@bigbinary/neeto-molecules 4.0.18 → 4.0.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (372) hide show
  1. package/dist/AuditLogs.js +5 -5
  2. package/dist/AuditLogs.js.map +1 -1
  3. package/dist/BoardView.js +6 -6
  4. package/dist/BoardView.js.map +1 -1
  5. package/dist/Breadcrumbs.js +1 -1
  6. package/dist/Breadcrumbs.js.map +1 -1
  7. package/dist/BrowserPreview.js +1 -1
  8. package/dist/BrowserPreview.js.map +1 -1
  9. package/dist/BrowserSupport.js +2 -2
  10. package/dist/BrowserSupport.js.map +1 -1
  11. package/dist/Builder.js +7 -7
  12. package/dist/Builder.js.map +1 -1
  13. package/dist/ButtonGroup.js +2 -2
  14. package/dist/ButtonGroup.js.map +1 -1
  15. package/dist/CalendarView.js +4 -4
  16. package/dist/CalendarView.js.map +1 -1
  17. package/dist/CardLayout.js.map +1 -1
  18. package/dist/{Chevron-DEQtNhrI.js → Chevron-BFX_mIg6.js} +5 -5
  19. package/dist/{Chevron-DEQtNhrI.js.map → Chevron-BFX_mIg6.js.map} +1 -1
  20. package/dist/Codeblock.js +2 -2
  21. package/dist/Codeblock.js.map +1 -1
  22. package/dist/{Columns-CwbG5wLv.js → Columns-xoAs08GC.js} +6 -6
  23. package/dist/{Columns-CwbG5wLv.js.map → Columns-xoAs08GC.js.map} +1 -1
  24. package/dist/Columns.js +2 -2
  25. package/dist/ConfigurePageSidebar.js +2 -2
  26. package/dist/ConfigurePageSidebar.js.map +1 -1
  27. package/dist/ConfirmationModal.js.map +1 -1
  28. package/dist/Container.js +1 -1
  29. package/dist/Container.js.map +1 -1
  30. package/dist/CopyToClipboardButton.js +2 -2
  31. package/dist/CopyToClipboardButton.js.map +1 -1
  32. package/dist/Currency.js +2 -2
  33. package/dist/Currency.js.map +1 -1
  34. package/dist/DateFormat.js +1 -1
  35. package/dist/DateFormat.js.map +1 -1
  36. package/dist/DateRangeFilter.js +1 -1
  37. package/dist/DateRangeFilter.js.map +1 -1
  38. package/dist/DeleteArchiveModal.js.map +1 -1
  39. package/dist/DeviceIncompatibilityMessage.js.map +1 -1
  40. package/dist/DocumentEditor.js +2 -2
  41. package/dist/DocumentEditor.js.map +1 -1
  42. package/dist/DownloadMobileAppCallout.js.map +1 -1
  43. package/dist/DynamicVariables.js +2 -2
  44. package/dist/DynamicVariables.js.map +1 -1
  45. package/dist/EmailForm.js +5 -5
  46. package/dist/EmailForm.js.map +1 -1
  47. package/dist/EmailPreview.js.map +1 -1
  48. package/dist/EmojiPicker.js +1 -1
  49. package/dist/EmojiPicker.js.map +1 -1
  50. package/dist/EmojiReactions.js.map +1 -1
  51. package/dist/Engagements.js +2 -2
  52. package/dist/Engagements.js.map +1 -1
  53. package/dist/ErrorPage.js +369 -657
  54. package/dist/ErrorPage.js.map +1 -1
  55. package/dist/FileUpload.js +14 -14
  56. package/dist/FileUpload.js.map +1 -1
  57. package/dist/FinderModal.js +3 -3
  58. package/dist/FinderModal.js.map +1 -1
  59. package/dist/FloatingActionMenu.js +7 -7
  60. package/dist/FloatingActionMenu.js.map +1 -1
  61. package/dist/GoogleFontPicker.js +21 -21
  62. package/dist/GoogleFontPicker.js.map +1 -1
  63. package/dist/Header.js +2 -2
  64. package/dist/Header.js.map +1 -1
  65. package/dist/HelpPopover.js +1 -1
  66. package/dist/HelpPopover.js.map +1 -1
  67. package/dist/IconPicker.js +2 -2
  68. package/dist/IconPicker.js.map +1 -1
  69. package/dist/ImageWithFallback.js +2 -2
  70. package/dist/ImageWithFallback.js.map +1 -1
  71. package/dist/InlineInput.js +17 -17
  72. package/dist/InlineInput.js.map +1 -1
  73. package/dist/Insights.js +2 -8
  74. package/dist/Insights.js.map +1 -1
  75. package/dist/IntegrationCard.js +3 -3
  76. package/dist/IntegrationCard.js.map +1 -1
  77. package/dist/IpRestriction.js +574 -488
  78. package/dist/IpRestriction.js.map +1 -1
  79. package/dist/KeyboardShortcuts.js +2 -4
  80. package/dist/KeyboardShortcuts.js.map +1 -1
  81. package/dist/LoginPage.js +23 -24
  82. package/dist/LoginPage.js.map +1 -1
  83. package/dist/MadeWith.js +2 -2
  84. package/dist/MadeWith.js.map +1 -1
  85. package/dist/MenuBar.js +6 -6
  86. package/dist/MenuBar.js.map +1 -1
  87. package/dist/Metadata.js +1 -1
  88. package/dist/Metadata.js.map +1 -1
  89. package/dist/MobilePreviewHeader.js.map +1 -1
  90. package/dist/MoreDropdown.js +4 -4
  91. package/dist/MoreDropdown.js.map +1 -1
  92. package/dist/NavigationHeader.js +4 -4
  93. package/dist/NavigationHeader.js.map +1 -1
  94. package/dist/NeetoWidget.js +5 -5
  95. package/dist/NeetoWidget.js.map +1 -1
  96. package/dist/Onboarding.js +4 -4
  97. package/dist/Onboarding.js.map +1 -1
  98. package/dist/OptionFields.js +7 -7
  99. package/dist/OptionFields.js.map +1 -1
  100. package/dist/PageLoader.js +2 -2
  101. package/dist/PageLoader.js.map +1 -1
  102. package/dist/PhoneNumber.js +5 -6
  103. package/dist/PhoneNumber.js.map +1 -1
  104. package/dist/ProductEmbed.js +6 -6
  105. package/dist/ProductEmbed.js.map +1 -1
  106. package/dist/PublishBlock.js +3 -3
  107. package/dist/PublishBlock.js.map +1 -1
  108. package/dist/PublishYourItem.js.map +1 -1
  109. package/dist/Rename.js +5 -5
  110. package/dist/Rename.js.map +1 -1
  111. package/dist/ResponsiveDevicePicker.js +2 -2
  112. package/dist/ResponsiveDevicePicker.js.map +1 -1
  113. package/dist/Schedule.js +3 -3
  114. package/dist/Schedule.js.map +1 -1
  115. package/dist/Scrollable.js +2 -2
  116. package/dist/Scrollable.js.map +1 -1
  117. package/dist/Search.js +2 -2
  118. package/dist/Search.js.map +1 -1
  119. package/dist/SendToFields.js +93 -70
  120. package/dist/SendToFields.js.map +1 -1
  121. package/dist/SessionEnvironment.js +3 -4
  122. package/dist/SessionEnvironment.js.map +1 -1
  123. package/dist/Settings.js +6 -6
  124. package/dist/Settings.js.map +1 -1
  125. package/dist/ShareRecordingPane.js +2 -2
  126. package/dist/ShareRecordingPane.js.map +1 -1
  127. package/dist/ShareViaEmail.js +3 -3
  128. package/dist/ShareViaEmail.js.map +1 -1
  129. package/dist/ShareViaLink.js +30 -30
  130. package/dist/ShareViaLink.js.map +1 -1
  131. package/dist/Sidebar.js +6 -6
  132. package/dist/Sidebar.js.map +1 -1
  133. package/dist/StatusDropdown.js +2 -2
  134. package/dist/StatusDropdown.js.map +1 -1
  135. package/dist/StickyRibbonsContainer.js +10 -12
  136. package/dist/StickyRibbonsContainer.js.map +1 -1
  137. package/dist/SubHeader.js +5 -5
  138. package/dist/SubHeader.js.map +1 -1
  139. package/dist/SubscriptionNotificationsContainer.js +1 -1
  140. package/dist/SubscriptionNotificationsContainer.js.map +1 -1
  141. package/dist/SuffixedInput.js +2 -2
  142. package/dist/SuffixedInput.js.map +1 -1
  143. package/dist/TableWrapper.js +1 -1
  144. package/dist/TableWrapper.js.map +1 -1
  145. package/dist/Taxonomy.js +16 -16
  146. package/dist/Taxonomy.js.map +1 -1
  147. package/dist/TimeFormat.js.map +1 -1
  148. package/dist/TimezoneMismatchModal.js.map +1 -1
  149. package/dist/ToggleFeatureCard.js +3 -3
  150. package/dist/ToggleFeatureCard.js.map +1 -1
  151. package/dist/VersionHistory.js +3 -3
  152. package/dist/VersionHistory.js.map +1 -1
  153. package/dist/cjs/AuditLogs.js +5 -5
  154. package/dist/cjs/AuditLogs.js.map +1 -1
  155. package/dist/cjs/BoardView.js +6 -6
  156. package/dist/cjs/BoardView.js.map +1 -1
  157. package/dist/cjs/Breadcrumbs.js +1 -1
  158. package/dist/cjs/Breadcrumbs.js.map +1 -1
  159. package/dist/cjs/BrowserPreview.js +1 -1
  160. package/dist/cjs/BrowserPreview.js.map +1 -1
  161. package/dist/cjs/BrowserSupport.js +2 -2
  162. package/dist/cjs/BrowserSupport.js.map +1 -1
  163. package/dist/cjs/Builder.js +6 -6
  164. package/dist/cjs/Builder.js.map +1 -1
  165. package/dist/cjs/ButtonGroup.js +2 -2
  166. package/dist/cjs/ButtonGroup.js.map +1 -1
  167. package/dist/cjs/CalendarView.js +4 -4
  168. package/dist/cjs/CalendarView.js.map +1 -1
  169. package/dist/cjs/CardLayout.js.map +1 -1
  170. package/dist/cjs/{Chevron-u-rD2gAf.js → Chevron-ClvaNo3d.js} +5 -5
  171. package/dist/cjs/{Chevron-u-rD2gAf.js.map → Chevron-ClvaNo3d.js.map} +1 -1
  172. package/dist/cjs/Codeblock.js +2 -2
  173. package/dist/cjs/Codeblock.js.map +1 -1
  174. package/dist/cjs/{Columns-CZDLxh70.js → Columns-C95kM2yL.js} +6 -6
  175. package/dist/cjs/{Columns-CZDLxh70.js.map → Columns-C95kM2yL.js.map} +1 -1
  176. package/dist/cjs/Columns.js +2 -2
  177. package/dist/cjs/ConfigurePageSidebar.js +2 -2
  178. package/dist/cjs/ConfigurePageSidebar.js.map +1 -1
  179. package/dist/cjs/ConfirmationModal.js.map +1 -1
  180. package/dist/cjs/Container.js +1 -1
  181. package/dist/cjs/Container.js.map +1 -1
  182. package/dist/cjs/CopyToClipboardButton.js +2 -2
  183. package/dist/cjs/CopyToClipboardButton.js.map +1 -1
  184. package/dist/cjs/Currency.js +2 -2
  185. package/dist/cjs/Currency.js.map +1 -1
  186. package/dist/cjs/DateFormat.js +1 -1
  187. package/dist/cjs/DateFormat.js.map +1 -1
  188. package/dist/cjs/DateRangeFilter.js +1 -1
  189. package/dist/cjs/DateRangeFilter.js.map +1 -1
  190. package/dist/cjs/DeleteArchiveModal.js.map +1 -1
  191. package/dist/cjs/DeviceIncompatibilityMessage.js.map +1 -1
  192. package/dist/cjs/DocumentEditor.js +2 -2
  193. package/dist/cjs/DocumentEditor.js.map +1 -1
  194. package/dist/cjs/DownloadMobileAppCallout.js.map +1 -1
  195. package/dist/cjs/DynamicVariables.js +2 -2
  196. package/dist/cjs/DynamicVariables.js.map +1 -1
  197. package/dist/cjs/EmailForm.js +5 -5
  198. package/dist/cjs/EmailForm.js.map +1 -1
  199. package/dist/cjs/EmailPreview.js.map +1 -1
  200. package/dist/cjs/EmojiPicker.js +1 -1
  201. package/dist/cjs/EmojiPicker.js.map +1 -1
  202. package/dist/cjs/EmojiReactions.js.map +1 -1
  203. package/dist/cjs/Engagements.js +2 -2
  204. package/dist/cjs/Engagements.js.map +1 -1
  205. package/dist/cjs/ErrorPage.js +369 -657
  206. package/dist/cjs/ErrorPage.js.map +1 -1
  207. package/dist/cjs/FileUpload.js +14 -14
  208. package/dist/cjs/FileUpload.js.map +1 -1
  209. package/dist/cjs/FinderModal.js +3 -3
  210. package/dist/cjs/FinderModal.js.map +1 -1
  211. package/dist/cjs/FloatingActionMenu.js +6 -6
  212. package/dist/cjs/FloatingActionMenu.js.map +1 -1
  213. package/dist/cjs/GoogleFontPicker.js +21 -21
  214. package/dist/cjs/GoogleFontPicker.js.map +1 -1
  215. package/dist/cjs/Header.js +2 -2
  216. package/dist/cjs/Header.js.map +1 -1
  217. package/dist/cjs/HelpPopover.js +1 -1
  218. package/dist/cjs/HelpPopover.js.map +1 -1
  219. package/dist/cjs/IconPicker.js +2 -2
  220. package/dist/cjs/IconPicker.js.map +1 -1
  221. package/dist/cjs/ImageWithFallback.js +2 -2
  222. package/dist/cjs/ImageWithFallback.js.map +1 -1
  223. package/dist/cjs/InlineInput.js +17 -17
  224. package/dist/cjs/InlineInput.js.map +1 -1
  225. package/dist/cjs/Insights.js +2 -8
  226. package/dist/cjs/Insights.js.map +1 -1
  227. package/dist/cjs/IntegrationCard.js +3 -3
  228. package/dist/cjs/IntegrationCard.js.map +1 -1
  229. package/dist/cjs/IpRestriction.js +574 -488
  230. package/dist/cjs/IpRestriction.js.map +1 -1
  231. package/dist/cjs/KeyboardShortcuts.js +2 -4
  232. package/dist/cjs/KeyboardShortcuts.js.map +1 -1
  233. package/dist/cjs/LoginPage.js +23 -24
  234. package/dist/cjs/LoginPage.js.map +1 -1
  235. package/dist/cjs/MadeWith.js +2 -2
  236. package/dist/cjs/MadeWith.js.map +1 -1
  237. package/dist/cjs/MenuBar.js +6 -6
  238. package/dist/cjs/MenuBar.js.map +1 -1
  239. package/dist/cjs/Metadata.js +1 -1
  240. package/dist/cjs/Metadata.js.map +1 -1
  241. package/dist/cjs/MobilePreviewHeader.js.map +1 -1
  242. package/dist/cjs/MoreDropdown.js +4 -4
  243. package/dist/cjs/MoreDropdown.js.map +1 -1
  244. package/dist/cjs/NavigationHeader.js +4 -4
  245. package/dist/cjs/NavigationHeader.js.map +1 -1
  246. package/dist/cjs/NeetoWidget.js +5 -5
  247. package/dist/cjs/NeetoWidget.js.map +1 -1
  248. package/dist/cjs/Onboarding.js +3 -3
  249. package/dist/cjs/Onboarding.js.map +1 -1
  250. package/dist/cjs/OptionFields.js +6 -6
  251. package/dist/cjs/OptionFields.js.map +1 -1
  252. package/dist/cjs/PageLoader.js +2 -2
  253. package/dist/cjs/PageLoader.js.map +1 -1
  254. package/dist/cjs/PhoneNumber.js +4 -5
  255. package/dist/cjs/PhoneNumber.js.map +1 -1
  256. package/dist/cjs/ProductEmbed.js +5 -5
  257. package/dist/cjs/ProductEmbed.js.map +1 -1
  258. package/dist/cjs/PublishBlock.js +3 -3
  259. package/dist/cjs/PublishBlock.js.map +1 -1
  260. package/dist/cjs/PublishYourItem.js.map +1 -1
  261. package/dist/cjs/Rename.js +5 -5
  262. package/dist/cjs/Rename.js.map +1 -1
  263. package/dist/cjs/ResponsiveDevicePicker.js +2 -2
  264. package/dist/cjs/ResponsiveDevicePicker.js.map +1 -1
  265. package/dist/cjs/Schedule.js +3 -3
  266. package/dist/cjs/Schedule.js.map +1 -1
  267. package/dist/cjs/Scrollable.js +2 -2
  268. package/dist/cjs/Scrollable.js.map +1 -1
  269. package/dist/cjs/Search.js +2 -2
  270. package/dist/cjs/Search.js.map +1 -1
  271. package/dist/cjs/SendToFields.js +93 -70
  272. package/dist/cjs/SendToFields.js.map +1 -1
  273. package/dist/cjs/SessionEnvironment.js +3 -4
  274. package/dist/cjs/SessionEnvironment.js.map +1 -1
  275. package/dist/cjs/Settings.js +6 -6
  276. package/dist/cjs/Settings.js.map +1 -1
  277. package/dist/cjs/ShareRecordingPane.js +2 -2
  278. package/dist/cjs/ShareRecordingPane.js.map +1 -1
  279. package/dist/cjs/ShareViaEmail.js +3 -3
  280. package/dist/cjs/ShareViaEmail.js.map +1 -1
  281. package/dist/cjs/ShareViaLink.js +24 -24
  282. package/dist/cjs/ShareViaLink.js.map +1 -1
  283. package/dist/cjs/Sidebar.js +5 -5
  284. package/dist/cjs/Sidebar.js.map +1 -1
  285. package/dist/cjs/StatusDropdown.js +2 -2
  286. package/dist/cjs/StatusDropdown.js.map +1 -1
  287. package/dist/cjs/StickyRibbonsContainer.js +10 -12
  288. package/dist/cjs/StickyRibbonsContainer.js.map +1 -1
  289. package/dist/cjs/SubHeader.js +5 -5
  290. package/dist/cjs/SubHeader.js.map +1 -1
  291. package/dist/cjs/SubscriptionNotificationsContainer.js +1 -1
  292. package/dist/cjs/SubscriptionNotificationsContainer.js.map +1 -1
  293. package/dist/cjs/SuffixedInput.js +2 -2
  294. package/dist/cjs/SuffixedInput.js.map +1 -1
  295. package/dist/cjs/TableWrapper.js +1 -1
  296. package/dist/cjs/TableWrapper.js.map +1 -1
  297. package/dist/cjs/Taxonomy.js +16 -16
  298. package/dist/cjs/Taxonomy.js.map +1 -1
  299. package/dist/cjs/TimeFormat.js.map +1 -1
  300. package/dist/cjs/TimezoneMismatchModal.js.map +1 -1
  301. package/dist/cjs/ToggleFeatureCard.js +3 -3
  302. package/dist/cjs/ToggleFeatureCard.js.map +1 -1
  303. package/dist/cjs/VersionHistory.js +3 -3
  304. package/dist/cjs/VersionHistory.js.map +1 -1
  305. package/dist/cjs/index-JY2zVpnv.js.map +1 -1
  306. package/dist/cjs/inject-css-B6qYtOJe.js +6 -0
  307. package/dist/cjs/inject-css-B6qYtOJe.js.map +1 -0
  308. package/dist/cjs/{phone-number-C93qn93_.js → phone-number-1EDAr56u.js} +34 -24
  309. package/dist/cjs/phone-number-1EDAr56u.js.map +1 -0
  310. package/dist/cjs/platform-BUcCb8Jx.js.map +1 -1
  311. package/dist/cjs/useKeyboardShortcutsPaneState-YnXpWOcs.js.map +1 -1
  312. package/dist/index-DAYCJu79.js.map +1 -1
  313. package/dist/inject-css-C2dztUxs.js +4 -0
  314. package/dist/inject-css-C2dztUxs.js.map +1 -0
  315. package/dist/{phone-number-CSXPpNBP.js → phone-number-BDkpXCIq.js} +36 -26
  316. package/dist/phone-number-BDkpXCIq.js.map +1 -0
  317. package/dist/platform-F44zJ4Xh.js.map +1 -1
  318. package/dist/useKeyboardShortcutsPaneState-C_eLceJQ.js.map +1 -1
  319. package/package.json +12 -14
  320. package/types/ButtonGroup.d.ts +2 -1
  321. package/types/CopyToClipboardButton.d.ts +2 -1
  322. package/types/EmailPreview.d.ts +2 -1
  323. package/types/FileUpload.d.ts +2 -1
  324. package/types/Header.d.ts +2 -1
  325. package/types/HelpPopover.d.ts +2 -1
  326. package/types/InlineInput.d.ts +2 -1
  327. package/types/IntegrationCard.d.ts +2 -1
  328. package/types/MoreDropdown.d.ts +1 -1
  329. package/types/PhoneNumber.d.ts +2 -1
  330. package/types/PublishBlock.d.ts +1 -1
  331. package/types/SubHeader.d.ts +1 -1
  332. package/types/ToggleFeatureCard.d.ts +1 -1
  333. package/dist/cjs/inject-css-vQvjPR2x.js +0 -6
  334. package/dist/cjs/inject-css-vQvjPR2x.js.map +0 -1
  335. package/dist/cjs/phone-number-C93qn93_.js.map +0 -1
  336. package/dist/inject-css-DmrvuTKK.js +0 -4
  337. package/dist/inject-css-DmrvuTKK.js.map +0 -1
  338. package/dist/phone-number-CSXPpNBP.js.map +0 -1
  339. package/src/translations/ar.json +0 -867
  340. package/src/translations/bg.json +0 -119
  341. package/src/translations/ca.json +0 -867
  342. package/src/translations/cs.json +0 -867
  343. package/src/translations/da.json +0 -867
  344. package/src/translations/de.json +0 -867
  345. package/src/translations/en.json +0 -867
  346. package/src/translations/es-MX.json +0 -867
  347. package/src/translations/es.json +0 -867
  348. package/src/translations/et.json +0 -867
  349. package/src/translations/fi.json +0 -867
  350. package/src/translations/fil.json +0 -867
  351. package/src/translations/fr.json +0 -867
  352. package/src/translations/hi.json +0 -119
  353. package/src/translations/hr.json +0 -867
  354. package/src/translations/id.json +0 -867
  355. package/src/translations/it.json +0 -867
  356. package/src/translations/ja.json +0 -867
  357. package/src/translations/ko.json +0 -867
  358. package/src/translations/nl.json +0 -867
  359. package/src/translations/pl.json +0 -867
  360. package/src/translations/pt-BR.json +0 -867
  361. package/src/translations/pt.json +0 -867
  362. package/src/translations/ro.json +0 -867
  363. package/src/translations/ru.json +0 -867
  364. package/src/translations/sk.json +0 -867
  365. package/src/translations/sl.json +0 -867
  366. package/src/translations/sv.json +0 -867
  367. package/src/translations/th.json +0 -867
  368. package/src/translations/tr.json +0 -867
  369. package/src/translations/uk.json +0 -867
  370. package/src/translations/vi.json +0 -867
  371. package/src/translations/zh-CN.json +0 -867
  372. package/src/translations/zh-TW.json +0 -867
package/dist/ErrorPage.js CHANGED
@@ -7,10 +7,10 @@ import Button from '@bigbinary/neetoui/Button';
7
7
  import Typography from '@bigbinary/neetoui/Typography';
8
8
  import { Helmet } from 'react-helmet';
9
9
  import { useTranslation, Trans } from 'react-i18next';
10
- import { n } from './inject-css-DmrvuTKK.js';
10
+ import { n } from './inject-css-C2dztUxs.js';
11
11
  import { jsx, jsxs } from 'react/jsx-runtime';
12
12
 
13
- /*! @license DOMPurify 3.0.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.3/LICENSE */
13
+ /*! @license DOMPurify 3.2.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.6/LICENSE */
14
14
 
15
15
  const {
16
16
  entries,
@@ -24,227 +24,259 @@ let {
24
24
  seal,
25
25
  create
26
26
  } = Object; // eslint-disable-line import/no-mutable-exports
27
-
28
27
  let {
29
28
  apply,
30
29
  construct
31
30
  } = typeof Reflect !== 'undefined' && Reflect;
32
-
33
- if (!apply) {
34
- apply = function apply(fun, thisValue, args) {
35
- return fun.apply(thisValue, args);
36
- };
37
- }
38
-
39
31
  if (!freeze) {
40
32
  freeze = function freeze(x) {
41
33
  return x;
42
34
  };
43
35
  }
44
-
45
36
  if (!seal) {
46
37
  seal = function seal(x) {
47
38
  return x;
48
39
  };
49
40
  }
50
-
41
+ if (!apply) {
42
+ apply = function apply(fun, thisValue, args) {
43
+ return fun.apply(thisValue, args);
44
+ };
45
+ }
51
46
  if (!construct) {
52
47
  construct = function construct(Func, args) {
53
48
  return new Func(...args);
54
49
  };
55
50
  }
56
-
57
51
  const arrayForEach = unapply(Array.prototype.forEach);
52
+ const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
58
53
  const arrayPop = unapply(Array.prototype.pop);
59
54
  const arrayPush = unapply(Array.prototype.push);
55
+ const arraySplice = unapply(Array.prototype.splice);
60
56
  const stringToLowerCase = unapply(String.prototype.toLowerCase);
61
57
  const stringToString = unapply(String.prototype.toString);
62
58
  const stringMatch = unapply(String.prototype.match);
63
59
  const stringReplace = unapply(String.prototype.replace);
64
60
  const stringIndexOf = unapply(String.prototype.indexOf);
65
61
  const stringTrim = unapply(String.prototype.trim);
62
+ const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
66
63
  const regExpTest = unapply(RegExp.prototype.test);
67
64
  const typeErrorCreate = unconstruct(TypeError);
65
+ /**
66
+ * Creates a new function that calls the given function with a specified thisArg and arguments.
67
+ *
68
+ * @param func - The function to be wrapped and called.
69
+ * @returns A new function that calls the given function with a specified thisArg and arguments.
70
+ */
68
71
  function unapply(func) {
69
72
  return function (thisArg) {
73
+ if (thisArg instanceof RegExp) {
74
+ thisArg.lastIndex = 0;
75
+ }
70
76
  for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
71
77
  args[_key - 1] = arguments[_key];
72
78
  }
73
-
74
79
  return apply(func, thisArg, args);
75
80
  };
76
81
  }
82
+ /**
83
+ * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
84
+ *
85
+ * @param func - The constructor function to be wrapped and called.
86
+ * @returns A new function that constructs an instance of the given constructor function with the provided arguments.
87
+ */
77
88
  function unconstruct(func) {
78
89
  return function () {
79
90
  for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
80
91
  args[_key2] = arguments[_key2];
81
92
  }
82
-
83
93
  return construct(func, args);
84
94
  };
85
95
  }
86
- /* Add properties to a lookup table */
87
-
88
- function addToSet(set, array, transformCaseFunc) {
89
- var _transformCaseFunc;
90
-
91
- transformCaseFunc = (_transformCaseFunc = transformCaseFunc) !== null && _transformCaseFunc !== void 0 ? _transformCaseFunc : stringToLowerCase;
92
-
96
+ /**
97
+ * Add properties to a lookup table
98
+ *
99
+ * @param set - The set to which elements will be added.
100
+ * @param array - The array containing elements to be added to the set.
101
+ * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
102
+ * @returns The modified set with added elements.
103
+ */
104
+ function addToSet(set, array) {
105
+ let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
93
106
  if (setPrototypeOf) {
94
107
  // Make 'in' and truthy checks like Boolean(set.constructor)
95
108
  // independent of any properties defined on Object.prototype.
96
109
  // Prevent prototype setters from intercepting set as a this value.
97
110
  setPrototypeOf(set, null);
98
111
  }
99
-
100
112
  let l = array.length;
101
-
102
113
  while (l--) {
103
114
  let element = array[l];
104
-
105
115
  if (typeof element === 'string') {
106
116
  const lcElement = transformCaseFunc(element);
107
-
108
117
  if (lcElement !== element) {
109
118
  // Config presets (e.g. tags.js, attrs.js) are immutable.
110
119
  if (!isFrozen(array)) {
111
120
  array[l] = lcElement;
112
121
  }
113
-
114
122
  element = lcElement;
115
123
  }
116
124
  }
117
-
118
125
  set[element] = true;
119
126
  }
120
-
121
127
  return set;
122
128
  }
123
- /* Shallow clone an object */
124
-
129
+ /**
130
+ * Clean up an array to harden against CSPP
131
+ *
132
+ * @param array - The array to be cleaned.
133
+ * @returns The cleaned version of the array
134
+ */
135
+ function cleanArray(array) {
136
+ for (let index = 0; index < array.length; index++) {
137
+ const isPropertyExist = objectHasOwnProperty(array, index);
138
+ if (!isPropertyExist) {
139
+ array[index] = null;
140
+ }
141
+ }
142
+ return array;
143
+ }
144
+ /**
145
+ * Shallow clone an object
146
+ *
147
+ * @param object - The object to be cloned.
148
+ * @returns A new object that copies the original.
149
+ */
125
150
  function clone(object) {
126
151
  const newObject = create(null);
127
-
128
152
  for (const [property, value] of entries(object)) {
129
- newObject[property] = value;
153
+ const isPropertyExist = objectHasOwnProperty(object, property);
154
+ if (isPropertyExist) {
155
+ if (Array.isArray(value)) {
156
+ newObject[property] = cleanArray(value);
157
+ } else if (value && typeof value === 'object' && value.constructor === Object) {
158
+ newObject[property] = clone(value);
159
+ } else {
160
+ newObject[property] = value;
161
+ }
162
+ }
130
163
  }
131
-
132
164
  return newObject;
133
165
  }
134
- /* This method automatically checks if the prop is function
135
- * or getter and behaves accordingly. */
136
-
166
+ /**
167
+ * This method automatically checks if the prop is function or getter and behaves accordingly.
168
+ *
169
+ * @param object - The object to look up the getter function in its prototype chain.
170
+ * @param prop - The property name for which to find the getter function.
171
+ * @returns The getter function found in the prototype chain or a fallback function.
172
+ */
137
173
  function lookupGetter(object, prop) {
138
174
  while (object !== null) {
139
175
  const desc = getOwnPropertyDescriptor(object, prop);
140
-
141
176
  if (desc) {
142
177
  if (desc.get) {
143
178
  return unapply(desc.get);
144
179
  }
145
-
146
180
  if (typeof desc.value === 'function') {
147
181
  return unapply(desc.value);
148
182
  }
149
183
  }
150
-
151
184
  object = getPrototypeOf(object);
152
185
  }
153
-
154
- function fallbackValue(element) {
155
- console.warn('fallback value for', element);
186
+ function fallbackValue() {
156
187
  return null;
157
188
  }
158
-
159
189
  return fallbackValue;
160
190
  }
161
191
 
162
- const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
163
-
192
+ const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
164
193
  const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
165
- const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
194
+ const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
195
+ // List of SVG elements that are disallowed by default.
166
196
  // We still need to know them so that we can do namespace
167
197
  // checks properly in case one wants to add them to
168
198
  // allow-list.
169
-
170
199
  const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
171
- const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']); // Similarly to SVG, we want to know all MathML elements,
200
+ const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
201
+ // Similarly to SVG, we want to know all MathML elements,
172
202
  // even those that we disallow by default.
173
-
174
203
  const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
175
204
  const text = freeze(['#text']);
176
205
 
177
- const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
178
- const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
206
+ const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
207
+ const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
179
208
  const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
180
209
  const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
181
210
 
211
+ // eslint-disable-next-line unicorn/better-regex
182
212
  const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
183
-
184
213
  const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
185
- const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
186
- const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
187
-
214
+ const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm); // eslint-disable-line unicorn/better-regex
215
+ const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
188
216
  const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
189
-
190
- const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
217
+ const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
191
218
  );
192
219
  const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
193
220
  const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
194
221
  );
195
222
  const DOCTYPE_NAME = seal(/^html$/i);
223
+ const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
196
224
 
197
225
  var EXPRESSIONS = /*#__PURE__*/Object.freeze({
198
226
  __proto__: null,
199
- MUSTACHE_EXPR: MUSTACHE_EXPR,
200
- ERB_EXPR: ERB_EXPR,
201
- TMPLIT_EXPR: TMPLIT_EXPR,
202
- DATA_ATTR: DATA_ATTR,
203
227
  ARIA_ATTR: ARIA_ATTR,
228
+ ATTR_WHITESPACE: ATTR_WHITESPACE,
229
+ CUSTOM_ELEMENT: CUSTOM_ELEMENT,
230
+ DATA_ATTR: DATA_ATTR,
231
+ DOCTYPE_NAME: DOCTYPE_NAME,
232
+ ERB_EXPR: ERB_EXPR,
204
233
  IS_ALLOWED_URI: IS_ALLOWED_URI,
205
234
  IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
206
- ATTR_WHITESPACE: ATTR_WHITESPACE,
207
- DOCTYPE_NAME: DOCTYPE_NAME
235
+ MUSTACHE_EXPR: MUSTACHE_EXPR,
236
+ TMPLIT_EXPR: TMPLIT_EXPR
208
237
  });
209
238
 
210
- const getGlobal = () => typeof window === 'undefined' ? null : window;
239
+ /* eslint-disable @typescript-eslint/indent */
240
+ // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
241
+ const NODE_TYPE = {
242
+ element: 1,
243
+ text: 3,
244
+ // Deprecated
245
+ progressingInstruction: 7,
246
+ comment: 8,
247
+ document: 9};
248
+ const getGlobal = function getGlobal() {
249
+ return typeof window === 'undefined' ? null : window;
250
+ };
211
251
  /**
212
252
  * Creates a no-op policy for internal use only.
213
253
  * Don't export this function outside this module!
214
- * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
215
- * @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
216
- * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
254
+ * @param trustedTypes The policy factory.
255
+ * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
256
+ * @return The policy created (or null, if Trusted Types
217
257
  * are not supported or creating the policy failed).
218
258
  */
219
-
220
-
221
259
  const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
222
260
  if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
223
261
  return null;
224
- } // Allow the callers to control the unique policy name
262
+ }
263
+ // Allow the callers to control the unique policy name
225
264
  // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
226
265
  // Policy creation with duplicate names throws in Trusted Types.
227
-
228
-
229
266
  let suffix = null;
230
267
  const ATTR_NAME = 'data-tt-policy-suffix';
231
-
232
268
  if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
233
269
  suffix = purifyHostElement.getAttribute(ATTR_NAME);
234
270
  }
235
-
236
271
  const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
237
-
238
272
  try {
239
273
  return trustedTypes.createPolicy(policyName, {
240
274
  createHTML(html) {
241
275
  return html;
242
276
  },
243
-
244
277
  createScriptURL(scriptUrl) {
245
278
  return scriptUrl;
246
279
  }
247
-
248
280
  });
249
281
  } catch (_) {
250
282
  // Policy creation failed (most likely another DOMPurify script has
@@ -254,37 +286,35 @@ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedType
254
286
  return null;
255
287
  }
256
288
  };
257
-
289
+ const _createHooksMap = function _createHooksMap() {
290
+ return {
291
+ afterSanitizeAttributes: [],
292
+ afterSanitizeElements: [],
293
+ afterSanitizeShadowDOM: [],
294
+ beforeSanitizeAttributes: [],
295
+ beforeSanitizeElements: [],
296
+ beforeSanitizeShadowDOM: [],
297
+ uponSanitizeAttribute: [],
298
+ uponSanitizeElement: [],
299
+ uponSanitizeShadowNode: []
300
+ };
301
+ };
258
302
  function createDOMPurify() {
259
303
  let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
260
-
261
304
  const DOMPurify = root => createDOMPurify(root);
262
- /**
263
- * Version label, exposed for easier checks
264
- * if DOMPurify is up to date or not
265
- */
266
-
267
-
268
- DOMPurify.version = '3.0.3';
269
- /**
270
- * Array of elements that DOMPurify removed during sanitation.
271
- * Empty if nothing was removed.
272
- */
273
-
305
+ DOMPurify.version = '3.2.6';
274
306
  DOMPurify.removed = [];
275
-
276
- if (!window || !window.document || window.document.nodeType !== 9) {
307
+ if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
277
308
  // Not running in a browser, provide a factory function
278
309
  // so that you can pass your own Window
279
310
  DOMPurify.isSupported = false;
280
311
  return DOMPurify;
281
312
  }
282
-
283
- const originalDocument = window.document;
284
- const currentScript = originalDocument.currentScript;
285
313
  let {
286
314
  document
287
315
  } = window;
316
+ const originalDocument = document;
317
+ const currentScript = originalDocument.currentScript;
288
318
  const {
289
319
  DocumentFragment,
290
320
  HTMLTemplateElement,
@@ -298,23 +328,22 @@ function createDOMPurify() {
298
328
  } = window;
299
329
  const ElementPrototype = Element.prototype;
300
330
  const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
331
+ const remove = lookupGetter(ElementPrototype, 'remove');
301
332
  const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
302
333
  const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
303
- const getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
334
+ const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
335
+ // As per issue #47, the web-components registry is inherited by a
304
336
  // new document created via createHTMLDocument. As per the spec
305
337
  // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
306
338
  // a new empty registry is used when creating a template contents owner
307
339
  // document, so we use that as our parent document to ensure nothing
308
340
  // is inherited.
309
-
310
341
  if (typeof HTMLTemplateElement === 'function') {
311
342
  const template = document.createElement('template');
312
-
313
343
  if (template.content && template.content.ownerDocument) {
314
344
  document = template.content.ownerDocument;
315
345
  }
316
346
  }
317
-
318
347
  let trustedTypesPolicy;
319
348
  let emptyHTML = '';
320
349
  const {
@@ -326,11 +355,10 @@ function createDOMPurify() {
326
355
  const {
327
356
  importNode
328
357
  } = originalDocument;
329
- let hooks = {};
358
+ let hooks = _createHooksMap();
330
359
  /**
331
360
  * Expose whether this browser supports running the full DOMPurify.
332
361
  */
333
-
334
362
  DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
335
363
  const {
336
364
  MUSTACHE_EXPR,
@@ -339,7 +367,8 @@ function createDOMPurify() {
339
367
  DATA_ATTR,
340
368
  ARIA_ATTR,
341
369
  IS_SCRIPT_OR_DATA,
342
- ATTR_WHITESPACE
370
+ ATTR_WHITESPACE,
371
+ CUSTOM_ELEMENT
343
372
  } = EXPRESSIONS;
344
373
  let {
345
374
  IS_ALLOWED_URI: IS_ALLOWED_URI$1
@@ -348,23 +377,19 @@ function createDOMPurify() {
348
377
  * We consider the elements and attributes below to be safe. Ideally
349
378
  * don't add any new ones but feel free to remove unwanted ones.
350
379
  */
351
-
352
380
  /* allowed element names */
353
-
354
381
  let ALLOWED_TAGS = null;
355
382
  const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
356
383
  /* Allowed attribute names */
357
-
358
384
  let ALLOWED_ATTR = null;
359
385
  const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
360
386
  /*
361
- * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
387
+ * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
362
388
  * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
363
389
  * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
364
390
  * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
365
391
  */
366
-
367
- let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
392
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
368
393
  tagNameCheck: {
369
394
  writable: true,
370
395
  configurable: false,
@@ -385,57 +410,47 @@ function createDOMPurify() {
385
410
  }
386
411
  }));
387
412
  /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
388
-
389
413
  let FORBID_TAGS = null;
390
414
  /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
391
-
392
415
  let FORBID_ATTR = null;
393
416
  /* Decide if ARIA attributes are okay */
394
-
395
417
  let ALLOW_ARIA_ATTR = true;
396
418
  /* Decide if custom data attributes are okay */
397
-
398
419
  let ALLOW_DATA_ATTR = true;
399
420
  /* Decide if unknown protocols are okay */
400
-
401
421
  let ALLOW_UNKNOWN_PROTOCOLS = false;
402
422
  /* Decide if self-closing tags in attributes are allowed.
403
423
  * Usually removed due to a mXSS issue in jQuery 3.0 */
404
-
405
424
  let ALLOW_SELF_CLOSE_IN_ATTR = true;
406
425
  /* Output should be safe for common template engines.
407
426
  * This means, DOMPurify removes data attributes, mustaches and ERB
408
427
  */
409
-
410
428
  let SAFE_FOR_TEMPLATES = false;
429
+ /* Output should be safe even for XML used within HTML and alike.
430
+ * This means, DOMPurify removes comments when containing risky content.
431
+ */
432
+ let SAFE_FOR_XML = true;
411
433
  /* Decide if document with <html>... should be returned */
412
-
413
434
  let WHOLE_DOCUMENT = false;
414
435
  /* Track whether config is already set on this instance of DOMPurify. */
415
-
416
436
  let SET_CONFIG = false;
417
437
  /* Decide if all elements (e.g. style, script) must be children of
418
438
  * document.body. By default, browsers might move them to document.head */
419
-
420
439
  let FORCE_BODY = false;
421
440
  /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
422
441
  * string (or a TrustedHTML object if Trusted Types are supported).
423
442
  * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
424
443
  */
425
-
426
444
  let RETURN_DOM = false;
427
445
  /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
428
446
  * string (or a TrustedHTML object if Trusted Types are supported) */
429
-
430
447
  let RETURN_DOM_FRAGMENT = false;
431
448
  /* Try to return a Trusted Type object instead of a string, return a string in
432
449
  * case Trusted Types are not supported */
433
-
434
450
  let RETURN_TRUSTED_TYPE = false;
435
451
  /* Output should be free from DOM clobbering attacks?
436
452
  * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
437
453
  */
438
-
439
454
  let SANITIZE_DOM = true;
440
455
  /* Achieve full DOM Clobbering protection by isolating the namespace of named
441
456
  * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
@@ -450,180 +465,138 @@ function createDOMPurify() {
450
465
  * Namespace isolation is implemented by prefixing `id` and `name` attributes
451
466
  * with a constant string, i.e., `user-content-`
452
467
  */
453
-
454
468
  let SANITIZE_NAMED_PROPS = false;
455
469
  const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
456
470
  /* Keep element content when removing element? */
457
-
458
471
  let KEEP_CONTENT = true;
459
472
  /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
460
473
  * of importing it into a new Document and returning a sanitized copy */
461
-
462
474
  let IN_PLACE = false;
463
475
  /* Allow usage of profiles like html, svg and mathMl */
464
-
465
476
  let USE_PROFILES = {};
466
477
  /* Tags to ignore content of when KEEP_CONTENT is true */
467
-
468
478
  let FORBID_CONTENTS = null;
469
479
  const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
470
480
  /* Tags that are safe for data: URIs */
471
-
472
481
  let DATA_URI_TAGS = null;
473
482
  const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
474
483
  /* Attributes safe for values like "javascript:" */
475
-
476
484
  let URI_SAFE_ATTRIBUTES = null;
477
485
  const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
478
486
  const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
479
487
  const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
480
488
  const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
481
489
  /* Document namespace */
482
-
483
490
  let NAMESPACE = HTML_NAMESPACE;
484
491
  let IS_EMPTY_INPUT = false;
485
492
  /* Allowed XHTML+XML namespaces */
486
-
487
493
  let ALLOWED_NAMESPACES = null;
488
494
  const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
495
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
496
+ let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
497
+ // Certain elements are allowed in both SVG and HTML
498
+ // namespace. We need to specify them explicitly
499
+ // so that they don't get erroneously deleted from
500
+ // HTML namespace.
501
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
489
502
  /* Parsing of strict XHTML documents */
490
-
491
- let PARSER_MEDIA_TYPE;
503
+ let PARSER_MEDIA_TYPE = null;
492
504
  const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
493
505
  const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
494
- let transformCaseFunc;
506
+ let transformCaseFunc = null;
495
507
  /* Keep a reference to config to pass to hooks */
496
-
497
508
  let CONFIG = null;
498
509
  /* Ideally, do not touch anything below this line */
499
-
500
510
  /* ______________________________________________ */
501
-
502
511
  const formElement = document.createElement('form');
503
-
504
512
  const isRegexOrFunction = function isRegexOrFunction(testValue) {
505
513
  return testValue instanceof RegExp || testValue instanceof Function;
506
514
  };
507
515
  /**
508
516
  * _parseConfig
509
517
  *
510
- * @param {Object} cfg optional config literal
518
+ * @param cfg optional config literal
511
519
  */
512
520
  // eslint-disable-next-line complexity
513
-
514
-
515
- const _parseConfig = function _parseConfig(cfg) {
521
+ const _parseConfig = function _parseConfig() {
522
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
516
523
  if (CONFIG && CONFIG === cfg) {
517
524
  return;
518
525
  }
519
526
  /* Shield configuration object from tampering */
520
-
521
-
522
527
  if (!cfg || typeof cfg !== 'object') {
523
528
  cfg = {};
524
529
  }
525
530
  /* Shield configuration object from prototype pollution */
526
-
527
-
528
531
  cfg = clone(cfg);
529
- PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
530
- SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
531
-
532
+ PARSER_MEDIA_TYPE =
533
+ // eslint-disable-next-line unicorn/prefer-includes
534
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
535
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
532
536
  transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
533
537
  /* Set configuration parameters */
534
-
535
- ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
536
- ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
537
- ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
538
- URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent
539
- cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent
540
- transformCaseFunc // eslint-disable-line indent
541
- ) // eslint-disable-line indent
542
- : DEFAULT_URI_SAFE_ATTRIBUTES;
543
- DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
544
- cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
545
- transformCaseFunc // eslint-disable-line indent
546
- ) // eslint-disable-line indent
547
- : DEFAULT_DATA_URI_TAGS;
548
- FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
549
- FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
550
- FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
551
- USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
538
+ ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
539
+ ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
540
+ ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
541
+ URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
542
+ DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
543
+ FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
544
+ FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
545
+ FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
546
+ USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
552
547
  ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
553
-
554
548
  ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
555
-
556
549
  ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
557
-
558
550
  ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
559
-
560
551
  SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
561
-
552
+ SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
562
553
  WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
563
-
564
554
  RETURN_DOM = cfg.RETURN_DOM || false; // Default false
565
-
566
555
  RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
567
-
568
556
  RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
569
-
570
557
  FORCE_BODY = cfg.FORCE_BODY || false; // Default false
571
-
572
558
  SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
573
-
574
559
  SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
575
-
576
560
  KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
577
-
578
561
  IN_PLACE = cfg.IN_PLACE || false; // Default false
579
-
580
562
  IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
581
563
  NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
564
+ MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
565
+ HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
582
566
  CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
583
-
584
567
  if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
585
568
  CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
586
569
  }
587
-
588
570
  if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
589
571
  CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
590
572
  }
591
-
592
573
  if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
593
574
  CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
594
575
  }
595
-
596
576
  if (SAFE_FOR_TEMPLATES) {
597
577
  ALLOW_DATA_ATTR = false;
598
578
  }
599
-
600
579
  if (RETURN_DOM_FRAGMENT) {
601
580
  RETURN_DOM = true;
602
581
  }
603
582
  /* Parse profile info */
604
-
605
-
606
583
  if (USE_PROFILES) {
607
- ALLOWED_TAGS = addToSet({}, [...text]);
584
+ ALLOWED_TAGS = addToSet({}, text);
608
585
  ALLOWED_ATTR = [];
609
-
610
586
  if (USE_PROFILES.html === true) {
611
587
  addToSet(ALLOWED_TAGS, html$1);
612
588
  addToSet(ALLOWED_ATTR, html);
613
589
  }
614
-
615
590
  if (USE_PROFILES.svg === true) {
616
591
  addToSet(ALLOWED_TAGS, svg$1);
617
592
  addToSet(ALLOWED_ATTR, svg);
618
593
  addToSet(ALLOWED_ATTR, xml);
619
594
  }
620
-
621
595
  if (USE_PROFILES.svgFilters === true) {
622
596
  addToSet(ALLOWED_TAGS, svgFilters);
623
597
  addToSet(ALLOWED_ATTR, svg);
624
598
  addToSet(ALLOWED_ATTR, xml);
625
599
  }
626
-
627
600
  if (USE_PROFILES.mathMl === true) {
628
601
  addToSet(ALLOWED_TAGS, mathMl$1);
629
602
  addToSet(ALLOWED_ATTR, mathMl);
@@ -631,171 +604,127 @@ function createDOMPurify() {
631
604
  }
632
605
  }
633
606
  /* Merge configuration parameters */
634
-
635
-
636
607
  if (cfg.ADD_TAGS) {
637
608
  if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
638
609
  ALLOWED_TAGS = clone(ALLOWED_TAGS);
639
610
  }
640
-
641
611
  addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
642
612
  }
643
-
644
613
  if (cfg.ADD_ATTR) {
645
614
  if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
646
615
  ALLOWED_ATTR = clone(ALLOWED_ATTR);
647
616
  }
648
-
649
617
  addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
650
618
  }
651
-
652
619
  if (cfg.ADD_URI_SAFE_ATTR) {
653
620
  addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
654
621
  }
655
-
656
622
  if (cfg.FORBID_CONTENTS) {
657
623
  if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
658
624
  FORBID_CONTENTS = clone(FORBID_CONTENTS);
659
625
  }
660
-
661
626
  addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
662
627
  }
663
628
  /* Add #text in case KEEP_CONTENT is set to true */
664
-
665
-
666
629
  if (KEEP_CONTENT) {
667
630
  ALLOWED_TAGS['#text'] = true;
668
631
  }
669
632
  /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
670
-
671
-
672
633
  if (WHOLE_DOCUMENT) {
673
634
  addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
674
635
  }
675
636
  /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
676
-
677
-
678
637
  if (ALLOWED_TAGS.table) {
679
638
  addToSet(ALLOWED_TAGS, ['tbody']);
680
639
  delete FORBID_TAGS.tbody;
681
640
  }
682
-
683
641
  if (cfg.TRUSTED_TYPES_POLICY) {
684
642
  if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
685
643
  throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
686
644
  }
687
-
688
645
  if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
689
646
  throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
690
- } // Overwrite existing TrustedTypes policy.
691
-
692
-
693
- trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; // Sign local variables required by `sanitize`.
694
-
647
+ }
648
+ // Overwrite existing TrustedTypes policy.
649
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
650
+ // Sign local variables required by `sanitize`.
695
651
  emptyHTML = trustedTypesPolicy.createHTML('');
696
652
  } else {
697
653
  // Uninitialized policy, attempt to initialize the internal dompurify policy.
698
654
  if (trustedTypesPolicy === undefined) {
699
655
  trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
700
- } // If creating the internal policy succeeded sign internal variables.
701
-
702
-
656
+ }
657
+ // If creating the internal policy succeeded sign internal variables.
703
658
  if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
704
659
  emptyHTML = trustedTypesPolicy.createHTML('');
705
660
  }
706
- } // Prevent further manipulation of configuration.
661
+ }
662
+ // Prevent further manipulation of configuration.
707
663
  // Not available in IE8, Safari 5, etc.
708
-
709
-
710
664
  if (freeze) {
711
665
  freeze(cfg);
712
666
  }
713
-
714
667
  CONFIG = cfg;
715
668
  };
716
-
717
- const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
718
- const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
719
- // namespace. We need to specify them explicitly
720
- // so that they don't get erroneously deleted from
721
- // HTML namespace.
722
-
723
- const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
724
669
  /* Keep track of all possible SVG and MathML tags
725
670
  * so that we can perform the namespace checks
726
671
  * correctly. */
727
-
728
- const ALL_SVG_TAGS = addToSet({}, svg$1);
729
- addToSet(ALL_SVG_TAGS, svgFilters);
730
- addToSet(ALL_SVG_TAGS, svgDisallowed);
731
- const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
732
- addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
672
+ const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
673
+ const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
733
674
  /**
734
- *
735
- *
736
- * @param {Element} element a DOM element whose namespace is being checked
737
- * @returns {boolean} Return false if the element has a
675
+ * @param element a DOM element whose namespace is being checked
676
+ * @returns Return false if the element has a
738
677
  * namespace that a spec-compliant parser would never
739
678
  * return. Return true otherwise.
740
679
  */
741
-
742
680
  const _checkValidNamespace = function _checkValidNamespace(element) {
743
- let parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
681
+ let parent = getParentNode(element);
682
+ // In JSDOM, if we're inside shadow DOM, then parentNode
744
683
  // can be null. We just simulate parent in this case.
745
-
746
684
  if (!parent || !parent.tagName) {
747
685
  parent = {
748
686
  namespaceURI: NAMESPACE,
749
687
  tagName: 'template'
750
688
  };
751
689
  }
752
-
753
690
  const tagName = stringToLowerCase(element.tagName);
754
691
  const parentTagName = stringToLowerCase(parent.tagName);
755
-
756
692
  if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
757
693
  return false;
758
694
  }
759
-
760
695
  if (element.namespaceURI === SVG_NAMESPACE) {
761
696
  // The only way to switch from HTML namespace to SVG
762
697
  // is via <svg>. If it happens via any other tag, then
763
698
  // it should be killed.
764
699
  if (parent.namespaceURI === HTML_NAMESPACE) {
765
700
  return tagName === 'svg';
766
- } // The only way to switch from MathML to SVG is via`
701
+ }
702
+ // The only way to switch from MathML to SVG is via`
767
703
  // svg if parent is either <annotation-xml> or MathML
768
704
  // text integration points.
769
-
770
-
771
705
  if (parent.namespaceURI === MATHML_NAMESPACE) {
772
706
  return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
773
- } // We only allow elements that are defined in SVG
707
+ }
708
+ // We only allow elements that are defined in SVG
774
709
  // spec. All others are disallowed in SVG namespace.
775
-
776
-
777
710
  return Boolean(ALL_SVG_TAGS[tagName]);
778
711
  }
779
-
780
712
  if (element.namespaceURI === MATHML_NAMESPACE) {
781
713
  // The only way to switch from HTML namespace to MathML
782
714
  // is via <math>. If it happens via any other tag, then
783
715
  // it should be killed.
784
716
  if (parent.namespaceURI === HTML_NAMESPACE) {
785
717
  return tagName === 'math';
786
- } // The only way to switch from SVG to MathML is via
718
+ }
719
+ // The only way to switch from SVG to MathML is via
787
720
  // <math> and HTML integration points
788
-
789
-
790
721
  if (parent.namespaceURI === SVG_NAMESPACE) {
791
722
  return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
792
- } // We only allow elements that are defined in MathML
723
+ }
724
+ // We only allow elements that are defined in MathML
793
725
  // spec. All others are disallowed in MathML namespace.
794
-
795
-
796
726
  return Boolean(ALL_MATHML_TAGS[tagName]);
797
727
  }
798
-
799
728
  if (element.namespaceURI === HTML_NAMESPACE) {
800
729
  // The only way to switch from SVG to HTML is via
801
730
  // HTML integration points, and from MathML to HTML
@@ -803,77 +732,67 @@ function createDOMPurify() {
803
732
  if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
804
733
  return false;
805
734
  }
806
-
807
735
  if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
808
736
  return false;
809
- } // We disallow tags that are specific for MathML
737
+ }
738
+ // We disallow tags that are specific for MathML
810
739
  // or SVG and should never appear in HTML namespace
811
-
812
-
813
740
  return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
814
- } // For XHTML and XML documents that support custom namespaces
815
-
816
-
741
+ }
742
+ // For XHTML and XML documents that support custom namespaces
817
743
  if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
818
744
  return true;
819
- } // The code should never reach this place (this means
745
+ }
746
+ // The code should never reach this place (this means
820
747
  // that the element somehow got namespace that is not
821
748
  // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
822
749
  // Return false just in case.
823
-
824
-
825
750
  return false;
826
751
  };
827
752
  /**
828
753
  * _forceRemove
829
754
  *
830
- * @param {Node} node a DOM node
755
+ * @param node a DOM node
831
756
  */
832
-
833
-
834
757
  const _forceRemove = function _forceRemove(node) {
835
758
  arrayPush(DOMPurify.removed, {
836
759
  element: node
837
760
  });
838
-
839
761
  try {
840
762
  // eslint-disable-next-line unicorn/prefer-dom-node-remove
841
- node.parentNode.removeChild(node);
763
+ getParentNode(node).removeChild(node);
842
764
  } catch (_) {
843
- node.remove();
765
+ remove(node);
844
766
  }
845
767
  };
846
768
  /**
847
769
  * _removeAttribute
848
770
  *
849
- * @param {String} name an Attribute name
850
- * @param {Node} node a DOM node
771
+ * @param name an Attribute name
772
+ * @param element a DOM node
851
773
  */
852
-
853
-
854
- const _removeAttribute = function _removeAttribute(name, node) {
774
+ const _removeAttribute = function _removeAttribute(name, element) {
855
775
  try {
856
776
  arrayPush(DOMPurify.removed, {
857
- attribute: node.getAttributeNode(name),
858
- from: node
777
+ attribute: element.getAttributeNode(name),
778
+ from: element
859
779
  });
860
780
  } catch (_) {
861
781
  arrayPush(DOMPurify.removed, {
862
782
  attribute: null,
863
- from: node
783
+ from: element
864
784
  });
865
785
  }
866
-
867
- node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
868
-
869
- if (name === 'is' && !ALLOWED_ATTR[name]) {
786
+ element.removeAttribute(name);
787
+ // We void attribute values for unremovable "is" attributes
788
+ if (name === 'is') {
870
789
  if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
871
790
  try {
872
- _forceRemove(node);
791
+ _forceRemove(element);
873
792
  } catch (_) {}
874
793
  } else {
875
794
  try {
876
- node.setAttribute(name, '');
795
+ element.setAttribute(name, '');
877
796
  } catch (_) {}
878
797
  }
879
798
  }
@@ -881,16 +800,13 @@ function createDOMPurify() {
881
800
  /**
882
801
  * _initDocument
883
802
  *
884
- * @param {String} dirty a string of dirty markup
885
- * @return {Document} a DOM, filled with the dirty markup
803
+ * @param dirty - a string of dirty markup
804
+ * @return a DOM, filled with the dirty markup
886
805
  */
887
-
888
-
889
806
  const _initDocument = function _initDocument(dirty) {
890
807
  /* Create a HTML document */
891
- let doc;
892
- let leadingWhitespace;
893
-
808
+ let doc = null;
809
+ let leadingWhitespace = null;
894
810
  if (FORCE_BODY) {
895
811
  dirty = '<remove></remove>' + dirty;
896
812
  } else {
@@ -898,200 +814,157 @@ function createDOMPurify() {
898
814
  const matches = stringMatch(dirty, /^[\r\n\t ]+/);
899
815
  leadingWhitespace = matches && matches[0];
900
816
  }
901
-
902
817
  if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
903
818
  // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
904
819
  dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
905
820
  }
906
-
907
821
  const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
908
822
  /*
909
823
  * Use the DOMParser API by default, fallback later if needs be
910
824
  * DOMParser not work for svg when has multiple root element.
911
825
  */
912
-
913
826
  if (NAMESPACE === HTML_NAMESPACE) {
914
827
  try {
915
828
  doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
916
829
  } catch (_) {}
917
830
  }
918
831
  /* Use createHTMLDocument in case DOMParser is not available */
919
-
920
-
921
832
  if (!doc || !doc.documentElement) {
922
833
  doc = implementation.createDocument(NAMESPACE, 'template', null);
923
-
924
834
  try {
925
835
  doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
926
- } catch (_) {// Syntax error if dirtyPayload is invalid xml
836
+ } catch (_) {
837
+ // Syntax error if dirtyPayload is invalid xml
927
838
  }
928
839
  }
929
-
930
840
  const body = doc.body || doc.documentElement;
931
-
932
841
  if (dirty && leadingWhitespace) {
933
842
  body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
934
843
  }
935
844
  /* Work on whole document or just its body */
936
-
937
-
938
845
  if (NAMESPACE === HTML_NAMESPACE) {
939
846
  return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
940
847
  }
941
-
942
848
  return WHOLE_DOCUMENT ? doc.documentElement : body;
943
849
  };
944
850
  /**
945
- * _createIterator
851
+ * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
946
852
  *
947
- * @param {Document} root document/fragment to create iterator for
948
- * @return {Iterator} iterator instance
853
+ * @param root The root element or node to start traversing on.
854
+ * @return The created NodeIterator
949
855
  */
950
-
951
-
952
- const _createIterator = function _createIterator(root) {
953
- return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
954
- NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
856
+ const _createNodeIterator = function _createNodeIterator(root) {
857
+ return createNodeIterator.call(root.ownerDocument || root, root,
858
+ // eslint-disable-next-line no-bitwise
859
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
955
860
  };
956
861
  /**
957
862
  * _isClobbered
958
863
  *
959
- * @param {Node} elm element to check for clobbering attacks
960
- * @return {Boolean} true if clobbered, false if safe
864
+ * @param element element to check for clobbering attacks
865
+ * @return true if clobbered, false if safe
961
866
  */
962
-
963
-
964
- const _isClobbered = function _isClobbered(elm) {
965
- return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
867
+ const _isClobbered = function _isClobbered(element) {
868
+ return element instanceof HTMLFormElement && (typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function');
966
869
  };
967
870
  /**
968
- * _isNode
871
+ * Checks whether the given object is a DOM node.
969
872
  *
970
- * @param {Node} obj object to check whether it's a DOM node
971
- * @return {Boolean} true is object is a DOM node
873
+ * @param value object to check whether it's a DOM node
874
+ * @return true is object is a DOM node
972
875
  */
973
-
974
-
975
- const _isNode = function _isNode(object) {
976
- return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
876
+ const _isNode = function _isNode(value) {
877
+ return typeof Node === 'function' && value instanceof Node;
977
878
  };
978
- /**
979
- * _executeHook
980
- * Execute user configurable hooks
981
- *
982
- * @param {String} entryPoint Name of the hook's entry point
983
- * @param {Node} currentNode node to work on with the hook
984
- * @param {Object} data additional hook parameters
985
- */
986
-
987
-
988
- const _executeHook = function _executeHook(entryPoint, currentNode, data) {
989
- if (!hooks[entryPoint]) {
990
- return;
991
- }
992
-
993
- arrayForEach(hooks[entryPoint], hook => {
879
+ function _executeHooks(hooks, currentNode, data) {
880
+ arrayForEach(hooks, hook => {
994
881
  hook.call(DOMPurify, currentNode, data, CONFIG);
995
882
  });
996
- };
883
+ }
997
884
  /**
998
885
  * _sanitizeElements
999
886
  *
1000
887
  * @protect nodeName
1001
888
  * @protect textContent
1002
889
  * @protect removeChild
1003
- *
1004
- * @param {Node} currentNode to check for permission to exist
1005
- * @return {Boolean} true if node was killed, false if left alive
890
+ * @param currentNode to check for permission to exist
891
+ * @return true if node was killed, false if left alive
1006
892
  */
1007
-
1008
-
1009
893
  const _sanitizeElements = function _sanitizeElements(currentNode) {
1010
- let content;
894
+ let content = null;
1011
895
  /* Execute a hook if present */
1012
-
1013
- _executeHook('beforeSanitizeElements', currentNode, null);
896
+ _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
1014
897
  /* Check if element is clobbered or can clobber */
1015
-
1016
-
1017
898
  if (_isClobbered(currentNode)) {
1018
899
  _forceRemove(currentNode);
1019
-
1020
900
  return true;
1021
901
  }
1022
902
  /* Now let's check the element's type and name */
1023
-
1024
-
1025
903
  const tagName = transformCaseFunc(currentNode.nodeName);
1026
904
  /* Execute a hook if present */
1027
-
1028
- _executeHook('uponSanitizeElement', currentNode, {
905
+ _executeHooks(hooks.uponSanitizeElement, currentNode, {
1029
906
  tagName,
1030
907
  allowedTags: ALLOWED_TAGS
1031
908
  });
1032
909
  /* Detect mXSS attempts abusing namespace confusion */
1033
-
1034
-
1035
- if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
910
+ if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
911
+ _forceRemove(currentNode);
912
+ return true;
913
+ }
914
+ /* Remove any occurrence of processing instructions */
915
+ if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
916
+ _forceRemove(currentNode);
917
+ return true;
918
+ }
919
+ /* Remove any kind of possibly harmful comments */
920
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
1036
921
  _forceRemove(currentNode);
1037
-
1038
922
  return true;
1039
923
  }
1040
924
  /* Remove element if anything forbids its presence */
1041
-
1042
-
1043
925
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1044
926
  /* Check if we have a custom element to handle */
1045
- if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
1046
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
1047
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
927
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
928
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
929
+ return false;
930
+ }
931
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
932
+ return false;
933
+ }
1048
934
  }
1049
935
  /* Keep content except for bad-listed elements */
1050
-
1051
-
1052
936
  if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
1053
937
  const parentNode = getParentNode(currentNode) || currentNode.parentNode;
1054
938
  const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
1055
-
1056
939
  if (childNodes && parentNode) {
1057
940
  const childCount = childNodes.length;
1058
-
1059
941
  for (let i = childCount - 1; i >= 0; --i) {
1060
- parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
942
+ const childClone = cloneNode(childNodes[i], true);
943
+ childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
944
+ parentNode.insertBefore(childClone, getNextSibling(currentNode));
1061
945
  }
1062
946
  }
1063
947
  }
1064
-
1065
948
  _forceRemove(currentNode);
1066
-
1067
949
  return true;
1068
950
  }
1069
951
  /* Check whether element has a valid namespace */
1070
-
1071
-
1072
952
  if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
1073
953
  _forceRemove(currentNode);
1074
-
1075
954
  return true;
1076
955
  }
1077
- /* Make sure that older browsers don't get noscript mXSS */
1078
-
1079
-
1080
- if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
956
+ /* Make sure that older browsers don't get fallback-tag mXSS */
957
+ if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
1081
958
  _forceRemove(currentNode);
1082
-
1083
959
  return true;
1084
960
  }
1085
961
  /* Sanitize element content to be template-safe */
1086
-
1087
-
1088
- if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
962
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
1089
963
  /* Get the element's text content */
1090
964
  content = currentNode.textContent;
1091
- content = stringReplace(content, MUSTACHE_EXPR, ' ');
1092
- content = stringReplace(content, ERB_EXPR, ' ');
1093
- content = stringReplace(content, TMPLIT_EXPR, ' ');
1094
-
965
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
966
+ content = stringReplace(content, expr, ' ');
967
+ });
1095
968
  if (currentNode.textContent !== content) {
1096
969
  arrayPush(DOMPurify.removed, {
1097
970
  element: currentNode.cloneNode()
@@ -1100,23 +973,18 @@ function createDOMPurify() {
1100
973
  }
1101
974
  }
1102
975
  /* Execute a hook if present */
1103
-
1104
-
1105
- _executeHook('afterSanitizeElements', currentNode, null);
1106
-
976
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
1107
977
  return false;
1108
978
  };
1109
979
  /**
1110
980
  * _isValidAttribute
1111
981
  *
1112
- * @param {string} lcTag Lowercase tag name of containing element.
1113
- * @param {string} lcName Lowercase attribute name.
1114
- * @param {string} value Attribute value.
1115
- * @return {Boolean} Returns true if `value` is valid, otherwise false.
982
+ * @param lcTag Lowercase tag name of containing element.
983
+ * @param lcName Lowercase attribute name.
984
+ * @param value Attribute value.
985
+ * @return Returns true if `value` is valid, otherwise false.
1116
986
  */
1117
987
  // eslint-disable-next-line complexity
1118
-
1119
-
1120
988
  const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
1121
989
  /* Make sure attribute cannot clobber */
1122
990
  if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
@@ -1126,35 +994,33 @@ function createDOMPurify() {
1126
994
  (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
1127
995
  XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
1128
996
  We don't need to check the value; it's always URI safe. */
1129
-
1130
-
1131
997
  if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
1132
- if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
998
+ if (
999
+ // First condition does a very basic check if a) it's basically a valid custom element tagname AND
1133
1000
  // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1134
1001
  // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
1135
- _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
1002
+ _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
1003
+ // Alternative, second condition checks if it's an `is`-attribute, AND
1136
1004
  // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1137
1005
  lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
1138
1006
  return false;
1139
1007
  }
1140
1008
  /* Check value is safe. First, is attr inert? If so, is safe */
1141
-
1142
1009
  } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
1143
1010
  return false;
1144
1011
  } else ;
1145
-
1146
1012
  return true;
1147
1013
  };
1148
1014
  /**
1149
- * _basicCustomElementCheck
1015
+ * _isBasicCustomElement
1150
1016
  * checks if at least one dash is included in tagName, and it's not the first char
1151
1017
  * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
1152
- * @param {string} tagName name of the tag of the node to sanitize
1018
+ *
1019
+ * @param tagName name of the tag of the node to sanitize
1020
+ * @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
1153
1021
  */
1154
-
1155
-
1156
- const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
1157
- return tagName.indexOf('-') > 0;
1022
+ const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
1023
+ return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
1158
1024
  };
1159
1025
  /**
1160
1026
  * _sanitizeAttributes
@@ -1164,109 +1030,85 @@ function createDOMPurify() {
1164
1030
  * @protect removeAttribute
1165
1031
  * @protect setAttribute
1166
1032
  *
1167
- * @param {Node} currentNode to sanitize
1033
+ * @param currentNode to sanitize
1168
1034
  */
1169
-
1170
-
1171
1035
  const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
1172
- let attr;
1173
- let value;
1174
- let lcName;
1175
- let l;
1176
1036
  /* Execute a hook if present */
1177
-
1178
- _executeHook('beforeSanitizeAttributes', currentNode, null);
1179
-
1037
+ _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
1180
1038
  const {
1181
1039
  attributes
1182
1040
  } = currentNode;
1183
1041
  /* Check if we have attributes; if not we might have a text node */
1184
-
1185
- if (!attributes) {
1042
+ if (!attributes || _isClobbered(currentNode)) {
1186
1043
  return;
1187
1044
  }
1188
-
1189
1045
  const hookEvent = {
1190
1046
  attrName: '',
1191
1047
  attrValue: '',
1192
1048
  keepAttr: true,
1193
- allowedAttributes: ALLOWED_ATTR
1049
+ allowedAttributes: ALLOWED_ATTR,
1050
+ forceKeepAttr: undefined
1194
1051
  };
1195
- l = attributes.length;
1052
+ let l = attributes.length;
1196
1053
  /* Go backwards over all attributes; safely remove bad ones */
1197
-
1198
1054
  while (l--) {
1199
- attr = attributes[l];
1055
+ const attr = attributes[l];
1200
1056
  const {
1201
1057
  name,
1202
- namespaceURI
1058
+ namespaceURI,
1059
+ value: attrValue
1203
1060
  } = attr;
1204
- value = name === 'value' ? attr.value : stringTrim(attr.value);
1205
- lcName = transformCaseFunc(name);
1061
+ const lcName = transformCaseFunc(name);
1062
+ const initValue = attrValue;
1063
+ let value = name === 'value' ? initValue : stringTrim(initValue);
1206
1064
  /* Execute a hook if present */
1207
-
1208
1065
  hookEvent.attrName = lcName;
1209
1066
  hookEvent.attrValue = value;
1210
1067
  hookEvent.keepAttr = true;
1211
1068
  hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
1212
-
1213
- _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
1214
-
1069
+ _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
1215
1070
  value = hookEvent.attrValue;
1071
+ /* Full DOM Clobbering protection via namespace isolation,
1072
+ * Prefix id and name attributes with `user-content-`
1073
+ */
1074
+ if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
1075
+ // Remove the attribute with this value
1076
+ _removeAttribute(name, currentNode);
1077
+ // Prefix the value and later re-create the attribute with the sanitized value
1078
+ value = SANITIZE_NAMED_PROPS_PREFIX + value;
1079
+ }
1080
+ /* Work around a security issue with comments inside attributes */
1081
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
1082
+ _removeAttribute(name, currentNode);
1083
+ continue;
1084
+ }
1216
1085
  /* Did the hooks approve of the attribute? */
1217
-
1218
1086
  if (hookEvent.forceKeepAttr) {
1219
1087
  continue;
1220
1088
  }
1221
- /* Remove attribute */
1222
-
1223
-
1224
- _removeAttribute(name, currentNode);
1225
1089
  /* Did the hooks approve of the attribute? */
1226
-
1227
-
1228
1090
  if (!hookEvent.keepAttr) {
1091
+ _removeAttribute(name, currentNode);
1229
1092
  continue;
1230
1093
  }
1231
1094
  /* Work around a security issue in jQuery 3.0 */
1232
-
1233
-
1234
1095
  if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
1235
1096
  _removeAttribute(name, currentNode);
1236
-
1237
1097
  continue;
1238
1098
  }
1239
1099
  /* Sanitize attribute content to be template-safe */
1240
-
1241
-
1242
1100
  if (SAFE_FOR_TEMPLATES) {
1243
- value = stringReplace(value, MUSTACHE_EXPR, ' ');
1244
- value = stringReplace(value, ERB_EXPR, ' ');
1245
- value = stringReplace(value, TMPLIT_EXPR, ' ');
1101
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
1102
+ value = stringReplace(value, expr, ' ');
1103
+ });
1246
1104
  }
1247
1105
  /* Is `value` valid for this attribute? */
1248
-
1249
-
1250
1106
  const lcTag = transformCaseFunc(currentNode.nodeName);
1251
-
1252
1107
  if (!_isValidAttribute(lcTag, lcName, value)) {
1108
+ _removeAttribute(name, currentNode);
1253
1109
  continue;
1254
1110
  }
1255
- /* Full DOM Clobbering protection via namespace isolation,
1256
- * Prefix id and name attributes with `user-content-`
1257
- */
1258
-
1259
-
1260
- if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
1261
- // Remove the attribute with this value
1262
- _removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
1263
-
1264
-
1265
- value = SANITIZE_NAMED_PROPS_PREFIX + value;
1266
- }
1267
1111
  /* Handle attributes that require Trusted Types */
1268
-
1269
-
1270
1112
  if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
1271
1113
  if (namespaceURI) ; else {
1272
1114
  switch (trustedTypes.getAttributeType(lcTag, lcName)) {
@@ -1275,7 +1117,6 @@ function createDOMPurify() {
1275
1117
  value = trustedTypesPolicy.createHTML(value);
1276
1118
  break;
1277
1119
  }
1278
-
1279
1120
  case 'TrustedScriptURL':
1280
1121
  {
1281
1122
  value = trustedTypesPolicy.createScriptURL(value);
@@ -1285,97 +1126,70 @@ function createDOMPurify() {
1285
1126
  }
1286
1127
  }
1287
1128
  /* Handle invalid data-* attribute set by try-catching it */
1288
-
1289
-
1290
- try {
1291
- if (namespaceURI) {
1292
- currentNode.setAttributeNS(namespaceURI, name, value);
1293
- } else {
1294
- /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1295
- currentNode.setAttribute(name, value);
1129
+ if (value !== initValue) {
1130
+ try {
1131
+ if (namespaceURI) {
1132
+ currentNode.setAttributeNS(namespaceURI, name, value);
1133
+ } else {
1134
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1135
+ currentNode.setAttribute(name, value);
1136
+ }
1137
+ if (_isClobbered(currentNode)) {
1138
+ _forceRemove(currentNode);
1139
+ } else {
1140
+ arrayPop(DOMPurify.removed);
1141
+ }
1142
+ } catch (_) {
1143
+ _removeAttribute(name, currentNode);
1296
1144
  }
1297
-
1298
- arrayPop(DOMPurify.removed);
1299
- } catch (_) {}
1145
+ }
1300
1146
  }
1301
1147
  /* Execute a hook if present */
1302
-
1303
-
1304
- _executeHook('afterSanitizeAttributes', currentNode, null);
1148
+ _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
1305
1149
  };
1306
1150
  /**
1307
1151
  * _sanitizeShadowDOM
1308
1152
  *
1309
- * @param {DocumentFragment} fragment to iterate over recursively
1153
+ * @param fragment to iterate over recursively
1310
1154
  */
1311
-
1312
-
1313
1155
  const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
1314
- let shadowNode;
1315
-
1316
- const shadowIterator = _createIterator(fragment);
1156
+ let shadowNode = null;
1157
+ const shadowIterator = _createNodeIterator(fragment);
1317
1158
  /* Execute a hook if present */
1318
-
1319
-
1320
- _executeHook('beforeSanitizeShadowDOM', fragment, null);
1321
-
1159
+ _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
1322
1160
  while (shadowNode = shadowIterator.nextNode()) {
1323
1161
  /* Execute a hook if present */
1324
- _executeHook('uponSanitizeShadowNode', shadowNode, null);
1162
+ _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
1325
1163
  /* Sanitize tags and elements */
1326
-
1327
-
1328
- if (_sanitizeElements(shadowNode)) {
1329
- continue;
1330
- }
1164
+ _sanitizeElements(shadowNode);
1165
+ /* Check attributes next */
1166
+ _sanitizeAttributes(shadowNode);
1331
1167
  /* Deep shadow DOM detected */
1332
-
1333
-
1334
1168
  if (shadowNode.content instanceof DocumentFragment) {
1335
1169
  _sanitizeShadowDOM(shadowNode.content);
1336
1170
  }
1337
- /* Check attributes, sanitize if necessary */
1338
-
1339
-
1340
- _sanitizeAttributes(shadowNode);
1341
1171
  }
1342
1172
  /* Execute a hook if present */
1343
-
1344
-
1345
- _executeHook('afterSanitizeShadowDOM', fragment, null);
1173
+ _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
1346
1174
  };
1347
- /**
1348
- * Sanitize
1349
- * Public method providing core sanitation functionality
1350
- *
1351
- * @param {String|Node} dirty string or DOM node
1352
- * @param {Object} configuration object
1353
- */
1354
1175
  // eslint-disable-next-line complexity
1355
-
1356
-
1357
1176
  DOMPurify.sanitize = function (dirty) {
1358
1177
  let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
1359
- let body;
1360
- let importedNode;
1361
- let currentNode;
1362
- let returnNode;
1178
+ let body = null;
1179
+ let importedNode = null;
1180
+ let currentNode = null;
1181
+ let returnNode = null;
1363
1182
  /* Make sure we have a string to sanitize.
1364
1183
  DO NOT return early, as this will return the wrong type if
1365
1184
  the user has requested a DOM object rather than a string */
1366
-
1367
1185
  IS_EMPTY_INPUT = !dirty;
1368
-
1369
1186
  if (IS_EMPTY_INPUT) {
1370
1187
  dirty = '<!-->';
1371
1188
  }
1372
1189
  /* Stringify, in case dirty is an object */
1373
-
1374
-
1375
1190
  if (typeof dirty !== 'string' && !_isNode(dirty)) {
1376
1191
  if (typeof dirty.toString === 'function') {
1377
1192
  dirty = dirty.toString();
1378
-
1379
1193
  if (typeof dirty !== 'string') {
1380
1194
  throw typeErrorCreate('dirty is not a string, aborting');
1381
1195
  }
@@ -1384,32 +1198,23 @@ function createDOMPurify() {
1384
1198
  }
1385
1199
  }
1386
1200
  /* Return dirty HTML if DOMPurify cannot run */
1387
-
1388
-
1389
1201
  if (!DOMPurify.isSupported) {
1390
1202
  return dirty;
1391
1203
  }
1392
1204
  /* Assign config vars */
1393
-
1394
-
1395
1205
  if (!SET_CONFIG) {
1396
1206
  _parseConfig(cfg);
1397
1207
  }
1398
1208
  /* Clean up removed elements */
1399
-
1400
-
1401
1209
  DOMPurify.removed = [];
1402
1210
  /* Check if dirty is correctly typed for IN_PLACE */
1403
-
1404
1211
  if (typeof dirty === 'string') {
1405
1212
  IN_PLACE = false;
1406
1213
  }
1407
-
1408
1214
  if (IN_PLACE) {
1409
1215
  /* Do some early pre-sanitization to avoid unsafe root nodes */
1410
1216
  if (dirty.nodeName) {
1411
1217
  const tagName = transformCaseFunc(dirty.nodeName);
1412
-
1413
1218
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1414
1219
  throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
1415
1220
  }
@@ -1419,8 +1224,7 @@ function createDOMPurify() {
1419
1224
  elements being stripped by the parser */
1420
1225
  body = _initDocument('<!---->');
1421
1226
  importedNode = body.ownerDocument.importNode(dirty, true);
1422
-
1423
- if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
1227
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
1424
1228
  /* Node is already a body, use as is */
1425
1229
  body = importedNode;
1426
1230
  } else if (importedNode.nodeName === 'HTML') {
@@ -1431,62 +1235,43 @@ function createDOMPurify() {
1431
1235
  }
1432
1236
  } else {
1433
1237
  /* Exit directly if we have nothing to do */
1434
- if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
1238
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
1239
+ // eslint-disable-next-line unicorn/prefer-includes
1435
1240
  dirty.indexOf('<') === -1) {
1436
1241
  return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
1437
1242
  }
1438
1243
  /* Initialize the document to work on */
1439
-
1440
-
1441
1244
  body = _initDocument(dirty);
1442
1245
  /* Check we have a DOM node from the data */
1443
-
1444
1246
  if (!body) {
1445
1247
  return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
1446
1248
  }
1447
1249
  }
1448
1250
  /* Remove first element node (ours) if FORCE_BODY is set */
1449
-
1450
-
1451
1251
  if (body && FORCE_BODY) {
1452
1252
  _forceRemove(body.firstChild);
1453
1253
  }
1454
1254
  /* Get node iterator */
1455
-
1456
-
1457
- const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
1255
+ const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
1458
1256
  /* Now start iterating over the created document */
1459
-
1460
-
1461
1257
  while (currentNode = nodeIterator.nextNode()) {
1462
1258
  /* Sanitize tags and elements */
1463
- if (_sanitizeElements(currentNode)) {
1464
- continue;
1465
- }
1259
+ _sanitizeElements(currentNode);
1260
+ /* Check attributes next */
1261
+ _sanitizeAttributes(currentNode);
1466
1262
  /* Shadow DOM detected, sanitize it */
1467
-
1468
-
1469
1263
  if (currentNode.content instanceof DocumentFragment) {
1470
1264
  _sanitizeShadowDOM(currentNode.content);
1471
1265
  }
1472
- /* Check attributes, sanitize if necessary */
1473
-
1474
-
1475
- _sanitizeAttributes(currentNode);
1476
1266
  }
1477
1267
  /* If we sanitized `dirty` in-place, return it. */
1478
-
1479
-
1480
1268
  if (IN_PLACE) {
1481
1269
  return dirty;
1482
1270
  }
1483
1271
  /* Return sanitized string or DOM */
1484
-
1485
-
1486
1272
  if (RETURN_DOM) {
1487
1273
  if (RETURN_DOM_FRAGMENT) {
1488
1274
  returnNode = createDocumentFragment.call(body.ownerDocument);
1489
-
1490
1275
  while (body.firstChild) {
1491
1276
  // eslint-disable-next-line unicorn/prefer-dom-node-append
1492
1277
  returnNode.appendChild(body.firstChild);
@@ -1494,8 +1279,7 @@ function createDOMPurify() {
1494
1279
  } else {
1495
1280
  returnNode = body;
1496
1281
  }
1497
-
1498
- if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {
1282
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
1499
1283
  /*
1500
1284
  AdoptNode() is not used because internal state is not reset
1501
1285
  (e.g. the past names map of a HTMLFormElement), this is safe
@@ -1505,132 +1289,60 @@ function createDOMPurify() {
1505
1289
  */
1506
1290
  returnNode = importNode.call(originalDocument, returnNode, true);
1507
1291
  }
1508
-
1509
1292
  return returnNode;
1510
1293
  }
1511
-
1512
1294
  let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1513
1295
  /* Serialize doctype if allowed */
1514
-
1515
1296
  if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1516
1297
  serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
1517
1298
  }
1518
1299
  /* Sanitize final string template-safe */
1519
-
1520
-
1521
1300
  if (SAFE_FOR_TEMPLATES) {
1522
- serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');
1523
- serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');
1524
- serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');
1301
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
1302
+ serializedHTML = stringReplace(serializedHTML, expr, ' ');
1303
+ });
1525
1304
  }
1526
-
1527
1305
  return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1528
1306
  };
1529
- /**
1530
- * Public method to set the configuration once
1531
- * setConfig
1532
- *
1533
- * @param {Object} cfg configuration object
1534
- */
1535
-
1536
-
1537
- DOMPurify.setConfig = function (cfg) {
1307
+ DOMPurify.setConfig = function () {
1308
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
1538
1309
  _parseConfig(cfg);
1539
-
1540
1310
  SET_CONFIG = true;
1541
1311
  };
1542
- /**
1543
- * Public method to remove the configuration
1544
- * clearConfig
1545
- *
1546
- */
1547
-
1548
-
1549
1312
  DOMPurify.clearConfig = function () {
1550
1313
  CONFIG = null;
1551
1314
  SET_CONFIG = false;
1552
1315
  };
1553
- /**
1554
- * Public method to check if an attribute value is valid.
1555
- * Uses last set config, if any. Otherwise, uses config defaults.
1556
- * isValidAttribute
1557
- *
1558
- * @param {string} tag Tag name of containing element.
1559
- * @param {string} attr Attribute name.
1560
- * @param {string} value Attribute value.
1561
- * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
1562
- */
1563
-
1564
-
1565
1316
  DOMPurify.isValidAttribute = function (tag, attr, value) {
1566
1317
  /* Initialize shared config vars if necessary. */
1567
1318
  if (!CONFIG) {
1568
1319
  _parseConfig({});
1569
1320
  }
1570
-
1571
1321
  const lcTag = transformCaseFunc(tag);
1572
1322
  const lcName = transformCaseFunc(attr);
1573
1323
  return _isValidAttribute(lcTag, lcName, value);
1574
1324
  };
1575
- /**
1576
- * AddHook
1577
- * Public method to add DOMPurify hooks
1578
- *
1579
- * @param {String} entryPoint entry point for the hook to add
1580
- * @param {Function} hookFunction function to execute
1581
- */
1582
-
1583
-
1584
1325
  DOMPurify.addHook = function (entryPoint, hookFunction) {
1585
1326
  if (typeof hookFunction !== 'function') {
1586
1327
  return;
1587
1328
  }
1588
-
1589
- hooks[entryPoint] = hooks[entryPoint] || [];
1590
1329
  arrayPush(hooks[entryPoint], hookFunction);
1591
1330
  };
1592
- /**
1593
- * RemoveHook
1594
- * Public method to remove a DOMPurify hook at a given entryPoint
1595
- * (pops it from the stack of hooks if more are present)
1596
- *
1597
- * @param {String} entryPoint entry point for the hook to remove
1598
- * @return {Function} removed(popped) hook
1599
- */
1600
-
1601
-
1602
- DOMPurify.removeHook = function (entryPoint) {
1603
- if (hooks[entryPoint]) {
1604
- return arrayPop(hooks[entryPoint]);
1331
+ DOMPurify.removeHook = function (entryPoint, hookFunction) {
1332
+ if (hookFunction !== undefined) {
1333
+ const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
1334
+ return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
1605
1335
  }
1336
+ return arrayPop(hooks[entryPoint]);
1606
1337
  };
1607
- /**
1608
- * RemoveHooks
1609
- * Public method to remove all DOMPurify hooks at a given entryPoint
1610
- *
1611
- * @param {String} entryPoint entry point for the hooks to remove
1612
- */
1613
-
1614
-
1615
1338
  DOMPurify.removeHooks = function (entryPoint) {
1616
- if (hooks[entryPoint]) {
1617
- hooks[entryPoint] = [];
1618
- }
1339
+ hooks[entryPoint] = [];
1619
1340
  };
1620
- /**
1621
- * RemoveAllHooks
1622
- * Public method to remove all DOMPurify hooks
1623
- *
1624
- */
1625
-
1626
-
1627
1341
  DOMPurify.removeAllHooks = function () {
1628
- hooks = {};
1342
+ hooks = _createHooksMap();
1629
1343
  };
1630
-
1631
1344
  return DOMPurify;
1632
1345
  }
1633
-
1634
1346
  var purify = createDOMPurify();
1635
1347
 
1636
1348
  var _path$2, _path2$1;
@@ -1646,7 +1358,7 @@ var SvgInternalServerError = function SvgInternalServerError(props) {
1646
1358
  })), _path2$1 || (_path2$1 = /*#__PURE__*/React.createElement("path", {
1647
1359
  fill: "#000",
1648
1360
  fillRule: "evenodd",
1649
- d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.915Zm9.19-32.132-.107.159h-.313l5.399-48.437h54.54V2.043H8.976L2.403 63.94h6.025c.94-1.643 2.035-3.208 3.287-4.538 6.338-7.904 15.806-12.364 26.448-12.364 18.076 0 31.77 13.85 31.77 31.926v.157c0 18.388-13.85 31.926-32.552 31.926-15.963 0-28.874-10.251-30.674-23.163l-.078-.547H.447l.078.704c1.878 16.041 17.293 28.561 36.778 28.561 22.379 0 38.812-15.885 38.812-37.638v-.156c0-21.284-15.963-37.247-37.247-37.247-12.213 0-23.498 5.49-29.55 14.395Zm87.03 45.232C89.42 91.053 85.656 76.469 85.656 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C103.286 5.645 113.384 0 125.963 0c12.58 0 22.697 5.685 29.654 15.844 6.947 10.143 10.732 24.727 10.732 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.076 15.725-29.654 15.725-12.58 0-22.678-5.665-29.615-15.814m54.063-4.51c5.736-9 8.878-22.023 8.878-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.736 9.01-8.878 22.033-8.878 38.03v.235c0 16.036 3.142 29.059 8.878 38.059 5.724 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.448-13.968m36.162 4.51c-6.927-10.134-10.692-24.718-10.692-42.569v-.235c0-17.89 3.765-32.474 10.692-42.598C193.511 5.645 203.609 0 216.188 0c12.581 0 22.698 5.685 29.655 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.075 15.725-29.654 15.725-12.58 0-22.677-5.665-29.615-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.448 13.968 10.414 0 18.724-4.984 24.449-13.968m-114.674 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C86.055 22.701 101.08.4 125.963.4c24.883 0 39.986 22.458 39.986 57.983v.235c0 35.839-15.103 57.983-39.986 57.983m0-5.555c21.127 0 33.726-20.267 33.726-52.428v-.235c0-32.317-12.599-52.427-33.726-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428m50.318-52.428c0 35.604 15.024 57.983 39.907 57.983 24.884 0 39.986-22.144 39.986-57.983v-.235C256.174 22.858 241.072.4 216.188.4c-24.883 0-39.907 22.301-39.907 57.983zm73.633 0c0 32.16-12.598 52.428-33.726 52.428-21.127 0-33.725-20.267-33.725-52.428v-.235c0-32.082 12.598-52.427 33.725-52.427 21.128 0 33.726 20.11 33.726 52.427z",
1361
+ d: "M.128 88.087v-.003L0 86.936h6.976l.127.892c1.766 12.672 14.469 22.817 30.278 22.817 18.489 0 32.152-13.365 32.152-31.525v-.157c0-17.857-13.517-31.526-31.37-31.526-10.526 0-19.877 4.41-26.136 12.214l-.01.012-.01.012c-1.226 1.302-2.304 2.84-3.231 4.462l-.115.202H1.958L8.616 1.643h60.621v6.434H14.655L9.411 55.124c6.23-8.672 17.41-13.965 29.457-13.965 21.505 0 37.647 16.143 37.647 37.648v.156c0 21.986-16.624 38.038-39.212 38.038-19.643 0-35.269-12.63-37.175-28.915m9.19-32.132-.107.159h-.313l5.399-48.437h54.54V2.043H8.976L2.403 63.94h6.025c.94-1.643 2.035-3.208 3.287-4.538 6.338-7.904 15.806-12.364 26.448-12.364 18.076 0 31.77 13.85 31.77 31.926v.157c0 18.388-13.85 31.926-32.552 31.926-15.963 0-28.874-10.251-30.674-23.163l-.078-.547H.447l.078.704c1.878 16.041 17.293 28.561 36.778 28.561 22.379 0 38.812-15.885 38.812-37.638v-.156c0-21.284-15.963-37.247-37.247-37.247-12.213 0-23.498 5.49-29.55 14.395m87.03 45.232C89.42 91.053 85.656 76.469 85.656 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C103.286 5.645 113.384 0 125.963 0c12.58 0 22.697 5.685 29.654 15.844 6.947 10.143 10.732 24.727 10.732 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.076 15.725-29.654 15.725-12.58 0-22.678-5.665-29.615-15.814m54.063-4.51c5.736-9 8.878-22.023 8.878-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.736 9.01-8.878 22.033-8.878 38.03v.235c0 16.036 3.142 29.059 8.878 38.059 5.724 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.448-13.968m36.162 4.51c-6.927-10.134-10.692-24.718-10.692-42.569v-.235c0-17.89 3.765-32.474 10.692-42.598C193.511 5.645 203.609 0 216.188 0c12.581 0 22.698 5.685 29.655 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.785 32.553-10.732 42.658-6.958 10.12-17.075 15.725-29.654 15.725s-22.677-5.665-29.615-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.449-13.91-10.413 0-18.723 5.004-24.448 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.448 13.968s18.724-4.984 24.449-13.968m-114.674 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C86.055 22.701 101.08.4 125.963.4c24.883 0 39.986 22.458 39.986 57.983v.235c0 35.839-15.103 57.983-39.986 57.983m0-5.555c21.127 0 33.726-20.267 33.726-52.428v-.235c0-32.317-12.599-52.427-33.726-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428m50.318-52.428c0 35.604 15.024 57.983 39.907 57.983 24.884 0 39.986-22.144 39.986-57.983v-.235C256.174 22.858 241.072.4 216.188.4s-39.907 22.301-39.907 57.983zm73.633 0c0 32.16-12.598 52.428-33.726 52.428-21.127 0-33.725-20.267-33.725-52.428v-.235c0-32.082 12.598-52.427 33.725-52.427s33.726 20.11 33.726 52.427z",
1650
1362
  clipRule: "evenodd"
1651
1363
  })));
1652
1364
  };
@@ -1662,7 +1374,7 @@ var SvgPageNotFound = function SvgPageNotFound(props) {
1662
1374
  fill: "#000",
1663
1375
  stroke: "#000",
1664
1376
  strokeWidth: 0.4,
1665
- d: "M58.94 115.558v.2h6.503V87.51H83.363V81.476H65.442V2.443H56.22l-.06.085L.836 81.483l-.036.051v5.976h58.14v28.048Zm179.355 0v.2h6.503V87.51H262.718V81.476H244.798V2.443H235.574l-.06.085-55.323 78.955-.036.051v5.976h58.14zM58.94 9.182v72.294H8.005L58.93 9.182h.009Zm32.32 50.036c0 17.826 3.76 32.366 10.657 42.456 6.902 10.097 16.94 15.727 29.451 15.727 12.51 0 22.567-5.57 29.489-15.639 6.916-10.06 10.696-24.6 10.696-42.544v-.235c0-17.787-3.78-32.327-10.696-42.426C153.935 6.45 143.879.8 131.368.8s-22.548 5.61-29.451 15.698c-6.896 10.08-10.657 24.62-10.657 42.485v.235Zm73.633 0c0 16.058-3.145 29.123-8.908 38.167-5.758 9.035-14.129 14.06-24.617 14.06-10.489 0-18.86-5.025-24.617-14.06-5.763-9.044-8.91-22.109-8.91-38.167v-.235c0-16.019 3.147-29.084 8.91-38.137 5.757-9.045 14.128-14.09 24.617-14.09s18.859 4.987 24.617 14.002c5.762 9.024 8.908 22.089 8.908 38.225zm73.402-50.037v72.295H187.36l50.926-72.294h.009Z"
1377
+ d: "M58.94 115.558v.2h6.503V87.51h17.92v-6.034h-17.92V2.443H56.22l-.06.085L.836 81.483l-.036.051v5.976h58.14zm179.355 0v.2h6.503V87.51h17.92v-6.034h-17.92V2.443h-9.224l-.06.085-55.323 78.955-.036.051v5.976h58.14zM58.94 9.182v72.294H8.005L58.93 9.182zm32.32 50.036c0 17.826 3.76 32.366 10.657 42.456 6.902 10.097 16.94 15.727 29.451 15.727s22.567-5.57 29.489-15.639c6.916-10.06 10.696-24.6 10.696-42.544v-.235c0-17.787-3.78-32.327-10.696-42.426C153.935 6.45 143.879.8 131.368.8s-22.548 5.61-29.451 15.698c-6.896 10.08-10.657 24.62-10.657 42.485zm73.633 0c0 16.058-3.145 29.123-8.908 38.167-5.758 9.035-14.129 14.06-24.617 14.06s-18.86-5.025-24.617-14.06c-5.763-9.044-8.91-22.109-8.91-38.167v-.235c0-16.019 3.147-29.084 8.91-38.137 5.757-9.045 14.128-14.09 24.617-14.09s18.859 4.987 24.617 14.002c5.762 9.024 8.908 22.089 8.908 38.225zm73.402-50.037v72.295H187.36l50.926-72.294z"
1666
1378
  })));
1667
1379
  };
1668
1380
 
@@ -1675,11 +1387,11 @@ var SvgUnauthorized = function SvgUnauthorized(props) {
1675
1387
  viewBox: "0 0 258 117"
1676
1388
  }, props), _path || (_path = /*#__PURE__*/React.createElement("path", {
1677
1389
  fill: "#000",
1678
- d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.248H58.54M7.13 81.076h51.41V8.382h-.313L7.129 80.919v.157M130.768 116.601c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428M218.958 116.601c-21.91 0-35.682-12.676-37.794-29.344l-.079-.704h6.026l.078.626c2.113 13.537 13.537 23.867 31.769 23.867 18.233 0 31.535-11.269 31.535-26.606v-.156c0-15.885-12.598-25.275-33.413-25.275h-12.754v-5.477h12.598c17.137 0 29.031-9.86 29.031-23.866v-.157c0-13.694-11.425-23.553-27.779-23.553-16.276 0-27.153 9.781-28.405 22.536l-.078.782h-6.025l.078-.782C185.233 12.45 198.379.4 218.176.4c19.875 0 34.039 12.129 34.039 28.561v.157c0 13.928-9.39 23.866-24.18 26.761v.313c17.294 1.174 28.718 11.973 28.718 28.014v.156c0 18.624-15.963 32.239-37.795 32.239"
1390
+ d: "M58.54 114.958V86.71H.4v-5.712L55.723 2.043h8.92v79.033h17.92v5.634h-17.92v28.248zM7.13 81.076h51.41V8.382h-.313L7.129 80.919zM130.768 116.601c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428M218.958 116.601c-21.91 0-35.682-12.676-37.794-29.344l-.079-.704h6.026l.078.626c2.113 13.537 13.537 23.867 31.769 23.867 18.233 0 31.535-11.269 31.535-26.606v-.156c0-15.885-12.598-25.275-33.413-25.275h-12.754v-5.477h12.598c17.137 0 29.031-9.86 29.031-23.866v-.157c0-13.694-11.425-23.553-27.779-23.553-16.276 0-27.153 9.781-28.405 22.536l-.078.782h-6.025l.078-.782C185.233 12.45 198.379.4 218.176.4c19.875 0 34.039 12.129 34.039 28.561v.157c0 13.928-9.39 23.866-24.18 26.761v.313c17.294 1.174 28.718 11.973 28.718 28.014v.156c0 18.624-15.963 32.239-37.795 32.239"
1679
1391
  })), _path2 || (_path2 = /*#__PURE__*/React.createElement("path", {
1680
1392
  fill: "#000",
1681
1393
  fillRule: "evenodd",
1682
- d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.248H58.14m6.503-28.648h17.92v-5.634h-17.92V2.043h-8.92L.4 80.998v5.712h58.14v28.248h6.103V86.71m116.124.598-.001-.006-.127-1.149h6.825l.12.965.001.006c2.081 13.313 13.313 23.521 31.373 23.521 18.078 0 31.135-11.15 31.135-26.204v-.157c0-7.824-3.096-14.021-8.741-18.275-5.66-4.264-13.918-6.6-24.272-6.6h-13.154v-6.277h12.998c8.494 0 15.656-2.443 20.687-6.59 5.026-4.141 7.944-9.995 7.944-16.876v-.157c0-13.415-11.183-23.153-27.379-23.153-16.106 0-26.778 9.658-28.007 22.175l-.114 1.143h-6.829l.122-1.22C184.856 12.182 198.2 0 218.176 0c20.03 0 34.439 12.247 34.439 28.961v.157c0 7.059-2.382 13.123-6.649 17.788-3.96 4.33-9.528 7.436-16.281 9.027 8.003.838 14.694 3.783 19.472 8.403 5.102 4.932 7.996 11.749 7.996 19.87v.156c0 18.902-16.204 32.639-38.195 32.639-22.083 0-36.05-12.799-38.191-29.693m47.619-31.09a46.445 46.445 0 0 0-.351-.026v-.313l.022-.004.303-.06c14.602-2.977 23.855-12.871 23.855-26.697v-.157C252.215 12.53 238.051.4 218.176.4c-19.797 0-32.943 12.05-34.43 28.092l-.078.782h6.025l.078-.782c1.252-12.755 12.129-22.536 28.405-22.536 16.354 0 27.779 9.86 27.779 23.553v.157c0 14.006-11.894 23.866-29.031 23.866h-12.598v5.477h12.754c20.815 0 33.413 9.39 33.413 25.275v.156c0 15.338-13.302 26.606-31.535 26.606-18.232 0-29.656-10.33-31.769-23.867l-.078-.626h-6.026l.079.704c2.112 16.668 15.884 29.344 37.794 29.344 21.832 0 37.795-13.615 37.795-32.239v-.156c0-15.933-11.27-26.694-28.367-27.989M58.54 81.075H7.13v-.157L58.226 8.382h.313v72.694ZM58.14 9.2 7.79 80.676h50.35V9.2m43.012 91.987C94.225 91.053 90.46 76.469 90.46 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C108.09 5.645 118.188 0 130.768 0c12.58 0 22.697 5.685 29.654 15.844 6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.784 32.553-10.732 42.658-6.957 10.12-17.075 15.725-29.653 15.725-12.58 0-22.678-5.665-29.616-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.448-13.91-10.413 0-18.724 5.004-24.449 13.997-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.449 13.968 10.413 0 18.723-4.984 24.448-13.968m-24.448 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427-21.128 0-33.726 20.345-33.726 52.427v.235c0 32.16 12.598 52.428 33.726 52.428",
1394
+ d: "M58.14 115.358V87.11H0V80.87L55.515 1.643h9.528v79.033h17.92v6.434h-17.92v28.248zm6.503-28.648h17.92v-5.634h-17.92V2.043h-8.92L.4 80.998v5.712h58.14v28.248h6.103zm116.124.598-.001-.006-.127-1.149h6.825l.12.965.001.006c2.081 13.313 13.313 23.521 31.373 23.521 18.078 0 31.135-11.15 31.135-26.204v-.157c0-7.824-3.096-14.021-8.741-18.275-5.66-4.264-13.918-6.6-24.272-6.6h-13.154v-6.277h12.998c8.494 0 15.656-2.443 20.687-6.59 5.026-4.141 7.944-9.995 7.944-16.876v-.157c0-13.415-11.183-23.153-27.379-23.153-16.106 0-26.778 9.658-28.007 22.175l-.114 1.143h-6.829l.122-1.22C184.856 12.182 198.2 0 218.176 0c20.03 0 34.439 12.247 34.439 28.961v.157c0 7.059-2.382 13.123-6.649 17.788-3.96 4.33-9.528 7.436-16.281 9.027 8.003.838 14.694 3.783 19.472 8.403 5.102 4.932 7.996 11.749 7.996 19.87v.156c0 18.902-16.204 32.639-38.195 32.639-22.083 0-36.05-12.799-38.191-29.693m47.619-31.09-.351-.026v-.313l.022-.004.303-.06c14.602-2.977 23.855-12.871 23.855-26.697v-.157C252.215 12.53 238.051.4 218.176.4c-19.797 0-32.943 12.05-34.43 28.092l-.078.782h6.025l.078-.782c1.252-12.755 12.129-22.536 28.405-22.536 16.354 0 27.779 9.86 27.779 23.553v.157c0 14.006-11.894 23.866-29.031 23.866h-12.598v5.477h12.754c20.815 0 33.413 9.39 33.413 25.275v.156c0 15.338-13.302 26.606-31.535 26.606-18.232 0-29.656-10.33-31.769-23.867l-.078-.626h-6.026l.079.704c2.112 16.668 15.884 29.344 37.794 29.344 21.832 0 37.795-13.615 37.795-32.239v-.156c0-15.933-11.27-26.694-28.367-27.989M58.54 81.075H7.13v-.157L58.226 8.382h.313zM58.14 9.2 7.79 80.676h50.35zm43.012 91.987C94.225 91.053 90.46 76.469 90.46 58.618v-.235c0-17.89 3.765-32.474 10.692-42.598C108.09 5.645 118.188 0 130.768 0s22.697 5.685 29.654 15.844c6.946 10.143 10.731 24.727 10.731 42.54v.234c0 17.968-3.784 32.553-10.732 42.658-6.957 10.12-17.075 15.725-29.653 15.725-12.58 0-22.678-5.665-29.616-15.814m54.064-4.51c5.735-9 8.877-22.023 8.877-38.059v-.235c0-16.114-3.142-29.137-8.877-38.117-5.724-8.963-14.034-13.91-24.448-13.91s-18.724 5.004-24.449 13.997c-5.735 9.01-8.877 22.033-8.877 38.03v.235c0 16.036 3.142 29.059 8.877 38.059 5.725 8.984 14.035 13.968 24.449 13.968 10.413 0 18.723-4.984 24.448-13.968m-24.448 19.924c-24.884 0-39.908-22.38-39.908-57.983v-.235C90.86 22.701 105.884.4 130.768.4c24.883 0 39.985 22.458 39.985 57.983v.235c0 35.839-15.102 57.983-39.985 57.983m0-5.555c21.127 0 33.725-20.267 33.725-52.428v-.235c0-32.317-12.598-52.427-33.725-52.427S97.042 26.3 97.042 58.383v.235c0 32.16 12.598 52.428 33.726 52.428",
1683
1395
  clipRule: "evenodd"
1684
1396
  })));
1685
1397
  };
@@ -1706,7 +1418,7 @@ var css = ".neeto-molecules-error-page__wrapper{align-items:center;container-nam
1706
1418
  n(css,{});
1707
1419
 
1708
1420
  function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
1709
- function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
1421
+ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
1710
1422
  var sanitize = purify.sanitize;
1711
1423
  var ErrorPage = function ErrorPage(_ref) {
1712
1424
  var _ref$homeUrl = _ref.homeUrl,