@bigbinary/neeto-molecules 4.0.18 → 4.0.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/AuditLogs.js +5 -5
- package/dist/AuditLogs.js.map +1 -1
- package/dist/BoardView.js +6 -6
- package/dist/BoardView.js.map +1 -1
- package/dist/Breadcrumbs.js +1 -1
- package/dist/Breadcrumbs.js.map +1 -1
- package/dist/BrowserPreview.js +1 -1
- package/dist/BrowserPreview.js.map +1 -1
- package/dist/BrowserSupport.js +2 -2
- package/dist/BrowserSupport.js.map +1 -1
- package/dist/Builder.js +7 -7
- package/dist/Builder.js.map +1 -1
- package/dist/ButtonGroup.js +2 -2
- package/dist/ButtonGroup.js.map +1 -1
- package/dist/CalendarView.js +4 -4
- package/dist/CalendarView.js.map +1 -1
- package/dist/CardLayout.js.map +1 -1
- package/dist/{Chevron-DEQtNhrI.js → Chevron-BFX_mIg6.js} +5 -5
- package/dist/{Chevron-DEQtNhrI.js.map → Chevron-BFX_mIg6.js.map} +1 -1
- package/dist/Codeblock.js +2 -2
- package/dist/Codeblock.js.map +1 -1
- package/dist/{Columns-CwbG5wLv.js → Columns-xoAs08GC.js} +6 -6
- package/dist/{Columns-CwbG5wLv.js.map → Columns-xoAs08GC.js.map} +1 -1
- package/dist/Columns.js +2 -2
- package/dist/ConfigurePageSidebar.js +2 -2
- package/dist/ConfigurePageSidebar.js.map +1 -1
- package/dist/ConfirmationModal.js.map +1 -1
- package/dist/Container.js +1 -1
- package/dist/Container.js.map +1 -1
- package/dist/CopyToClipboardButton.js +2 -2
- package/dist/CopyToClipboardButton.js.map +1 -1
- package/dist/Currency.js +2 -2
- package/dist/Currency.js.map +1 -1
- package/dist/DateFormat.js +1 -1
- package/dist/DateFormat.js.map +1 -1
- package/dist/DateRangeFilter.js +1 -1
- package/dist/DateRangeFilter.js.map +1 -1
- package/dist/DeleteArchiveModal.js.map +1 -1
- package/dist/DeviceIncompatibilityMessage.js.map +1 -1
- package/dist/DocumentEditor.js +2 -2
- package/dist/DocumentEditor.js.map +1 -1
- package/dist/DownloadMobileAppCallout.js.map +1 -1
- package/dist/DynamicVariables.js +2 -2
- package/dist/DynamicVariables.js.map +1 -1
- package/dist/EmailForm.js +5 -5
- package/dist/EmailForm.js.map +1 -1
- package/dist/EmailPreview.js.map +1 -1
- package/dist/EmojiPicker.js +1 -1
- package/dist/EmojiPicker.js.map +1 -1
- package/dist/EmojiReactions.js.map +1 -1
- package/dist/Engagements.js +2 -2
- package/dist/Engagements.js.map +1 -1
- package/dist/ErrorPage.js +369 -657
- package/dist/ErrorPage.js.map +1 -1
- package/dist/FileUpload.js +14 -14
- package/dist/FileUpload.js.map +1 -1
- package/dist/FinderModal.js +3 -3
- package/dist/FinderModal.js.map +1 -1
- package/dist/FloatingActionMenu.js +7 -7
- package/dist/FloatingActionMenu.js.map +1 -1
- package/dist/GoogleFontPicker.js +21 -21
- package/dist/GoogleFontPicker.js.map +1 -1
- package/dist/Header.js +2 -2
- package/dist/Header.js.map +1 -1
- package/dist/HelpPopover.js +1 -1
- package/dist/HelpPopover.js.map +1 -1
- package/dist/IconPicker.js +2 -2
- package/dist/IconPicker.js.map +1 -1
- package/dist/ImageWithFallback.js +2 -2
- package/dist/ImageWithFallback.js.map +1 -1
- package/dist/InlineInput.js +17 -17
- package/dist/InlineInput.js.map +1 -1
- package/dist/Insights.js +2 -8
- package/dist/Insights.js.map +1 -1
- package/dist/IntegrationCard.js +3 -3
- package/dist/IntegrationCard.js.map +1 -1
- package/dist/IpRestriction.js +574 -488
- package/dist/IpRestriction.js.map +1 -1
- package/dist/KeyboardShortcuts.js +2 -4
- package/dist/KeyboardShortcuts.js.map +1 -1
- package/dist/LoginPage.js +23 -24
- package/dist/LoginPage.js.map +1 -1
- package/dist/MadeWith.js +2 -2
- package/dist/MadeWith.js.map +1 -1
- package/dist/MenuBar.js +6 -6
- package/dist/MenuBar.js.map +1 -1
- package/dist/Metadata.js +1 -1
- package/dist/Metadata.js.map +1 -1
- package/dist/MobilePreviewHeader.js.map +1 -1
- package/dist/MoreDropdown.js +4 -4
- package/dist/MoreDropdown.js.map +1 -1
- package/dist/NavigationHeader.js +4 -4
- package/dist/NavigationHeader.js.map +1 -1
- package/dist/NeetoWidget.js +5 -5
- package/dist/NeetoWidget.js.map +1 -1
- package/dist/Onboarding.js +4 -4
- package/dist/Onboarding.js.map +1 -1
- package/dist/OptionFields.js +7 -7
- package/dist/OptionFields.js.map +1 -1
- package/dist/PageLoader.js +2 -2
- package/dist/PageLoader.js.map +1 -1
- package/dist/PhoneNumber.js +5 -6
- package/dist/PhoneNumber.js.map +1 -1
- package/dist/ProductEmbed.js +6 -6
- package/dist/ProductEmbed.js.map +1 -1
- package/dist/PublishBlock.js +3 -3
- package/dist/PublishBlock.js.map +1 -1
- package/dist/PublishYourItem.js.map +1 -1
- package/dist/Rename.js +5 -5
- package/dist/Rename.js.map +1 -1
- package/dist/ResponsiveDevicePicker.js +2 -2
- package/dist/ResponsiveDevicePicker.js.map +1 -1
- package/dist/Schedule.js +3 -3
- package/dist/Schedule.js.map +1 -1
- package/dist/Scrollable.js +2 -2
- package/dist/Scrollable.js.map +1 -1
- package/dist/Search.js +2 -2
- package/dist/Search.js.map +1 -1
- package/dist/SendToFields.js +93 -70
- package/dist/SendToFields.js.map +1 -1
- package/dist/SessionEnvironment.js +3 -4
- package/dist/SessionEnvironment.js.map +1 -1
- package/dist/Settings.js +6 -6
- package/dist/Settings.js.map +1 -1
- package/dist/ShareRecordingPane.js +2 -2
- package/dist/ShareRecordingPane.js.map +1 -1
- package/dist/ShareViaEmail.js +3 -3
- package/dist/ShareViaEmail.js.map +1 -1
- package/dist/ShareViaLink.js +30 -30
- package/dist/ShareViaLink.js.map +1 -1
- package/dist/Sidebar.js +6 -6
- package/dist/Sidebar.js.map +1 -1
- package/dist/StatusDropdown.js +2 -2
- package/dist/StatusDropdown.js.map +1 -1
- package/dist/StickyRibbonsContainer.js +10 -12
- package/dist/StickyRibbonsContainer.js.map +1 -1
- package/dist/SubHeader.js +5 -5
- package/dist/SubHeader.js.map +1 -1
- package/dist/SubscriptionNotificationsContainer.js +1 -1
- package/dist/SubscriptionNotificationsContainer.js.map +1 -1
- package/dist/SuffixedInput.js +2 -2
- package/dist/SuffixedInput.js.map +1 -1
- package/dist/TableWrapper.js +1 -1
- package/dist/TableWrapper.js.map +1 -1
- package/dist/Taxonomy.js +16 -16
- package/dist/Taxonomy.js.map +1 -1
- package/dist/TimeFormat.js.map +1 -1
- package/dist/TimezoneMismatchModal.js.map +1 -1
- package/dist/ToggleFeatureCard.js +3 -3
- package/dist/ToggleFeatureCard.js.map +1 -1
- package/dist/VersionHistory.js +3 -3
- package/dist/VersionHistory.js.map +1 -1
- package/dist/cjs/AuditLogs.js +5 -5
- package/dist/cjs/AuditLogs.js.map +1 -1
- package/dist/cjs/BoardView.js +6 -6
- package/dist/cjs/BoardView.js.map +1 -1
- package/dist/cjs/Breadcrumbs.js +1 -1
- package/dist/cjs/Breadcrumbs.js.map +1 -1
- package/dist/cjs/BrowserPreview.js +1 -1
- package/dist/cjs/BrowserPreview.js.map +1 -1
- package/dist/cjs/BrowserSupport.js +2 -2
- package/dist/cjs/BrowserSupport.js.map +1 -1
- package/dist/cjs/Builder.js +6 -6
- package/dist/cjs/Builder.js.map +1 -1
- package/dist/cjs/ButtonGroup.js +2 -2
- package/dist/cjs/ButtonGroup.js.map +1 -1
- package/dist/cjs/CalendarView.js +4 -4
- package/dist/cjs/CalendarView.js.map +1 -1
- package/dist/cjs/CardLayout.js.map +1 -1
- package/dist/cjs/{Chevron-u-rD2gAf.js → Chevron-ClvaNo3d.js} +5 -5
- package/dist/cjs/{Chevron-u-rD2gAf.js.map → Chevron-ClvaNo3d.js.map} +1 -1
- package/dist/cjs/Codeblock.js +2 -2
- package/dist/cjs/Codeblock.js.map +1 -1
- package/dist/cjs/{Columns-CZDLxh70.js → Columns-C95kM2yL.js} +6 -6
- package/dist/cjs/{Columns-CZDLxh70.js.map → Columns-C95kM2yL.js.map} +1 -1
- package/dist/cjs/Columns.js +2 -2
- package/dist/cjs/ConfigurePageSidebar.js +2 -2
- package/dist/cjs/ConfigurePageSidebar.js.map +1 -1
- package/dist/cjs/ConfirmationModal.js.map +1 -1
- package/dist/cjs/Container.js +1 -1
- package/dist/cjs/Container.js.map +1 -1
- package/dist/cjs/CopyToClipboardButton.js +2 -2
- package/dist/cjs/CopyToClipboardButton.js.map +1 -1
- package/dist/cjs/Currency.js +2 -2
- package/dist/cjs/Currency.js.map +1 -1
- package/dist/cjs/DateFormat.js +1 -1
- package/dist/cjs/DateFormat.js.map +1 -1
- package/dist/cjs/DateRangeFilter.js +1 -1
- package/dist/cjs/DateRangeFilter.js.map +1 -1
- package/dist/cjs/DeleteArchiveModal.js.map +1 -1
- package/dist/cjs/DeviceIncompatibilityMessage.js.map +1 -1
- package/dist/cjs/DocumentEditor.js +2 -2
- package/dist/cjs/DocumentEditor.js.map +1 -1
- package/dist/cjs/DownloadMobileAppCallout.js.map +1 -1
- package/dist/cjs/DynamicVariables.js +2 -2
- package/dist/cjs/DynamicVariables.js.map +1 -1
- package/dist/cjs/EmailForm.js +5 -5
- package/dist/cjs/EmailForm.js.map +1 -1
- package/dist/cjs/EmailPreview.js.map +1 -1
- package/dist/cjs/EmojiPicker.js +1 -1
- package/dist/cjs/EmojiPicker.js.map +1 -1
- package/dist/cjs/EmojiReactions.js.map +1 -1
- package/dist/cjs/Engagements.js +2 -2
- package/dist/cjs/Engagements.js.map +1 -1
- package/dist/cjs/ErrorPage.js +369 -657
- package/dist/cjs/ErrorPage.js.map +1 -1
- package/dist/cjs/FileUpload.js +14 -14
- package/dist/cjs/FileUpload.js.map +1 -1
- package/dist/cjs/FinderModal.js +3 -3
- package/dist/cjs/FinderModal.js.map +1 -1
- package/dist/cjs/FloatingActionMenu.js +6 -6
- package/dist/cjs/FloatingActionMenu.js.map +1 -1
- package/dist/cjs/GoogleFontPicker.js +21 -21
- package/dist/cjs/GoogleFontPicker.js.map +1 -1
- package/dist/cjs/Header.js +2 -2
- package/dist/cjs/Header.js.map +1 -1
- package/dist/cjs/HelpPopover.js +1 -1
- package/dist/cjs/HelpPopover.js.map +1 -1
- package/dist/cjs/IconPicker.js +2 -2
- package/dist/cjs/IconPicker.js.map +1 -1
- package/dist/cjs/ImageWithFallback.js +2 -2
- package/dist/cjs/ImageWithFallback.js.map +1 -1
- package/dist/cjs/InlineInput.js +17 -17
- package/dist/cjs/InlineInput.js.map +1 -1
- package/dist/cjs/Insights.js +2 -8
- package/dist/cjs/Insights.js.map +1 -1
- package/dist/cjs/IntegrationCard.js +3 -3
- package/dist/cjs/IntegrationCard.js.map +1 -1
- package/dist/cjs/IpRestriction.js +574 -488
- package/dist/cjs/IpRestriction.js.map +1 -1
- package/dist/cjs/KeyboardShortcuts.js +2 -4
- package/dist/cjs/KeyboardShortcuts.js.map +1 -1
- package/dist/cjs/LoginPage.js +23 -24
- package/dist/cjs/LoginPage.js.map +1 -1
- package/dist/cjs/MadeWith.js +2 -2
- package/dist/cjs/MadeWith.js.map +1 -1
- package/dist/cjs/MenuBar.js +6 -6
- package/dist/cjs/MenuBar.js.map +1 -1
- package/dist/cjs/Metadata.js +1 -1
- package/dist/cjs/Metadata.js.map +1 -1
- package/dist/cjs/MobilePreviewHeader.js.map +1 -1
- package/dist/cjs/MoreDropdown.js +4 -4
- package/dist/cjs/MoreDropdown.js.map +1 -1
- package/dist/cjs/NavigationHeader.js +4 -4
- package/dist/cjs/NavigationHeader.js.map +1 -1
- package/dist/cjs/NeetoWidget.js +5 -5
- package/dist/cjs/NeetoWidget.js.map +1 -1
- package/dist/cjs/Onboarding.js +3 -3
- package/dist/cjs/Onboarding.js.map +1 -1
- package/dist/cjs/OptionFields.js +6 -6
- package/dist/cjs/OptionFields.js.map +1 -1
- package/dist/cjs/PageLoader.js +2 -2
- package/dist/cjs/PageLoader.js.map +1 -1
- package/dist/cjs/PhoneNumber.js +4 -5
- package/dist/cjs/PhoneNumber.js.map +1 -1
- package/dist/cjs/ProductEmbed.js +5 -5
- package/dist/cjs/ProductEmbed.js.map +1 -1
- package/dist/cjs/PublishBlock.js +3 -3
- package/dist/cjs/PublishBlock.js.map +1 -1
- package/dist/cjs/PublishYourItem.js.map +1 -1
- package/dist/cjs/Rename.js +5 -5
- package/dist/cjs/Rename.js.map +1 -1
- package/dist/cjs/ResponsiveDevicePicker.js +2 -2
- package/dist/cjs/ResponsiveDevicePicker.js.map +1 -1
- package/dist/cjs/Schedule.js +3 -3
- package/dist/cjs/Schedule.js.map +1 -1
- package/dist/cjs/Scrollable.js +2 -2
- package/dist/cjs/Scrollable.js.map +1 -1
- package/dist/cjs/Search.js +2 -2
- package/dist/cjs/Search.js.map +1 -1
- package/dist/cjs/SendToFields.js +93 -70
- package/dist/cjs/SendToFields.js.map +1 -1
- package/dist/cjs/SessionEnvironment.js +3 -4
- package/dist/cjs/SessionEnvironment.js.map +1 -1
- package/dist/cjs/Settings.js +6 -6
- package/dist/cjs/Settings.js.map +1 -1
- package/dist/cjs/ShareRecordingPane.js +2 -2
- package/dist/cjs/ShareRecordingPane.js.map +1 -1
- package/dist/cjs/ShareViaEmail.js +3 -3
- package/dist/cjs/ShareViaEmail.js.map +1 -1
- package/dist/cjs/ShareViaLink.js +24 -24
- package/dist/cjs/ShareViaLink.js.map +1 -1
- package/dist/cjs/Sidebar.js +5 -5
- package/dist/cjs/Sidebar.js.map +1 -1
- package/dist/cjs/StatusDropdown.js +2 -2
- package/dist/cjs/StatusDropdown.js.map +1 -1
- package/dist/cjs/StickyRibbonsContainer.js +10 -12
- package/dist/cjs/StickyRibbonsContainer.js.map +1 -1
- package/dist/cjs/SubHeader.js +5 -5
- package/dist/cjs/SubHeader.js.map +1 -1
- package/dist/cjs/SubscriptionNotificationsContainer.js +1 -1
- package/dist/cjs/SubscriptionNotificationsContainer.js.map +1 -1
- package/dist/cjs/SuffixedInput.js +2 -2
- package/dist/cjs/SuffixedInput.js.map +1 -1
- package/dist/cjs/TableWrapper.js +1 -1
- package/dist/cjs/TableWrapper.js.map +1 -1
- package/dist/cjs/Taxonomy.js +16 -16
- package/dist/cjs/Taxonomy.js.map +1 -1
- package/dist/cjs/TimeFormat.js.map +1 -1
- package/dist/cjs/TimezoneMismatchModal.js.map +1 -1
- package/dist/cjs/ToggleFeatureCard.js +3 -3
- package/dist/cjs/ToggleFeatureCard.js.map +1 -1
- package/dist/cjs/VersionHistory.js +3 -3
- package/dist/cjs/VersionHistory.js.map +1 -1
- package/dist/cjs/index-JY2zVpnv.js.map +1 -1
- package/dist/cjs/inject-css-B6qYtOJe.js +6 -0
- package/dist/cjs/inject-css-B6qYtOJe.js.map +1 -0
- package/dist/cjs/{phone-number-C93qn93_.js → phone-number-1EDAr56u.js} +34 -24
- package/dist/cjs/phone-number-1EDAr56u.js.map +1 -0
- package/dist/cjs/platform-BUcCb8Jx.js.map +1 -1
- package/dist/cjs/useKeyboardShortcutsPaneState-YnXpWOcs.js.map +1 -1
- package/dist/index-DAYCJu79.js.map +1 -1
- package/dist/inject-css-C2dztUxs.js +4 -0
- package/dist/inject-css-C2dztUxs.js.map +1 -0
- package/dist/{phone-number-CSXPpNBP.js → phone-number-BDkpXCIq.js} +36 -26
- package/dist/phone-number-BDkpXCIq.js.map +1 -0
- package/dist/platform-F44zJ4Xh.js.map +1 -1
- package/dist/useKeyboardShortcutsPaneState-C_eLceJQ.js.map +1 -1
- package/package.json +12 -14
- package/types/ButtonGroup.d.ts +2 -1
- package/types/CopyToClipboardButton.d.ts +2 -1
- package/types/EmailPreview.d.ts +2 -1
- package/types/FileUpload.d.ts +2 -1
- package/types/Header.d.ts +2 -1
- package/types/HelpPopover.d.ts +2 -1
- package/types/InlineInput.d.ts +2 -1
- package/types/IntegrationCard.d.ts +2 -1
- package/types/MoreDropdown.d.ts +1 -1
- package/types/PhoneNumber.d.ts +2 -1
- package/types/PublishBlock.d.ts +1 -1
- package/types/SubHeader.d.ts +1 -1
- package/types/ToggleFeatureCard.d.ts +1 -1
- package/dist/cjs/inject-css-vQvjPR2x.js +0 -6
- package/dist/cjs/inject-css-vQvjPR2x.js.map +0 -1
- package/dist/cjs/phone-number-C93qn93_.js.map +0 -1
- package/dist/inject-css-DmrvuTKK.js +0 -4
- package/dist/inject-css-DmrvuTKK.js.map +0 -1
- package/dist/phone-number-CSXPpNBP.js.map +0 -1
- package/src/translations/ar.json +0 -867
- package/src/translations/bg.json +0 -119
- package/src/translations/ca.json +0 -867
- package/src/translations/cs.json +0 -867
- package/src/translations/da.json +0 -867
- package/src/translations/de.json +0 -867
- package/src/translations/en.json +0 -867
- package/src/translations/es-MX.json +0 -867
- package/src/translations/es.json +0 -867
- package/src/translations/et.json +0 -867
- package/src/translations/fi.json +0 -867
- package/src/translations/fil.json +0 -867
- package/src/translations/fr.json +0 -867
- package/src/translations/hi.json +0 -119
- package/src/translations/hr.json +0 -867
- package/src/translations/id.json +0 -867
- package/src/translations/it.json +0 -867
- package/src/translations/ja.json +0 -867
- package/src/translations/ko.json +0 -867
- package/src/translations/nl.json +0 -867
- package/src/translations/pl.json +0 -867
- package/src/translations/pt-BR.json +0 -867
- package/src/translations/pt.json +0 -867
- package/src/translations/ro.json +0 -867
- package/src/translations/ru.json +0 -867
- package/src/translations/sk.json +0 -867
- package/src/translations/sl.json +0 -867
- package/src/translations/sv.json +0 -867
- package/src/translations/th.json +0 -867
- package/src/translations/tr.json +0 -867
- package/src/translations/uk.json +0 -867
- package/src/translations/vi.json +0 -867
- package/src/translations/zh-CN.json +0 -867
- package/src/translations/zh-TW.json +0 -867
package/dist/ErrorPage.js
CHANGED
|
@@ -7,10 +7,10 @@ import Button from '@bigbinary/neetoui/Button';
|
|
|
7
7
|
import Typography from '@bigbinary/neetoui/Typography';
|
|
8
8
|
import { Helmet } from 'react-helmet';
|
|
9
9
|
import { useTranslation, Trans } from 'react-i18next';
|
|
10
|
-
import { n } from './inject-css-
|
|
10
|
+
import { n } from './inject-css-C2dztUxs.js';
|
|
11
11
|
import { jsx, jsxs } from 'react/jsx-runtime';
|
|
12
12
|
|
|
13
|
-
/*! @license DOMPurify 3.
|
|
13
|
+
/*! @license DOMPurify 3.2.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.6/LICENSE */
|
|
14
14
|
|
|
15
15
|
const {
|
|
16
16
|
entries,
|
|
@@ -24,227 +24,259 @@ let {
|
|
|
24
24
|
seal,
|
|
25
25
|
create
|
|
26
26
|
} = Object; // eslint-disable-line import/no-mutable-exports
|
|
27
|
-
|
|
28
27
|
let {
|
|
29
28
|
apply,
|
|
30
29
|
construct
|
|
31
30
|
} = typeof Reflect !== 'undefined' && Reflect;
|
|
32
|
-
|
|
33
|
-
if (!apply) {
|
|
34
|
-
apply = function apply(fun, thisValue, args) {
|
|
35
|
-
return fun.apply(thisValue, args);
|
|
36
|
-
};
|
|
37
|
-
}
|
|
38
|
-
|
|
39
31
|
if (!freeze) {
|
|
40
32
|
freeze = function freeze(x) {
|
|
41
33
|
return x;
|
|
42
34
|
};
|
|
43
35
|
}
|
|
44
|
-
|
|
45
36
|
if (!seal) {
|
|
46
37
|
seal = function seal(x) {
|
|
47
38
|
return x;
|
|
48
39
|
};
|
|
49
40
|
}
|
|
50
|
-
|
|
41
|
+
if (!apply) {
|
|
42
|
+
apply = function apply(fun, thisValue, args) {
|
|
43
|
+
return fun.apply(thisValue, args);
|
|
44
|
+
};
|
|
45
|
+
}
|
|
51
46
|
if (!construct) {
|
|
52
47
|
construct = function construct(Func, args) {
|
|
53
48
|
return new Func(...args);
|
|
54
49
|
};
|
|
55
50
|
}
|
|
56
|
-
|
|
57
51
|
const arrayForEach = unapply(Array.prototype.forEach);
|
|
52
|
+
const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
|
|
58
53
|
const arrayPop = unapply(Array.prototype.pop);
|
|
59
54
|
const arrayPush = unapply(Array.prototype.push);
|
|
55
|
+
const arraySplice = unapply(Array.prototype.splice);
|
|
60
56
|
const stringToLowerCase = unapply(String.prototype.toLowerCase);
|
|
61
57
|
const stringToString = unapply(String.prototype.toString);
|
|
62
58
|
const stringMatch = unapply(String.prototype.match);
|
|
63
59
|
const stringReplace = unapply(String.prototype.replace);
|
|
64
60
|
const stringIndexOf = unapply(String.prototype.indexOf);
|
|
65
61
|
const stringTrim = unapply(String.prototype.trim);
|
|
62
|
+
const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
|
|
66
63
|
const regExpTest = unapply(RegExp.prototype.test);
|
|
67
64
|
const typeErrorCreate = unconstruct(TypeError);
|
|
65
|
+
/**
|
|
66
|
+
* Creates a new function that calls the given function with a specified thisArg and arguments.
|
|
67
|
+
*
|
|
68
|
+
* @param func - The function to be wrapped and called.
|
|
69
|
+
* @returns A new function that calls the given function with a specified thisArg and arguments.
|
|
70
|
+
*/
|
|
68
71
|
function unapply(func) {
|
|
69
72
|
return function (thisArg) {
|
|
73
|
+
if (thisArg instanceof RegExp) {
|
|
74
|
+
thisArg.lastIndex = 0;
|
|
75
|
+
}
|
|
70
76
|
for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
|
|
71
77
|
args[_key - 1] = arguments[_key];
|
|
72
78
|
}
|
|
73
|
-
|
|
74
79
|
return apply(func, thisArg, args);
|
|
75
80
|
};
|
|
76
81
|
}
|
|
82
|
+
/**
|
|
83
|
+
* Creates a new function that constructs an instance of the given constructor function with the provided arguments.
|
|
84
|
+
*
|
|
85
|
+
* @param func - The constructor function to be wrapped and called.
|
|
86
|
+
* @returns A new function that constructs an instance of the given constructor function with the provided arguments.
|
|
87
|
+
*/
|
|
77
88
|
function unconstruct(func) {
|
|
78
89
|
return function () {
|
|
79
90
|
for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
|
|
80
91
|
args[_key2] = arguments[_key2];
|
|
81
92
|
}
|
|
82
|
-
|
|
83
93
|
return construct(func, args);
|
|
84
94
|
};
|
|
85
95
|
}
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
96
|
+
/**
|
|
97
|
+
* Add properties to a lookup table
|
|
98
|
+
*
|
|
99
|
+
* @param set - The set to which elements will be added.
|
|
100
|
+
* @param array - The array containing elements to be added to the set.
|
|
101
|
+
* @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
|
|
102
|
+
* @returns The modified set with added elements.
|
|
103
|
+
*/
|
|
104
|
+
function addToSet(set, array) {
|
|
105
|
+
let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
|
|
93
106
|
if (setPrototypeOf) {
|
|
94
107
|
// Make 'in' and truthy checks like Boolean(set.constructor)
|
|
95
108
|
// independent of any properties defined on Object.prototype.
|
|
96
109
|
// Prevent prototype setters from intercepting set as a this value.
|
|
97
110
|
setPrototypeOf(set, null);
|
|
98
111
|
}
|
|
99
|
-
|
|
100
112
|
let l = array.length;
|
|
101
|
-
|
|
102
113
|
while (l--) {
|
|
103
114
|
let element = array[l];
|
|
104
|
-
|
|
105
115
|
if (typeof element === 'string') {
|
|
106
116
|
const lcElement = transformCaseFunc(element);
|
|
107
|
-
|
|
108
117
|
if (lcElement !== element) {
|
|
109
118
|
// Config presets (e.g. tags.js, attrs.js) are immutable.
|
|
110
119
|
if (!isFrozen(array)) {
|
|
111
120
|
array[l] = lcElement;
|
|
112
121
|
}
|
|
113
|
-
|
|
114
122
|
element = lcElement;
|
|
115
123
|
}
|
|
116
124
|
}
|
|
117
|
-
|
|
118
125
|
set[element] = true;
|
|
119
126
|
}
|
|
120
|
-
|
|
121
127
|
return set;
|
|
122
128
|
}
|
|
123
|
-
|
|
124
|
-
|
|
129
|
+
/**
|
|
130
|
+
* Clean up an array to harden against CSPP
|
|
131
|
+
*
|
|
132
|
+
* @param array - The array to be cleaned.
|
|
133
|
+
* @returns The cleaned version of the array
|
|
134
|
+
*/
|
|
135
|
+
function cleanArray(array) {
|
|
136
|
+
for (let index = 0; index < array.length; index++) {
|
|
137
|
+
const isPropertyExist = objectHasOwnProperty(array, index);
|
|
138
|
+
if (!isPropertyExist) {
|
|
139
|
+
array[index] = null;
|
|
140
|
+
}
|
|
141
|
+
}
|
|
142
|
+
return array;
|
|
143
|
+
}
|
|
144
|
+
/**
|
|
145
|
+
* Shallow clone an object
|
|
146
|
+
*
|
|
147
|
+
* @param object - The object to be cloned.
|
|
148
|
+
* @returns A new object that copies the original.
|
|
149
|
+
*/
|
|
125
150
|
function clone(object) {
|
|
126
151
|
const newObject = create(null);
|
|
127
|
-
|
|
128
152
|
for (const [property, value] of entries(object)) {
|
|
129
|
-
|
|
153
|
+
const isPropertyExist = objectHasOwnProperty(object, property);
|
|
154
|
+
if (isPropertyExist) {
|
|
155
|
+
if (Array.isArray(value)) {
|
|
156
|
+
newObject[property] = cleanArray(value);
|
|
157
|
+
} else if (value && typeof value === 'object' && value.constructor === Object) {
|
|
158
|
+
newObject[property] = clone(value);
|
|
159
|
+
} else {
|
|
160
|
+
newObject[property] = value;
|
|
161
|
+
}
|
|
162
|
+
}
|
|
130
163
|
}
|
|
131
|
-
|
|
132
164
|
return newObject;
|
|
133
165
|
}
|
|
134
|
-
|
|
135
|
-
* or getter and behaves accordingly.
|
|
136
|
-
|
|
166
|
+
/**
|
|
167
|
+
* This method automatically checks if the prop is function or getter and behaves accordingly.
|
|
168
|
+
*
|
|
169
|
+
* @param object - The object to look up the getter function in its prototype chain.
|
|
170
|
+
* @param prop - The property name for which to find the getter function.
|
|
171
|
+
* @returns The getter function found in the prototype chain or a fallback function.
|
|
172
|
+
*/
|
|
137
173
|
function lookupGetter(object, prop) {
|
|
138
174
|
while (object !== null) {
|
|
139
175
|
const desc = getOwnPropertyDescriptor(object, prop);
|
|
140
|
-
|
|
141
176
|
if (desc) {
|
|
142
177
|
if (desc.get) {
|
|
143
178
|
return unapply(desc.get);
|
|
144
179
|
}
|
|
145
|
-
|
|
146
180
|
if (typeof desc.value === 'function') {
|
|
147
181
|
return unapply(desc.value);
|
|
148
182
|
}
|
|
149
183
|
}
|
|
150
|
-
|
|
151
184
|
object = getPrototypeOf(object);
|
|
152
185
|
}
|
|
153
|
-
|
|
154
|
-
function fallbackValue(element) {
|
|
155
|
-
console.warn('fallback value for', element);
|
|
186
|
+
function fallbackValue() {
|
|
156
187
|
return null;
|
|
157
188
|
}
|
|
158
|
-
|
|
159
189
|
return fallbackValue;
|
|
160
190
|
}
|
|
161
191
|
|
|
162
|
-
const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
163
|
-
|
|
192
|
+
const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
164
193
|
const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
|
|
165
|
-
const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
194
|
+
const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
195
|
+
// List of SVG elements that are disallowed by default.
|
|
166
196
|
// We still need to know them so that we can do namespace
|
|
167
197
|
// checks properly in case one wants to add them to
|
|
168
198
|
// allow-list.
|
|
169
|
-
|
|
170
199
|
const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
|
|
171
|
-
const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
200
|
+
const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
201
|
+
// Similarly to SVG, we want to know all MathML elements,
|
|
172
202
|
// even those that we disallow by default.
|
|
173
|
-
|
|
174
203
|
const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
|
|
175
204
|
const text = freeze(['#text']);
|
|
176
205
|
|
|
177
|
-
const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
|
|
178
|
-
const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
|
|
206
|
+
const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
|
|
207
|
+
const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
|
|
179
208
|
const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
|
|
180
209
|
const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
|
|
181
210
|
|
|
211
|
+
// eslint-disable-next-line unicorn/better-regex
|
|
182
212
|
const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
|
|
183
|
-
|
|
184
213
|
const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
185
|
-
const TMPLIT_EXPR = seal(
|
|
186
|
-
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]
|
|
187
|
-
|
|
214
|
+
const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm); // eslint-disable-line unicorn/better-regex
|
|
215
|
+
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
|
|
188
216
|
const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
|
|
189
|
-
|
|
190
|
-
const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
|
|
217
|
+
const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
|
|
191
218
|
);
|
|
192
219
|
const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
|
|
193
220
|
const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
|
|
194
221
|
);
|
|
195
222
|
const DOCTYPE_NAME = seal(/^html$/i);
|
|
223
|
+
const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
|
|
196
224
|
|
|
197
225
|
var EXPRESSIONS = /*#__PURE__*/Object.freeze({
|
|
198
226
|
__proto__: null,
|
|
199
|
-
MUSTACHE_EXPR: MUSTACHE_EXPR,
|
|
200
|
-
ERB_EXPR: ERB_EXPR,
|
|
201
|
-
TMPLIT_EXPR: TMPLIT_EXPR,
|
|
202
|
-
DATA_ATTR: DATA_ATTR,
|
|
203
227
|
ARIA_ATTR: ARIA_ATTR,
|
|
228
|
+
ATTR_WHITESPACE: ATTR_WHITESPACE,
|
|
229
|
+
CUSTOM_ELEMENT: CUSTOM_ELEMENT,
|
|
230
|
+
DATA_ATTR: DATA_ATTR,
|
|
231
|
+
DOCTYPE_NAME: DOCTYPE_NAME,
|
|
232
|
+
ERB_EXPR: ERB_EXPR,
|
|
204
233
|
IS_ALLOWED_URI: IS_ALLOWED_URI,
|
|
205
234
|
IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
|
|
206
|
-
|
|
207
|
-
|
|
235
|
+
MUSTACHE_EXPR: MUSTACHE_EXPR,
|
|
236
|
+
TMPLIT_EXPR: TMPLIT_EXPR
|
|
208
237
|
});
|
|
209
238
|
|
|
210
|
-
|
|
239
|
+
/* eslint-disable @typescript-eslint/indent */
|
|
240
|
+
// https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
|
|
241
|
+
const NODE_TYPE = {
|
|
242
|
+
element: 1,
|
|
243
|
+
text: 3,
|
|
244
|
+
// Deprecated
|
|
245
|
+
progressingInstruction: 7,
|
|
246
|
+
comment: 8,
|
|
247
|
+
document: 9};
|
|
248
|
+
const getGlobal = function getGlobal() {
|
|
249
|
+
return typeof window === 'undefined' ? null : window;
|
|
250
|
+
};
|
|
211
251
|
/**
|
|
212
252
|
* Creates a no-op policy for internal use only.
|
|
213
253
|
* Don't export this function outside this module!
|
|
214
|
-
* @param
|
|
215
|
-
* @param
|
|
216
|
-
* @return
|
|
254
|
+
* @param trustedTypes The policy factory.
|
|
255
|
+
* @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
|
|
256
|
+
* @return The policy created (or null, if Trusted Types
|
|
217
257
|
* are not supported or creating the policy failed).
|
|
218
258
|
*/
|
|
219
|
-
|
|
220
|
-
|
|
221
259
|
const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
|
|
222
260
|
if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
|
|
223
261
|
return null;
|
|
224
|
-
}
|
|
262
|
+
}
|
|
263
|
+
// Allow the callers to control the unique policy name
|
|
225
264
|
// by adding a data-tt-policy-suffix to the script element with the DOMPurify.
|
|
226
265
|
// Policy creation with duplicate names throws in Trusted Types.
|
|
227
|
-
|
|
228
|
-
|
|
229
266
|
let suffix = null;
|
|
230
267
|
const ATTR_NAME = 'data-tt-policy-suffix';
|
|
231
|
-
|
|
232
268
|
if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
|
|
233
269
|
suffix = purifyHostElement.getAttribute(ATTR_NAME);
|
|
234
270
|
}
|
|
235
|
-
|
|
236
271
|
const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
|
|
237
|
-
|
|
238
272
|
try {
|
|
239
273
|
return trustedTypes.createPolicy(policyName, {
|
|
240
274
|
createHTML(html) {
|
|
241
275
|
return html;
|
|
242
276
|
},
|
|
243
|
-
|
|
244
277
|
createScriptURL(scriptUrl) {
|
|
245
278
|
return scriptUrl;
|
|
246
279
|
}
|
|
247
|
-
|
|
248
280
|
});
|
|
249
281
|
} catch (_) {
|
|
250
282
|
// Policy creation failed (most likely another DOMPurify script has
|
|
@@ -254,37 +286,35 @@ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedType
|
|
|
254
286
|
return null;
|
|
255
287
|
}
|
|
256
288
|
};
|
|
257
|
-
|
|
289
|
+
const _createHooksMap = function _createHooksMap() {
|
|
290
|
+
return {
|
|
291
|
+
afterSanitizeAttributes: [],
|
|
292
|
+
afterSanitizeElements: [],
|
|
293
|
+
afterSanitizeShadowDOM: [],
|
|
294
|
+
beforeSanitizeAttributes: [],
|
|
295
|
+
beforeSanitizeElements: [],
|
|
296
|
+
beforeSanitizeShadowDOM: [],
|
|
297
|
+
uponSanitizeAttribute: [],
|
|
298
|
+
uponSanitizeElement: [],
|
|
299
|
+
uponSanitizeShadowNode: []
|
|
300
|
+
};
|
|
301
|
+
};
|
|
258
302
|
function createDOMPurify() {
|
|
259
303
|
let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
|
|
260
|
-
|
|
261
304
|
const DOMPurify = root => createDOMPurify(root);
|
|
262
|
-
|
|
263
|
-
* Version label, exposed for easier checks
|
|
264
|
-
* if DOMPurify is up to date or not
|
|
265
|
-
*/
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
DOMPurify.version = '3.0.3';
|
|
269
|
-
/**
|
|
270
|
-
* Array of elements that DOMPurify removed during sanitation.
|
|
271
|
-
* Empty if nothing was removed.
|
|
272
|
-
*/
|
|
273
|
-
|
|
305
|
+
DOMPurify.version = '3.2.6';
|
|
274
306
|
DOMPurify.removed = [];
|
|
275
|
-
|
|
276
|
-
if (!window || !window.document || window.document.nodeType !== 9) {
|
|
307
|
+
if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
|
|
277
308
|
// Not running in a browser, provide a factory function
|
|
278
309
|
// so that you can pass your own Window
|
|
279
310
|
DOMPurify.isSupported = false;
|
|
280
311
|
return DOMPurify;
|
|
281
312
|
}
|
|
282
|
-
|
|
283
|
-
const originalDocument = window.document;
|
|
284
|
-
const currentScript = originalDocument.currentScript;
|
|
285
313
|
let {
|
|
286
314
|
document
|
|
287
315
|
} = window;
|
|
316
|
+
const originalDocument = document;
|
|
317
|
+
const currentScript = originalDocument.currentScript;
|
|
288
318
|
const {
|
|
289
319
|
DocumentFragment,
|
|
290
320
|
HTMLTemplateElement,
|
|
@@ -298,23 +328,22 @@ function createDOMPurify() {
|
|
|
298
328
|
} = window;
|
|
299
329
|
const ElementPrototype = Element.prototype;
|
|
300
330
|
const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
|
|
331
|
+
const remove = lookupGetter(ElementPrototype, 'remove');
|
|
301
332
|
const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
|
|
302
333
|
const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
|
|
303
|
-
const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
334
|
+
const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
335
|
+
// As per issue #47, the web-components registry is inherited by a
|
|
304
336
|
// new document created via createHTMLDocument. As per the spec
|
|
305
337
|
// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
|
|
306
338
|
// a new empty registry is used when creating a template contents owner
|
|
307
339
|
// document, so we use that as our parent document to ensure nothing
|
|
308
340
|
// is inherited.
|
|
309
|
-
|
|
310
341
|
if (typeof HTMLTemplateElement === 'function') {
|
|
311
342
|
const template = document.createElement('template');
|
|
312
|
-
|
|
313
343
|
if (template.content && template.content.ownerDocument) {
|
|
314
344
|
document = template.content.ownerDocument;
|
|
315
345
|
}
|
|
316
346
|
}
|
|
317
|
-
|
|
318
347
|
let trustedTypesPolicy;
|
|
319
348
|
let emptyHTML = '';
|
|
320
349
|
const {
|
|
@@ -326,11 +355,10 @@ function createDOMPurify() {
|
|
|
326
355
|
const {
|
|
327
356
|
importNode
|
|
328
357
|
} = originalDocument;
|
|
329
|
-
let hooks =
|
|
358
|
+
let hooks = _createHooksMap();
|
|
330
359
|
/**
|
|
331
360
|
* Expose whether this browser supports running the full DOMPurify.
|
|
332
361
|
*/
|
|
333
|
-
|
|
334
362
|
DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
|
|
335
363
|
const {
|
|
336
364
|
MUSTACHE_EXPR,
|
|
@@ -339,7 +367,8 @@ function createDOMPurify() {
|
|
|
339
367
|
DATA_ATTR,
|
|
340
368
|
ARIA_ATTR,
|
|
341
369
|
IS_SCRIPT_OR_DATA,
|
|
342
|
-
ATTR_WHITESPACE
|
|
370
|
+
ATTR_WHITESPACE,
|
|
371
|
+
CUSTOM_ELEMENT
|
|
343
372
|
} = EXPRESSIONS;
|
|
344
373
|
let {
|
|
345
374
|
IS_ALLOWED_URI: IS_ALLOWED_URI$1
|
|
@@ -348,23 +377,19 @@ function createDOMPurify() {
|
|
|
348
377
|
* We consider the elements and attributes below to be safe. Ideally
|
|
349
378
|
* don't add any new ones but feel free to remove unwanted ones.
|
|
350
379
|
*/
|
|
351
|
-
|
|
352
380
|
/* allowed element names */
|
|
353
|
-
|
|
354
381
|
let ALLOWED_TAGS = null;
|
|
355
382
|
const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
|
|
356
383
|
/* Allowed attribute names */
|
|
357
|
-
|
|
358
384
|
let ALLOWED_ATTR = null;
|
|
359
385
|
const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
|
|
360
386
|
/*
|
|
361
|
-
* Configure how
|
|
387
|
+
* Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
|
|
362
388
|
* @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
|
|
363
389
|
* @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
|
|
364
390
|
* @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
|
|
365
391
|
*/
|
|
366
|
-
|
|
367
|
-
let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
|
|
392
|
+
let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
368
393
|
tagNameCheck: {
|
|
369
394
|
writable: true,
|
|
370
395
|
configurable: false,
|
|
@@ -385,57 +410,47 @@ function createDOMPurify() {
|
|
|
385
410
|
}
|
|
386
411
|
}));
|
|
387
412
|
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
|
|
388
|
-
|
|
389
413
|
let FORBID_TAGS = null;
|
|
390
414
|
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
|
|
391
|
-
|
|
392
415
|
let FORBID_ATTR = null;
|
|
393
416
|
/* Decide if ARIA attributes are okay */
|
|
394
|
-
|
|
395
417
|
let ALLOW_ARIA_ATTR = true;
|
|
396
418
|
/* Decide if custom data attributes are okay */
|
|
397
|
-
|
|
398
419
|
let ALLOW_DATA_ATTR = true;
|
|
399
420
|
/* Decide if unknown protocols are okay */
|
|
400
|
-
|
|
401
421
|
let ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
402
422
|
/* Decide if self-closing tags in attributes are allowed.
|
|
403
423
|
* Usually removed due to a mXSS issue in jQuery 3.0 */
|
|
404
|
-
|
|
405
424
|
let ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
406
425
|
/* Output should be safe for common template engines.
|
|
407
426
|
* This means, DOMPurify removes data attributes, mustaches and ERB
|
|
408
427
|
*/
|
|
409
|
-
|
|
410
428
|
let SAFE_FOR_TEMPLATES = false;
|
|
429
|
+
/* Output should be safe even for XML used within HTML and alike.
|
|
430
|
+
* This means, DOMPurify removes comments when containing risky content.
|
|
431
|
+
*/
|
|
432
|
+
let SAFE_FOR_XML = true;
|
|
411
433
|
/* Decide if document with <html>... should be returned */
|
|
412
|
-
|
|
413
434
|
let WHOLE_DOCUMENT = false;
|
|
414
435
|
/* Track whether config is already set on this instance of DOMPurify. */
|
|
415
|
-
|
|
416
436
|
let SET_CONFIG = false;
|
|
417
437
|
/* Decide if all elements (e.g. style, script) must be children of
|
|
418
438
|
* document.body. By default, browsers might move them to document.head */
|
|
419
|
-
|
|
420
439
|
let FORCE_BODY = false;
|
|
421
440
|
/* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
|
|
422
441
|
* string (or a TrustedHTML object if Trusted Types are supported).
|
|
423
442
|
* If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
|
|
424
443
|
*/
|
|
425
|
-
|
|
426
444
|
let RETURN_DOM = false;
|
|
427
445
|
/* Decide if a DOM `DocumentFragment` should be returned, instead of a html
|
|
428
446
|
* string (or a TrustedHTML object if Trusted Types are supported) */
|
|
429
|
-
|
|
430
447
|
let RETURN_DOM_FRAGMENT = false;
|
|
431
448
|
/* Try to return a Trusted Type object instead of a string, return a string in
|
|
432
449
|
* case Trusted Types are not supported */
|
|
433
|
-
|
|
434
450
|
let RETURN_TRUSTED_TYPE = false;
|
|
435
451
|
/* Output should be free from DOM clobbering attacks?
|
|
436
452
|
* This sanitizes markups named with colliding, clobberable built-in DOM APIs.
|
|
437
453
|
*/
|
|
438
|
-
|
|
439
454
|
let SANITIZE_DOM = true;
|
|
440
455
|
/* Achieve full DOM Clobbering protection by isolating the namespace of named
|
|
441
456
|
* properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
|
|
@@ -450,180 +465,138 @@ function createDOMPurify() {
|
|
|
450
465
|
* Namespace isolation is implemented by prefixing `id` and `name` attributes
|
|
451
466
|
* with a constant string, i.e., `user-content-`
|
|
452
467
|
*/
|
|
453
|
-
|
|
454
468
|
let SANITIZE_NAMED_PROPS = false;
|
|
455
469
|
const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
|
|
456
470
|
/* Keep element content when removing element? */
|
|
457
|
-
|
|
458
471
|
let KEEP_CONTENT = true;
|
|
459
472
|
/* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
|
|
460
473
|
* of importing it into a new Document and returning a sanitized copy */
|
|
461
|
-
|
|
462
474
|
let IN_PLACE = false;
|
|
463
475
|
/* Allow usage of profiles like html, svg and mathMl */
|
|
464
|
-
|
|
465
476
|
let USE_PROFILES = {};
|
|
466
477
|
/* Tags to ignore content of when KEEP_CONTENT is true */
|
|
467
|
-
|
|
468
478
|
let FORBID_CONTENTS = null;
|
|
469
479
|
const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
|
|
470
480
|
/* Tags that are safe for data: URIs */
|
|
471
|
-
|
|
472
481
|
let DATA_URI_TAGS = null;
|
|
473
482
|
const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
|
|
474
483
|
/* Attributes safe for values like "javascript:" */
|
|
475
|
-
|
|
476
484
|
let URI_SAFE_ATTRIBUTES = null;
|
|
477
485
|
const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
|
|
478
486
|
const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
|
|
479
487
|
const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
|
|
480
488
|
const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
|
|
481
489
|
/* Document namespace */
|
|
482
|
-
|
|
483
490
|
let NAMESPACE = HTML_NAMESPACE;
|
|
484
491
|
let IS_EMPTY_INPUT = false;
|
|
485
492
|
/* Allowed XHTML+XML namespaces */
|
|
486
|
-
|
|
487
493
|
let ALLOWED_NAMESPACES = null;
|
|
488
494
|
const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
|
|
495
|
+
let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
496
|
+
let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
|
|
497
|
+
// Certain elements are allowed in both SVG and HTML
|
|
498
|
+
// namespace. We need to specify them explicitly
|
|
499
|
+
// so that they don't get erroneously deleted from
|
|
500
|
+
// HTML namespace.
|
|
501
|
+
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
489
502
|
/* Parsing of strict XHTML documents */
|
|
490
|
-
|
|
491
|
-
let PARSER_MEDIA_TYPE;
|
|
503
|
+
let PARSER_MEDIA_TYPE = null;
|
|
492
504
|
const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
|
|
493
505
|
const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
|
|
494
|
-
let transformCaseFunc;
|
|
506
|
+
let transformCaseFunc = null;
|
|
495
507
|
/* Keep a reference to config to pass to hooks */
|
|
496
|
-
|
|
497
508
|
let CONFIG = null;
|
|
498
509
|
/* Ideally, do not touch anything below this line */
|
|
499
|
-
|
|
500
510
|
/* ______________________________________________ */
|
|
501
|
-
|
|
502
511
|
const formElement = document.createElement('form');
|
|
503
|
-
|
|
504
512
|
const isRegexOrFunction = function isRegexOrFunction(testValue) {
|
|
505
513
|
return testValue instanceof RegExp || testValue instanceof Function;
|
|
506
514
|
};
|
|
507
515
|
/**
|
|
508
516
|
* _parseConfig
|
|
509
517
|
*
|
|
510
|
-
* @param
|
|
518
|
+
* @param cfg optional config literal
|
|
511
519
|
*/
|
|
512
520
|
// eslint-disable-next-line complexity
|
|
513
|
-
|
|
514
|
-
|
|
515
|
-
const _parseConfig = function _parseConfig(cfg) {
|
|
521
|
+
const _parseConfig = function _parseConfig() {
|
|
522
|
+
let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
516
523
|
if (CONFIG && CONFIG === cfg) {
|
|
517
524
|
return;
|
|
518
525
|
}
|
|
519
526
|
/* Shield configuration object from tampering */
|
|
520
|
-
|
|
521
|
-
|
|
522
527
|
if (!cfg || typeof cfg !== 'object') {
|
|
523
528
|
cfg = {};
|
|
524
529
|
}
|
|
525
530
|
/* Shield configuration object from prototype pollution */
|
|
526
|
-
|
|
527
|
-
|
|
528
531
|
cfg = clone(cfg);
|
|
529
|
-
PARSER_MEDIA_TYPE =
|
|
530
|
-
|
|
531
|
-
|
|
532
|
+
PARSER_MEDIA_TYPE =
|
|
533
|
+
// eslint-disable-next-line unicorn/prefer-includes
|
|
534
|
+
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
|
|
535
|
+
// HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
|
|
532
536
|
transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
|
|
533
537
|
/* Set configuration parameters */
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
537
|
-
|
|
538
|
-
|
|
539
|
-
cfg.
|
|
540
|
-
transformCaseFunc
|
|
541
|
-
)
|
|
542
|
-
:
|
|
543
|
-
DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
|
|
544
|
-
cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
|
|
545
|
-
transformCaseFunc // eslint-disable-line indent
|
|
546
|
-
) // eslint-disable-line indent
|
|
547
|
-
: DEFAULT_DATA_URI_TAGS;
|
|
548
|
-
FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
549
|
-
FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
|
|
550
|
-
FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
|
|
551
|
-
USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
|
|
538
|
+
ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
|
|
539
|
+
ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
|
|
540
|
+
ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
|
|
541
|
+
URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
|
|
542
|
+
DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
|
|
543
|
+
FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
544
|
+
FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
|
|
545
|
+
FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
|
|
546
|
+
USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
|
|
552
547
|
ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
|
|
553
|
-
|
|
554
548
|
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
|
|
555
|
-
|
|
556
549
|
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
|
|
557
|
-
|
|
558
550
|
ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
|
|
559
|
-
|
|
560
551
|
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
|
|
561
|
-
|
|
552
|
+
SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
|
|
562
553
|
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
|
|
563
|
-
|
|
564
554
|
RETURN_DOM = cfg.RETURN_DOM || false; // Default false
|
|
565
|
-
|
|
566
555
|
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
|
|
567
|
-
|
|
568
556
|
RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
|
|
569
|
-
|
|
570
557
|
FORCE_BODY = cfg.FORCE_BODY || false; // Default false
|
|
571
|
-
|
|
572
558
|
SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
|
|
573
|
-
|
|
574
559
|
SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
|
|
575
|
-
|
|
576
560
|
KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
|
|
577
|
-
|
|
578
561
|
IN_PLACE = cfg.IN_PLACE || false; // Default false
|
|
579
|
-
|
|
580
562
|
IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
|
|
581
563
|
NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
|
|
564
|
+
MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
|
|
565
|
+
HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
|
|
582
566
|
CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
|
|
583
|
-
|
|
584
567
|
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
|
|
585
568
|
CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
|
|
586
569
|
}
|
|
587
|
-
|
|
588
570
|
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
|
|
589
571
|
CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
|
|
590
572
|
}
|
|
591
|
-
|
|
592
573
|
if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
|
|
593
574
|
CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
|
|
594
575
|
}
|
|
595
|
-
|
|
596
576
|
if (SAFE_FOR_TEMPLATES) {
|
|
597
577
|
ALLOW_DATA_ATTR = false;
|
|
598
578
|
}
|
|
599
|
-
|
|
600
579
|
if (RETURN_DOM_FRAGMENT) {
|
|
601
580
|
RETURN_DOM = true;
|
|
602
581
|
}
|
|
603
582
|
/* Parse profile info */
|
|
604
|
-
|
|
605
|
-
|
|
606
583
|
if (USE_PROFILES) {
|
|
607
|
-
ALLOWED_TAGS = addToSet({},
|
|
584
|
+
ALLOWED_TAGS = addToSet({}, text);
|
|
608
585
|
ALLOWED_ATTR = [];
|
|
609
|
-
|
|
610
586
|
if (USE_PROFILES.html === true) {
|
|
611
587
|
addToSet(ALLOWED_TAGS, html$1);
|
|
612
588
|
addToSet(ALLOWED_ATTR, html);
|
|
613
589
|
}
|
|
614
|
-
|
|
615
590
|
if (USE_PROFILES.svg === true) {
|
|
616
591
|
addToSet(ALLOWED_TAGS, svg$1);
|
|
617
592
|
addToSet(ALLOWED_ATTR, svg);
|
|
618
593
|
addToSet(ALLOWED_ATTR, xml);
|
|
619
594
|
}
|
|
620
|
-
|
|
621
595
|
if (USE_PROFILES.svgFilters === true) {
|
|
622
596
|
addToSet(ALLOWED_TAGS, svgFilters);
|
|
623
597
|
addToSet(ALLOWED_ATTR, svg);
|
|
624
598
|
addToSet(ALLOWED_ATTR, xml);
|
|
625
599
|
}
|
|
626
|
-
|
|
627
600
|
if (USE_PROFILES.mathMl === true) {
|
|
628
601
|
addToSet(ALLOWED_TAGS, mathMl$1);
|
|
629
602
|
addToSet(ALLOWED_ATTR, mathMl);
|
|
@@ -631,171 +604,127 @@ function createDOMPurify() {
|
|
|
631
604
|
}
|
|
632
605
|
}
|
|
633
606
|
/* Merge configuration parameters */
|
|
634
|
-
|
|
635
|
-
|
|
636
607
|
if (cfg.ADD_TAGS) {
|
|
637
608
|
if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
|
|
638
609
|
ALLOWED_TAGS = clone(ALLOWED_TAGS);
|
|
639
610
|
}
|
|
640
|
-
|
|
641
611
|
addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
|
|
642
612
|
}
|
|
643
|
-
|
|
644
613
|
if (cfg.ADD_ATTR) {
|
|
645
614
|
if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
|
|
646
615
|
ALLOWED_ATTR = clone(ALLOWED_ATTR);
|
|
647
616
|
}
|
|
648
|
-
|
|
649
617
|
addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
|
|
650
618
|
}
|
|
651
|
-
|
|
652
619
|
if (cfg.ADD_URI_SAFE_ATTR) {
|
|
653
620
|
addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
|
|
654
621
|
}
|
|
655
|
-
|
|
656
622
|
if (cfg.FORBID_CONTENTS) {
|
|
657
623
|
if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
|
|
658
624
|
FORBID_CONTENTS = clone(FORBID_CONTENTS);
|
|
659
625
|
}
|
|
660
|
-
|
|
661
626
|
addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
|
|
662
627
|
}
|
|
663
628
|
/* Add #text in case KEEP_CONTENT is set to true */
|
|
664
|
-
|
|
665
|
-
|
|
666
629
|
if (KEEP_CONTENT) {
|
|
667
630
|
ALLOWED_TAGS['#text'] = true;
|
|
668
631
|
}
|
|
669
632
|
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
|
|
670
|
-
|
|
671
|
-
|
|
672
633
|
if (WHOLE_DOCUMENT) {
|
|
673
634
|
addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
|
|
674
635
|
}
|
|
675
636
|
/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
|
|
676
|
-
|
|
677
|
-
|
|
678
637
|
if (ALLOWED_TAGS.table) {
|
|
679
638
|
addToSet(ALLOWED_TAGS, ['tbody']);
|
|
680
639
|
delete FORBID_TAGS.tbody;
|
|
681
640
|
}
|
|
682
|
-
|
|
683
641
|
if (cfg.TRUSTED_TYPES_POLICY) {
|
|
684
642
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
|
|
685
643
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
|
|
686
644
|
}
|
|
687
|
-
|
|
688
645
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
|
|
689
646
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
|
|
690
|
-
}
|
|
691
|
-
|
|
692
|
-
|
|
693
|
-
|
|
694
|
-
|
|
647
|
+
}
|
|
648
|
+
// Overwrite existing TrustedTypes policy.
|
|
649
|
+
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
|
|
650
|
+
// Sign local variables required by `sanitize`.
|
|
695
651
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
696
652
|
} else {
|
|
697
653
|
// Uninitialized policy, attempt to initialize the internal dompurify policy.
|
|
698
654
|
if (trustedTypesPolicy === undefined) {
|
|
699
655
|
trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
|
|
700
|
-
}
|
|
701
|
-
|
|
702
|
-
|
|
656
|
+
}
|
|
657
|
+
// If creating the internal policy succeeded sign internal variables.
|
|
703
658
|
if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
|
|
704
659
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
705
660
|
}
|
|
706
|
-
}
|
|
661
|
+
}
|
|
662
|
+
// Prevent further manipulation of configuration.
|
|
707
663
|
// Not available in IE8, Safari 5, etc.
|
|
708
|
-
|
|
709
|
-
|
|
710
664
|
if (freeze) {
|
|
711
665
|
freeze(cfg);
|
|
712
666
|
}
|
|
713
|
-
|
|
714
667
|
CONFIG = cfg;
|
|
715
668
|
};
|
|
716
|
-
|
|
717
|
-
const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
718
|
-
const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
|
|
719
|
-
// namespace. We need to specify them explicitly
|
|
720
|
-
// so that they don't get erroneously deleted from
|
|
721
|
-
// HTML namespace.
|
|
722
|
-
|
|
723
|
-
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
724
669
|
/* Keep track of all possible SVG and MathML tags
|
|
725
670
|
* so that we can perform the namespace checks
|
|
726
671
|
* correctly. */
|
|
727
|
-
|
|
728
|
-
const
|
|
729
|
-
addToSet(ALL_SVG_TAGS, svgFilters);
|
|
730
|
-
addToSet(ALL_SVG_TAGS, svgDisallowed);
|
|
731
|
-
const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
|
|
732
|
-
addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
|
|
672
|
+
const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
|
|
673
|
+
const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
|
|
733
674
|
/**
|
|
734
|
-
*
|
|
735
|
-
*
|
|
736
|
-
* @param {Element} element a DOM element whose namespace is being checked
|
|
737
|
-
* @returns {boolean} Return false if the element has a
|
|
675
|
+
* @param element a DOM element whose namespace is being checked
|
|
676
|
+
* @returns Return false if the element has a
|
|
738
677
|
* namespace that a spec-compliant parser would never
|
|
739
678
|
* return. Return true otherwise.
|
|
740
679
|
*/
|
|
741
|
-
|
|
742
680
|
const _checkValidNamespace = function _checkValidNamespace(element) {
|
|
743
|
-
let parent = getParentNode(element);
|
|
681
|
+
let parent = getParentNode(element);
|
|
682
|
+
// In JSDOM, if we're inside shadow DOM, then parentNode
|
|
744
683
|
// can be null. We just simulate parent in this case.
|
|
745
|
-
|
|
746
684
|
if (!parent || !parent.tagName) {
|
|
747
685
|
parent = {
|
|
748
686
|
namespaceURI: NAMESPACE,
|
|
749
687
|
tagName: 'template'
|
|
750
688
|
};
|
|
751
689
|
}
|
|
752
|
-
|
|
753
690
|
const tagName = stringToLowerCase(element.tagName);
|
|
754
691
|
const parentTagName = stringToLowerCase(parent.tagName);
|
|
755
|
-
|
|
756
692
|
if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
757
693
|
return false;
|
|
758
694
|
}
|
|
759
|
-
|
|
760
695
|
if (element.namespaceURI === SVG_NAMESPACE) {
|
|
761
696
|
// The only way to switch from HTML namespace to SVG
|
|
762
697
|
// is via <svg>. If it happens via any other tag, then
|
|
763
698
|
// it should be killed.
|
|
764
699
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
765
700
|
return tagName === 'svg';
|
|
766
|
-
}
|
|
701
|
+
}
|
|
702
|
+
// The only way to switch from MathML to SVG is via`
|
|
767
703
|
// svg if parent is either <annotation-xml> or MathML
|
|
768
704
|
// text integration points.
|
|
769
|
-
|
|
770
|
-
|
|
771
705
|
if (parent.namespaceURI === MATHML_NAMESPACE) {
|
|
772
706
|
return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
|
|
773
|
-
}
|
|
707
|
+
}
|
|
708
|
+
// We only allow elements that are defined in SVG
|
|
774
709
|
// spec. All others are disallowed in SVG namespace.
|
|
775
|
-
|
|
776
|
-
|
|
777
710
|
return Boolean(ALL_SVG_TAGS[tagName]);
|
|
778
711
|
}
|
|
779
|
-
|
|
780
712
|
if (element.namespaceURI === MATHML_NAMESPACE) {
|
|
781
713
|
// The only way to switch from HTML namespace to MathML
|
|
782
714
|
// is via <math>. If it happens via any other tag, then
|
|
783
715
|
// it should be killed.
|
|
784
716
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
785
717
|
return tagName === 'math';
|
|
786
|
-
}
|
|
718
|
+
}
|
|
719
|
+
// The only way to switch from SVG to MathML is via
|
|
787
720
|
// <math> and HTML integration points
|
|
788
|
-
|
|
789
|
-
|
|
790
721
|
if (parent.namespaceURI === SVG_NAMESPACE) {
|
|
791
722
|
return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
|
|
792
|
-
}
|
|
723
|
+
}
|
|
724
|
+
// We only allow elements that are defined in MathML
|
|
793
725
|
// spec. All others are disallowed in MathML namespace.
|
|
794
|
-
|
|
795
|
-
|
|
796
726
|
return Boolean(ALL_MATHML_TAGS[tagName]);
|
|
797
727
|
}
|
|
798
|
-
|
|
799
728
|
if (element.namespaceURI === HTML_NAMESPACE) {
|
|
800
729
|
// The only way to switch from SVG to HTML is via
|
|
801
730
|
// HTML integration points, and from MathML to HTML
|
|
@@ -803,77 +732,67 @@ function createDOMPurify() {
|
|
|
803
732
|
if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
|
|
804
733
|
return false;
|
|
805
734
|
}
|
|
806
|
-
|
|
807
735
|
if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
|
|
808
736
|
return false;
|
|
809
|
-
}
|
|
737
|
+
}
|
|
738
|
+
// We disallow tags that are specific for MathML
|
|
810
739
|
// or SVG and should never appear in HTML namespace
|
|
811
|
-
|
|
812
|
-
|
|
813
740
|
return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
|
|
814
|
-
}
|
|
815
|
-
|
|
816
|
-
|
|
741
|
+
}
|
|
742
|
+
// For XHTML and XML documents that support custom namespaces
|
|
817
743
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
818
744
|
return true;
|
|
819
|
-
}
|
|
745
|
+
}
|
|
746
|
+
// The code should never reach this place (this means
|
|
820
747
|
// that the element somehow got namespace that is not
|
|
821
748
|
// HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
|
|
822
749
|
// Return false just in case.
|
|
823
|
-
|
|
824
|
-
|
|
825
750
|
return false;
|
|
826
751
|
};
|
|
827
752
|
/**
|
|
828
753
|
* _forceRemove
|
|
829
754
|
*
|
|
830
|
-
* @param
|
|
755
|
+
* @param node a DOM node
|
|
831
756
|
*/
|
|
832
|
-
|
|
833
|
-
|
|
834
757
|
const _forceRemove = function _forceRemove(node) {
|
|
835
758
|
arrayPush(DOMPurify.removed, {
|
|
836
759
|
element: node
|
|
837
760
|
});
|
|
838
|
-
|
|
839
761
|
try {
|
|
840
762
|
// eslint-disable-next-line unicorn/prefer-dom-node-remove
|
|
841
|
-
node.
|
|
763
|
+
getParentNode(node).removeChild(node);
|
|
842
764
|
} catch (_) {
|
|
843
|
-
|
|
765
|
+
remove(node);
|
|
844
766
|
}
|
|
845
767
|
};
|
|
846
768
|
/**
|
|
847
769
|
* _removeAttribute
|
|
848
770
|
*
|
|
849
|
-
* @param
|
|
850
|
-
* @param
|
|
771
|
+
* @param name an Attribute name
|
|
772
|
+
* @param element a DOM node
|
|
851
773
|
*/
|
|
852
|
-
|
|
853
|
-
|
|
854
|
-
const _removeAttribute = function _removeAttribute(name, node) {
|
|
774
|
+
const _removeAttribute = function _removeAttribute(name, element) {
|
|
855
775
|
try {
|
|
856
776
|
arrayPush(DOMPurify.removed, {
|
|
857
|
-
attribute:
|
|
858
|
-
from:
|
|
777
|
+
attribute: element.getAttributeNode(name),
|
|
778
|
+
from: element
|
|
859
779
|
});
|
|
860
780
|
} catch (_) {
|
|
861
781
|
arrayPush(DOMPurify.removed, {
|
|
862
782
|
attribute: null,
|
|
863
|
-
from:
|
|
783
|
+
from: element
|
|
864
784
|
});
|
|
865
785
|
}
|
|
866
|
-
|
|
867
|
-
|
|
868
|
-
|
|
869
|
-
if (name === 'is' && !ALLOWED_ATTR[name]) {
|
|
786
|
+
element.removeAttribute(name);
|
|
787
|
+
// We void attribute values for unremovable "is" attributes
|
|
788
|
+
if (name === 'is') {
|
|
870
789
|
if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
|
|
871
790
|
try {
|
|
872
|
-
_forceRemove(
|
|
791
|
+
_forceRemove(element);
|
|
873
792
|
} catch (_) {}
|
|
874
793
|
} else {
|
|
875
794
|
try {
|
|
876
|
-
|
|
795
|
+
element.setAttribute(name, '');
|
|
877
796
|
} catch (_) {}
|
|
878
797
|
}
|
|
879
798
|
}
|
|
@@ -881,16 +800,13 @@ function createDOMPurify() {
|
|
|
881
800
|
/**
|
|
882
801
|
* _initDocument
|
|
883
802
|
*
|
|
884
|
-
* @param
|
|
885
|
-
* @return
|
|
803
|
+
* @param dirty - a string of dirty markup
|
|
804
|
+
* @return a DOM, filled with the dirty markup
|
|
886
805
|
*/
|
|
887
|
-
|
|
888
|
-
|
|
889
806
|
const _initDocument = function _initDocument(dirty) {
|
|
890
807
|
/* Create a HTML document */
|
|
891
|
-
let doc;
|
|
892
|
-
let leadingWhitespace;
|
|
893
|
-
|
|
808
|
+
let doc = null;
|
|
809
|
+
let leadingWhitespace = null;
|
|
894
810
|
if (FORCE_BODY) {
|
|
895
811
|
dirty = '<remove></remove>' + dirty;
|
|
896
812
|
} else {
|
|
@@ -898,200 +814,157 @@ function createDOMPurify() {
|
|
|
898
814
|
const matches = stringMatch(dirty, /^[\r\n\t ]+/);
|
|
899
815
|
leadingWhitespace = matches && matches[0];
|
|
900
816
|
}
|
|
901
|
-
|
|
902
817
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
|
|
903
818
|
// Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
|
|
904
819
|
dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
|
|
905
820
|
}
|
|
906
|
-
|
|
907
821
|
const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
908
822
|
/*
|
|
909
823
|
* Use the DOMParser API by default, fallback later if needs be
|
|
910
824
|
* DOMParser not work for svg when has multiple root element.
|
|
911
825
|
*/
|
|
912
|
-
|
|
913
826
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
914
827
|
try {
|
|
915
828
|
doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
|
|
916
829
|
} catch (_) {}
|
|
917
830
|
}
|
|
918
831
|
/* Use createHTMLDocument in case DOMParser is not available */
|
|
919
|
-
|
|
920
|
-
|
|
921
832
|
if (!doc || !doc.documentElement) {
|
|
922
833
|
doc = implementation.createDocument(NAMESPACE, 'template', null);
|
|
923
|
-
|
|
924
834
|
try {
|
|
925
835
|
doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
|
|
926
|
-
} catch (_) {
|
|
836
|
+
} catch (_) {
|
|
837
|
+
// Syntax error if dirtyPayload is invalid xml
|
|
927
838
|
}
|
|
928
839
|
}
|
|
929
|
-
|
|
930
840
|
const body = doc.body || doc.documentElement;
|
|
931
|
-
|
|
932
841
|
if (dirty && leadingWhitespace) {
|
|
933
842
|
body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
|
|
934
843
|
}
|
|
935
844
|
/* Work on whole document or just its body */
|
|
936
|
-
|
|
937
|
-
|
|
938
845
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
939
846
|
return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
|
|
940
847
|
}
|
|
941
|
-
|
|
942
848
|
return WHOLE_DOCUMENT ? doc.documentElement : body;
|
|
943
849
|
};
|
|
944
850
|
/**
|
|
945
|
-
*
|
|
851
|
+
* Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
|
|
946
852
|
*
|
|
947
|
-
* @param
|
|
948
|
-
* @return
|
|
853
|
+
* @param root The root element or node to start traversing on.
|
|
854
|
+
* @return The created NodeIterator
|
|
949
855
|
*/
|
|
950
|
-
|
|
951
|
-
|
|
952
|
-
|
|
953
|
-
|
|
954
|
-
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
|
|
856
|
+
const _createNodeIterator = function _createNodeIterator(root) {
|
|
857
|
+
return createNodeIterator.call(root.ownerDocument || root, root,
|
|
858
|
+
// eslint-disable-next-line no-bitwise
|
|
859
|
+
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
|
|
955
860
|
};
|
|
956
861
|
/**
|
|
957
862
|
* _isClobbered
|
|
958
863
|
*
|
|
959
|
-
* @param
|
|
960
|
-
* @return
|
|
864
|
+
* @param element element to check for clobbering attacks
|
|
865
|
+
* @return true if clobbered, false if safe
|
|
961
866
|
*/
|
|
962
|
-
|
|
963
|
-
|
|
964
|
-
const _isClobbered = function _isClobbered(elm) {
|
|
965
|
-
return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
|
|
867
|
+
const _isClobbered = function _isClobbered(element) {
|
|
868
|
+
return element instanceof HTMLFormElement && (typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function');
|
|
966
869
|
};
|
|
967
870
|
/**
|
|
968
|
-
*
|
|
871
|
+
* Checks whether the given object is a DOM node.
|
|
969
872
|
*
|
|
970
|
-
* @param
|
|
971
|
-
* @return
|
|
873
|
+
* @param value object to check whether it's a DOM node
|
|
874
|
+
* @return true is object is a DOM node
|
|
972
875
|
*/
|
|
973
|
-
|
|
974
|
-
|
|
975
|
-
const _isNode = function _isNode(object) {
|
|
976
|
-
return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
|
|
876
|
+
const _isNode = function _isNode(value) {
|
|
877
|
+
return typeof Node === 'function' && value instanceof Node;
|
|
977
878
|
};
|
|
978
|
-
|
|
979
|
-
|
|
980
|
-
* Execute user configurable hooks
|
|
981
|
-
*
|
|
982
|
-
* @param {String} entryPoint Name of the hook's entry point
|
|
983
|
-
* @param {Node} currentNode node to work on with the hook
|
|
984
|
-
* @param {Object} data additional hook parameters
|
|
985
|
-
*/
|
|
986
|
-
|
|
987
|
-
|
|
988
|
-
const _executeHook = function _executeHook(entryPoint, currentNode, data) {
|
|
989
|
-
if (!hooks[entryPoint]) {
|
|
990
|
-
return;
|
|
991
|
-
}
|
|
992
|
-
|
|
993
|
-
arrayForEach(hooks[entryPoint], hook => {
|
|
879
|
+
function _executeHooks(hooks, currentNode, data) {
|
|
880
|
+
arrayForEach(hooks, hook => {
|
|
994
881
|
hook.call(DOMPurify, currentNode, data, CONFIG);
|
|
995
882
|
});
|
|
996
|
-
}
|
|
883
|
+
}
|
|
997
884
|
/**
|
|
998
885
|
* _sanitizeElements
|
|
999
886
|
*
|
|
1000
887
|
* @protect nodeName
|
|
1001
888
|
* @protect textContent
|
|
1002
889
|
* @protect removeChild
|
|
1003
|
-
*
|
|
1004
|
-
* @
|
|
1005
|
-
* @return {Boolean} true if node was killed, false if left alive
|
|
890
|
+
* @param currentNode to check for permission to exist
|
|
891
|
+
* @return true if node was killed, false if left alive
|
|
1006
892
|
*/
|
|
1007
|
-
|
|
1008
|
-
|
|
1009
893
|
const _sanitizeElements = function _sanitizeElements(currentNode) {
|
|
1010
|
-
let content;
|
|
894
|
+
let content = null;
|
|
1011
895
|
/* Execute a hook if present */
|
|
1012
|
-
|
|
1013
|
-
_executeHook('beforeSanitizeElements', currentNode, null);
|
|
896
|
+
_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
|
|
1014
897
|
/* Check if element is clobbered or can clobber */
|
|
1015
|
-
|
|
1016
|
-
|
|
1017
898
|
if (_isClobbered(currentNode)) {
|
|
1018
899
|
_forceRemove(currentNode);
|
|
1019
|
-
|
|
1020
900
|
return true;
|
|
1021
901
|
}
|
|
1022
902
|
/* Now let's check the element's type and name */
|
|
1023
|
-
|
|
1024
|
-
|
|
1025
903
|
const tagName = transformCaseFunc(currentNode.nodeName);
|
|
1026
904
|
/* Execute a hook if present */
|
|
1027
|
-
|
|
1028
|
-
_executeHook('uponSanitizeElement', currentNode, {
|
|
905
|
+
_executeHooks(hooks.uponSanitizeElement, currentNode, {
|
|
1029
906
|
tagName,
|
|
1030
907
|
allowedTags: ALLOWED_TAGS
|
|
1031
908
|
});
|
|
1032
909
|
/* Detect mXSS attempts abusing namespace confusion */
|
|
1033
|
-
|
|
1034
|
-
|
|
1035
|
-
|
|
910
|
+
if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
|
|
911
|
+
_forceRemove(currentNode);
|
|
912
|
+
return true;
|
|
913
|
+
}
|
|
914
|
+
/* Remove any occurrence of processing instructions */
|
|
915
|
+
if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
|
|
916
|
+
_forceRemove(currentNode);
|
|
917
|
+
return true;
|
|
918
|
+
}
|
|
919
|
+
/* Remove any kind of possibly harmful comments */
|
|
920
|
+
if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
|
|
1036
921
|
_forceRemove(currentNode);
|
|
1037
|
-
|
|
1038
922
|
return true;
|
|
1039
923
|
}
|
|
1040
924
|
/* Remove element if anything forbids its presence */
|
|
1041
|
-
|
|
1042
|
-
|
|
1043
925
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
1044
926
|
/* Check if we have a custom element to handle */
|
|
1045
|
-
if (!FORBID_TAGS[tagName] &&
|
|
1046
|
-
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName))
|
|
1047
|
-
|
|
927
|
+
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
|
|
928
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
|
|
929
|
+
return false;
|
|
930
|
+
}
|
|
931
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
|
|
932
|
+
return false;
|
|
933
|
+
}
|
|
1048
934
|
}
|
|
1049
935
|
/* Keep content except for bad-listed elements */
|
|
1050
|
-
|
|
1051
|
-
|
|
1052
936
|
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
|
|
1053
937
|
const parentNode = getParentNode(currentNode) || currentNode.parentNode;
|
|
1054
938
|
const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
|
|
1055
|
-
|
|
1056
939
|
if (childNodes && parentNode) {
|
|
1057
940
|
const childCount = childNodes.length;
|
|
1058
|
-
|
|
1059
941
|
for (let i = childCount - 1; i >= 0; --i) {
|
|
1060
|
-
|
|
942
|
+
const childClone = cloneNode(childNodes[i], true);
|
|
943
|
+
childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
|
|
944
|
+
parentNode.insertBefore(childClone, getNextSibling(currentNode));
|
|
1061
945
|
}
|
|
1062
946
|
}
|
|
1063
947
|
}
|
|
1064
|
-
|
|
1065
948
|
_forceRemove(currentNode);
|
|
1066
|
-
|
|
1067
949
|
return true;
|
|
1068
950
|
}
|
|
1069
951
|
/* Check whether element has a valid namespace */
|
|
1070
|
-
|
|
1071
|
-
|
|
1072
952
|
if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
|
|
1073
953
|
_forceRemove(currentNode);
|
|
1074
|
-
|
|
1075
954
|
return true;
|
|
1076
955
|
}
|
|
1077
|
-
/* Make sure that older browsers don't get
|
|
1078
|
-
|
|
1079
|
-
|
|
1080
|
-
if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
|
|
956
|
+
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
957
|
+
if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
1081
958
|
_forceRemove(currentNode);
|
|
1082
|
-
|
|
1083
959
|
return true;
|
|
1084
960
|
}
|
|
1085
961
|
/* Sanitize element content to be template-safe */
|
|
1086
|
-
|
|
1087
|
-
|
|
1088
|
-
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
|
|
962
|
+
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
|
|
1089
963
|
/* Get the element's text content */
|
|
1090
964
|
content = currentNode.textContent;
|
|
1091
|
-
|
|
1092
|
-
|
|
1093
|
-
|
|
1094
|
-
|
|
965
|
+
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
|
|
966
|
+
content = stringReplace(content, expr, ' ');
|
|
967
|
+
});
|
|
1095
968
|
if (currentNode.textContent !== content) {
|
|
1096
969
|
arrayPush(DOMPurify.removed, {
|
|
1097
970
|
element: currentNode.cloneNode()
|
|
@@ -1100,23 +973,18 @@ function createDOMPurify() {
|
|
|
1100
973
|
}
|
|
1101
974
|
}
|
|
1102
975
|
/* Execute a hook if present */
|
|
1103
|
-
|
|
1104
|
-
|
|
1105
|
-
_executeHook('afterSanitizeElements', currentNode, null);
|
|
1106
|
-
|
|
976
|
+
_executeHooks(hooks.afterSanitizeElements, currentNode, null);
|
|
1107
977
|
return false;
|
|
1108
978
|
};
|
|
1109
979
|
/**
|
|
1110
980
|
* _isValidAttribute
|
|
1111
981
|
*
|
|
1112
|
-
* @param
|
|
1113
|
-
* @param
|
|
1114
|
-
* @param
|
|
1115
|
-
* @return
|
|
982
|
+
* @param lcTag Lowercase tag name of containing element.
|
|
983
|
+
* @param lcName Lowercase attribute name.
|
|
984
|
+
* @param value Attribute value.
|
|
985
|
+
* @return Returns true if `value` is valid, otherwise false.
|
|
1116
986
|
*/
|
|
1117
987
|
// eslint-disable-next-line complexity
|
|
1118
|
-
|
|
1119
|
-
|
|
1120
988
|
const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
|
|
1121
989
|
/* Make sure attribute cannot clobber */
|
|
1122
990
|
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
|
|
@@ -1126,35 +994,33 @@ function createDOMPurify() {
|
|
|
1126
994
|
(https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
|
|
1127
995
|
XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
|
|
1128
996
|
We don't need to check the value; it's always URI safe. */
|
|
1129
|
-
|
|
1130
|
-
|
|
1131
997
|
if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
|
|
1132
|
-
if (
|
|
998
|
+
if (
|
|
999
|
+
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
1133
1000
|
// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
1134
1001
|
// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
|
|
1135
|
-
|
|
1002
|
+
_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
|
|
1003
|
+
// Alternative, second condition checks if it's an `is`-attribute, AND
|
|
1136
1004
|
// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
1137
1005
|
lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
|
|
1138
1006
|
return false;
|
|
1139
1007
|
}
|
|
1140
1008
|
/* Check value is safe. First, is attr inert? If so, is safe */
|
|
1141
|
-
|
|
1142
1009
|
} else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
|
|
1143
1010
|
return false;
|
|
1144
1011
|
} else ;
|
|
1145
|
-
|
|
1146
1012
|
return true;
|
|
1147
1013
|
};
|
|
1148
1014
|
/**
|
|
1149
|
-
*
|
|
1015
|
+
* _isBasicCustomElement
|
|
1150
1016
|
* checks if at least one dash is included in tagName, and it's not the first char
|
|
1151
1017
|
* for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
|
|
1152
|
-
*
|
|
1018
|
+
*
|
|
1019
|
+
* @param tagName name of the tag of the node to sanitize
|
|
1020
|
+
* @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
|
|
1153
1021
|
*/
|
|
1154
|
-
|
|
1155
|
-
|
|
1156
|
-
const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
|
|
1157
|
-
return tagName.indexOf('-') > 0;
|
|
1022
|
+
const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
|
|
1023
|
+
return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
|
|
1158
1024
|
};
|
|
1159
1025
|
/**
|
|
1160
1026
|
* _sanitizeAttributes
|
|
@@ -1164,109 +1030,85 @@ function createDOMPurify() {
|
|
|
1164
1030
|
* @protect removeAttribute
|
|
1165
1031
|
* @protect setAttribute
|
|
1166
1032
|
*
|
|
1167
|
-
* @param
|
|
1033
|
+
* @param currentNode to sanitize
|
|
1168
1034
|
*/
|
|
1169
|
-
|
|
1170
|
-
|
|
1171
1035
|
const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
|
|
1172
|
-
let attr;
|
|
1173
|
-
let value;
|
|
1174
|
-
let lcName;
|
|
1175
|
-
let l;
|
|
1176
1036
|
/* Execute a hook if present */
|
|
1177
|
-
|
|
1178
|
-
_executeHook('beforeSanitizeAttributes', currentNode, null);
|
|
1179
|
-
|
|
1037
|
+
_executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
|
|
1180
1038
|
const {
|
|
1181
1039
|
attributes
|
|
1182
1040
|
} = currentNode;
|
|
1183
1041
|
/* Check if we have attributes; if not we might have a text node */
|
|
1184
|
-
|
|
1185
|
-
if (!attributes) {
|
|
1042
|
+
if (!attributes || _isClobbered(currentNode)) {
|
|
1186
1043
|
return;
|
|
1187
1044
|
}
|
|
1188
|
-
|
|
1189
1045
|
const hookEvent = {
|
|
1190
1046
|
attrName: '',
|
|
1191
1047
|
attrValue: '',
|
|
1192
1048
|
keepAttr: true,
|
|
1193
|
-
allowedAttributes: ALLOWED_ATTR
|
|
1049
|
+
allowedAttributes: ALLOWED_ATTR,
|
|
1050
|
+
forceKeepAttr: undefined
|
|
1194
1051
|
};
|
|
1195
|
-
l = attributes.length;
|
|
1052
|
+
let l = attributes.length;
|
|
1196
1053
|
/* Go backwards over all attributes; safely remove bad ones */
|
|
1197
|
-
|
|
1198
1054
|
while (l--) {
|
|
1199
|
-
attr = attributes[l];
|
|
1055
|
+
const attr = attributes[l];
|
|
1200
1056
|
const {
|
|
1201
1057
|
name,
|
|
1202
|
-
namespaceURI
|
|
1058
|
+
namespaceURI,
|
|
1059
|
+
value: attrValue
|
|
1203
1060
|
} = attr;
|
|
1204
|
-
|
|
1205
|
-
|
|
1061
|
+
const lcName = transformCaseFunc(name);
|
|
1062
|
+
const initValue = attrValue;
|
|
1063
|
+
let value = name === 'value' ? initValue : stringTrim(initValue);
|
|
1206
1064
|
/* Execute a hook if present */
|
|
1207
|
-
|
|
1208
1065
|
hookEvent.attrName = lcName;
|
|
1209
1066
|
hookEvent.attrValue = value;
|
|
1210
1067
|
hookEvent.keepAttr = true;
|
|
1211
1068
|
hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
|
|
1212
|
-
|
|
1213
|
-
_executeHook('uponSanitizeAttribute', currentNode, hookEvent);
|
|
1214
|
-
|
|
1069
|
+
_executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
|
|
1215
1070
|
value = hookEvent.attrValue;
|
|
1071
|
+
/* Full DOM Clobbering protection via namespace isolation,
|
|
1072
|
+
* Prefix id and name attributes with `user-content-`
|
|
1073
|
+
*/
|
|
1074
|
+
if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
|
|
1075
|
+
// Remove the attribute with this value
|
|
1076
|
+
_removeAttribute(name, currentNode);
|
|
1077
|
+
// Prefix the value and later re-create the attribute with the sanitized value
|
|
1078
|
+
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
1079
|
+
}
|
|
1080
|
+
/* Work around a security issue with comments inside attributes */
|
|
1081
|
+
if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
|
|
1082
|
+
_removeAttribute(name, currentNode);
|
|
1083
|
+
continue;
|
|
1084
|
+
}
|
|
1216
1085
|
/* Did the hooks approve of the attribute? */
|
|
1217
|
-
|
|
1218
1086
|
if (hookEvent.forceKeepAttr) {
|
|
1219
1087
|
continue;
|
|
1220
1088
|
}
|
|
1221
|
-
/* Remove attribute */
|
|
1222
|
-
|
|
1223
|
-
|
|
1224
|
-
_removeAttribute(name, currentNode);
|
|
1225
1089
|
/* Did the hooks approve of the attribute? */
|
|
1226
|
-
|
|
1227
|
-
|
|
1228
1090
|
if (!hookEvent.keepAttr) {
|
|
1091
|
+
_removeAttribute(name, currentNode);
|
|
1229
1092
|
continue;
|
|
1230
1093
|
}
|
|
1231
1094
|
/* Work around a security issue in jQuery 3.0 */
|
|
1232
|
-
|
|
1233
|
-
|
|
1234
1095
|
if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
|
|
1235
1096
|
_removeAttribute(name, currentNode);
|
|
1236
|
-
|
|
1237
1097
|
continue;
|
|
1238
1098
|
}
|
|
1239
1099
|
/* Sanitize attribute content to be template-safe */
|
|
1240
|
-
|
|
1241
|
-
|
|
1242
1100
|
if (SAFE_FOR_TEMPLATES) {
|
|
1243
|
-
|
|
1244
|
-
|
|
1245
|
-
|
|
1101
|
+
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
|
|
1102
|
+
value = stringReplace(value, expr, ' ');
|
|
1103
|
+
});
|
|
1246
1104
|
}
|
|
1247
1105
|
/* Is `value` valid for this attribute? */
|
|
1248
|
-
|
|
1249
|
-
|
|
1250
1106
|
const lcTag = transformCaseFunc(currentNode.nodeName);
|
|
1251
|
-
|
|
1252
1107
|
if (!_isValidAttribute(lcTag, lcName, value)) {
|
|
1108
|
+
_removeAttribute(name, currentNode);
|
|
1253
1109
|
continue;
|
|
1254
1110
|
}
|
|
1255
|
-
/* Full DOM Clobbering protection via namespace isolation,
|
|
1256
|
-
* Prefix id and name attributes with `user-content-`
|
|
1257
|
-
*/
|
|
1258
|
-
|
|
1259
|
-
|
|
1260
|
-
if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
|
|
1261
|
-
// Remove the attribute with this value
|
|
1262
|
-
_removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
|
|
1263
|
-
|
|
1264
|
-
|
|
1265
|
-
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
1266
|
-
}
|
|
1267
1111
|
/* Handle attributes that require Trusted Types */
|
|
1268
|
-
|
|
1269
|
-
|
|
1270
1112
|
if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
|
|
1271
1113
|
if (namespaceURI) ; else {
|
|
1272
1114
|
switch (trustedTypes.getAttributeType(lcTag, lcName)) {
|
|
@@ -1275,7 +1117,6 @@ function createDOMPurify() {
|
|
|
1275
1117
|
value = trustedTypesPolicy.createHTML(value);
|
|
1276
1118
|
break;
|
|
1277
1119
|
}
|
|
1278
|
-
|
|
1279
1120
|
case 'TrustedScriptURL':
|
|
1280
1121
|
{
|
|
1281
1122
|
value = trustedTypesPolicy.createScriptURL(value);
|
|
@@ -1285,97 +1126,70 @@ function createDOMPurify() {
|
|
|
1285
1126
|
}
|
|
1286
1127
|
}
|
|
1287
1128
|
/* Handle invalid data-* attribute set by try-catching it */
|
|
1288
|
-
|
|
1289
|
-
|
|
1290
|
-
|
|
1291
|
-
|
|
1292
|
-
|
|
1293
|
-
|
|
1294
|
-
|
|
1295
|
-
|
|
1129
|
+
if (value !== initValue) {
|
|
1130
|
+
try {
|
|
1131
|
+
if (namespaceURI) {
|
|
1132
|
+
currentNode.setAttributeNS(namespaceURI, name, value);
|
|
1133
|
+
} else {
|
|
1134
|
+
/* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
|
|
1135
|
+
currentNode.setAttribute(name, value);
|
|
1136
|
+
}
|
|
1137
|
+
if (_isClobbered(currentNode)) {
|
|
1138
|
+
_forceRemove(currentNode);
|
|
1139
|
+
} else {
|
|
1140
|
+
arrayPop(DOMPurify.removed);
|
|
1141
|
+
}
|
|
1142
|
+
} catch (_) {
|
|
1143
|
+
_removeAttribute(name, currentNode);
|
|
1296
1144
|
}
|
|
1297
|
-
|
|
1298
|
-
arrayPop(DOMPurify.removed);
|
|
1299
|
-
} catch (_) {}
|
|
1145
|
+
}
|
|
1300
1146
|
}
|
|
1301
1147
|
/* Execute a hook if present */
|
|
1302
|
-
|
|
1303
|
-
|
|
1304
|
-
_executeHook('afterSanitizeAttributes', currentNode, null);
|
|
1148
|
+
_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
|
|
1305
1149
|
};
|
|
1306
1150
|
/**
|
|
1307
1151
|
* _sanitizeShadowDOM
|
|
1308
1152
|
*
|
|
1309
|
-
* @param
|
|
1153
|
+
* @param fragment to iterate over recursively
|
|
1310
1154
|
*/
|
|
1311
|
-
|
|
1312
|
-
|
|
1313
1155
|
const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
|
|
1314
|
-
let shadowNode;
|
|
1315
|
-
|
|
1316
|
-
const shadowIterator = _createIterator(fragment);
|
|
1156
|
+
let shadowNode = null;
|
|
1157
|
+
const shadowIterator = _createNodeIterator(fragment);
|
|
1317
1158
|
/* Execute a hook if present */
|
|
1318
|
-
|
|
1319
|
-
|
|
1320
|
-
_executeHook('beforeSanitizeShadowDOM', fragment, null);
|
|
1321
|
-
|
|
1159
|
+
_executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
|
|
1322
1160
|
while (shadowNode = shadowIterator.nextNode()) {
|
|
1323
1161
|
/* Execute a hook if present */
|
|
1324
|
-
|
|
1162
|
+
_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
|
|
1325
1163
|
/* Sanitize tags and elements */
|
|
1326
|
-
|
|
1327
|
-
|
|
1328
|
-
|
|
1329
|
-
continue;
|
|
1330
|
-
}
|
|
1164
|
+
_sanitizeElements(shadowNode);
|
|
1165
|
+
/* Check attributes next */
|
|
1166
|
+
_sanitizeAttributes(shadowNode);
|
|
1331
1167
|
/* Deep shadow DOM detected */
|
|
1332
|
-
|
|
1333
|
-
|
|
1334
1168
|
if (shadowNode.content instanceof DocumentFragment) {
|
|
1335
1169
|
_sanitizeShadowDOM(shadowNode.content);
|
|
1336
1170
|
}
|
|
1337
|
-
/* Check attributes, sanitize if necessary */
|
|
1338
|
-
|
|
1339
|
-
|
|
1340
|
-
_sanitizeAttributes(shadowNode);
|
|
1341
1171
|
}
|
|
1342
1172
|
/* Execute a hook if present */
|
|
1343
|
-
|
|
1344
|
-
|
|
1345
|
-
_executeHook('afterSanitizeShadowDOM', fragment, null);
|
|
1173
|
+
_executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
|
|
1346
1174
|
};
|
|
1347
|
-
/**
|
|
1348
|
-
* Sanitize
|
|
1349
|
-
* Public method providing core sanitation functionality
|
|
1350
|
-
*
|
|
1351
|
-
* @param {String|Node} dirty string or DOM node
|
|
1352
|
-
* @param {Object} configuration object
|
|
1353
|
-
*/
|
|
1354
1175
|
// eslint-disable-next-line complexity
|
|
1355
|
-
|
|
1356
|
-
|
|
1357
1176
|
DOMPurify.sanitize = function (dirty) {
|
|
1358
1177
|
let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
|
|
1359
|
-
let body;
|
|
1360
|
-
let importedNode;
|
|
1361
|
-
let currentNode;
|
|
1362
|
-
let returnNode;
|
|
1178
|
+
let body = null;
|
|
1179
|
+
let importedNode = null;
|
|
1180
|
+
let currentNode = null;
|
|
1181
|
+
let returnNode = null;
|
|
1363
1182
|
/* Make sure we have a string to sanitize.
|
|
1364
1183
|
DO NOT return early, as this will return the wrong type if
|
|
1365
1184
|
the user has requested a DOM object rather than a string */
|
|
1366
|
-
|
|
1367
1185
|
IS_EMPTY_INPUT = !dirty;
|
|
1368
|
-
|
|
1369
1186
|
if (IS_EMPTY_INPUT) {
|
|
1370
1187
|
dirty = '<!-->';
|
|
1371
1188
|
}
|
|
1372
1189
|
/* Stringify, in case dirty is an object */
|
|
1373
|
-
|
|
1374
|
-
|
|
1375
1190
|
if (typeof dirty !== 'string' && !_isNode(dirty)) {
|
|
1376
1191
|
if (typeof dirty.toString === 'function') {
|
|
1377
1192
|
dirty = dirty.toString();
|
|
1378
|
-
|
|
1379
1193
|
if (typeof dirty !== 'string') {
|
|
1380
1194
|
throw typeErrorCreate('dirty is not a string, aborting');
|
|
1381
1195
|
}
|
|
@@ -1384,32 +1198,23 @@ function createDOMPurify() {
|
|
|
1384
1198
|
}
|
|
1385
1199
|
}
|
|
1386
1200
|
/* Return dirty HTML if DOMPurify cannot run */
|
|
1387
|
-
|
|
1388
|
-
|
|
1389
1201
|
if (!DOMPurify.isSupported) {
|
|
1390
1202
|
return dirty;
|
|
1391
1203
|
}
|
|
1392
1204
|
/* Assign config vars */
|
|
1393
|
-
|
|
1394
|
-
|
|
1395
1205
|
if (!SET_CONFIG) {
|
|
1396
1206
|
_parseConfig(cfg);
|
|
1397
1207
|
}
|
|
1398
1208
|
/* Clean up removed elements */
|
|
1399
|
-
|
|
1400
|
-
|
|
1401
1209
|
DOMPurify.removed = [];
|
|
1402
1210
|
/* Check if dirty is correctly typed for IN_PLACE */
|
|
1403
|
-
|
|
1404
1211
|
if (typeof dirty === 'string') {
|
|
1405
1212
|
IN_PLACE = false;
|
|
1406
1213
|
}
|
|
1407
|
-
|
|
1408
1214
|
if (IN_PLACE) {
|
|
1409
1215
|
/* Do some early pre-sanitization to avoid unsafe root nodes */
|
|
1410
1216
|
if (dirty.nodeName) {
|
|
1411
1217
|
const tagName = transformCaseFunc(dirty.nodeName);
|
|
1412
|
-
|
|
1413
1218
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
1414
1219
|
throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
|
|
1415
1220
|
}
|
|
@@ -1419,8 +1224,7 @@ function createDOMPurify() {
|
|
|
1419
1224
|
elements being stripped by the parser */
|
|
1420
1225
|
body = _initDocument('<!---->');
|
|
1421
1226
|
importedNode = body.ownerDocument.importNode(dirty, true);
|
|
1422
|
-
|
|
1423
|
-
if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
|
|
1227
|
+
if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
|
|
1424
1228
|
/* Node is already a body, use as is */
|
|
1425
1229
|
body = importedNode;
|
|
1426
1230
|
} else if (importedNode.nodeName === 'HTML') {
|
|
@@ -1431,62 +1235,43 @@ function createDOMPurify() {
|
|
|
1431
1235
|
}
|
|
1432
1236
|
} else {
|
|
1433
1237
|
/* Exit directly if we have nothing to do */
|
|
1434
|
-
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
|
|
1238
|
+
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
|
|
1239
|
+
// eslint-disable-next-line unicorn/prefer-includes
|
|
1435
1240
|
dirty.indexOf('<') === -1) {
|
|
1436
1241
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
1437
1242
|
}
|
|
1438
1243
|
/* Initialize the document to work on */
|
|
1439
|
-
|
|
1440
|
-
|
|
1441
1244
|
body = _initDocument(dirty);
|
|
1442
1245
|
/* Check we have a DOM node from the data */
|
|
1443
|
-
|
|
1444
1246
|
if (!body) {
|
|
1445
1247
|
return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
|
|
1446
1248
|
}
|
|
1447
1249
|
}
|
|
1448
1250
|
/* Remove first element node (ours) if FORCE_BODY is set */
|
|
1449
|
-
|
|
1450
|
-
|
|
1451
1251
|
if (body && FORCE_BODY) {
|
|
1452
1252
|
_forceRemove(body.firstChild);
|
|
1453
1253
|
}
|
|
1454
1254
|
/* Get node iterator */
|
|
1455
|
-
|
|
1456
|
-
|
|
1457
|
-
const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
|
|
1255
|
+
const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
|
|
1458
1256
|
/* Now start iterating over the created document */
|
|
1459
|
-
|
|
1460
|
-
|
|
1461
1257
|
while (currentNode = nodeIterator.nextNode()) {
|
|
1462
1258
|
/* Sanitize tags and elements */
|
|
1463
|
-
|
|
1464
|
-
|
|
1465
|
-
|
|
1259
|
+
_sanitizeElements(currentNode);
|
|
1260
|
+
/* Check attributes next */
|
|
1261
|
+
_sanitizeAttributes(currentNode);
|
|
1466
1262
|
/* Shadow DOM detected, sanitize it */
|
|
1467
|
-
|
|
1468
|
-
|
|
1469
1263
|
if (currentNode.content instanceof DocumentFragment) {
|
|
1470
1264
|
_sanitizeShadowDOM(currentNode.content);
|
|
1471
1265
|
}
|
|
1472
|
-
/* Check attributes, sanitize if necessary */
|
|
1473
|
-
|
|
1474
|
-
|
|
1475
|
-
_sanitizeAttributes(currentNode);
|
|
1476
1266
|
}
|
|
1477
1267
|
/* If we sanitized `dirty` in-place, return it. */
|
|
1478
|
-
|
|
1479
|
-
|
|
1480
1268
|
if (IN_PLACE) {
|
|
1481
1269
|
return dirty;
|
|
1482
1270
|
}
|
|
1483
1271
|
/* Return sanitized string or DOM */
|
|
1484
|
-
|
|
1485
|
-
|
|
1486
1272
|
if (RETURN_DOM) {
|
|
1487
1273
|
if (RETURN_DOM_FRAGMENT) {
|
|
1488
1274
|
returnNode = createDocumentFragment.call(body.ownerDocument);
|
|
1489
|
-
|
|
1490
1275
|
while (body.firstChild) {
|
|
1491
1276
|
// eslint-disable-next-line unicorn/prefer-dom-node-append
|
|
1492
1277
|
returnNode.appendChild(body.firstChild);
|
|
@@ -1494,8 +1279,7 @@ function createDOMPurify() {
|
|
|
1494
1279
|
} else {
|
|
1495
1280
|
returnNode = body;
|
|
1496
1281
|
}
|
|
1497
|
-
|
|
1498
|
-
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {
|
|
1282
|
+
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
1499
1283
|
/*
|
|
1500
1284
|
AdoptNode() is not used because internal state is not reset
|
|
1501
1285
|
(e.g. the past names map of a HTMLFormElement), this is safe
|
|
@@ -1505,132 +1289,60 @@ function createDOMPurify() {
|
|
|
1505
1289
|
*/
|
|
1506
1290
|
returnNode = importNode.call(originalDocument, returnNode, true);
|
|
1507
1291
|
}
|
|
1508
|
-
|
|
1509
1292
|
return returnNode;
|
|
1510
1293
|
}
|
|
1511
|
-
|
|
1512
1294
|
let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
|
1513
1295
|
/* Serialize doctype if allowed */
|
|
1514
|
-
|
|
1515
1296
|
if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
|
|
1516
1297
|
serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
|
|
1517
1298
|
}
|
|
1518
1299
|
/* Sanitize final string template-safe */
|
|
1519
|
-
|
|
1520
|
-
|
|
1521
1300
|
if (SAFE_FOR_TEMPLATES) {
|
|
1522
|
-
|
|
1523
|
-
|
|
1524
|
-
|
|
1301
|
+
arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
|
|
1302
|
+
serializedHTML = stringReplace(serializedHTML, expr, ' ');
|
|
1303
|
+
});
|
|
1525
1304
|
}
|
|
1526
|
-
|
|
1527
1305
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
|
|
1528
1306
|
};
|
|
1529
|
-
|
|
1530
|
-
|
|
1531
|
-
* setConfig
|
|
1532
|
-
*
|
|
1533
|
-
* @param {Object} cfg configuration object
|
|
1534
|
-
*/
|
|
1535
|
-
|
|
1536
|
-
|
|
1537
|
-
DOMPurify.setConfig = function (cfg) {
|
|
1307
|
+
DOMPurify.setConfig = function () {
|
|
1308
|
+
let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
1538
1309
|
_parseConfig(cfg);
|
|
1539
|
-
|
|
1540
1310
|
SET_CONFIG = true;
|
|
1541
1311
|
};
|
|
1542
|
-
/**
|
|
1543
|
-
* Public method to remove the configuration
|
|
1544
|
-
* clearConfig
|
|
1545
|
-
*
|
|
1546
|
-
*/
|
|
1547
|
-
|
|
1548
|
-
|
|
1549
1312
|
DOMPurify.clearConfig = function () {
|
|
1550
1313
|
CONFIG = null;
|
|
1551
1314
|
SET_CONFIG = false;
|
|
1552
1315
|
};
|
|
1553
|
-
/**
|
|
1554
|
-
* Public method to check if an attribute value is valid.
|
|
1555
|
-
* Uses last set config, if any. Otherwise, uses config defaults.
|
|
1556
|
-
* isValidAttribute
|
|
1557
|
-
*
|
|
1558
|
-
* @param {string} tag Tag name of containing element.
|
|
1559
|
-
* @param {string} attr Attribute name.
|
|
1560
|
-
* @param {string} value Attribute value.
|
|
1561
|
-
* @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
|
|
1562
|
-
*/
|
|
1563
|
-
|
|
1564
|
-
|
|
1565
1316
|
DOMPurify.isValidAttribute = function (tag, attr, value) {
|
|
1566
1317
|
/* Initialize shared config vars if necessary. */
|
|
1567
1318
|
if (!CONFIG) {
|
|
1568
1319
|
_parseConfig({});
|
|
1569
1320
|
}
|
|
1570
|
-
|
|
1571
1321
|
const lcTag = transformCaseFunc(tag);
|
|
1572
1322
|
const lcName = transformCaseFunc(attr);
|
|
1573
1323
|
return _isValidAttribute(lcTag, lcName, value);
|
|
1574
1324
|
};
|
|
1575
|
-
/**
|
|
1576
|
-
* AddHook
|
|
1577
|
-
* Public method to add DOMPurify hooks
|
|
1578
|
-
*
|
|
1579
|
-
* @param {String} entryPoint entry point for the hook to add
|
|
1580
|
-
* @param {Function} hookFunction function to execute
|
|
1581
|
-
*/
|
|
1582
|
-
|
|
1583
|
-
|
|
1584
1325
|
DOMPurify.addHook = function (entryPoint, hookFunction) {
|
|
1585
1326
|
if (typeof hookFunction !== 'function') {
|
|
1586
1327
|
return;
|
|
1587
1328
|
}
|
|
1588
|
-
|
|
1589
|
-
hooks[entryPoint] = hooks[entryPoint] || [];
|
|
1590
1329
|
arrayPush(hooks[entryPoint], hookFunction);
|
|
1591
1330
|
};
|
|
1592
|
-
|
|
1593
|
-
|
|
1594
|
-
|
|
1595
|
-
|
|
1596
|
-
*
|
|
1597
|
-
* @param {String} entryPoint entry point for the hook to remove
|
|
1598
|
-
* @return {Function} removed(popped) hook
|
|
1599
|
-
*/
|
|
1600
|
-
|
|
1601
|
-
|
|
1602
|
-
DOMPurify.removeHook = function (entryPoint) {
|
|
1603
|
-
if (hooks[entryPoint]) {
|
|
1604
|
-
return arrayPop(hooks[entryPoint]);
|
|
1331
|
+
DOMPurify.removeHook = function (entryPoint, hookFunction) {
|
|
1332
|
+
if (hookFunction !== undefined) {
|
|
1333
|
+
const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
|
|
1334
|
+
return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
|
|
1605
1335
|
}
|
|
1336
|
+
return arrayPop(hooks[entryPoint]);
|
|
1606
1337
|
};
|
|
1607
|
-
/**
|
|
1608
|
-
* RemoveHooks
|
|
1609
|
-
* Public method to remove all DOMPurify hooks at a given entryPoint
|
|
1610
|
-
*
|
|
1611
|
-
* @param {String} entryPoint entry point for the hooks to remove
|
|
1612
|
-
*/
|
|
1613
|
-
|
|
1614
|
-
|
|
1615
1338
|
DOMPurify.removeHooks = function (entryPoint) {
|
|
1616
|
-
|
|
1617
|
-
hooks[entryPoint] = [];
|
|
1618
|
-
}
|
|
1339
|
+
hooks[entryPoint] = [];
|
|
1619
1340
|
};
|
|
1620
|
-
/**
|
|
1621
|
-
* RemoveAllHooks
|
|
1622
|
-
* Public method to remove all DOMPurify hooks
|
|
1623
|
-
*
|
|
1624
|
-
*/
|
|
1625
|
-
|
|
1626
|
-
|
|
1627
1341
|
DOMPurify.removeAllHooks = function () {
|
|
1628
|
-
hooks =
|
|
1342
|
+
hooks = _createHooksMap();
|
|
1629
1343
|
};
|
|
1630
|
-
|
|
1631
1344
|
return DOMPurify;
|
|
1632
1345
|
}
|
|
1633
|
-
|
|
1634
1346
|
var purify = createDOMPurify();
|
|
1635
1347
|
|
|
1636
1348
|
var _path$2, _path2$1;
|
|
@@ -1646,7 +1358,7 @@ var SvgInternalServerError = function SvgInternalServerError(props) {
|
|
|
1646
1358
|
})), _path2$1 || (_path2$1 = /*#__PURE__*/React.createElement("path", {
|
|
1647
1359
|
fill: "#000",
|
|
1648
1360
|
fillRule: "evenodd",
|
|
1649
|
-
d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.
|
|
1361
|
+
d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.915m9.19-32.132-.107.159h-.313l5.399-48.437h54.54V2.043H8.976L2.403 63.94h6.025c.94-1.643 2.035-3.208 3.287-4.538 6.338-7.904 15.806-12.364 26.448-12.364 18.076 0 31.77 13.85 31.77 31.926v.157c0 18.388-13.85 31.926-32.552 31.926-15.963 0-28.874-10.251-30.674-23.163l-.078-.547H.447l.078.704c1.878 16.041 17.293 28.561 36.778 28.561 22.379 0 38.812-15.885 38.812-37.638v-.156c0-21.284-15.963-37.247-37.247-37.247-12.213 0-23.498 5.49-29.55 14.395m87.03 45.232C89.42 91.053 85.656 76.469 85.656 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C103.286 5.645 113.384 0 125.963 0c12.58 0 22.697 5.685 29.654 15.844 6.947 10.143 10.732 24.727 10.732 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.076 15.725-29.654 15.725-12.58 0-22.678-5.665-29.615-15.814m54.063-4.51c5.736-9 8.878-22.023 8.878-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.736 9.01-8.878 22.033-8.878 38.03v.235c0 16.036 3.142 29.059 8.878 38.059 5.724 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.448-13.968m36.162 4.51c-6.927-10.134-10.692-24.718-10.692-42.569v-.235c0-17.89 3.765-32.474 10.692-42.598C193.511 5.645 203.609 0 216.188 0c12.581 0 22.698 5.685 29.655 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.075 15.725-29.654 15.725s-22.677-5.665-29.615-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.449-13.968m-114.674 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C86.055 22.701 101.08.4 125.963.4c24.883 0 39.986 22.458 39.986 57.983v.235c0 35.839-15.103 57.983-39.986 57.983m0-5.555c21.127 0 33.726-20.267 33.726-52.428v-.235c0-32.317-12.599-52.427-33.726-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428m50.318-52.428c0 35.604 15.024 57.983 39.907 57.983 24.884 0 39.986-22.144 39.986-57.983v-.235C256.174 22.858 241.072.4 216.188.4s-39.907 22.301-39.907 57.983zm73.633 0c0 32.16-12.598 52.428-33.726 52.428-21.127 0-33.725-20.267-33.725-52.428v-.235c0-32.082 12.598-52.427 33.725-52.427s33.726 20.11 33.726 52.427z",
|
|
1650
1362
|
clipRule: "evenodd"
|
|
1651
1363
|
})));
|
|
1652
1364
|
};
|
|
@@ -1662,7 +1374,7 @@ var SvgPageNotFound = function SvgPageNotFound(props) {
|
|
|
1662
1374
|
fill: "#000",
|
|
1663
1375
|
stroke: "#000",
|
|
1664
1376
|
strokeWidth: 0.4,
|
|
1665
|
-
d: "M58.94 115.558v.2h6.503V87.
|
|
1377
|
+
d: "M58.94 115.558v.2h6.503V87.51h17.92v-6.034h-17.92V2.443H56.22l-.06.085L.836 81.483l-.036.051v5.976h58.14zm179.355 0v.2h6.503V87.51h17.92v-6.034h-17.92V2.443h-9.224l-.06.085-55.323 78.955-.036.051v5.976h58.14zM58.94 9.182v72.294H8.005L58.93 9.182zm32.32 50.036c0 17.826 3.76 32.366 10.657 42.456 6.902 10.097 16.94 15.727 29.451 15.727s22.567-5.57 29.489-15.639c6.916-10.06 10.696-24.6 10.696-42.544v-.235c0-17.787-3.78-32.327-10.696-42.426C153.935 6.45 143.879.8 131.368.8s-22.548 5.61-29.451 15.698c-6.896 10.08-10.657 24.62-10.657 42.485zm73.633 0c0 16.058-3.145 29.123-8.908 38.167-5.758 9.035-14.129 14.06-24.617 14.06s-18.86-5.025-24.617-14.06c-5.763-9.044-8.91-22.109-8.91-38.167v-.235c0-16.019 3.147-29.084 8.91-38.137 5.757-9.045 14.128-14.09 24.617-14.09s18.859 4.987 24.617 14.002c5.762 9.024 8.908 22.089 8.908 38.225zm73.402-50.037v72.295H187.36l50.926-72.294z"
|
|
1666
1378
|
})));
|
|
1667
1379
|
};
|
|
1668
1380
|
|
|
@@ -1675,11 +1387,11 @@ var SvgUnauthorized = function SvgUnauthorized(props) {
|
|
|
1675
1387
|
viewBox: "0 0 258 117"
|
|
1676
1388
|
}, props), _path || (_path = /*#__PURE__*/React.createElement("path", {
|
|
1677
1389
|
fill: "#000",
|
|
1678
|
-
d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.
|
|
1390
|
+
d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.248zM7.13 81.076h51.41V8.382h-.313L7.129 80.919zM130.768 116.601c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428M218.958 116.601c-21.91 0-35.682-12.676-37.794-29.344l-.079-.704h6.026l.078.626c2.113 13.537 13.537 23.867 31.769 23.867 18.233 0 31.535-11.269 31.535-26.606v-.156c0-15.885-12.598-25.275-33.413-25.275h-12.754v-5.477h12.598c17.137 0 29.031-9.86 29.031-23.866v-.157c0-13.694-11.425-23.553-27.779-23.553-16.276 0-27.153 9.781-28.405 22.536l-.078.782h-6.025l.078-.782C185.233 12.45 198.379.4 218.176.4c19.875 0 34.039 12.129 34.039 28.561v.157c0 13.928-9.39 23.866-24.18 26.761v.313c17.294 1.174 28.718 11.973 28.718 28.014v.156c0 18.624-15.963 32.239-37.795 32.239"
|
|
1679
1391
|
})), _path2 || (_path2 = /*#__PURE__*/React.createElement("path", {
|
|
1680
1392
|
fill: "#000",
|
|
1681
1393
|
fillRule: "evenodd",
|
|
1682
|
-
d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.
|
|
1394
|
+
d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.248zm6.503-28.648h17.92v-5.634h-17.92V2.043h-8.92L.4 80.998v5.712h58.14v28.248h6.103zm116.124.598-.001-.006-.127-1.149h6.825l.12.965.001.006c2.081 13.313 13.313 23.521 31.373 23.521 18.078 0 31.135-11.15 31.135-26.204v-.157c0-7.824-3.096-14.021-8.741-18.275-5.66-4.264-13.918-6.6-24.272-6.6h-13.154v-6.277h12.998c8.494 0 15.656-2.443 20.687-6.59 5.026-4.141 7.944-9.995 7.944-16.876v-.157c0-13.415-11.183-23.153-27.379-23.153-16.106 0-26.778 9.658-28.007 22.175l-.114 1.143h-6.829l.122-1.22C184.856 12.182 198.2 0 218.176 0c20.03 0 34.439 12.247 34.439 28.961v.157c0 7.059-2.382 13.123-6.649 17.788-3.96 4.33-9.528 7.436-16.281 9.027 8.003.838 14.694 3.783 19.472 8.403 5.102 4.932 7.996 11.749 7.996 19.87v.156c0 18.902-16.204 32.639-38.195 32.639-22.083 0-36.05-12.799-38.191-29.693m47.619-31.09-.351-.026v-.313l.022-.004.303-.06c14.602-2.977 23.855-12.871 23.855-26.697v-.157C252.215 12.53 238.051.4 218.176.4c-19.797 0-32.943 12.05-34.43 28.092l-.078.782h6.025l.078-.782c1.252-12.755 12.129-22.536 28.405-22.536 16.354 0 27.779 9.86 27.779 23.553v.157c0 14.006-11.894 23.866-29.031 23.866h-12.598v5.477h12.754c20.815 0 33.413 9.39 33.413 25.275v.156c0 15.338-13.302 26.606-31.535 26.606-18.232 0-29.656-10.33-31.769-23.867l-.078-.626h-6.026l.079.704c2.112 16.668 15.884 29.344 37.794 29.344 21.832 0 37.795-13.615 37.795-32.239v-.156c0-15.933-11.27-26.694-28.367-27.989M58.54 81.075H7.13v-.157L58.226 8.382h.313zM58.14 9.2 7.79 80.676h50.35zm43.012 91.987C94.225 91.053 90.46 76.469 90.46 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C108.09 5.645 118.188 0 130.768 0s22.697 5.685 29.654 15.844c6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.784 32.553-10.732 42.658-6.957 10.12-17.075 15.725-29.653 15.725-12.58 0-22.678-5.665-29.616-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.448-13.91s-18.724 5.004-24.449 13.997c-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.449 13.968 10.413 0 18.723-4.984 24.448-13.968m-24.448 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428",
|
|
1683
1395
|
clipRule: "evenodd"
|
|
1684
1396
|
})));
|
|
1685
1397
|
};
|
|
@@ -1706,7 +1418,7 @@ var css = ".neeto-molecules-error-page__wrapper{align-items:center;container-nam
|
|
|
1706
1418
|
n(css,{});
|
|
1707
1419
|
|
|
1708
1420
|
function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
|
|
1709
|
-
function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t),
|
|
1421
|
+
function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
|
|
1710
1422
|
var sanitize = purify.sanitize;
|
|
1711
1423
|
var ErrorPage = function ErrorPage(_ref) {
|
|
1712
1424
|
var _ref$homeUrl = _ref.homeUrl,
|