* @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
|
|
276
|
+
* @return The policy created (or null, if Trusted Types
|
|
237
277
|
* are not supported or creating the policy failed).
|
|
238
278
|
*/
|
|
239
|
-
|
|
240
|
-
|
|
241
279
|
const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
|
|
242
280
|
if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
|
|
243
281
|
return null;
|
|
244
|
-
}
|
|
282
|
+
}
|
|
283
|
+
// Allow the callers to control the unique policy name
|
|
245
284
|
// by adding a data-tt-policy-suffix to the script element with the DOMPurify.
|
|
246
285
|
// Policy creation with duplicate names throws in Trusted Types.
|
|
247
|
-
|
|
248
|
-
|
|
249
286
|
let suffix = null;
|
|
250
287
|
const ATTR_NAME = 'data-tt-policy-suffix';
|
|
251
|
-
|
|
252
288
|
if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
|
|
253
289
|
suffix = purifyHostElement.getAttribute(ATTR_NAME);
|
|
254
290
|
}
|
|
255
|
-
|
|
256
291
|
const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
|
|
257
|
-
|
|
258
292
|
try {
|
|
259
293
|
return trustedTypes.createPolicy(policyName, {
|
|
260
294
|
createHTML(html) {
|
|
261
295
|
return html;
|
|
262
296
|
},
|
|
263
|
-
|
|
264
297
|
createScriptURL(scriptUrl) {
|
|
265
298
|
return scriptUrl;
|
|
266
299
|
}
|
|
267
|
-
|
|
268
300
|
});
|
|
269
301
|
} catch (_) {
|
|
270
302
|
// Policy creation failed (most likely another DOMPurify script has
|
|
@@ -274,37 +306,35 @@ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedType
|
|
|
274
306
|
return null;
|
|
275
307
|
}
|
|
276
308
|
};
|
|
277
|
-
|
|
309
|
+
const _createHooksMap = function _createHooksMap() {
|
|
310
|
+
return {
|
|
311
|
+
afterSanitizeAttributes: [],
|
|
312
|
+
afterSanitizeElements: [],
|
|
313
|
+
afterSanitizeShadowDOM: [],
|
|
314
|
+
beforeSanitizeAttributes: [],
|
|
315
|
+
beforeSanitizeElements: [],
|
|
316
|
+
beforeSanitizeShadowDOM: [],
|
|
317
|
+
uponSanitizeAttribute: [],
|
|
318
|
+
uponSanitizeElement: [],
|
|
319
|
+
uponSanitizeShadowNode: []
|
|
320
|
+
};
|
|
321
|
+
};
|
|
278
322
|
function createDOMPurify() {
|
|
279
323
|
let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
|
|
280
|
-
|
|
281
324
|
const DOMPurify = root => createDOMPurify(root);
|
|
282
|
-
|
|
283
|
-
* Version label, exposed for easier checks
|
|
284
|
-
* if DOMPurify is up to date or not
|
|
285
|
-
*/
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
DOMPurify.version = '3.0.3';
|
|
289
|
-
/**
|
|
290
|
-
* Array of elements that DOMPurify removed during sanitation.
|
|
291
|
-
* Empty if nothing was removed.
|
|
292
|
-
*/
|
|
293
|
-
|
|
325
|
+
DOMPurify.version = '3.2.6';
|
|
294
326
|
DOMPurify.removed = [];
|
|
295
|
-
|
|
296
|
-
if (!window || !window.document || window.document.nodeType !== 9) {
|
|
327
|
+
if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
|
|
297
328
|
// Not running in a browser, provide a factory function
|
|
298
329
|
// so that you can pass your own Window
|
|
299
330
|
DOMPurify.isSupported = false;
|
|
300
331
|
return DOMPurify;
|
|
301
332
|
}
|
|
302
|
-
|
|
303
|
-
const originalDocument = window.document;
|
|
304
|
-
const currentScript = originalDocument.currentScript;
|
|
305
333
|
let {
|
|
306
334
|
document
|
|
307
335
|
} = window;
|
|
336
|
+
const originalDocument = document;
|
|
337
|
+
const currentScript = originalDocument.currentScript;
|
|
308
338
|
const {
|
|
309
339
|
DocumentFragment,
|
|
310
340
|
HTMLTemplateElement,
|
|
@@ -318,23 +348,22 @@ function createDOMPurify() {
|
|
|
318
348
|
} = window;
|
|
319
349
|
const ElementPrototype = Element.prototype;
|
|
320
350
|
const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
|
|
351
|
+
const remove = lookupGetter(ElementPrototype, 'remove');
|
|
321
352
|
const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
|
|
322
353
|
const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
|
|
323
|
-
const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
354
|
+
const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
355
|
+
// As per issue #47, the web-components registry is inherited by a
|
|
324
356
|
// new document created via createHTMLDocument. As per the spec
|
|
325
357
|
// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
|
|
326
358
|
// a new empty registry is used when creating a template contents owner
|
|
327
359
|
// document, so we use that as our parent document to ensure nothing
|
|
328
360
|
// is inherited.
|
|
329
|
-
|
|
330
361
|
if (typeof HTMLTemplateElement === 'function') {
|
|
331
362
|
const template = document.createElement('template');
|
|
332
|
-
|
|
333
363
|
if (template.content && template.content.ownerDocument) {
|
|
334
364
|
document = template.content.ownerDocument;
|
|
335
365
|
}
|
|
336
366
|
}
|
|
337
|
-
|
|
338
367
|
let trustedTypesPolicy;
|
|
339
368
|
let emptyHTML = '';
|
|
340
369
|
const {
|
|
@@ -346,11 +375,10 @@ function createDOMPurify() {
|
|
|
346
375
|
const {
|
|
347
376
|
importNode
|
|
348
377
|
} = originalDocument;
|
|
349
|
-
let hooks =
|
|
378
|
+
let hooks = _createHooksMap();
|
|
350
379
|
/**
|
|
351
380
|
* Expose whether this browser supports running the full DOMPurify.
|
|
352
381
|
*/
|
|
353
|
-
|
|
354
382
|
DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
|
|
355
383
|
const {
|
|
356
384
|
MUSTACHE_EXPR,
|
|
@@ -359,7 +387,8 @@ function createDOMPurify() {
|
|
|
359
387
|
DATA_ATTR,
|
|
360
388
|
ARIA_ATTR,
|
|
361
389
|
IS_SCRIPT_OR_DATA,
|
|
362
|
-
ATTR_WHITESPACE
|
|
390
|
+
ATTR_WHITESPACE,
|
|
391
|
+
CUSTOM_ELEMENT
|
|
363
392
|
} = EXPRESSIONS;
|
|
364
393
|
let {
|
|
365
394
|
IS_ALLOWED_URI: IS_ALLOWED_URI$1
|
|
@@ -368,23 +397,19 @@ function createDOMPurify() {
|
|
|
368
397
|
* We consider the elements and attributes below to be safe. Ideally
|
|
369
398
|
* don't add any new ones but feel free to remove unwanted ones.
|
|
370
399
|
*/
|
|
371
|
-
|
|
372
400
|
/* allowed element names */
|
|
373
|
-
|
|
374
401
|
let ALLOWED_TAGS = null;
|
|
375
402
|
const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
|
|
376
403
|
/* Allowed attribute names */
|
|
377
|
-
|
|
378
404
|
let ALLOWED_ATTR = null;
|
|
379
405
|
const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
|
|
380
406
|
/*
|
|
381
|
-
* Configure how
|
|
407
|
+
* Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
|
|
382
408
|
* @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
|
|
383
409
|
* @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
|
|
384
410
|
* @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
|
|
385
411
|
*/
|
|
386
|
-
|
|
387
|
-
let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
|
|
412
|
+
let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
388
413
|
tagNameCheck: {
|
|
389
414
|
writable: true,
|
|
390
415
|
configurable: false,
|
|
@@ -405,57 +430,47 @@ function createDOMPurify() {
|
|
|
405
430
|
}
|
|
406
431
|
}));
|
|
407
432
|
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
|
|
408
|
-
|
|
409
433
|
let FORBID_TAGS = null;
|
|
410
434
|
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
|
|
411
|
-
|
|
412
435
|
let FORBID_ATTR = null;
|
|
413
436
|
/* Decide if ARIA attributes are okay */
|
|
414
|
-
|
|
415
437
|
let ALLOW_ARIA_ATTR = true;
|
|
416
438
|
/* Decide if custom data attributes are okay */
|
|
417
|
-
|
|
418
439
|
let ALLOW_DATA_ATTR = true;
|
|
419
440
|
/* Decide if unknown protocols are okay */
|
|
420
|
-
|
|
421
441
|
let ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
422
442
|
/* Decide if self-closing tags in attributes are allowed.
|
|
423
443
|
* Usually removed due to a mXSS issue in jQuery 3.0 */
|
|
424
|
-
|
|
425
444
|
let ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
426
445
|
/* Output should be safe for common template engines.
|
|
427
446
|
* This means, DOMPurify removes data attributes, mustaches and ERB
|
|
428
447
|
*/
|
|
429
|
-
|
|
430
448
|
let SAFE_FOR_TEMPLATES = false;
|
|
449
|
+
/* Output should be safe even for XML used within HTML and alike.
|
|
450
|
+
* This means, DOMPurify removes comments when containing risky content.
|
|
451
|
+
*/
|
|
452
|
+
let SAFE_FOR_XML = true;
|
|
431
453
|
/* Decide if document with <html>... should be returned */
|
|
432
|
-
|
|
433
454
|
let WHOLE_DOCUMENT = false;
|
|
434
455
|
/* Track whether config is already set on this instance of DOMPurify. */
|
|
435
|
-
|
|
436
456
|
let SET_CONFIG = false;
|
|
437
457
|
/* Decide if all elements (e.g. style, script) must be children of
|
|
438
458
|
* document.body. By default, browsers might move them to document.head */
|
|
439
|
-
|
|
440
459
|
let FORCE_BODY = false;
|
|
441
460
|
/* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
|
|
442
461
|
* string (or a TrustedHTML object if Trusted Types are supported).
|
|
443
462
|
* If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
|
|
444
463
|
*/
|
|
445
|
-
|
|
446
464
|
let RETURN_DOM = false;
|
|
447
465
|
/* Decide if a DOM `DocumentFragment` should be returned, instead of a html
|
|
448
466
|
* string (or a TrustedHTML object if Trusted Types are supported) */
|
|
449
|
-
|
|
450
467
|
let RETURN_DOM_FRAGMENT = false;
|
|
451
468
|
/* Try to return a Trusted Type object instead of a string, return a string in
|
|
452
469
|
* case Trusted Types are not supported */
|
|
453
|
-
|
|
454
470
|
let RETURN_TRUSTED_TYPE = false;
|
|
455
471
|
/* Output should be free from DOM clobbering attacks?
|
|
456
472
|
* This sanitizes markups named with colliding, clobberable built-in DOM APIs.
|
|
457
473
|
*/
|
|
458
|
-
|
|
459
474
|
let SANITIZE_DOM = true;
|
|
460
475
|
/* Achieve full DOM Clobbering protection by isolating the namespace of named
|
|
461
476
|
* properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
|
|
@@ -470,180 +485,138 @@ function createDOMPurify() {
|
|
|
470
485
|
* Namespace isolation is implemented by prefixing `id` and `name` attributes
|
|
471
486
|
* with a constant string, i.e., `user-content-`
|
|
472
487
|
*/
|
|
473
|
-
|
|
474
488
|
let SANITIZE_NAMED_PROPS = false;
|
|
475
489
|
const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
|
|
476
490
|
/* Keep element content when removing element? */
|
|
477
|
-
|
|
478
491
|
let KEEP_CONTENT = true;
|
|
479
492
|
/* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
|
|
480
493
|
* of importing it into a new Document and returning a sanitized copy */
|
|
481
|
-
|
|
482
494
|
let IN_PLACE = false;
|
|
483
495
|
/* Allow usage of profiles like html, svg and mathMl */
|
|
484
|
-
|
|
485
496
|
let USE_PROFILES = {};
|
|
486
497
|
/* Tags to ignore content of when KEEP_CONTENT is true */
|
|
487
|
-
|
|
488
498
|
let FORBID_CONTENTS = null;
|
|
489
499
|
const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
|
|
490
500
|
/* Tags that are safe for data: URIs */
|
|
491
|
-
|
|
492
501
|
let DATA_URI_TAGS = null;
|
|
493
502
|
const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
|
|
494
503
|
/* Attributes safe for values like "javascript:" */
|
|
495
|
-
|
|
496
504
|
let URI_SAFE_ATTRIBUTES = null;
|
|
497
505
|
const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
|
|
498
506
|
const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
|
|
499
507
|
const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
|
|
500
508
|
const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
|
|
501
509
|
/* Document namespace */
|
|
502
|
-
|
|
503
510
|
let NAMESPACE = HTML_NAMESPACE;
|
|
504
511
|
let IS_EMPTY_INPUT = false;
|
|
505
512
|
/* Allowed XHTML+XML namespaces */
|
|
506
|
-
|
|
507
513
|
let ALLOWED_NAMESPACES = null;
|
|
508
514
|
const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
|
|
515
|
+
let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
516
|
+
let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
|
|
517
|
+
// Certain elements are allowed in both SVG and HTML
|
|
518
|
+
// namespace. We need to specify them explicitly
|
|
519
|
+
// so that they don't get erroneously deleted from
|
|
520
|
+
// HTML namespace.
|
|
521
|
+
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
509
522
|
/* Parsing of strict XHTML documents */
|
|
510
|
-
|
|
511
|
-
let PARSER_MEDIA_TYPE;
|
|
523
|
+
let PARSER_MEDIA_TYPE = null;
|
|
512
524
|
const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
|
|
513
525
|
const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
|
|
514
|
-
let transformCaseFunc;
|
|
526
|
+
let transformCaseFunc = null;
|
|
515
527
|
/* Keep a reference to config to pass to hooks */
|
|
516
|
-
|
|
517
528
|
let CONFIG = null;
|
|
518
529
|
/* Ideally, do not touch anything below this line */
|
|
519
|
-
|
|
520
530
|
/* ______________________________________________ */
|
|
521
|
-
|
|
522
531
|
const formElement = document.createElement('form');
|
|
523
|
-
|
|
524
532
|
const isRegexOrFunction = function isRegexOrFunction(testValue) {
|
|
525
533
|
return testValue instanceof RegExp || testValue instanceof Function;
|
|
526
534
|
};
|
|
527
535
|
/**
|
|
528
536
|
* _parseConfig
|
|
529
537
|
*
|
|
530
|
-
* @param
|
|
538
|
+
* @param cfg optional config literal
|
|
531
539
|
*/
|
|
532
540
|
// eslint-disable-next-line complexity
|
|
533
|
-
|
|
534
|
-
|
|
535
|
-
const _parseConfig = function _parseConfig(cfg) {
|
|
541
|
+
const _parseConfig = function _parseConfig() {
|
|
542
|
+
let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
536
543
|
if (CONFIG && CONFIG === cfg) {
|
|
537
544
|
return;
|
|
538
545
|
}
|
|
539
546
|
/* Shield configuration object from tampering */
|
|
540
|
-
|
|
541
|
-
|
|
542
547
|
if (!cfg || typeof cfg !== 'object') {
|
|
543
548
|
cfg = {};
|
|
544
549
|
}
|
|
545
550
|
/* Shield configuration object from prototype pollution */
|
|
546
|
-
|
|
547
|
-
|
|
548
551
|
cfg = clone(cfg);
|
|
549
|
-
PARSER_MEDIA_TYPE =
|
|
550
|
-
|
|
551
|
-
|
|
552
|
+
PARSER_MEDIA_TYPE =
|
|
553
|
+
// eslint-disable-next-line unicorn/prefer-includes
|
|
554
|
+
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
|
|
555
|
+
// HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
|
|
552
556
|
transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
|
|
553
557
|
/* Set configuration parameters */
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
cfg.
|
|
560
|
-
transformCaseFunc
|
|
561
|
-
)
|
|
562
|
-
:
|
|
563
|
-
DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
|
|
564
|
-
cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
|
|
565
|
-
transformCaseFunc // eslint-disable-line indent
|
|
566
|
-
) // eslint-disable-line indent
|
|
567
|
-
: DEFAULT_DATA_URI_TAGS;
|
|
568
|
-
FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
569
|
-
FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
|
|
570
|
-
FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
|
|
571
|
-
USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
|
|
558
|
+
ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
|
|
559
|
+
ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
|
|
560
|
+
ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
|
|
561
|
+
URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
|
|
562
|
+
DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
|
|
563
|
+
FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
564
|
+
FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
|
|
565
|
+
FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
|
|
566
|
+
USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
|
|
572
567
|
ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
|
|
573
|
-
|
|
574
568
|
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
|
|
575
|
-
|
|
576
569
|
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
|
|
577
|
-
|
|
578
570
|
ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
|
|
579
|
-
|
|
580
571
|
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
|
|
581
|
-
|
|
572
|
+
SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
|
|
582
573
|
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
|
|
583
|
-
|
|
584
574
|
RETURN_DOM = cfg.RETURN_DOM || false; // Default false
|
|
585
|
-
|
|
586
575
|
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
|
|
587
|
-
|
|
588
576
|
RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
|
|
589
|
-
|
|
590
577
|
FORCE_BODY = cfg.FORCE_BODY || false; // Default false
|
|
591
|
-
|
|
592
578
|
SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
|
|
593
|
-
|
|
594
579
|
SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
|
|
595
|
-
|
|
596
580
|
KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
|
|
597
|
-
|
|
598
581
|
IN_PLACE = cfg.IN_PLACE || false; // Default false
|
|
599
|
-
|
|
600
582
|
IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
|
|
601
583
|
NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
|
|
584
|
+
MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
|
|
585
|
+
HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
|
|
602
586
|
CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
|
|
603
|
-
|
|
604
587
|
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
|
|
605
588
|
CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
|
|
606
589
|
}
|
|
607
|
-
|
|
608
590
|
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
|
|
609
591
|
CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
|
|
610
592
|
}
|
|
611
|
-
|
|
612
593
|
if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
|
|
613
594
|
CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
|
|
614
595
|
}
|
|
615
|
-
|
|
616
596
|
if (SAFE_FOR_TEMPLATES) {
|
|
617
597
|
ALLOW_DATA_ATTR = false;
|
|
618
598
|
}
|
|
619
|
-
|
|
620
599
|
if (RETURN_DOM_FRAGMENT) {
|
|
621
600
|
RETURN_DOM = true;
|
|
622
601
|
}
|
|
623
602
|
/* Parse profile info */
|
|
624
|
-
|
|
625
|
-
|
|
626
603
|
if (USE_PROFILES) {
|
|
627
|
-
ALLOWED_TAGS = addToSet({},
|
|
604
|
+
ALLOWED_TAGS = addToSet({}, text);
|
|
628
605
|
ALLOWED_ATTR = [];
|
|
629
|
-
|
|
630
606
|
if (USE_PROFILES.html === true) {
|
|
631
607
|
addToSet(ALLOWED_TAGS, html$1);
|
|
632
608
|
addToSet(ALLOWED_ATTR, html);
|
|
633
609
|
}
|
|
634
|
-
|
|
635
610
|
if (USE_PROFILES.svg === true) {
|
|
636
611
|
addToSet(ALLOWED_TAGS, svg$1);
|
|
637
612
|
addToSet(ALLOWED_ATTR, svg);
|
|
638
613
|
addToSet(ALLOWED_ATTR, xml);
|
|
639
614
|
}
|
|
640
|
-
|
|
641
615
|
if (USE_PROFILES.svgFilters === true) {
|
|
642
616
|
addToSet(ALLOWED_TAGS, svgFilters);
|
|
643
617
|
addToSet(ALLOWED_ATTR, svg);
|
|
644
618
|
addToSet(ALLOWED_ATTR, xml);
|
|
645
619
|
}
|
|
646
|
-
|
|
647
620
|
if (USE_PROFILES.mathMl === true) {
|
|
648
621
|
addToSet(ALLOWED_TAGS, mathMl$1);
|
|
649
622
|
addToSet(ALLOWED_ATTR, mathMl);
|
|
@@ -651,171 +624,127 @@ function createDOMPurify() {
|
|
|
651
624
|
}
|
|
652
625
|
}
|
|
653
626
|
/* Merge configuration parameters */
|
|
654
|
-
|
|
655
|
-
|
|
656
627
|
if (cfg.ADD_TAGS) {
|
|
657
628
|
if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
|
|
658
629
|
ALLOWED_TAGS = clone(ALLOWED_TAGS);
|
|
659
630
|
}
|
|
660
|
-
|
|
661
631
|
addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
|
|
662
632
|
}
|
|
663
|
-
|
|
664
633
|
if (cfg.ADD_ATTR) {
|
|
665
634
|
if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
|
|
666
635
|
ALLOWED_ATTR = clone(ALLOWED_ATTR);
|
|
667
636
|
}
|
|
668
|
-
|
|
669
637
|
addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
|
|
670
638
|
}
|
|
671
|
-
|
|
672
639
|
if (cfg.ADD_URI_SAFE_ATTR) {
|
|
673
640
|
addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
|
|
674
641
|
}
|
|
675
|
-
|
|
676
642
|
if (cfg.FORBID_CONTENTS) {
|
|
677
643
|
if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
|
|
678
644
|
FORBID_CONTENTS = clone(FORBID_CONTENTS);
|
|
679
645
|
}
|
|
680
|
-
|
|
681
646
|
addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
|
|
682
647
|
}
|
|
683
648
|
/* Add #text in case KEEP_CONTENT is set to true */
|
|
684
|
-
|
|
685
|
-
|
|
686
649
|
if (KEEP_CONTENT) {
|
|
687
650
|
ALLOWED_TAGS['#text'] = true;
|
|
688
651
|
}
|
|
689
652
|
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
|
|
690
|
-
|
|
691
|
-
|
|
692
653
|
if (WHOLE_DOCUMENT) {
|
|
693
654
|
addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
|
|
694
655
|
}
|
|
695
656
|
/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
|
|
696
|
-
|
|
697
|
-
|
|
698
657
|
if (ALLOWED_TAGS.table) {
|
|
699
658
|
addToSet(ALLOWED_TAGS, ['tbody']);
|
|
700
659
|
delete FORBID_TAGS.tbody;
|
|
701
660
|
}
|
|
702
|
-
|
|
703
661
|
if (cfg.TRUSTED_TYPES_POLICY) {
|
|
704
662
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
|
|
705
663
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
|
|
706
664
|
}
|
|
707
|
-
|
|
708
665
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
|
|
709
666
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
|
|
710
|
-
}
|
|
711
|
-
|
|
712
|
-
|
|
713
|
-
|
|
714
|
-
|
|
667
|
+
}
|
|
668
|
+
// Overwrite existing TrustedTypes policy.
|
|
669
|
+
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
|
|
670
|
+
// Sign local variables required by `sanitize`.
|
|
715
671
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
716
672
|
} else {
|
|
717
673
|
// Uninitialized policy, attempt to initialize the internal dompurify policy.
|
|
718
674
|
if (trustedTypesPolicy === undefined) {
|
|
719
675
|
trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
|
|
720
|
-
}
|
|
721
|
-
|
|
722
|
-
|
|
676
|
+
}
|
|
677
|
+
// If creating the internal policy succeeded sign internal variables.
|
|
723
678
|
if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
|
|
724
679
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
725
680
|
}
|
|
726
|
-
}
|
|
681
|
+
}
|
|
682
|
+
// Prevent further manipulation of configuration.
|
|
727
683
|
// Not available in IE8, Safari 5, etc.
|
|
728
|
-
|
|
729
|
-
|
|
730
684
|
if (freeze) {
|
|
731
685
|
freeze(cfg);
|
|
732
686
|
}
|
|
733
|
-
|
|
734
687
|
CONFIG = cfg;
|
|
735
688
|
};
|
|
736
|
-
|
|
737
|
-
const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
738
|
-
const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
|
|
739
|
-
// namespace. We need to specify them explicitly
|
|
740
|
-
// so that they don't get erroneously deleted from
|
|
741
|
-
// HTML namespace.
|
|
742
|
-
|
|
743
|
-
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
744
689
|
/* Keep track of all possible SVG and MathML tags
|
|
745
690
|
* so that we can perform the namespace checks
|
|
746
691
|
* correctly. */
|
|
747
|
-
|
|
748
|
-
const
|
|
749
|
-
addToSet(ALL_SVG_TAGS, svgFilters);
|
|
750
|
-
addToSet(ALL_SVG_TAGS, svgDisallowed);
|
|
751
|
-
const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
|
|
752
|
-
addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
|
|
692
|
+
const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
|
|
693
|
+
const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
|
|
753
694
|
/**
|
|
754
|
-
*
|
|
755
|
-
*
|
|
756
|
-
* @param {Element} element a DOM element whose namespace is being checked
|
|
757
|
-
* @returns {boolean} Return false if the element has a
|
|
695
|
+
* @param element a DOM element whose namespace is being checked
|
|
696
|
+
* @returns Return false if the element has a
|
|
758
697
|
* namespace that a spec-compliant parser would never
|
|
759
698
|
* return. Return true otherwise.
|
|
760
699
|
*/
|
|
761
|
-
|
|
762
700
|
const _checkValidNamespace = function _checkValidNamespace(element) {
|
|
763
|
-
let parent = getParentNode(element);
|
|
701
|
+
let parent = getParentNode(element);
|
|
702
|
+
// In JSDOM, if we're inside shadow DOM, then parentNode
|
|
764
703
|
// can be null. We just simulate parent in this case.
|
|
765
|
-
|
|
766
704
|
if (!parent || !parent.tagName) {
|
|
767
705
|
parent = {
|
|
768
706
|
namespaceURI: NAMESPACE,
|
|
769
707
|
tagName: 'template'
|
|
770
708
|
};
|
|
771
709
|
}
|
|
772
|
-
|
|
773
710
|
const tagName = stringToLowerCase(element.tagName);
|
|
774
711
|
const parentTagName = stringToLowerCase(parent.tagName);
|
|
775
|
-
|
|
776
712
|
if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
777
713
|
return false;
|
|
778
714
|
}
|
|
779
|
-
|
|
780
715
|
if (element.namespaceURI === SVG_NAMESPACE) {
|
|
781
716
|
// The only way to switch from HTML namespace to SVG
|
|
782
717
|
// is via <svg>. If it happens via any other tag, then
|
|
783
718
|
// it should be killed.
|
|
784
719
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
785
720
|
return tagName === 'svg';
|
|
786
|
-
}
|
|
721
|
+
}
|
|
722
|
+
// The only way to switch from MathML to SVG is via`
|
|
787
723
|
// svg if parent is either <annotation-xml> or MathML
|
|
788
724
|
// text integration points.
|
|
789
|
-
|
|
790
|
-
|
|
791
725
|
if (parent.namespaceURI === MATHML_NAMESPACE) {
|
|
792
726
|
return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
|
|
793
|
-
}
|
|
727
|
+
}
|
|
728
|
+
// We only allow elements that are defined in SVG
|
|
794
729
|
// spec. All others are disallowed in SVG namespace.
|
|
795
|
-
|
|
796
|
-
|
|
797
730
|
return Boolean(ALL_SVG_TAGS[tagName]);
|
|
798
731
|
}
|
|
799
|
-
|
|
800
732
|
if (element.namespaceURI === MATHML_NAMESPACE) {
|
|
801
733
|
// The only way to switch from HTML namespace to MathML
|
|
802
734
|
// is via <math>. If it happens via any other tag, then
|
|
803
735
|
// it should be killed.
|
|
804
736
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
805
737
|
return tagName === 'math';
|
|
806
|
-
}
|
|
738
|
+
}
|
|
739
|
+
// The only way to switch from SVG to MathML is via
|
|
807
740
|
// <math> and HTML integration points
|
|
808
|
-
|
|
809
|
-
|
|
810
741
|
if (parent.namespaceURI === SVG_NAMESPACE) {
|
|
811
742
|
return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
|
|
812
|
-
}
|
|
743
|
+
}
|
|
744
|
+
// We only allow elements that are defined in MathML
|
|
813
745
|
// spec. All others are disallowed in MathML namespace.
|
|
814
|
-
|
|
815
|
-
|
|
816
746
|
return Boolean(ALL_MATHML_TAGS[tagName]);
|
|
817
747
|
}
|
|
818
|
-
|
|
819
748
|
if (element.namespaceURI === HTML_NAMESPACE) {
|
|
820
749
|
// The only way to switch from SVG to HTML is via
|
|
821
750
|
// HTML integration points, and from MathML to HTML
|
|
@@ -823,77 +752,67 @@ function createDOMPurify() {
|
|
|
823
752
|
if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
|
|
824
753
|
return false;
|
|
825
754
|
}
|
|
826
|
-
|
|
827
755
|
if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
|
|
828
756
|
return false;
|
|
829
|
-
}
|
|
757
|
+
}
|
|
758
|
+
// We disallow tags that are specific for MathML
|
|
830
759
|
// or SVG and should never appear in HTML namespace
|
|
831
|
-
|
|
832
|
-
|
|
833
760
|
return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
|
|
834
|
-
}
|
|
835
|
-
|
|
836
|
-
|
|
761
|
+
}
|
|
762
|
+
// For XHTML and XML documents that support custom namespaces
|
|
837
763
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
838
764
|
return true;
|
|
839
|
-
}
|
|
765
|
+
}
|
|
766
|
+
// The code should never reach this place (this means
|
|
840
767
|
// that the element somehow got namespace that is not
|
|
841
768
|
// HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
|
|
842
769
|
// Return false just in case.
|
|
843
|
-
|
|
844
|
-
|
|
845
770
|
return false;
|
|
846
771
|
};
|
|
847
772
|
/**
|
|
848
773
|
* _forceRemove
|
|
849
774
|
*
|
|
850
|
-
* @param
|
|
775
|
+
* @param node a DOM node
|
|
851
776
|
*/
|
|
852
|
-
|
|
853
|
-
|
|
854
777
|
const _forceRemove = function _forceRemove(node) {
|
|
855
778
|
arrayPush(DOMPurify.removed, {
|
|
856
779
|
element: node
|
|
857
780
|
});
|
|
858
|
-
|
|
859
781
|
try {
|
|
860
782
|
// eslint-disable-next-line unicorn/prefer-dom-node-remove
|
|
861
|
-
node.
|
|
783
|
+
getParentNode(node).removeChild(node);
|
|
862
784
|
} catch (_) {
|
|
863
|
-
|
|
785
|
+
remove(node);
|
|
864
786
|
}
|
|
865
787
|
};
|
|
866
788
|
/**
|
|
867
789
|
* _removeAttribute
|
|
868
790
|
*
|
|
869
|
-
* @param
|
|
870
|
-
* @param
|
|
791
|
+
* @param name an Attribute name
|
|
792
|
+
* @param element a DOM node
|
|
871
793
|
*/
|
|
872
|
-
|
|
873
|
-
|
|
874
|
-
const _removeAttribute = function _removeAttribute(name, node) {
|
|
794
|
+
const _removeAttribute = function _removeAttribute(name, element) {
|
|
875
795
|
try {
|
|
876
796
|
arrayPush(DOMPurify.removed, {
|
|
877
|
-
attribute:
|
|
878
|
-
from:
|
|
797
|
+
attribute: element.getAttributeNode(name),
|
|
798
|
+
from: element
|
|
879
799
|
});
|
|
880
800
|
} catch (_) {
|
|
881
801
|
arrayPush(DOMPurify.removed, {
|
|
882
802
|
attribute: null,
|
|
883
|
-
from:
|
|
803
|
+
from: element
|
|
884
804
|
});
|
|
885
805
|
}
|
|
886
|
-
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
if (name === 'is' && !ALLOWED_ATTR[name]) {
|
|
806
|
+
element.removeAttribute(name);
|
|
807
|
+
// We void attribute values for unremovable "is" attributes
|
|
808
|
+
if (name === 'is') {
|
|
890
809
|
if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
|
|
891
810
|
try {
|
|
892
|
-
_forceRemove(
|
|
811
|
+
_forceRemove(element);
|
|
893
812
|
} catch (_) {}
|
|
894
813
|
} else {
|
|
895
814
|
try {
|
|
896
|
-
|
|
815
|
+
element.setAttribute(name, '');
|
|
897
816
|
} catch (_) {}
|
|
898
817
|
}
|
|
899
818
|
}
|
|
@@ -901,16 +820,13 @@ function createDOMPurify() {
|
|
|
901
820
|
/**
|
|
902
821
|
* _initDocument
|
|
903
822
|
*
|
|
904
|
-
* @param
|
|
905
|
-
* @return
|
|
823
|
+
* @param dirty - a string of dirty markup
|
|
824
|
+
* @return a DOM, filled with the dirty markup
|
|
906
825
|
*/
|
|
907
|
-
|
|
908
|
-
|
|
909
826
|
const _initDocument = function _initDocument(dirty) {
|
|
910
827
|
/* Create a HTML document */
|
|
911
|
-
let doc;
|
|
912
|
-
let leadingWhitespace;
|
|
913
|
-
|
|
828
|
+
let doc = null;
|
|
829
|
+
let leadingWhitespace = null;
|
|
914
830
|
if (FORCE_BODY) {
|
|
915
831
|
dirty = '<remove></remove>' + dirty;
|
|
916
832
|
} else {
|
|
@@ -918,200 +834,157 @@ function createDOMPurify() {
|
|
|
918
834
|
const matches = stringMatch(dirty, /^[\r\n\t ]+/);
|
|
919
835
|
leadingWhitespace = matches && matches[0];
|
|
920
836
|
}
|
|
921
|
-
|
|
922
837
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
|
|
923
838
|
// Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
|
|
924
839
|
dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
|
|
925
840
|
}
|
|
926
|
-
|
|
927
841
|
const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
928
842
|
/*
|
|
929
843
|
* Use the DOMParser API by default, fallback later if needs be
|
|
930
844
|
* DOMParser not work for svg when has multiple root element.
|
|
931
845
|
*/
|
|
932
|
-
|
|
933
846
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
934
847
|
try {
|
|
935
848
|
doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
|
|
936
849
|
} catch (_) {}
|
|
937
850
|
}
|
|
938
851
|
/* Use createHTMLDocument in case DOMParser is not available */
|
|
939
|
-
|
|
940
|
-
|
|
941
852
|
if (!doc || !doc.documentElement) {
|
|
942
853
|
doc = implementation.createDocument(NAMESPACE, 'template', null);
|
|
943
|
-
|
|
944
854
|
try {
|
|
945
855
|
doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
|
|
946
|
-
} catch (_) {
|
|
856
|
+
} catch (_) {
|
|
857
|
+
// Syntax error if dirtyPayload is invalid xml
|
|
947
858
|
}
|
|
948
859
|
}
|
|
949
|
-
|
|
950
860
|
const body = doc.body || doc.documentElement;
|
|
951
|
-
|
|
952
861
|
if (dirty && leadingWhitespace) {
|
|
953
862
|
body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
|
|
954
863
|
}
|
|
955
864
|
/* Work on whole document or just its body */
|
|
956
|
-
|
|
957
|
-
|
|
958
865
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
959
866
|
return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
|
|
960
867
|
}
|
|
961
|
-
|
|
962
868
|
return WHOLE_DOCUMENT ? doc.documentElement : body;
|
|
963
869
|
};
|
|
964
870
|
/**
|
|
965
|
-
*
|
|
871
|
+
* Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
|
|
966
872
|
*
|
|
967
|
-
* @param
|
|
968
|
-
* @return
|
|
873
|
+
* @param root The root element or node to start traversing on.
|
|
874
|
+
* @return The created NodeIterator
|
|
969
875
|
*/
|
|
970
|
-
|
|
971
|
-
|
|
972
|
-
|
|
973
|
-
|
|
974
|
-
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
|
|
876
|
+
const _createNodeIterator = function _createNodeIterator(root) {
|
|
877
|
+
return createNodeIterator.call(root.ownerDocument || root, root,
|
|
878
|
+
// eslint-disable-next-line no-bitwise
|
|
879
|
+
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
|
|
975
880
|
};
|
|
976
881
|
/**
|
|
977
882
|
* _isClobbered
|
|
978
883
|
*
|
|
979
|
-
* @param
|
|
980
|
-
* @return
|
|
884
|
+
* @param element element to check for clobbering attacks
|
|
885
|
+
* @return true if clobbered, false if safe
|
|
981
886
|
*/
|
|
982
|
-
|
|
983
|
-
|
|
984
|
-
const _isClobbered = function _isClobbered(elm) {
|
|
985
|
-
return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
|
|
887
|
+
const _isClobbered = function _isClobbered(element) {
|
|
888
|
+
return element instanceof HTMLFormElement && (typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function');
|
|
986
889
|
};
|
|
987
890
|
/**
|
|
988
|
-
*
|
|
891
|
+
* Checks whether the given object is a DOM node.
|
|
989
892
|
*
|
|
990
|
-
* @param
|
|
991
|
-
* @return
|
|
893
|
+
* @param value object to check whether it's a DOM node
|
|
894
|
+
* @return true is object is a DOM node
|
|
992
895
|
*/
|
|
993
|
-
|
|
994
|
-
|
|
995
|
-
const _isNode = function _isNode(object) {
|
|
996
|
-
return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
|
|
896
|
+
const _isNode = function _isNode(value) {
|
|
897
|
+
return typeof Node === 'function' && value instanceof Node;
|
|
997
898
|
};
|
|
998
|
-
|
|
999
|
-
|
|
1000
|
-
* Execute user configurable hooks
|
|
1001
|
-
*
|
|
1002
|
-
* @param {String} entryPoint Name of the hook's entry point
|
|
1003
|
-
* @param {Node} currentNode node to work on with the hook
|
|
1004
|
-
* @param {Object} data additional hook parameters
|
|
1005
|
-
*/
|
|
1006
|
-
|
|
1007
|
-
|
|
1008
|
-
const _executeHook = function _executeHook(entryPoint, currentNode, data) {
|
|
1009
|
-
if (!hooks[entryPoint]) {
|
|
1010
|
-
return;
|
|
1011
|
-
}
|
|
1012
|
-
|
|
1013
|
-
arrayForEach(hooks[entryPoint], hook => {
|
|
899
|
+
function _executeHooks(hooks, currentNode, data) {
|
|
900
|
+
arrayForEach(hooks, hook => {
|
|
1014
901
|
hook.call(DOMPurify, currentNode, data, CONFIG);
|
|
1015
902
|
});
|
|
1016
|
-
}
|
|
903
|
+
}
|
|
1017
904
|
/**
|
|
1018
905
|
* _sanitizeElements
|
|
1019
906
|
*
|
|
1020
907
|
* @protect nodeName
|
|
1021
908
|
* @protect textContent
|
|
1022
909
|
* @protect removeChild
|
|
1023
|
-
*
|
|
1024
|
-
* @
|
|
1025
|
-
* @return {Boolean} true if node was killed, false if left alive
|
|
910
|
+
* @param currentNode to check for permission to exist
|
|
911
|
+
* @return true if node was killed, false if left alive
|
|
1026
912
|
*/
|
|
1027
|
-
|
|
1028
|
-
|
|
1029
913
|
const _sanitizeElements = function _sanitizeElements(currentNode) {
|
|
1030
|
-
let content;
|
|
914
|
+
let content = null;
|
|
1031
915
|
/* Execute a hook if present */
|
|
1032
|
-
|
|
1033
|
-
_executeHook('beforeSanitizeElements', currentNode, null);
|
|
916
|
+
_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
|
|
1034
917
|
/* Check if element is clobbered or can clobber */
|
|
1035
|
-
|
|
1036
|
-
|
|
1037
918
|
if (_isClobbered(currentNode)) {
|
|
1038
919
|
_forceRemove(currentNode);
|
|
1039
|
-
|
|
1040
920
|
return true;
|
|
1041
921
|
}
|
|
1042
922
|
/* Now let's check the element's type and name */
|
|
1043
|
-
|
|
1044
|
-
|
|
1045
923
|
const tagName = transformCaseFunc(currentNode.nodeName);
|
|
1046
924
|
/* Execute a hook if present */
|
|
1047
|
-
|
|
1048
|
-
_executeHook('uponSanitizeElement', currentNode, {
|
|
925
|
+
_executeHooks(hooks.uponSanitizeElement, currentNode, {
|
|
1049
926
|
tagName,
|
|
1050
927
|
allowedTags: ALLOWED_TAGS
|
|
1051
928
|
});
|
|
1052
929
|
/* Detect mXSS attempts abusing namespace confusion */
|
|
1053
|
-
|
|
1054
|
-
|
|
1055
|
-
|
|
930
|
+
if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
|
|
931
|
+
_forceRemove(currentNode);
|
|
932
|
+
return true;
|
|
933
|
+
}
|
|
934
|
+
/* Remove any occurrence of processing instructions */
|
|
935
|
+
if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
|
|
936
|
+
_forceRemove(currentNode);
|
|
937
|
+
return true;
|
|
938
|
+
}
|
|
939
|
+
/* Remove any kind of possibly harmful comments */
|
|
940
|
+
if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
|
|
1056
941
|
_forceRemove(currentNode);
|
|
1057
|
-
|
|
1058
942
|
return true;
|
|
1059
943
|
}
|
|
1060
944
|
/* Remove element if anything forbids its presence */
|
|
1061
|
-
|
|
1062
|
-
|
|
1063
945
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
1064
946
|
/* Check if we have a custom element to handle */
|
|
1065
|
-
if (!FORBID_TAGS[tagName] &&
|
|
1066
|
-
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName))
|
|
1067
|
-
|
|
947
|
+
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
|
|
948
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
|
|
949
|
+
return false;
|
|
950
|
+
}
|
|
951
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
|
|
952
|
+
return false;
|
|
953
|
+
}
|
|
1068
954
|
}
|
|
1069
955
|
/* Keep content except for bad-listed elements */
|
|
1070
|
-
|
|
1071
|
-
|
|
1072
956
|
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
|
|
1073
957
|
const parentNode = getParentNode(currentNode) || currentNode.parentNode;
|
|
1074
958
|
const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
|
|
1075
|
-
|
|
1076
959
|
if (childNodes && parentNode) {
|
|
1077
960
|
const childCount = childNodes.length;
|
|
1078
|
-
|
|
1079
961
|
for (let i = childCount - 1; i >= 0; --i) {
|
|
1080
|
-
|
|
962
|
+
const childClone = cloneNode(childNodes[i], true);
|
|
963
|
+
childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
|
|
964
|
+
parentNode.insertBefore(childClone, getNextSibling(currentNode));
|
|
1081
965
|
}
|
|
1082
966
|
}
|
|
1083
967
|
}
|
|
1084
|
-
|
|
1085
968
|
_forceRemove(currentNode);
|
|
1086
|
-
|
|
1087
969
|
return true;
|
|
1088
970
|
}
|
|
1089
971
|
/* Check whether element has a valid namespace */
|
|
1090
|
-
|
|
1091
|
-
|
|
1092
972
|
if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
|
|
1093
973
|
_forceRemove(currentNode);
|
|
1094
|
-
|
|
1095
974
|
return true;
|
|
1096
975
|
}
|
|
1097
|
-
/* Make sure that older browsers don't get
|
|
1098
|
-
|
|
1099
|
-
|
|
1100
|
-
if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
|
|
976
|
+
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
977
|
+
if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
1101
978
|
_forceRemove(currentNode);
|
|
1102
|
-
|
|
1103
979
|
return true;
|
|
1104
980
|
}
|
|
1105
981
|
/* Sanitize element content to be template-safe */
|
|
1106
|
-
|
|
1107
|
-
|
|
1108
|
-
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
|
|
982
|
+
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
|
|
1109
983
|
/* Get the element's text content */
|
|
1110
984
|
content = currentNode.textContent;
|
|
1111
|
-
|
|
1112
|
-
|
|
1113
|
-
|
|
1114
|
-
|
|
985
|
+
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
|
|
986
|
+
content = stringReplace(content, expr, ' ');
|
|
987
|
+
});
|
|
1115
988
|
if (currentNode.textContent !== content) {
|
|
1116
989
|
arrayPush(DOMPurify.removed, {
|
|
1117
990
|
element: currentNode.cloneNode()
|
|
@@ -1120,23 +993,18 @@ function createDOMPurify() {
|
|
|
1120
993
|
}
|
|
1121
994
|
}
|
|
1122
995
|
/* Execute a hook if present */
|
|
1123
|
-
|
|
1124
|
-
|
|
1125
|
-
_executeHook('afterSanitizeElements', currentNode, null);
|
|
1126
|
-
|
|
996
|
+
_executeHooks(hooks.afterSanitizeElements, currentNode, null);
|
|
1127
997
|
return false;
|
|
1128
998
|
};
|
|
1129
999
|
/**
|
|
1130
1000
|
* _isValidAttribute
|
|
1131
1001
|
*
|
|
1132
|
-
* @param
|
|
1133
|
-
* @param
|
|
1134
|
-
* @param
|
|
1135
|
-
* @return
|
|
1002
|
+
* @param lcTag Lowercase tag name of containing element.
|
|
1003
|
+
* @param lcName Lowercase attribute name.
|
|
1004
|
+
* @param value Attribute value.
|
|
1005
|
+
* @return Returns true if `value` is valid, otherwise false.
|
|
1136
1006
|
*/
|
|
1137
1007
|
// eslint-disable-next-line complexity
|
|
1138
|
-
|
|
1139
|
-
|
|
1140
1008
|
const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
|
|
1141
1009
|
/* Make sure attribute cannot clobber */
|
|
1142
1010
|
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
|
|
@@ -1146,35 +1014,33 @@ function createDOMPurify() {
|
|
|
1146
1014
|
(https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
|
|
1147
1015
|
XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
|
|
1148
1016
|
We don't need to check the value; it's always URI safe. */
|
|
1149
|
-
|
|
1150
|
-
|
|
1151
1017
|
if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
|
|
1152
|
-
if (
|
|
1018
|
+
if (
|
|
1019
|
+
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
1153
1020
|
// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
1154
1021
|
// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
|
|
1155
|
-
|
|
1022
|
+
_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
|
|
1023
|
+
// Alternative, second condition checks if it's an `is`-attribute, AND
|
|
1156
1024
|
// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
1157
1025
|
lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
|
|
1158
1026
|
return false;
|
|
1159
1027
|
}
|
|
1160
1028
|
/* Check value is safe. First, is attr inert? If so, is safe */
|
|
1161
|
-
|
|
1162
1029
|
} else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
|
|
1163
1030
|
return false;
|
|
1164
1031
|
} else ;
|
|
1165
|
-
|
|
1166
1032
|
return true;
|
|
1167
1033
|
};
|
|
1168
1034
|
/**
|
|
1169
|
-
*
|
|
1035
|
+
* _isBasicCustomElement
|
|
1170
1036
|
* checks if at least one dash is included in tagName, and it's not the first char
|
|
1171
1037
|
* for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
|
|
1172
|
-
*
|
|
1038
|
+
*
|
|
1039
|
+
* @param tagName name of the tag of the node to sanitize
|
|
1040
|
+
* @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
|
|
1173
1041
|
*/
|
|
1174
|
-
|
|
1175
|
-
|
|
1176
|
-
const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
|
|
1177
|
-
return tagName.indexOf('-') > 0;
|
|
1042
|
+
const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
|
|
1043
|
+
return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
|
|
1178
1044
|
};
|
|
1179
1045
|
/**
|
|
1180
1046
|
* _sanitizeAttributes
|
|
@@ -1184,109 +1050,85 @@ function createDOMPurify() {
|
|
|
1184
1050
|
* @protect removeAttribute
|
|
1185
1051
|
* @protect setAttribute
|
|
1186
1052
|
*
|
|
1187
|
-
* @param
|
|
1053
|
+
* @param currentNode to sanitize
|
|
1188
1054
|
*/
|
|
1189
|
-
|
|
1190
|
-
|
|
1191
1055
|
const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
|
|
1192
|
-
let attr;
|
|
1193
|
-
let value;
|
|
1194
|
-
let lcName;
|
|
1195
|
-
let l;
|
|
1196
1056
|
/* Execute a hook if present */
|
|
1197
|
-
|
|
1198
|
-
_executeHook('beforeSanitizeAttributes', currentNode, null);
|
|
1199
|
-
|
|
1057
|
+
_executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
|
|
1200
1058
|
const {
|
|
1201
1059
|
attributes
|
|
1202
1060
|
} = currentNode;
|
|
1203
1061
|
/* Check if we have attributes; if not we might have a text node */
|
|
1204
|
-
|
|
1205
|
-
if (!attributes) {
|
|
1062
|
+
if (!attributes || _isClobbered(currentNode)) {
|
|
1206
1063
|
return;
|
|
1207
1064
|
}
|
|
1208
|
-
|
|
1209
1065
|
const hookEvent = {
|
|
1210
1066
|
attrName: '',
|
|
1211
1067
|
attrValue: '',
|
|
1212
1068
|
keepAttr: true,
|
|
1213
|
-
allowedAttributes: ALLOWED_ATTR
|
|
1069
|
+
allowedAttributes: ALLOWED_ATTR,
|
|
1070
|
+
forceKeepAttr: undefined
|
|
1214
1071
|
};
|
|
1215
|
-
l = attributes.length;
|
|
1072
|
+
let l = attributes.length;
|
|
1216
1073
|
/* Go backwards over all attributes; safely remove bad ones */
|
|
1217
|
-
|
|
1218
1074
|
while (l--) {
|
|
1219
|
-
attr = attributes[l];
|
|
1075
|
+
const attr = attributes[l];
|
|
1220
1076
|
const {
|
|
1221
1077
|
name,
|
|
1222
|
-
namespaceURI
|
|
1078
|
+
namespaceURI,
|
|
1079
|
+
value: attrValue
|
|
1223
1080
|
} = attr;
|
|
1224
|
-
|
|
1225
|
-
|
|
1081
|
+
const lcName = transformCaseFunc(name);
|
|
1082
|
+
const initValue = attrValue;
|
|
1083
|
+
let value = name === 'value' ? initValue : stringTrim(initValue);
|
|
1226
1084
|
/* Execute a hook if present */
|
|
1227
|
-
|
|
1228
1085
|
hookEvent.attrName = lcName;
|
|
1229
1086
|
hookEvent.attrValue = value;
|
|
1230
1087
|
hookEvent.keepAttr = true;
|
|
1231
1088
|
hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
|
|
1232
|
-
|
|
1233
|
-
_executeHook('uponSanitizeAttribute', currentNode, hookEvent);
|
|
1234
|
-
|
|
1089
|
+
_executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
|
|
1235
1090
|
value = hookEvent.attrValue;
|
|
1091
|
+
/* Full DOM Clobbering protection via namespace isolation,
|
|
1092
|
+
* Prefix id and name attributes with `user-content-`
|
|
1093
|
+
*/
|
|
1094
|
+
if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
|
|
1095
|
+
// Remove the attribute with this value
|
|
1096
|
+
_removeAttribute(name, currentNode);
|
|
1097
|
+
// Prefix the value and later re-create the attribute with the sanitized value
|
|
1098
|
+
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
1099
|
+
}
|
|
1100
|
+
/* Work around a security issue with comments inside attributes */
|
|
1101
|
+
if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
|
|
1102
|
+
_removeAttribute(name, currentNode);
|
|
1103
|
+
continue;
|
|
1104
|
+
}
|
|
1236
1105
|
/* Did the hooks approve of the attribute? */
|
|
1237
|
-
|
|
1238
1106
|
if (hookEvent.forceKeepAttr) {
|
|
1239
1107
|
continue;
|
|
1240
1108
|
}
|
|
1241
|
-
/* Remove attribute */
|
|
1242
|
-
|
|
1243
|
-
|
|
1244
|
-
_removeAttribute(name, currentNode);
|
|
1245
1109
|
/* Did the hooks approve of the attribute? */
|
|
1246
|
-
|
|
1247
|
-
|
|
1248
1110
|
if (!hookEvent.keepAttr) {
|
|
1111
|
+
_removeAttribute(name, currentNode);
|
|
1249
1112
|
continue;
|
|
1250
1113
|
}
|
|
1251
1114
|
/* Work around a security issue in jQuery 3.0 */
|
|
1252
|
-
|
|
1253
|
-
|
|
1254
1115
|
if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
|
|
1255
1116
|
_removeAttribute(name, currentNode);
|
|
1256
|
-
|
|
1257
1117
|
continue;
|
|
1258
1118
|
}
|
|
1259
1119
|
/* Sanitize attribute content to be template-safe */
|
|
1260
|
-
|
|
1261
|
-
|
|
1262
1120
|
if (SAFE_FOR_TEMPLATES) {
|
|
1263
|
-
|
|
1264
|
-
|
|
1265
|
-
|
|
1121
|
+
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
|
|
1122
|
+
value = stringReplace(value, expr, ' ');
|
|
1123
|
+
});
|
|
1266
1124
|
}
|
|
1267
1125
|
/* Is `value` valid for this attribute? */
|
|
1268
|
-
|
|
1269
|
-
|
|
1270
1126
|
const lcTag = transformCaseFunc(currentNode.nodeName);
|
|
1271
|
-
|
|
1272
1127
|
if (!_isValidAttribute(lcTag, lcName, value)) {
|
|
1128
|
+
_removeAttribute(name, currentNode);
|
|
1273
1129
|
continue;
|
|
1274
1130
|
}
|
|
1275
|
-
/* Full DOM Clobbering protection via namespace isolation,
|
|
1276
|
-
* Prefix id and name attributes with `user-content-`
|
|
1277
|
-
*/
|
|
1278
|
-
|
|
1279
|
-
|
|
1280
|
-
if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
|
|
1281
|
-
// Remove the attribute with this value
|
|
1282
|
-
_removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
|
|
1283
|
-
|
|
1284
|
-
|
|
1285
|
-
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
1286
|
-
}
|
|
1287
1131
|
/* Handle attributes that require Trusted Types */
|
|
1288
|
-
|
|
1289
|
-
|
|
1290
1132
|
if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
|
|
1291
1133
|
if (namespaceURI) ; else {
|
|
1292
1134
|
switch (trustedTypes.getAttributeType(lcTag, lcName)) {
|
|
@@ -1295,7 +1137,6 @@ function createDOMPurify() {
|
|
|
1295
1137
|
value = trustedTypesPolicy.createHTML(value);
|
|
1296
1138
|
break;
|
|
1297
1139
|
}
|
|
1298
|
-
|
|
1299
1140
|
case 'TrustedScriptURL':
|
|
1300
1141
|
{
|
|
1301
1142
|
value = trustedTypesPolicy.createScriptURL(value);
|
|
@@ -1305,97 +1146,70 @@ function createDOMPurify() {
|
|
|
1305
1146
|
}
|
|
1306
1147
|
}
|
|
1307
1148
|
/* Handle invalid data-* attribute set by try-catching it */
|
|
1308
|
-
|
|
1309
|
-
|
|
1310
|
-
|
|
1311
|
-
|
|
1312
|
-
|
|
1313
|
-
|
|
1314
|
-
|
|
1315
|
-
|
|
1149
|
+
if (value !== initValue) {
|
|
1150
|
+
try {
|
|
1151
|
+
if (namespaceURI) {
|
|
1152
|
+
currentNode.setAttributeNS(namespaceURI, name, value);
|
|
1153
|
+
} else {
|
|
1154
|
+
/* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
|
|
1155
|
+
currentNode.setAttribute(name, value);
|
|
1156
|
+
}
|
|
1157
|
+
if (_isClobbered(currentNode)) {
|
|
1158
|
+
_forceRemove(currentNode);
|
|
1159
|
+
} else {
|
|
1160
|
+
arrayPop(DOMPurify.removed);
|
|
1161
|
+
}
|
|
1162
|
+
} catch (_) {
|
|
1163
|
+
_removeAttribute(name, currentNode);
|
|
1316
1164
|
}
|
|
1317
|
-
|
|
1318
|
-
arrayPop(DOMPurify.removed);
|
|
1319
|
-
} catch (_) {}
|
|
1165
|
+
}
|
|
1320
1166
|
}
|
|
1321
1167
|
/* Execute a hook if present */
|
|
1322
|
-
|
|
1323
|
-
|
|
1324
|
-
_executeHook('afterSanitizeAttributes', currentNode, null);
|
|
1168
|
+
_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
|
|
1325
1169
|
};
|
|
1326
1170
|
/**
|
|
1327
1171
|
* _sanitizeShadowDOM
|
|
1328
1172
|
*
|
|
1329
|
-
* @param
|
|
1173
|
+
* @param fragment to iterate over recursively
|
|
1330
1174
|
*/
|
|
1331
|
-
|
|
1332
|
-
|
|
1333
1175
|
const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
|
|
1334
|
-
let shadowNode;
|
|
1335
|
-
|
|
1336
|
-
const shadowIterator = _createIterator(fragment);
|
|
1176
|
+
let shadowNode = null;
|
|
1177
|
+
const shadowIterator = _createNodeIterator(fragment);
|
|
1337
1178
|
/* Execute a hook if present */
|
|
1338
|
-
|
|
1339
|
-
|
|
1340
|
-
_executeHook('beforeSanitizeShadowDOM', fragment, null);
|
|
1341
|
-
|
|
1179
|
+
_executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
|
|
1342
1180
|
while (shadowNode = shadowIterator.nextNode()) {
|
|
1343
1181
|
/* Execute a hook if present */
|
|
1344
|
-
|
|
1182
|
+
_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
|
|
1345
1183
|
/* Sanitize tags and elements */
|
|
1346
|
-
|
|
1347
|
-
|
|
1348
|
-
|
|
1349
|
-
continue;
|
|
1350
|
-
}
|
|
1184
|
+
_sanitizeElements(shadowNode);
|
|
1185
|
+
/* Check attributes next */
|
|
1186
|
+
_sanitizeAttributes(shadowNode);
|
|
1351
1187
|
/* Deep shadow DOM detected */
|
|
1352
|
-
|
|
1353
|
-
|
|
1354
1188
|
if (shadowNode.content instanceof DocumentFragment) {
|
|
1355
1189
|
_sanitizeShadowDOM(shadowNode.content);
|
|
1356
1190
|
}
|
|
1357
|
-
/* Check attributes, sanitize if necessary */
|
|
1358
|
-
|
|
1359
|
-
|
|
1360
|
-
_sanitizeAttributes(shadowNode);
|
|
1361
1191
|
}
|
|
1362
1192
|
/* Execute a hook if present */
|
|
1363
|
-
|
|
1364
|
-
|
|
1365
|
-
_executeHook('afterSanitizeShadowDOM', fragment, null);
|
|
1193
|
+
_executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
|
|
1366
1194
|
};
|
|
1367
|
-
/**
|
|
1368
|
-
* Sanitize
|
|
1369
|
-
* Public method providing core sanitation functionality
|
|
1370
|
-
*
|
|
1371
|
-
* @param {String|Node} dirty string or DOM node
|
|
1372
|
-
* @param {Object} configuration object
|
|
1373
|
-
*/
|
|
1374
1195
|
// eslint-disable-next-line complexity
|
|
1375
|
-
|
|
1376
|
-
|
|
1377
1196
|
DOMPurify.sanitize = function (dirty) {
|
|
1378
1197
|
let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
|
|
1379
|
-
let body;
|
|
1380
|
-
let importedNode;
|
|
1381
|
-
let currentNode;
|
|
1382
|
-
let returnNode;
|
|
1198
|
+
let body = null;
|
|
1199
|
+
let importedNode = null;
|
|
1200
|
+
let currentNode = null;
|
|
1201
|
+
let returnNode = null;
|
|
1383
1202
|
/* Make sure we have a string to sanitize.
|
|
1384
1203
|
DO NOT return early, as this will return the wrong type if
|
|
1385
1204
|
the user has requested a DOM object rather than a string */
|
|
1386
|
-
|
|
1387
1205
|
IS_EMPTY_INPUT = !dirty;
|
|
1388
|
-
|
|
1389
1206
|
if (IS_EMPTY_INPUT) {
|
|
1390
1207
|
dirty = '<!-->';
|
|
1391
1208
|
}
|
|
1392
1209
|
/* Stringify, in case dirty is an object */
|
|
1393
|
-
|
|
1394
|
-
|
|
1395
1210
|
if (typeof dirty !== 'string' && !_isNode(dirty)) {
|
|
1396
1211
|
if (typeof dirty.toString === 'function') {
|
|
1397
1212
|
dirty = dirty.toString();
|
|
1398
|
-
|
|
1399
1213
|
if (typeof dirty !== 'string') {
|
|
1400
1214
|
throw typeErrorCreate('dirty is not a string, aborting');
|
|
1401
1215
|
}
|
|
@@ -1404,32 +1218,23 @@ function createDOMPurify() {
|
|
|
1404
1218
|
}
|
|
1405
1219
|
}
|
|
1406
1220
|
/* Return dirty HTML if DOMPurify cannot run */
|
|
1407
|
-
|
|
1408
|
-
|
|
1409
1221
|
if (!DOMPurify.isSupported) {
|
|
1410
1222
|
return dirty;
|
|
1411
1223
|
}
|
|
1412
1224
|
/* Assign config vars */
|
|
1413
|
-
|
|
1414
|
-
|
|
1415
1225
|
if (!SET_CONFIG) {
|
|
1416
1226
|
_parseConfig(cfg);
|
|
1417
1227
|
}
|
|
1418
1228
|
/* Clean up removed elements */
|
|
1419
|
-
|
|
1420
|
-
|
|
1421
1229
|
DOMPurify.removed = [];
|
|
1422
1230
|
/* Check if dirty is correctly typed for IN_PLACE */
|
|
1423
|
-
|
|
1424
1231
|
if (typeof dirty === 'string') {
|
|
1425
1232
|
IN_PLACE = false;
|
|
1426
1233
|
}
|
|
1427
|
-
|
|
1428
1234
|
if (IN_PLACE) {
|
|
1429
1235
|
/* Do some early pre-sanitization to avoid unsafe root nodes */
|
|
1430
1236
|
if (dirty.nodeName) {
|
|
1431
1237
|
const tagName = transformCaseFunc(dirty.nodeName);
|
|
1432
|
-
|
|
1433
1238
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
1434
1239
|
throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
|
|
1435
1240
|
}
|
|
@@ -1439,8 +1244,7 @@ function createDOMPurify() {
|
|
|
1439
1244
|
elements being stripped by the parser */
|
|
1440
1245
|
body = _initDocument('<!---->');
|
|
1441
1246
|
importedNode = body.ownerDocument.importNode(dirty, true);
|
|
1442
|
-
|
|
1443
|
-
if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
|
|
1247
|
+
if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
|
|
1444
1248
|
/* Node is already a body, use as is */
|
|
1445
1249
|
body = importedNode;
|
|
1446
1250
|
} else if (importedNode.nodeName === 'HTML') {
|
|
@@ -1451,62 +1255,43 @@ function createDOMPurify() {
|
|
|
1451
1255
|
}
|
|
1452
1256
|
} else {
|
|
1453
1257
|
/* Exit directly if we have nothing to do */
|
|
1454
|
-
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
|
|
1258
|
+
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
|
|
1259
|
+
// eslint-disable-next-line unicorn/prefer-includes
|
|
1455
1260
|
dirty.indexOf('<') === -1) {
|
|
1456
1261
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
1457
1262
|
}
|
|
1458
1263
|
/* Initialize the document to work on */
|
|
1459
|
-
|
|
1460
|
-
|
|
1461
1264
|
body = _initDocument(dirty);
|
|
1462
1265
|
/* Check we have a DOM node from the data */
|
|
1463
|
-
|
|
1464
1266
|
if (!body) {
|
|
1465
1267
|
return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
|
|
1466
1268
|
}
|
|
1467
1269
|
}
|
|
1468
1270
|
/* Remove first element node (ours) if FORCE_BODY is set */
|
|
1469
|
-
|
|
1470
|
-
|
|
1471
1271
|
if (body && FORCE_BODY) {
|
|
1472
1272
|
_forceRemove(body.firstChild);
|
|
1473
1273
|
}
|
|
1474
1274
|
/* Get node iterator */
|
|
1475
|
-
|
|
1476
|
-
|
|
1477
|
-
const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
|
|
1275
|
+
const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
|
|
1478
1276
|
/* Now start iterating over the created document */
|
|
1479
|
-
|
|
1480
|
-
|
|
1481
1277
|
while (currentNode = nodeIterator.nextNode()) {
|
|
1482
1278
|
/* Sanitize tags and elements */
|
|
1483
|
-
|
|
1484
|
-
|
|
1485
|
-
|
|
1279
|
+
_sanitizeElements(currentNode);
|
|
1280
|
+
/* Check attributes next */
|
|
1281
|
+
_sanitizeAttributes(currentNode);
|
|
1486
1282
|
/* Shadow DOM detected, sanitize it */
|
|
1487
|
-
|
|
1488
|
-
|
|
1489
1283
|
if (currentNode.content instanceof DocumentFragment) {
|
|
1490
1284
|
_sanitizeShadowDOM(currentNode.content);
|
|
1491
1285
|
}
|
|
1492
|
-
/* Check attributes, sanitize if necessary */
|
|
1493
|
-
|
|
1494
|
-
|
|
1495
|
-
_sanitizeAttributes(currentNode);
|
|
1496
1286
|
}
|
|
1497
1287
|
/* If we sanitized `dirty` in-place, return it. */
|
|
1498
|
-
|
|
1499
|
-
|
|
1500
1288
|
if (IN_PLACE) {
|
|
1501
1289
|
return dirty;
|
|
1502
1290
|
}
|
|
1503
1291
|
/* Return sanitized string or DOM */
|
|
1504
|
-
|
|
1505
|
-
|
|
1506
1292
|
if (RETURN_DOM) {
|
|
1507
1293
|
if (RETURN_DOM_FRAGMENT) {
|
|
1508
1294
|
returnNode = createDocumentFragment.call(body.ownerDocument);
|
|
1509
|
-
|
|
1510
1295
|
while (body.firstChild) {
|
|
1511
1296
|
// eslint-disable-next-line unicorn/prefer-dom-node-append
|
|
1512
1297
|
returnNode.appendChild(body.firstChild);
|
|
@@ -1514,8 +1299,7 @@ function createDOMPurify() {
|
|
|
1514
1299
|
} else {
|
|
1515
1300
|
returnNode = body;
|
|
1516
1301
|
}
|
|
1517
|
-
|
|
1518
|
-
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {
|
|
1302
|
+
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
1519
1303
|
/*
|
|
1520
1304
|
AdoptNode() is not used because internal state is not reset
|
|
1521
1305
|
(e.g. the past names map of a HTMLFormElement), this is safe
|
|
@@ -1525,132 +1309,60 @@ function createDOMPurify() {
|
|
|
1525
1309
|
*/
|
|
1526
1310
|
returnNode = importNode.call(originalDocument, returnNode, true);
|
|
1527
1311
|
}
|
|
1528
|
-
|
|
1529
1312
|
return returnNode;
|
|
1530
1313
|
}
|
|
1531
|
-
|
|
1532
1314
|
let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
|
1533
1315
|
/* Serialize doctype if allowed */
|
|
1534
|
-
|
|
1535
1316
|
if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
|
|
1536
1317
|
serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
|
|
1537
1318
|
}
|
|
1538
1319
|
/* Sanitize final string template-safe */
|
|
1539
|
-
|
|
1540
|
-
|
|
1541
1320
|
if (SAFE_FOR_TEMPLATES) {
|
|
1542
|
-
|
|
1543
|
-
|
|
1544
|
-
|
|
1321
|
+
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
|
|
1322
|
+
serializedHTML = stringReplace(serializedHTML, expr, ' ');
|
|
1323
|
+
});
|
|
1545
1324
|
}
|
|
1546
|
-
|
|
1547
1325
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
|
|
1548
1326
|
};
|
|
1549
|
-
|
|
1550
|
-
|
|
1551
|
-
* setConfig
|
|
1552
|
-
*
|
|
1553
|
-
* @param {Object} cfg configuration object
|
|
1554
|
-
*/
|
|
1555
|
-
|
|
1556
|
-
|
|
1557
|
-
DOMPurify.setConfig = function (cfg) {
|
|
1327
|
+
DOMPurify.setConfig = function () {
|
|
1328
|
+
let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
1558
1329
|
_parseConfig(cfg);
|
|
1559
|
-
|
|
1560
1330
|
SET_CONFIG = true;
|
|
1561
1331
|
};
|
|
1562
|
-
/**
|
|
1563
|
-
* Public method to remove the configuration
|
|
1564
|
-
* clearConfig
|
|
1565
|
-
*
|
|
1566
|
-
*/
|
|
1567
|
-
|
|
1568
|
-
|
|
1569
1332
|
DOMPurify.clearConfig = function () {
|
|
1570
1333
|
CONFIG = null;
|
|
1571
1334
|
SET_CONFIG = false;
|
|
1572
1335
|
};
|
|
1573
|
-
/**
|
|
1574
|
-
* Public method to check if an attribute value is valid.
|
|
1575
|
-
* Uses last set config, if any. Otherwise, uses config defaults.
|
|
1576
|
-
* isValidAttribute
|
|
1577
|
-
*
|
|
1578
|
-
* @param {string} tag Tag name of containing element.
|
|
1579
|
-
* @param {string} attr Attribute name.
|
|
1580
|
-
* @param {string} value Attribute value.
|
|
1581
|
-
* @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
|
|
1582
|
-
*/
|
|
1583
|
-
|
|
1584
|
-
|
|
1585
1336
|
DOMPurify.isValidAttribute = function (tag, attr, value) {
|
|
1586
1337
|
/* Initialize shared config vars if necessary. */
|
|
1587
1338
|
if (!CONFIG) {
|
|
1588
1339
|
_parseConfig({});
|
|
1589
1340
|
}
|
|
1590
|
-
|
|
1591
1341
|
const lcTag = transformCaseFunc(tag);
|
|
1592
1342
|
const lcName = transformCaseFunc(attr);
|
|
1593
1343
|
return _isValidAttribute(lcTag, lcName, value);
|
|
1594
1344
|
};
|
|
1595
|
-
/**
|
|
1596
|
-
* AddHook
|
|
1597
|
-
* Public method to add DOMPurify hooks
|
|
1598
|
-
*
|
|
1599
|
-
* @param {String} entryPoint entry point for the hook to add
|
|
1600
|
-
* @param {Function} hookFunction function to execute
|
|
1601
|
-
*/
|
|
1602
|
-
|
|
1603
|
-
|
|
1604
1345
|
DOMPurify.addHook = function (entryPoint, hookFunction) {
|
|
1605
1346
|
if (typeof hookFunction !== 'function') {
|
|
1606
1347
|
return;
|
|
1607
1348
|
}
|
|
1608
|
-
|
|
1609
|
-
hooks[entryPoint] = hooks[entryPoint] || [];
|
|
1610
1349
|
arrayPush(hooks[entryPoint], hookFunction);
|
|
1611
1350
|
};
|
|
1612
|
-
|
|
1613
|
-
|
|
1614
|
-
|
|
1615
|
-
|
|
1616
|
-
*
|
|
1617
|
-
* @param {String} entryPoint entry point for the hook to remove
|
|
1618
|
-
* @return {Function} removed(popped) hook
|
|
1619
|
-
*/
|
|
1620
|
-
|
|
1621
|
-
|
|
1622
|
-
DOMPurify.removeHook = function (entryPoint) {
|
|
1623
|
-
if (hooks[entryPoint]) {
|
|
1624
|
-
return arrayPop(hooks[entryPoint]);
|
|
1351
|
+
DOMPurify.removeHook = function (entryPoint, hookFunction) {
|
|
1352
|
+
if (hookFunction !== undefined) {
|
|
1353
|
+
const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
|
|
1354
|
+
return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
|
|
1625
1355
|
}
|
|
1356
|
+
return arrayPop(hooks[entryPoint]);
|
|
1626
1357
|
};
|
|
1627
|
-
/**
|
|
1628
|
-
* RemoveHooks
|
|
1629
|
-
* Public method to remove all DOMPurify hooks at a given entryPoint
|
|
1630
|
-
*
|
|
1631
|
-
* @param {String} entryPoint entry point for the hooks to remove
|
|
1632
|
-
*/
|
|
1633
|
-
|
|
1634
|
-
|
|
1635
1358
|
DOMPurify.removeHooks = function (entryPoint) {
|
|
1636
|
-
|
|
1637
|
-
hooks[entryPoint] = [];
|
|
1638
|
-
}
|
|
1359
|
+
hooks[entryPoint] = [];
|
|
1639
1360
|
};
|
|
1640
|
-
/**
|
|
1641
|
-
* RemoveAllHooks
|
|
1642
|
-
* Public method to remove all DOMPurify hooks
|
|
1643
|
-
*
|
|
1644
|
-
*/
|
|
1645
|
-
|
|
1646
|
-
|
|
1647
1361
|
DOMPurify.removeAllHooks = function () {
|
|
1648
|
-
hooks =
|
|
1362
|
+
hooks = _createHooksMap();
|
|
1649
1363
|
};
|
|
1650
|
-
|
|
1651
1364
|
return DOMPurify;
|
|
1652
1365
|
}
|
|
1653
|
-
|
|
1654
1366
|
var purify = createDOMPurify();
|
|
1655
1367
|
|
|
1656
1368
|
var _path$2, _path2$1;
|
|
@@ -1666,7 +1378,7 @@ var SvgInternalServerError = function SvgInternalServerError(props) {
|
|
|
1666
1378
|
})), _path2$1 || (_path2$1 = /*#__PURE__*/React__namespace.createElement("path", {
|
|
1667
1379
|
fill: "#000",
|
|
1668
1380
|
fillRule: "evenodd",
|
|
1669
|
-
d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.
|
|
1381
|
+
d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.915m9.19-32.132-.107.159h-.313l5.399-48.437h54.54V2.043H8.976L2.403 63.94h6.025c.94-1.643 2.035-3.208 3.287-4.538 6.338-7.904 15.806-12.364 26.448-12.364 18.076 0 31.77 13.85 31.77 31.926v.157c0 18.388-13.85 31.926-32.552 31.926-15.963 0-28.874-10.251-30.674-23.163l-.078-.547H.447l.078.704c1.878 16.041 17.293 28.561 36.778 28.561 22.379 0 38.812-15.885 38.812-37.638v-.156c0-21.284-15.963-37.247-37.247-37.247-12.213 0-23.498 5.49-29.55 14.395m87.03 45.232C89.42 91.053 85.656 76.469 85.656 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C103.286 5.645 113.384 0 125.963 0c12.58 0 22.697 5.685 29.654 15.844 6.947 10.143 10.732 24.727 10.732 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.076 15.725-29.654 15.725-12.58 0-22.678-5.665-29.615-15.814m54.063-4.51c5.736-9 8.878-22.023 8.878-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.736 9.01-8.878 22.033-8.878 38.03v.235c0 16.036 3.142 29.059 8.878 38.059 5.724 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.448-13.968m36.162 4.51c-6.927-10.134-10.692-24.718-10.692-42.569v-.235c0-17.89 3.765-32.474 10.692-42.598C193.511 5.645 203.609 0 216.188 0c12.581 0 22.698 5.685 29.655 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.075 15.725-29.654 15.725s-22.677-5.665-29.615-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.449-13.968m-114.674 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C86.055 22.701 101.08.4 125.963.4c24.883 0 39.986 22.458 39.986 57.983v.235c0 35.839-15.103 57.983-39.986 57.983m0-5.555c21.127 0 33.726-20.267 33.726-52.428v-.235c0-32.317-12.599-52.427-33.726-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428m50.318-52.428c0 35.604 15.024 57.983 39.907 57.983 24.884 0 39.986-22.144 39.986-57.983v-.235C256.174 22.858 241.072.4 216.188.4s-39.907 22.301-39.907 57.983zm73.633 0c0 32.16-12.598 52.428-33.726 52.428-21.127 0-33.725-20.267-33.725-52.428v-.235c0-32.082 12.598-52.427 33.725-52.427s33.726 20.11 33.726 52.427z",
|
|
1670
1382
|
clipRule: "evenodd"
|
|
1671
1383
|
})));
|
|
1672
1384
|
};
|
|
@@ -1682,7 +1394,7 @@ var SvgPageNotFound = function SvgPageNotFound(props) {
|
|
|
1682
1394
|
fill: "#000",
|
|
1683
1395
|
stroke: "#000",
|
|
1684
1396
|
strokeWidth: 0.4,
|
|
1685
|
-
d: "M58.94 115.558v.2h6.503V87.
|
|
1397
|
+
d: "M58.94 115.558v.2h6.503V87.51h17.92v-6.034h-17.92V2.443H56.22l-.06.085L.836 81.483l-.036.051v5.976h58.14zm179.355 0v.2h6.503V87.51h17.92v-6.034h-17.92V2.443h-9.224l-.06.085-55.323 78.955-.036.051v5.976h58.14zM58.94 9.182v72.294H8.005L58.93 9.182zm32.32 50.036c0 17.826 3.76 32.366 10.657 42.456 6.902 10.097 16.94 15.727 29.451 15.727s22.567-5.57 29.489-15.639c6.916-10.06 10.696-24.6 10.696-42.544v-.235c0-17.787-3.78-32.327-10.696-42.426C153.935 6.45 143.879.8 131.368.8s-22.548 5.61-29.451 15.698c-6.896 10.08-10.657 24.62-10.657 42.485zm73.633 0c0 16.058-3.145 29.123-8.908 38.167-5.758 9.035-14.129 14.06-24.617 14.06s-18.86-5.025-24.617-14.06c-5.763-9.044-8.91-22.109-8.91-38.167v-.235c0-16.019 3.147-29.084 8.91-38.137 5.757-9.045 14.128-14.09 24.617-14.09s18.859 4.987 24.617 14.002c5.762 9.024 8.908 22.089 8.908 38.225zm73.402-50.037v72.295H187.36l50.926-72.294z"
|
|
1686
1398
|
})));
|
|
1687
1399
|
};
|
|
1688
1400
|
|
|
@@ -1695,11 +1407,11 @@ var SvgUnauthorized = function SvgUnauthorized(props) {
|
|
|
1695
1407
|
viewBox: "0 0 258 117"
|
|
1696
1408
|
}, props), _path || (_path = /*#__PURE__*/React__namespace.createElement("path", {
|
|
1697
1409
|
fill: "#000",
|
|
1698
|
-
d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.
|
|
1410
|
+
d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.248zM7.13 81.076h51.41V8.382h-.313L7.129 80.919zM130.768 116.601c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428M218.958 116.601c-21.91 0-35.682-12.676-37.794-29.344l-.079-.704h6.026l.078.626c2.113 13.537 13.537 23.867 31.769 23.867 18.233 0 31.535-11.269 31.535-26.606v-.156c0-15.885-12.598-25.275-33.413-25.275h-12.754v-5.477h12.598c17.137 0 29.031-9.86 29.031-23.866v-.157c0-13.694-11.425-23.553-27.779-23.553-16.276 0-27.153 9.781-28.405 22.536l-.078.782h-6.025l.078-.782C185.233 12.45 198.379.4 218.176.4c19.875 0 34.039 12.129 34.039 28.561v.157c0 13.928-9.39 23.866-24.18 26.761v.313c17.294 1.174 28.718 11.973 28.718 28.014v.156c0 18.624-15.963 32.239-37.795 32.239"
|
|
1699
1411
|
})), _path2 || (_path2 = /*#__PURE__*/React__namespace.createElement("path", {
|
|
1700
1412
|
fill: "#000",
|
|
1701
1413
|
fillRule: "evenodd",
|
|
1702
|
-
d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.
|
|
1414
|
+
d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.248zm6.503-28.648h17.92v-5.634h-17.92V2.043h-8.92L.4 80.998v5.712h58.14v28.248h6.103zm116.124.598-.001-.006-.127-1.149h6.825l.12.965.001.006c2.081 13.313 13.313 23.521 31.373 23.521 18.078 0 31.135-11.15 31.135-26.204v-.157c0-7.824-3.096-14.021-8.741-18.275-5.66-4.264-13.918-6.6-24.272-6.6h-13.154v-6.277h12.998c8.494 0 15.656-2.443 20.687-6.59 5.026-4.141 7.944-9.995 7.944-16.876v-.157c0-13.415-11.183-23.153-27.379-23.153-16.106 0-26.778 9.658-28.007 22.175l-.114 1.143h-6.829l.122-1.22C184.856 12.182 198.2 0 218.176 0c20.03 0 34.439 12.247 34.439 28.961v.157c0 7.059-2.382 13.123-6.649 17.788-3.96 4.33-9.528 7.436-16.281 9.027 8.003.838 14.694 3.783 19.472 8.403 5.102 4.932 7.996 11.749 7.996 19.87v.156c0 18.902-16.204 32.639-38.195 32.639-22.083 0-36.05-12.799-38.191-29.693m47.619-31.09-.351-.026v-.313l.022-.004.303-.06c14.602-2.977 23.855-12.871 23.855-26.697v-.157C252.215 12.53 238.051.4 218.176.4c-19.797 0-32.943 12.05-34.43 28.092l-.078.782h6.025l.078-.782c1.252-12.755 12.129-22.536 28.405-22.536 16.354 0 27.779 9.86 27.779 23.553v.157c0 14.006-11.894 23.866-29.031 23.866h-12.598v5.477h12.754c20.815 0 33.413 9.39 33.413 25.275v.156c0 15.338-13.302 26.606-31.535 26.606-18.232 0-29.656-10.33-31.769-23.867l-.078-.626h-6.026l.079.704c2.112 16.668 15.884 29.344 37.794 29.344 21.832 0 37.795-13.615 37.795-32.239v-.156c0-15.933-11.27-26.694-28.367-27.989M58.54 81.075H7.13v-.157L58.226 8.382h.313zM58.14 9.2 7.79 80.676h50.35zm43.012 91.987C94.225 91.053 90.46 76.469 90.46 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C108.09 5.645 118.188 0 130.768 0s22.697 5.685 29.654 15.844c6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.784 32.553-10.732 42.658-6.957 10.12-17.075 15.725-29.653 15.725-12.58 0-22.678-5.665-29.616-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.448-13.91s-18.724 5.004-24.449 13.997c-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.449 13.968 10.413 0 18.723-4.984 24.448-13.968m-24.448 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428",
|
|
1703
1415
|
clipRule: "evenodd"
|
|
1704
1416
|
})));
|
|
1705
1417
|
};
|
|
@@ -1726,7 +1438,7 @@ var css = ".neeto-molecules-error-page__wrapper{align-items:center;container-nam
|
|
|
1726
1438
|
injectCss.n(css,{});
|
|
1727
1439
|
|
|
1728
1440
|
function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
|
|
1729
|
-
function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t),
|
|
1441
|
+
function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
|
|
1730
1442
|
var sanitize = purify.sanitize;
|
|
1731
1443
|
var ErrorPage = function ErrorPage(_ref) {
|
|
1732
1444
|
var _ref$homeUrl = _ref.homeUrl,
|