@blockspark/chat-widget 1.0.11 → 1.0.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{ChatWidget-D7n917Xu.mjs → ChatWidget-6eL3-YdH.mjs} +2 -2
- package/dist/{ChatWidget-D7n917Xu.mjs.map → ChatWidget-6eL3-YdH.mjs.map} +1 -1
- package/dist/{ChatWidget-DzXzVMnC.js → ChatWidget-CxS-a1ha.js} +2 -2
- package/dist/{ChatWidget-DzXzVMnC.js.map → ChatWidget-CxS-a1ha.js.map} +1 -1
- package/dist/index.cjs.js +1 -1
- package/dist/index.esm.js +1 -1
- package/dist/nuxt.cjs.js +1 -1
- package/dist/nuxt.esm.js +2 -2
- package/dist/{sanitize-KZRn4tR6.mjs → sanitize-DA2IXhv_.mjs} +941 -950
- package/dist/sanitize-DA2IXhv_.mjs.map +1 -0
- package/dist/{sanitize-DjaOZGNM.js → sanitize-lemglDjf.js} +3 -3
- package/dist/sanitize-lemglDjf.js.map +1 -0
- package/dist/utils/sanitize.d.ts.map +1 -1
- package/dist/vue.cjs.js +1 -1
- package/dist/vue.esm.js +2 -2
- package/package.json +4 -3
- package/dist/sanitize-DjaOZGNM.js.map +0 -1
- package/dist/sanitize-KZRn4tR6.mjs.map +0 -1
|
@@ -455,13 +455,13 @@ let pubCache;
|
|
|
455
455
|
const isKeyObject = (key) => {
|
|
456
456
|
return key?.[Symbol.toStringTag] === "KeyObject";
|
|
457
457
|
};
|
|
458
|
-
const importAndCache = async (cache, key, jwk, alg,
|
|
458
|
+
const importAndCache = async (cache, key, jwk, alg, freeze2 = false) => {
|
|
459
459
|
let cached = cache.get(key);
|
|
460
460
|
if (cached?.[alg]) {
|
|
461
461
|
return cached[alg];
|
|
462
462
|
}
|
|
463
463
|
const cryptoKey = await parse({ ...jwk, alg });
|
|
464
|
-
if (
|
|
464
|
+
if (freeze2)
|
|
465
465
|
Object.freeze(key);
|
|
466
466
|
if (!cached) {
|
|
467
467
|
cache.set(key, { [alg]: cryptoKey });
|
|
@@ -1784,1024 +1784,1015 @@ function createChatService(config) {
|
|
|
1784
1784
|
return new ChatService(config);
|
|
1785
1785
|
}
|
|
1786
1786
|
/*! @license DOMPurify 3.3.1 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.1/LICENSE */
|
|
1787
|
-
|
|
1788
|
-
|
|
1789
|
-
|
|
1790
|
-
|
|
1791
|
-
|
|
1792
|
-
|
|
1793
|
-
|
|
1794
|
-
|
|
1795
|
-
|
|
1796
|
-
|
|
1797
|
-
|
|
1798
|
-
|
|
1799
|
-
|
|
1800
|
-
|
|
1801
|
-
|
|
1802
|
-
|
|
1803
|
-
|
|
1804
|
-
|
|
1805
|
-
|
|
1806
|
-
|
|
1807
|
-
|
|
1808
|
-
|
|
1809
|
-
|
|
1810
|
-
|
|
1811
|
-
|
|
1812
|
-
|
|
1813
|
-
|
|
1814
|
-
|
|
1815
|
-
|
|
1816
|
-
|
|
1817
|
-
}
|
|
1818
|
-
if (!apply) {
|
|
1819
|
-
apply = function apply2(func, thisArg) {
|
|
1820
|
-
for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
|
|
1821
|
-
args[_key - 2] = arguments[_key];
|
|
1822
|
-
}
|
|
1823
|
-
return func.apply(thisArg, args);
|
|
1824
|
-
};
|
|
1825
|
-
}
|
|
1826
|
-
if (!construct) {
|
|
1827
|
-
construct = function construct2(Func) {
|
|
1828
|
-
for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) {
|
|
1829
|
-
args[_key2 - 1] = arguments[_key2];
|
|
1830
|
-
}
|
|
1831
|
-
return new Func(...args);
|
|
1832
|
-
};
|
|
1833
|
-
}
|
|
1834
|
-
const arrayForEach = unapply(Array.prototype.forEach);
|
|
1835
|
-
const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
|
|
1836
|
-
const arrayPop = unapply(Array.prototype.pop);
|
|
1837
|
-
const arrayPush = unapply(Array.prototype.push);
|
|
1838
|
-
const arraySplice = unapply(Array.prototype.splice);
|
|
1839
|
-
const stringToLowerCase = unapply(String.prototype.toLowerCase);
|
|
1840
|
-
const stringToString = unapply(String.prototype.toString);
|
|
1841
|
-
const stringMatch = unapply(String.prototype.match);
|
|
1842
|
-
const stringReplace = unapply(String.prototype.replace);
|
|
1843
|
-
const stringIndexOf = unapply(String.prototype.indexOf);
|
|
1844
|
-
const stringTrim = unapply(String.prototype.trim);
|
|
1845
|
-
const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
|
|
1846
|
-
const regExpTest = unapply(RegExp.prototype.test);
|
|
1847
|
-
const typeErrorCreate = unconstruct(TypeError);
|
|
1848
|
-
function unapply(func) {
|
|
1849
|
-
return function(thisArg) {
|
|
1850
|
-
if (thisArg instanceof RegExp) {
|
|
1851
|
-
thisArg.lastIndex = 0;
|
|
1852
|
-
}
|
|
1853
|
-
for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) {
|
|
1854
|
-
args[_key3 - 1] = arguments[_key3];
|
|
1855
|
-
}
|
|
1856
|
-
return apply(func, thisArg, args);
|
|
1857
|
-
};
|
|
1858
|
-
}
|
|
1859
|
-
function unconstruct(Func) {
|
|
1860
|
-
return function() {
|
|
1861
|
-
for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
|
|
1862
|
-
args[_key4] = arguments[_key4];
|
|
1863
|
-
}
|
|
1864
|
-
return construct(Func, args);
|
|
1865
|
-
};
|
|
1866
|
-
}
|
|
1867
|
-
function addToSet(set, array) {
|
|
1868
|
-
let transformCaseFunc = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : stringToLowerCase;
|
|
1869
|
-
if (setPrototypeOf) {
|
|
1870
|
-
setPrototypeOf(set, null);
|
|
1787
|
+
const {
|
|
1788
|
+
entries,
|
|
1789
|
+
setPrototypeOf,
|
|
1790
|
+
isFrozen,
|
|
1791
|
+
getPrototypeOf,
|
|
1792
|
+
getOwnPropertyDescriptor
|
|
1793
|
+
} = Object;
|
|
1794
|
+
let {
|
|
1795
|
+
freeze,
|
|
1796
|
+
seal,
|
|
1797
|
+
create
|
|
1798
|
+
} = Object;
|
|
1799
|
+
let {
|
|
1800
|
+
apply,
|
|
1801
|
+
construct
|
|
1802
|
+
} = typeof Reflect !== "undefined" && Reflect;
|
|
1803
|
+
if (!freeze) {
|
|
1804
|
+
freeze = function freeze2(x) {
|
|
1805
|
+
return x;
|
|
1806
|
+
};
|
|
1807
|
+
}
|
|
1808
|
+
if (!seal) {
|
|
1809
|
+
seal = function seal2(x) {
|
|
1810
|
+
return x;
|
|
1811
|
+
};
|
|
1812
|
+
}
|
|
1813
|
+
if (!apply) {
|
|
1814
|
+
apply = function apply2(func, thisArg) {
|
|
1815
|
+
for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
|
|
1816
|
+
args[_key - 2] = arguments[_key];
|
|
1871
1817
|
}
|
|
1872
|
-
|
|
1873
|
-
|
|
1874
|
-
|
|
1875
|
-
|
|
1876
|
-
|
|
1877
|
-
|
|
1878
|
-
|
|
1879
|
-
|
|
1880
|
-
|
|
1881
|
-
|
|
1818
|
+
return func.apply(thisArg, args);
|
|
1819
|
+
};
|
|
1820
|
+
}
|
|
1821
|
+
if (!construct) {
|
|
1822
|
+
construct = function construct2(Func) {
|
|
1823
|
+
for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) {
|
|
1824
|
+
args[_key2 - 1] = arguments[_key2];
|
|
1825
|
+
}
|
|
1826
|
+
return new Func(...args);
|
|
1827
|
+
};
|
|
1828
|
+
}
|
|
1829
|
+
const arrayForEach = unapply(Array.prototype.forEach);
|
|
1830
|
+
const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
|
|
1831
|
+
const arrayPop = unapply(Array.prototype.pop);
|
|
1832
|
+
const arrayPush = unapply(Array.prototype.push);
|
|
1833
|
+
const arraySplice = unapply(Array.prototype.splice);
|
|
1834
|
+
const stringToLowerCase = unapply(String.prototype.toLowerCase);
|
|
1835
|
+
const stringToString = unapply(String.prototype.toString);
|
|
1836
|
+
const stringMatch = unapply(String.prototype.match);
|
|
1837
|
+
const stringReplace = unapply(String.prototype.replace);
|
|
1838
|
+
const stringIndexOf = unapply(String.prototype.indexOf);
|
|
1839
|
+
const stringTrim = unapply(String.prototype.trim);
|
|
1840
|
+
const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
|
|
1841
|
+
const regExpTest = unapply(RegExp.prototype.test);
|
|
1842
|
+
const typeErrorCreate = unconstruct(TypeError);
|
|
1843
|
+
function unapply(func) {
|
|
1844
|
+
return function(thisArg) {
|
|
1845
|
+
if (thisArg instanceof RegExp) {
|
|
1846
|
+
thisArg.lastIndex = 0;
|
|
1847
|
+
}
|
|
1848
|
+
for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) {
|
|
1849
|
+
args[_key3 - 1] = arguments[_key3];
|
|
1850
|
+
}
|
|
1851
|
+
return apply(func, thisArg, args);
|
|
1852
|
+
};
|
|
1853
|
+
}
|
|
1854
|
+
function unconstruct(Func) {
|
|
1855
|
+
return function() {
|
|
1856
|
+
for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
|
|
1857
|
+
args[_key4] = arguments[_key4];
|
|
1858
|
+
}
|
|
1859
|
+
return construct(Func, args);
|
|
1860
|
+
};
|
|
1861
|
+
}
|
|
1862
|
+
function addToSet(set, array) {
|
|
1863
|
+
let transformCaseFunc = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : stringToLowerCase;
|
|
1864
|
+
if (setPrototypeOf) {
|
|
1865
|
+
setPrototypeOf(set, null);
|
|
1866
|
+
}
|
|
1867
|
+
let l = array.length;
|
|
1868
|
+
while (l--) {
|
|
1869
|
+
let element = array[l];
|
|
1870
|
+
if (typeof element === "string") {
|
|
1871
|
+
const lcElement = transformCaseFunc(element);
|
|
1872
|
+
if (lcElement !== element) {
|
|
1873
|
+
if (!isFrozen(array)) {
|
|
1874
|
+
array[l] = lcElement;
|
|
1882
1875
|
}
|
|
1876
|
+
element = lcElement;
|
|
1883
1877
|
}
|
|
1884
|
-
set[element] = true;
|
|
1885
1878
|
}
|
|
1886
|
-
|
|
1879
|
+
set[element] = true;
|
|
1880
|
+
}
|
|
1881
|
+
return set;
|
|
1882
|
+
}
|
|
1883
|
+
function cleanArray(array) {
|
|
1884
|
+
for (let index = 0; index < array.length; index++) {
|
|
1885
|
+
const isPropertyExist = objectHasOwnProperty(array, index);
|
|
1886
|
+
if (!isPropertyExist) {
|
|
1887
|
+
array[index] = null;
|
|
1888
|
+
}
|
|
1887
1889
|
}
|
|
1888
|
-
|
|
1889
|
-
|
|
1890
|
-
|
|
1891
|
-
|
|
1892
|
-
|
|
1890
|
+
return array;
|
|
1891
|
+
}
|
|
1892
|
+
function clone(object) {
|
|
1893
|
+
const newObject = create(null);
|
|
1894
|
+
for (const [property, value] of entries(object)) {
|
|
1895
|
+
const isPropertyExist = objectHasOwnProperty(object, property);
|
|
1896
|
+
if (isPropertyExist) {
|
|
1897
|
+
if (Array.isArray(value)) {
|
|
1898
|
+
newObject[property] = cleanArray(value);
|
|
1899
|
+
} else if (value && typeof value === "object" && value.constructor === Object) {
|
|
1900
|
+
newObject[property] = clone(value);
|
|
1901
|
+
} else {
|
|
1902
|
+
newObject[property] = value;
|
|
1893
1903
|
}
|
|
1894
1904
|
}
|
|
1895
|
-
return array;
|
|
1896
1905
|
}
|
|
1897
|
-
|
|
1898
|
-
|
|
1899
|
-
|
|
1900
|
-
|
|
1901
|
-
|
|
1902
|
-
|
|
1903
|
-
|
|
1904
|
-
|
|
1905
|
-
|
|
1906
|
-
|
|
1907
|
-
|
|
1908
|
-
}
|
|
1906
|
+
return newObject;
|
|
1907
|
+
}
|
|
1908
|
+
function lookupGetter(object, prop) {
|
|
1909
|
+
while (object !== null) {
|
|
1910
|
+
const desc = getOwnPropertyDescriptor(object, prop);
|
|
1911
|
+
if (desc) {
|
|
1912
|
+
if (desc.get) {
|
|
1913
|
+
return unapply(desc.get);
|
|
1914
|
+
}
|
|
1915
|
+
if (typeof desc.value === "function") {
|
|
1916
|
+
return unapply(desc.value);
|
|
1909
1917
|
}
|
|
1910
1918
|
}
|
|
1911
|
-
|
|
1919
|
+
object = getPrototypeOf(object);
|
|
1912
1920
|
}
|
|
1913
|
-
function
|
|
1914
|
-
|
|
1915
|
-
|
|
1916
|
-
|
|
1917
|
-
|
|
1918
|
-
|
|
1919
|
-
|
|
1920
|
-
|
|
1921
|
-
|
|
1922
|
-
|
|
1921
|
+
function fallbackValue() {
|
|
1922
|
+
return null;
|
|
1923
|
+
}
|
|
1924
|
+
return fallbackValue;
|
|
1925
|
+
}
|
|
1926
|
+
const html$1 = freeze(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "search", "section", "select", "shadow", "slot", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]);
|
|
1927
|
+
const svg$1 = freeze(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "enterkeyhint", "exportparts", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "inputmode", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "part", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]);
|
|
1928
|
+
const svgFilters = freeze(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]);
|
|
1929
|
+
const svgDisallowed = freeze(["animate", "color-profile", "cursor", "discard", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]);
|
|
1930
|
+
const mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]);
|
|
1931
|
+
const mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]);
|
|
1932
|
+
const text = freeze(["#text"]);
|
|
1933
|
+
const html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns", "slot"]);
|
|
1934
|
+
const svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
|
|
1935
|
+
const mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnsalign", "columnlines", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lspace", "lquote", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]);
|
|
1936
|
+
const xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
|
|
1937
|
+
const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm);
|
|
1938
|
+
const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
1939
|
+
const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm);
|
|
1940
|
+
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/);
|
|
1941
|
+
const ARIA_ATTR = seal(/^aria-[\-\w]+$/);
|
|
1942
|
+
const IS_ALLOWED_URI = seal(
|
|
1943
|
+
/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
|
|
1944
|
+
// eslint-disable-line no-useless-escape
|
|
1945
|
+
);
|
|
1946
|
+
const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
|
|
1947
|
+
const ATTR_WHITESPACE = seal(
|
|
1948
|
+
/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
|
|
1949
|
+
// eslint-disable-line no-control-regex
|
|
1950
|
+
);
|
|
1951
|
+
const DOCTYPE_NAME = seal(/^html$/i);
|
|
1952
|
+
const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
|
|
1953
|
+
var EXPRESSIONS = /* @__PURE__ */ Object.freeze({
|
|
1954
|
+
__proto__: null,
|
|
1955
|
+
ARIA_ATTR,
|
|
1956
|
+
ATTR_WHITESPACE,
|
|
1957
|
+
CUSTOM_ELEMENT,
|
|
1958
|
+
DATA_ATTR,
|
|
1959
|
+
DOCTYPE_NAME,
|
|
1960
|
+
ERB_EXPR,
|
|
1961
|
+
IS_ALLOWED_URI,
|
|
1962
|
+
IS_SCRIPT_OR_DATA,
|
|
1963
|
+
MUSTACHE_EXPR,
|
|
1964
|
+
TMPLIT_EXPR
|
|
1965
|
+
});
|
|
1966
|
+
const NODE_TYPE = {
|
|
1967
|
+
element: 1,
|
|
1968
|
+
text: 3,
|
|
1969
|
+
// Deprecated
|
|
1970
|
+
progressingInstruction: 7,
|
|
1971
|
+
comment: 8,
|
|
1972
|
+
document: 9
|
|
1973
|
+
};
|
|
1974
|
+
const getGlobal = function getGlobal2() {
|
|
1975
|
+
return typeof window === "undefined" ? null : window;
|
|
1976
|
+
};
|
|
1977
|
+
const _createTrustedTypesPolicy = function _createTrustedTypesPolicy2(trustedTypes, purifyHostElement) {
|
|
1978
|
+
if (typeof trustedTypes !== "object" || typeof trustedTypes.createPolicy !== "function") {
|
|
1979
|
+
return null;
|
|
1980
|
+
}
|
|
1981
|
+
let suffix = null;
|
|
1982
|
+
const ATTR_NAME = "data-tt-policy-suffix";
|
|
1983
|
+
if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
|
|
1984
|
+
suffix = purifyHostElement.getAttribute(ATTR_NAME);
|
|
1985
|
+
}
|
|
1986
|
+
const policyName = "dompurify" + (suffix ? "#" + suffix : "");
|
|
1987
|
+
try {
|
|
1988
|
+
return trustedTypes.createPolicy(policyName, {
|
|
1989
|
+
createHTML(html2) {
|
|
1990
|
+
return html2;
|
|
1991
|
+
},
|
|
1992
|
+
createScriptURL(scriptUrl) {
|
|
1993
|
+
return scriptUrl;
|
|
1923
1994
|
}
|
|
1924
|
-
|
|
1925
|
-
|
|
1926
|
-
|
|
1927
|
-
|
|
1928
|
-
|
|
1929
|
-
|
|
1930
|
-
|
|
1931
|
-
|
|
1932
|
-
|
|
1933
|
-
|
|
1934
|
-
|
|
1935
|
-
|
|
1936
|
-
|
|
1937
|
-
|
|
1938
|
-
|
|
1939
|
-
|
|
1940
|
-
|
|
1941
|
-
const xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
|
|
1942
|
-
const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm);
|
|
1943
|
-
const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
1944
|
-
const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm);
|
|
1945
|
-
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/);
|
|
1946
|
-
const ARIA_ATTR = seal(/^aria-[\-\w]+$/);
|
|
1947
|
-
const IS_ALLOWED_URI = seal(
|
|
1948
|
-
/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
|
|
1949
|
-
// eslint-disable-line no-useless-escape
|
|
1950
|
-
);
|
|
1951
|
-
const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
|
|
1952
|
-
const ATTR_WHITESPACE = seal(
|
|
1953
|
-
/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
|
|
1954
|
-
// eslint-disable-line no-control-regex
|
|
1955
|
-
);
|
|
1956
|
-
const DOCTYPE_NAME = seal(/^html$/i);
|
|
1957
|
-
const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
|
|
1958
|
-
var EXPRESSIONS = /* @__PURE__ */ Object.freeze({
|
|
1959
|
-
__proto__: null,
|
|
1960
|
-
ARIA_ATTR,
|
|
1961
|
-
ATTR_WHITESPACE,
|
|
1962
|
-
CUSTOM_ELEMENT,
|
|
1963
|
-
DATA_ATTR,
|
|
1964
|
-
DOCTYPE_NAME,
|
|
1965
|
-
ERB_EXPR,
|
|
1966
|
-
IS_ALLOWED_URI,
|
|
1967
|
-
IS_SCRIPT_OR_DATA,
|
|
1968
|
-
MUSTACHE_EXPR,
|
|
1969
|
-
TMPLIT_EXPR
|
|
1970
|
-
});
|
|
1971
|
-
const NODE_TYPE = {
|
|
1972
|
-
element: 1,
|
|
1973
|
-
text: 3,
|
|
1974
|
-
// Deprecated
|
|
1975
|
-
progressingInstruction: 7,
|
|
1976
|
-
comment: 8,
|
|
1977
|
-
document: 9
|
|
1995
|
+
});
|
|
1996
|
+
} catch (_) {
|
|
1997
|
+
console.warn("TrustedTypes policy " + policyName + " could not be created.");
|
|
1998
|
+
return null;
|
|
1999
|
+
}
|
|
2000
|
+
};
|
|
2001
|
+
const _createHooksMap = function _createHooksMap2() {
|
|
2002
|
+
return {
|
|
2003
|
+
afterSanitizeAttributes: [],
|
|
2004
|
+
afterSanitizeElements: [],
|
|
2005
|
+
afterSanitizeShadowDOM: [],
|
|
2006
|
+
beforeSanitizeAttributes: [],
|
|
2007
|
+
beforeSanitizeElements: [],
|
|
2008
|
+
beforeSanitizeShadowDOM: [],
|
|
2009
|
+
uponSanitizeAttribute: [],
|
|
2010
|
+
uponSanitizeElement: [],
|
|
2011
|
+
uponSanitizeShadowNode: []
|
|
1978
2012
|
};
|
|
1979
|
-
|
|
1980
|
-
|
|
2013
|
+
};
|
|
2014
|
+
function createDOMPurify() {
|
|
2015
|
+
let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
|
|
2016
|
+
const DOMPurify = (root) => createDOMPurify(root);
|
|
2017
|
+
DOMPurify.version = "3.3.1";
|
|
2018
|
+
DOMPurify.removed = [];
|
|
2019
|
+
if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document || !window2.Element) {
|
|
2020
|
+
DOMPurify.isSupported = false;
|
|
2021
|
+
return DOMPurify;
|
|
2022
|
+
}
|
|
2023
|
+
let {
|
|
2024
|
+
document
|
|
2025
|
+
} = window2;
|
|
2026
|
+
const originalDocument = document;
|
|
2027
|
+
const currentScript = originalDocument.currentScript;
|
|
2028
|
+
const {
|
|
2029
|
+
DocumentFragment,
|
|
2030
|
+
HTMLTemplateElement,
|
|
2031
|
+
Node,
|
|
2032
|
+
Element,
|
|
2033
|
+
NodeFilter,
|
|
2034
|
+
NamedNodeMap = window2.NamedNodeMap || window2.MozNamedAttrMap,
|
|
2035
|
+
HTMLFormElement,
|
|
2036
|
+
DOMParser,
|
|
2037
|
+
trustedTypes
|
|
2038
|
+
} = window2;
|
|
2039
|
+
const ElementPrototype = Element.prototype;
|
|
2040
|
+
const cloneNode = lookupGetter(ElementPrototype, "cloneNode");
|
|
2041
|
+
const remove = lookupGetter(ElementPrototype, "remove");
|
|
2042
|
+
const getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
|
|
2043
|
+
const getChildNodes = lookupGetter(ElementPrototype, "childNodes");
|
|
2044
|
+
const getParentNode = lookupGetter(ElementPrototype, "parentNode");
|
|
2045
|
+
if (typeof HTMLTemplateElement === "function") {
|
|
2046
|
+
const template = document.createElement("template");
|
|
2047
|
+
if (template.content && template.content.ownerDocument) {
|
|
2048
|
+
document = template.content.ownerDocument;
|
|
2049
|
+
}
|
|
2050
|
+
}
|
|
2051
|
+
let trustedTypesPolicy;
|
|
2052
|
+
let emptyHTML = "";
|
|
2053
|
+
const {
|
|
2054
|
+
implementation,
|
|
2055
|
+
createNodeIterator,
|
|
2056
|
+
createDocumentFragment,
|
|
2057
|
+
getElementsByTagName
|
|
2058
|
+
} = document;
|
|
2059
|
+
const {
|
|
2060
|
+
importNode
|
|
2061
|
+
} = originalDocument;
|
|
2062
|
+
let hooks = _createHooksMap();
|
|
2063
|
+
DOMPurify.isSupported = typeof entries === "function" && typeof getParentNode === "function" && implementation && implementation.createHTMLDocument !== void 0;
|
|
2064
|
+
const {
|
|
2065
|
+
MUSTACHE_EXPR: MUSTACHE_EXPR2,
|
|
2066
|
+
ERB_EXPR: ERB_EXPR2,
|
|
2067
|
+
TMPLIT_EXPR: TMPLIT_EXPR2,
|
|
2068
|
+
DATA_ATTR: DATA_ATTR2,
|
|
2069
|
+
ARIA_ATTR: ARIA_ATTR2,
|
|
2070
|
+
IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA2,
|
|
2071
|
+
ATTR_WHITESPACE: ATTR_WHITESPACE2,
|
|
2072
|
+
CUSTOM_ELEMENT: CUSTOM_ELEMENT2
|
|
2073
|
+
} = EXPRESSIONS;
|
|
2074
|
+
let {
|
|
2075
|
+
IS_ALLOWED_URI: IS_ALLOWED_URI$1
|
|
2076
|
+
} = EXPRESSIONS;
|
|
2077
|
+
let ALLOWED_TAGS = null;
|
|
2078
|
+
const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
|
|
2079
|
+
let ALLOWED_ATTR = null;
|
|
2080
|
+
const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
|
|
2081
|
+
let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
2082
|
+
tagNameCheck: {
|
|
2083
|
+
writable: true,
|
|
2084
|
+
configurable: false,
|
|
2085
|
+
enumerable: true,
|
|
2086
|
+
value: null
|
|
2087
|
+
},
|
|
2088
|
+
attributeNameCheck: {
|
|
2089
|
+
writable: true,
|
|
2090
|
+
configurable: false,
|
|
2091
|
+
enumerable: true,
|
|
2092
|
+
value: null
|
|
2093
|
+
},
|
|
2094
|
+
allowCustomizedBuiltInElements: {
|
|
2095
|
+
writable: true,
|
|
2096
|
+
configurable: false,
|
|
2097
|
+
enumerable: true,
|
|
2098
|
+
value: false
|
|
2099
|
+
}
|
|
2100
|
+
}));
|
|
2101
|
+
let FORBID_TAGS = null;
|
|
2102
|
+
let FORBID_ATTR = null;
|
|
2103
|
+
const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
2104
|
+
tagCheck: {
|
|
2105
|
+
writable: true,
|
|
2106
|
+
configurable: false,
|
|
2107
|
+
enumerable: true,
|
|
2108
|
+
value: null
|
|
2109
|
+
},
|
|
2110
|
+
attributeCheck: {
|
|
2111
|
+
writable: true,
|
|
2112
|
+
configurable: false,
|
|
2113
|
+
enumerable: true,
|
|
2114
|
+
value: null
|
|
2115
|
+
}
|
|
2116
|
+
}));
|
|
2117
|
+
let ALLOW_ARIA_ATTR = true;
|
|
2118
|
+
let ALLOW_DATA_ATTR = true;
|
|
2119
|
+
let ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
2120
|
+
let ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
2121
|
+
let SAFE_FOR_TEMPLATES = false;
|
|
2122
|
+
let SAFE_FOR_XML = true;
|
|
2123
|
+
let WHOLE_DOCUMENT = false;
|
|
2124
|
+
let SET_CONFIG = false;
|
|
2125
|
+
let FORCE_BODY = false;
|
|
2126
|
+
let RETURN_DOM = false;
|
|
2127
|
+
let RETURN_DOM_FRAGMENT = false;
|
|
2128
|
+
let RETURN_TRUSTED_TYPE = false;
|
|
2129
|
+
let SANITIZE_DOM = true;
|
|
2130
|
+
let SANITIZE_NAMED_PROPS = false;
|
|
2131
|
+
const SANITIZE_NAMED_PROPS_PREFIX = "user-content-";
|
|
2132
|
+
let KEEP_CONTENT = true;
|
|
2133
|
+
let IN_PLACE = false;
|
|
2134
|
+
let USE_PROFILES = {};
|
|
2135
|
+
let FORBID_CONTENTS = null;
|
|
2136
|
+
const DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
|
|
2137
|
+
let DATA_URI_TAGS = null;
|
|
2138
|
+
const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]);
|
|
2139
|
+
let URI_SAFE_ATTRIBUTES = null;
|
|
2140
|
+
const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]);
|
|
2141
|
+
const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML";
|
|
2142
|
+
const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
|
|
2143
|
+
const HTML_NAMESPACE = "http://www.w3.org/1999/xhtml";
|
|
2144
|
+
let NAMESPACE = HTML_NAMESPACE;
|
|
2145
|
+
let IS_EMPTY_INPUT = false;
|
|
2146
|
+
let ALLOWED_NAMESPACES = null;
|
|
2147
|
+
const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
|
|
2148
|
+
let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
|
|
2149
|
+
let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
|
|
2150
|
+
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]);
|
|
2151
|
+
let PARSER_MEDIA_TYPE = null;
|
|
2152
|
+
const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"];
|
|
2153
|
+
const DEFAULT_PARSER_MEDIA_TYPE = "text/html";
|
|
2154
|
+
let transformCaseFunc = null;
|
|
2155
|
+
let CONFIG = null;
|
|
2156
|
+
const formElement = document.createElement("form");
|
|
2157
|
+
const isRegexOrFunction = function isRegexOrFunction2(testValue) {
|
|
2158
|
+
return testValue instanceof RegExp || testValue instanceof Function;
|
|
1981
2159
|
};
|
|
1982
|
-
const
|
|
1983
|
-
|
|
1984
|
-
|
|
1985
|
-
|
|
1986
|
-
let suffix = null;
|
|
1987
|
-
const ATTR_NAME = "data-tt-policy-suffix";
|
|
1988
|
-
if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
|
|
1989
|
-
suffix = purifyHostElement.getAttribute(ATTR_NAME);
|
|
1990
|
-
}
|
|
1991
|
-
const policyName = "dompurify" + (suffix ? "#" + suffix : "");
|
|
1992
|
-
try {
|
|
1993
|
-
return trustedTypes.createPolicy(policyName, {
|
|
1994
|
-
createHTML(html2) {
|
|
1995
|
-
return html2;
|
|
1996
|
-
},
|
|
1997
|
-
createScriptURL(scriptUrl) {
|
|
1998
|
-
return scriptUrl;
|
|
1999
|
-
}
|
|
2000
|
-
});
|
|
2001
|
-
} catch (_) {
|
|
2002
|
-
console.warn("TrustedTypes policy " + policyName + " could not be created.");
|
|
2003
|
-
return null;
|
|
2160
|
+
const _parseConfig = function _parseConfig2() {
|
|
2161
|
+
let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
|
|
2162
|
+
if (CONFIG && CONFIG === cfg) {
|
|
2163
|
+
return;
|
|
2004
2164
|
}
|
|
2005
|
-
|
|
2006
|
-
|
|
2007
|
-
|
|
2008
|
-
|
|
2009
|
-
|
|
2010
|
-
|
|
2011
|
-
|
|
2012
|
-
|
|
2013
|
-
|
|
2014
|
-
|
|
2015
|
-
|
|
2016
|
-
|
|
2017
|
-
};
|
|
2018
|
-
|
|
2019
|
-
|
|
2020
|
-
|
|
2021
|
-
|
|
2022
|
-
|
|
2023
|
-
|
|
2024
|
-
|
|
2025
|
-
|
|
2026
|
-
|
|
2027
|
-
|
|
2028
|
-
|
|
2029
|
-
|
|
2030
|
-
|
|
2031
|
-
|
|
2032
|
-
|
|
2033
|
-
|
|
2034
|
-
|
|
2035
|
-
|
|
2036
|
-
|
|
2037
|
-
|
|
2038
|
-
|
|
2039
|
-
|
|
2040
|
-
|
|
2041
|
-
|
|
2042
|
-
|
|
2043
|
-
}
|
|
2044
|
-
|
|
2045
|
-
|
|
2046
|
-
|
|
2047
|
-
|
|
2048
|
-
|
|
2049
|
-
|
|
2050
|
-
if (
|
|
2051
|
-
|
|
2052
|
-
|
|
2053
|
-
|
|
2054
|
-
|
|
2055
|
-
}
|
|
2056
|
-
|
|
2057
|
-
|
|
2058
|
-
|
|
2059
|
-
|
|
2060
|
-
|
|
2061
|
-
|
|
2062
|
-
|
|
2063
|
-
|
|
2064
|
-
|
|
2065
|
-
|
|
2066
|
-
|
|
2067
|
-
|
|
2068
|
-
|
|
2069
|
-
|
|
2070
|
-
|
|
2071
|
-
|
|
2072
|
-
|
|
2073
|
-
|
|
2074
|
-
|
|
2075
|
-
|
|
2076
|
-
|
|
2077
|
-
|
|
2078
|
-
}
|
|
2079
|
-
|
|
2080
|
-
|
|
2081
|
-
|
|
2082
|
-
|
|
2083
|
-
|
|
2084
|
-
|
|
2085
|
-
const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
|
|
2086
|
-
let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
2087
|
-
tagNameCheck: {
|
|
2088
|
-
writable: true,
|
|
2089
|
-
configurable: false,
|
|
2090
|
-
enumerable: true,
|
|
2091
|
-
value: null
|
|
2092
|
-
},
|
|
2093
|
-
attributeNameCheck: {
|
|
2094
|
-
writable: true,
|
|
2095
|
-
configurable: false,
|
|
2096
|
-
enumerable: true,
|
|
2097
|
-
value: null
|
|
2098
|
-
},
|
|
2099
|
-
allowCustomizedBuiltInElements: {
|
|
2100
|
-
writable: true,
|
|
2101
|
-
configurable: false,
|
|
2102
|
-
enumerable: true,
|
|
2103
|
-
value: false
|
|
2104
|
-
}
|
|
2105
|
-
}));
|
|
2106
|
-
let FORBID_TAGS = null;
|
|
2107
|
-
let FORBID_ATTR = null;
|
|
2108
|
-
const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, {
|
|
2109
|
-
tagCheck: {
|
|
2110
|
-
writable: true,
|
|
2111
|
-
configurable: false,
|
|
2112
|
-
enumerable: true,
|
|
2113
|
-
value: null
|
|
2114
|
-
},
|
|
2115
|
-
attributeCheck: {
|
|
2116
|
-
writable: true,
|
|
2117
|
-
configurable: false,
|
|
2118
|
-
enumerable: true,
|
|
2119
|
-
value: null
|
|
2120
|
-
}
|
|
2121
|
-
}));
|
|
2122
|
-
let ALLOW_ARIA_ATTR = true;
|
|
2123
|
-
let ALLOW_DATA_ATTR = true;
|
|
2124
|
-
let ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
2125
|
-
let ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
2126
|
-
let SAFE_FOR_TEMPLATES = false;
|
|
2127
|
-
let SAFE_FOR_XML = true;
|
|
2128
|
-
let WHOLE_DOCUMENT = false;
|
|
2129
|
-
let SET_CONFIG = false;
|
|
2130
|
-
let FORCE_BODY = false;
|
|
2131
|
-
let RETURN_DOM = false;
|
|
2132
|
-
let RETURN_DOM_FRAGMENT = false;
|
|
2133
|
-
let RETURN_TRUSTED_TYPE = false;
|
|
2134
|
-
let SANITIZE_DOM = true;
|
|
2135
|
-
let SANITIZE_NAMED_PROPS = false;
|
|
2136
|
-
const SANITIZE_NAMED_PROPS_PREFIX = "user-content-";
|
|
2137
|
-
let KEEP_CONTENT = true;
|
|
2138
|
-
let IN_PLACE = false;
|
|
2139
|
-
let USE_PROFILES = {};
|
|
2140
|
-
let FORBID_CONTENTS = null;
|
|
2141
|
-
const DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
|
|
2142
|
-
let DATA_URI_TAGS = null;
|
|
2143
|
-
const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]);
|
|
2144
|
-
let URI_SAFE_ATTRIBUTES = null;
|
|
2145
|
-
const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]);
|
|
2146
|
-
const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML";
|
|
2147
|
-
const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
|
|
2148
|
-
const HTML_NAMESPACE = "http://www.w3.org/1999/xhtml";
|
|
2149
|
-
let NAMESPACE = HTML_NAMESPACE;
|
|
2150
|
-
let IS_EMPTY_INPUT = false;
|
|
2151
|
-
let ALLOWED_NAMESPACES = null;
|
|
2152
|
-
const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
|
|
2153
|
-
let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
|
|
2154
|
-
let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
|
|
2155
|
-
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]);
|
|
2156
|
-
let PARSER_MEDIA_TYPE = null;
|
|
2157
|
-
const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"];
|
|
2158
|
-
const DEFAULT_PARSER_MEDIA_TYPE = "text/html";
|
|
2159
|
-
let transformCaseFunc = null;
|
|
2160
|
-
let CONFIG = null;
|
|
2161
|
-
const formElement = document.createElement("form");
|
|
2162
|
-
const isRegexOrFunction = function isRegexOrFunction2(testValue) {
|
|
2163
|
-
return testValue instanceof RegExp || testValue instanceof Function;
|
|
2164
|
-
};
|
|
2165
|
-
const _parseConfig = function _parseConfig2() {
|
|
2166
|
-
let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
|
|
2167
|
-
if (CONFIG && CONFIG === cfg) {
|
|
2168
|
-
return;
|
|
2169
|
-
}
|
|
2170
|
-
if (!cfg || typeof cfg !== "object") {
|
|
2171
|
-
cfg = {};
|
|
2172
|
-
}
|
|
2173
|
-
cfg = clone(cfg);
|
|
2174
|
-
PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
|
|
2175
|
-
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
|
|
2176
|
-
transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
|
|
2177
|
-
ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
|
|
2178
|
-
ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
|
|
2179
|
-
ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
|
|
2180
|
-
URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
|
|
2181
|
-
DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
|
|
2182
|
-
FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
2183
|
-
FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
|
|
2184
|
-
FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
|
|
2185
|
-
USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES : false;
|
|
2186
|
-
ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
|
|
2187
|
-
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
|
|
2188
|
-
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false;
|
|
2189
|
-
ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false;
|
|
2190
|
-
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false;
|
|
2191
|
-
SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false;
|
|
2192
|
-
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false;
|
|
2193
|
-
RETURN_DOM = cfg.RETURN_DOM || false;
|
|
2194
|
-
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false;
|
|
2195
|
-
RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false;
|
|
2196
|
-
FORCE_BODY = cfg.FORCE_BODY || false;
|
|
2197
|
-
SANITIZE_DOM = cfg.SANITIZE_DOM !== false;
|
|
2198
|
-
SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false;
|
|
2199
|
-
KEEP_CONTENT = cfg.KEEP_CONTENT !== false;
|
|
2200
|
-
IN_PLACE = cfg.IN_PLACE || false;
|
|
2201
|
-
IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
|
|
2202
|
-
NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
|
|
2203
|
-
MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
|
|
2204
|
-
HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
|
|
2205
|
-
CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
|
|
2206
|
-
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
|
|
2207
|
-
CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
|
|
2208
|
-
}
|
|
2209
|
-
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
|
|
2210
|
-
CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
|
|
2211
|
-
}
|
|
2212
|
-
if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === "boolean") {
|
|
2213
|
-
CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
|
|
2214
|
-
}
|
|
2215
|
-
if (SAFE_FOR_TEMPLATES) {
|
|
2216
|
-
ALLOW_DATA_ATTR = false;
|
|
2217
|
-
}
|
|
2218
|
-
if (RETURN_DOM_FRAGMENT) {
|
|
2219
|
-
RETURN_DOM = true;
|
|
2220
|
-
}
|
|
2221
|
-
if (USE_PROFILES) {
|
|
2222
|
-
ALLOWED_TAGS = addToSet({}, text);
|
|
2223
|
-
ALLOWED_ATTR = [];
|
|
2224
|
-
if (USE_PROFILES.html === true) {
|
|
2225
|
-
addToSet(ALLOWED_TAGS, html$1);
|
|
2226
|
-
addToSet(ALLOWED_ATTR, html);
|
|
2227
|
-
}
|
|
2228
|
-
if (USE_PROFILES.svg === true) {
|
|
2229
|
-
addToSet(ALLOWED_TAGS, svg$1);
|
|
2230
|
-
addToSet(ALLOWED_ATTR, svg);
|
|
2231
|
-
addToSet(ALLOWED_ATTR, xml);
|
|
2232
|
-
}
|
|
2233
|
-
if (USE_PROFILES.svgFilters === true) {
|
|
2234
|
-
addToSet(ALLOWED_TAGS, svgFilters);
|
|
2235
|
-
addToSet(ALLOWED_ATTR, svg);
|
|
2236
|
-
addToSet(ALLOWED_ATTR, xml);
|
|
2237
|
-
}
|
|
2238
|
-
if (USE_PROFILES.mathMl === true) {
|
|
2239
|
-
addToSet(ALLOWED_TAGS, mathMl$1);
|
|
2240
|
-
addToSet(ALLOWED_ATTR, mathMl);
|
|
2241
|
-
addToSet(ALLOWED_ATTR, xml);
|
|
2165
|
+
if (!cfg || typeof cfg !== "object") {
|
|
2166
|
+
cfg = {};
|
|
2167
|
+
}
|
|
2168
|
+
cfg = clone(cfg);
|
|
2169
|
+
PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
|
|
2170
|
+
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
|
|
2171
|
+
transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
|
|
2172
|
+
ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
|
|
2173
|
+
ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
|
|
2174
|
+
ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
|
|
2175
|
+
URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
|
|
2176
|
+
DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
|
|
2177
|
+
FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
2178
|
+
FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
|
|
2179
|
+
FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
|
|
2180
|
+
USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES : false;
|
|
2181
|
+
ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
|
|
2182
|
+
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
|
|
2183
|
+
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false;
|
|
2184
|
+
ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false;
|
|
2185
|
+
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false;
|
|
2186
|
+
SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false;
|
|
2187
|
+
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false;
|
|
2188
|
+
RETURN_DOM = cfg.RETURN_DOM || false;
|
|
2189
|
+
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false;
|
|
2190
|
+
RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false;
|
|
2191
|
+
FORCE_BODY = cfg.FORCE_BODY || false;
|
|
2192
|
+
SANITIZE_DOM = cfg.SANITIZE_DOM !== false;
|
|
2193
|
+
SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false;
|
|
2194
|
+
KEEP_CONTENT = cfg.KEEP_CONTENT !== false;
|
|
2195
|
+
IN_PLACE = cfg.IN_PLACE || false;
|
|
2196
|
+
IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
|
|
2197
|
+
NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
|
|
2198
|
+
MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
|
|
2199
|
+
HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
|
|
2200
|
+
CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
|
|
2201
|
+
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
|
|
2202
|
+
CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
|
|
2203
|
+
}
|
|
2204
|
+
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
|
|
2205
|
+
CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
|
|
2206
|
+
}
|
|
2207
|
+
if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === "boolean") {
|
|
2208
|
+
CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
|
|
2209
|
+
}
|
|
2210
|
+
if (SAFE_FOR_TEMPLATES) {
|
|
2211
|
+
ALLOW_DATA_ATTR = false;
|
|
2212
|
+
}
|
|
2213
|
+
if (RETURN_DOM_FRAGMENT) {
|
|
2214
|
+
RETURN_DOM = true;
|
|
2215
|
+
}
|
|
2216
|
+
if (USE_PROFILES) {
|
|
2217
|
+
ALLOWED_TAGS = addToSet({}, text);
|
|
2218
|
+
ALLOWED_ATTR = [];
|
|
2219
|
+
if (USE_PROFILES.html === true) {
|
|
2220
|
+
addToSet(ALLOWED_TAGS, html$1);
|
|
2221
|
+
addToSet(ALLOWED_ATTR, html);
|
|
2222
|
+
}
|
|
2223
|
+
if (USE_PROFILES.svg === true) {
|
|
2224
|
+
addToSet(ALLOWED_TAGS, svg$1);
|
|
2225
|
+
addToSet(ALLOWED_ATTR, svg);
|
|
2226
|
+
addToSet(ALLOWED_ATTR, xml);
|
|
2227
|
+
}
|
|
2228
|
+
if (USE_PROFILES.svgFilters === true) {
|
|
2229
|
+
addToSet(ALLOWED_TAGS, svgFilters);
|
|
2230
|
+
addToSet(ALLOWED_ATTR, svg);
|
|
2231
|
+
addToSet(ALLOWED_ATTR, xml);
|
|
2232
|
+
}
|
|
2233
|
+
if (USE_PROFILES.mathMl === true) {
|
|
2234
|
+
addToSet(ALLOWED_TAGS, mathMl$1);
|
|
2235
|
+
addToSet(ALLOWED_ATTR, mathMl);
|
|
2236
|
+
addToSet(ALLOWED_ATTR, xml);
|
|
2237
|
+
}
|
|
2238
|
+
}
|
|
2239
|
+
if (cfg.ADD_TAGS) {
|
|
2240
|
+
if (typeof cfg.ADD_TAGS === "function") {
|
|
2241
|
+
EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS;
|
|
2242
|
+
} else {
|
|
2243
|
+
if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
|
|
2244
|
+
ALLOWED_TAGS = clone(ALLOWED_TAGS);
|
|
2242
2245
|
}
|
|
2246
|
+
addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
|
|
2243
2247
|
}
|
|
2244
|
-
|
|
2245
|
-
|
|
2246
|
-
|
|
2247
|
-
|
|
2248
|
-
|
|
2249
|
-
|
|
2250
|
-
|
|
2251
|
-
addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
|
|
2248
|
+
}
|
|
2249
|
+
if (cfg.ADD_ATTR) {
|
|
2250
|
+
if (typeof cfg.ADD_ATTR === "function") {
|
|
2251
|
+
EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR;
|
|
2252
|
+
} else {
|
|
2253
|
+
if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
|
|
2254
|
+
ALLOWED_ATTR = clone(ALLOWED_ATTR);
|
|
2252
2255
|
}
|
|
2256
|
+
addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
|
|
2253
2257
|
}
|
|
2254
|
-
|
|
2255
|
-
|
|
2256
|
-
|
|
2257
|
-
|
|
2258
|
-
|
|
2259
|
-
|
|
2260
|
-
|
|
2261
|
-
addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
|
|
2262
|
-
}
|
|
2258
|
+
}
|
|
2259
|
+
if (cfg.ADD_URI_SAFE_ATTR) {
|
|
2260
|
+
addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
|
|
2261
|
+
}
|
|
2262
|
+
if (cfg.FORBID_CONTENTS) {
|
|
2263
|
+
if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
|
|
2264
|
+
FORBID_CONTENTS = clone(FORBID_CONTENTS);
|
|
2263
2265
|
}
|
|
2264
|
-
|
|
2265
|
-
|
|
2266
|
+
addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
|
|
2267
|
+
}
|
|
2268
|
+
if (cfg.ADD_FORBID_CONTENTS) {
|
|
2269
|
+
if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
|
|
2270
|
+
FORBID_CONTENTS = clone(FORBID_CONTENTS);
|
|
2266
2271
|
}
|
|
2267
|
-
|
|
2268
|
-
|
|
2269
|
-
|
|
2270
|
-
|
|
2271
|
-
|
|
2272
|
+
addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
|
|
2273
|
+
}
|
|
2274
|
+
if (KEEP_CONTENT) {
|
|
2275
|
+
ALLOWED_TAGS["#text"] = true;
|
|
2276
|
+
}
|
|
2277
|
+
if (WHOLE_DOCUMENT) {
|
|
2278
|
+
addToSet(ALLOWED_TAGS, ["html", "head", "body"]);
|
|
2279
|
+
}
|
|
2280
|
+
if (ALLOWED_TAGS.table) {
|
|
2281
|
+
addToSet(ALLOWED_TAGS, ["tbody"]);
|
|
2282
|
+
delete FORBID_TAGS.tbody;
|
|
2283
|
+
}
|
|
2284
|
+
if (cfg.TRUSTED_TYPES_POLICY) {
|
|
2285
|
+
if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== "function") {
|
|
2286
|
+
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
|
|
2272
2287
|
}
|
|
2273
|
-
if (cfg.
|
|
2274
|
-
|
|
2275
|
-
FORBID_CONTENTS = clone(FORBID_CONTENTS);
|
|
2276
|
-
}
|
|
2277
|
-
addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
|
|
2288
|
+
if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") {
|
|
2289
|
+
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
|
|
2278
2290
|
}
|
|
2279
|
-
|
|
2280
|
-
|
|
2291
|
+
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
|
|
2292
|
+
emptyHTML = trustedTypesPolicy.createHTML("");
|
|
2293
|
+
} else {
|
|
2294
|
+
if (trustedTypesPolicy === void 0) {
|
|
2295
|
+
trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
|
|
2281
2296
|
}
|
|
2282
|
-
if (
|
|
2283
|
-
|
|
2297
|
+
if (trustedTypesPolicy !== null && typeof emptyHTML === "string") {
|
|
2298
|
+
emptyHTML = trustedTypesPolicy.createHTML("");
|
|
2284
2299
|
}
|
|
2285
|
-
|
|
2286
|
-
|
|
2287
|
-
|
|
2300
|
+
}
|
|
2301
|
+
if (freeze) {
|
|
2302
|
+
freeze(cfg);
|
|
2303
|
+
}
|
|
2304
|
+
CONFIG = cfg;
|
|
2305
|
+
};
|
|
2306
|
+
const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
|
|
2307
|
+
const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
|
|
2308
|
+
const _checkValidNamespace = function _checkValidNamespace2(element) {
|
|
2309
|
+
let parent = getParentNode(element);
|
|
2310
|
+
if (!parent || !parent.tagName) {
|
|
2311
|
+
parent = {
|
|
2312
|
+
namespaceURI: NAMESPACE,
|
|
2313
|
+
tagName: "template"
|
|
2314
|
+
};
|
|
2315
|
+
}
|
|
2316
|
+
const tagName = stringToLowerCase(element.tagName);
|
|
2317
|
+
const parentTagName = stringToLowerCase(parent.tagName);
|
|
2318
|
+
if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
2319
|
+
return false;
|
|
2320
|
+
}
|
|
2321
|
+
if (element.namespaceURI === SVG_NAMESPACE) {
|
|
2322
|
+
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
2323
|
+
return tagName === "svg";
|
|
2288
2324
|
}
|
|
2289
|
-
if (
|
|
2290
|
-
|
|
2291
|
-
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
|
|
2292
|
-
}
|
|
2293
|
-
if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") {
|
|
2294
|
-
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
|
|
2295
|
-
}
|
|
2296
|
-
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
|
|
2297
|
-
emptyHTML = trustedTypesPolicy.createHTML("");
|
|
2298
|
-
} else {
|
|
2299
|
-
if (trustedTypesPolicy === void 0) {
|
|
2300
|
-
trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
|
|
2301
|
-
}
|
|
2302
|
-
if (trustedTypesPolicy !== null && typeof emptyHTML === "string") {
|
|
2303
|
-
emptyHTML = trustedTypesPolicy.createHTML("");
|
|
2304
|
-
}
|
|
2325
|
+
if (parent.namespaceURI === MATHML_NAMESPACE) {
|
|
2326
|
+
return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
|
|
2305
2327
|
}
|
|
2306
|
-
|
|
2307
|
-
|
|
2328
|
+
return Boolean(ALL_SVG_TAGS[tagName]);
|
|
2329
|
+
}
|
|
2330
|
+
if (element.namespaceURI === MATHML_NAMESPACE) {
|
|
2331
|
+
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
2332
|
+
return tagName === "math";
|
|
2308
2333
|
}
|
|
2309
|
-
|
|
2310
|
-
|
|
2311
|
-
const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
|
|
2312
|
-
const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
|
|
2313
|
-
const _checkValidNamespace = function _checkValidNamespace2(element) {
|
|
2314
|
-
let parent = getParentNode(element);
|
|
2315
|
-
if (!parent || !parent.tagName) {
|
|
2316
|
-
parent = {
|
|
2317
|
-
namespaceURI: NAMESPACE,
|
|
2318
|
-
tagName: "template"
|
|
2319
|
-
};
|
|
2334
|
+
if (parent.namespaceURI === SVG_NAMESPACE) {
|
|
2335
|
+
return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
|
|
2320
2336
|
}
|
|
2321
|
-
|
|
2322
|
-
|
|
2323
|
-
|
|
2337
|
+
return Boolean(ALL_MATHML_TAGS[tagName]);
|
|
2338
|
+
}
|
|
2339
|
+
if (element.namespaceURI === HTML_NAMESPACE) {
|
|
2340
|
+
if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
|
|
2324
2341
|
return false;
|
|
2325
2342
|
}
|
|
2326
|
-
if (
|
|
2327
|
-
|
|
2328
|
-
return tagName === "svg";
|
|
2329
|
-
}
|
|
2330
|
-
if (parent.namespaceURI === MATHML_NAMESPACE) {
|
|
2331
|
-
return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
|
|
2332
|
-
}
|
|
2333
|
-
return Boolean(ALL_SVG_TAGS[tagName]);
|
|
2334
|
-
}
|
|
2335
|
-
if (element.namespaceURI === MATHML_NAMESPACE) {
|
|
2336
|
-
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
2337
|
-
return tagName === "math";
|
|
2338
|
-
}
|
|
2339
|
-
if (parent.namespaceURI === SVG_NAMESPACE) {
|
|
2340
|
-
return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
|
|
2341
|
-
}
|
|
2342
|
-
return Boolean(ALL_MATHML_TAGS[tagName]);
|
|
2343
|
+
if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
|
|
2344
|
+
return false;
|
|
2343
2345
|
}
|
|
2344
|
-
|
|
2345
|
-
|
|
2346
|
-
|
|
2346
|
+
return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
|
|
2347
|
+
}
|
|
2348
|
+
if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
2349
|
+
return true;
|
|
2350
|
+
}
|
|
2351
|
+
return false;
|
|
2352
|
+
};
|
|
2353
|
+
const _forceRemove = function _forceRemove2(node) {
|
|
2354
|
+
arrayPush(DOMPurify.removed, {
|
|
2355
|
+
element: node
|
|
2356
|
+
});
|
|
2357
|
+
try {
|
|
2358
|
+
getParentNode(node).removeChild(node);
|
|
2359
|
+
} catch (_) {
|
|
2360
|
+
remove(node);
|
|
2361
|
+
}
|
|
2362
|
+
};
|
|
2363
|
+
const _removeAttribute = function _removeAttribute2(name, element) {
|
|
2364
|
+
try {
|
|
2365
|
+
arrayPush(DOMPurify.removed, {
|
|
2366
|
+
attribute: element.getAttributeNode(name),
|
|
2367
|
+
from: element
|
|
2368
|
+
});
|
|
2369
|
+
} catch (_) {
|
|
2370
|
+
arrayPush(DOMPurify.removed, {
|
|
2371
|
+
attribute: null,
|
|
2372
|
+
from: element
|
|
2373
|
+
});
|
|
2374
|
+
}
|
|
2375
|
+
element.removeAttribute(name);
|
|
2376
|
+
if (name === "is") {
|
|
2377
|
+
if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
|
|
2378
|
+
try {
|
|
2379
|
+
_forceRemove(element);
|
|
2380
|
+
} catch (_) {
|
|
2347
2381
|
}
|
|
2348
|
-
|
|
2349
|
-
|
|
2382
|
+
} else {
|
|
2383
|
+
try {
|
|
2384
|
+
element.setAttribute(name, "");
|
|
2385
|
+
} catch (_) {
|
|
2350
2386
|
}
|
|
2351
|
-
return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
|
|
2352
|
-
}
|
|
2353
|
-
if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
2354
|
-
return true;
|
|
2355
2387
|
}
|
|
2356
|
-
|
|
2357
|
-
|
|
2358
|
-
|
|
2359
|
-
|
|
2360
|
-
|
|
2361
|
-
|
|
2388
|
+
}
|
|
2389
|
+
};
|
|
2390
|
+
const _initDocument = function _initDocument2(dirty) {
|
|
2391
|
+
let doc = null;
|
|
2392
|
+
let leadingWhitespace = null;
|
|
2393
|
+
if (FORCE_BODY) {
|
|
2394
|
+
dirty = "<remove></remove>" + dirty;
|
|
2395
|
+
} else {
|
|
2396
|
+
const matches = stringMatch(dirty, /^[\r\n\t ]+/);
|
|
2397
|
+
leadingWhitespace = matches && matches[0];
|
|
2398
|
+
}
|
|
2399
|
+
if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) {
|
|
2400
|
+
dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
|
|
2401
|
+
}
|
|
2402
|
+
const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
2403
|
+
if (NAMESPACE === HTML_NAMESPACE) {
|
|
2362
2404
|
try {
|
|
2363
|
-
|
|
2405
|
+
doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
|
|
2364
2406
|
} catch (_) {
|
|
2365
|
-
remove(node);
|
|
2366
2407
|
}
|
|
2367
|
-
}
|
|
2368
|
-
|
|
2408
|
+
}
|
|
2409
|
+
if (!doc || !doc.documentElement) {
|
|
2410
|
+
doc = implementation.createDocument(NAMESPACE, "template", null);
|
|
2369
2411
|
try {
|
|
2370
|
-
|
|
2371
|
-
attribute: element.getAttributeNode(name),
|
|
2372
|
-
from: element
|
|
2373
|
-
});
|
|
2412
|
+
doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
|
|
2374
2413
|
} catch (_) {
|
|
2375
|
-
arrayPush(DOMPurify.removed, {
|
|
2376
|
-
attribute: null,
|
|
2377
|
-
from: element
|
|
2378
|
-
});
|
|
2379
2414
|
}
|
|
2380
|
-
|
|
2381
|
-
|
|
2382
|
-
|
|
2383
|
-
|
|
2384
|
-
|
|
2385
|
-
|
|
2386
|
-
|
|
2387
|
-
|
|
2388
|
-
|
|
2389
|
-
|
|
2390
|
-
|
|
2391
|
-
|
|
2415
|
+
}
|
|
2416
|
+
const body = doc.body || doc.documentElement;
|
|
2417
|
+
if (dirty && leadingWhitespace) {
|
|
2418
|
+
body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
|
|
2419
|
+
}
|
|
2420
|
+
if (NAMESPACE === HTML_NAMESPACE) {
|
|
2421
|
+
return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0];
|
|
2422
|
+
}
|
|
2423
|
+
return WHOLE_DOCUMENT ? doc.documentElement : body;
|
|
2424
|
+
};
|
|
2425
|
+
const _createNodeIterator = function _createNodeIterator2(root) {
|
|
2426
|
+
return createNodeIterator.call(
|
|
2427
|
+
root.ownerDocument || root,
|
|
2428
|
+
root,
|
|
2429
|
+
// eslint-disable-next-line no-bitwise
|
|
2430
|
+
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION,
|
|
2431
|
+
null
|
|
2432
|
+
);
|
|
2433
|
+
};
|
|
2434
|
+
const _isClobbered = function _isClobbered2(element) {
|
|
2435
|
+
return element instanceof HTMLFormElement && (typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function");
|
|
2436
|
+
};
|
|
2437
|
+
const _isNode = function _isNode2(value) {
|
|
2438
|
+
return typeof Node === "function" && value instanceof Node;
|
|
2439
|
+
};
|
|
2440
|
+
function _executeHooks(hooks2, currentNode, data) {
|
|
2441
|
+
arrayForEach(hooks2, (hook) => {
|
|
2442
|
+
hook.call(DOMPurify, currentNode, data, CONFIG);
|
|
2443
|
+
});
|
|
2444
|
+
}
|
|
2445
|
+
const _sanitizeElements = function _sanitizeElements2(currentNode) {
|
|
2446
|
+
let content = null;
|
|
2447
|
+
_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
|
|
2448
|
+
if (_isClobbered(currentNode)) {
|
|
2449
|
+
_forceRemove(currentNode);
|
|
2450
|
+
return true;
|
|
2451
|
+
}
|
|
2452
|
+
const tagName = transformCaseFunc(currentNode.nodeName);
|
|
2453
|
+
_executeHooks(hooks.uponSanitizeElement, currentNode, {
|
|
2454
|
+
tagName,
|
|
2455
|
+
allowedTags: ALLOWED_TAGS
|
|
2456
|
+
});
|
|
2457
|
+
if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
|
|
2458
|
+
_forceRemove(currentNode);
|
|
2459
|
+
return true;
|
|
2460
|
+
}
|
|
2461
|
+
if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
|
|
2462
|
+
_forceRemove(currentNode);
|
|
2463
|
+
return true;
|
|
2464
|
+
}
|
|
2465
|
+
if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
|
|
2466
|
+
_forceRemove(currentNode);
|
|
2467
|
+
return true;
|
|
2468
|
+
}
|
|
2469
|
+
if (!(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName])) {
|
|
2470
|
+
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
|
|
2471
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
|
|
2472
|
+
return false;
|
|
2392
2473
|
}
|
|
2393
|
-
|
|
2394
|
-
|
|
2395
|
-
const _initDocument = function _initDocument2(dirty) {
|
|
2396
|
-
let doc = null;
|
|
2397
|
-
let leadingWhitespace = null;
|
|
2398
|
-
if (FORCE_BODY) {
|
|
2399
|
-
dirty = "<remove></remove>" + dirty;
|
|
2400
|
-
} else {
|
|
2401
|
-
const matches = stringMatch(dirty, /^[\r\n\t ]+/);
|
|
2402
|
-
leadingWhitespace = matches && matches[0];
|
|
2403
|
-
}
|
|
2404
|
-
if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) {
|
|
2405
|
-
dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
|
|
2406
|
-
}
|
|
2407
|
-
const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
2408
|
-
if (NAMESPACE === HTML_NAMESPACE) {
|
|
2409
|
-
try {
|
|
2410
|
-
doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
|
|
2411
|
-
} catch (_) {
|
|
2474
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
|
|
2475
|
+
return false;
|
|
2412
2476
|
}
|
|
2413
2477
|
}
|
|
2414
|
-
if (
|
|
2415
|
-
|
|
2416
|
-
|
|
2417
|
-
|
|
2418
|
-
|
|
2478
|
+
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
|
|
2479
|
+
const parentNode = getParentNode(currentNode) || currentNode.parentNode;
|
|
2480
|
+
const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
|
|
2481
|
+
if (childNodes && parentNode) {
|
|
2482
|
+
const childCount = childNodes.length;
|
|
2483
|
+
for (let i = childCount - 1; i >= 0; --i) {
|
|
2484
|
+
const childClone = cloneNode(childNodes[i], true);
|
|
2485
|
+
childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
|
|
2486
|
+
parentNode.insertBefore(childClone, getNextSibling(currentNode));
|
|
2487
|
+
}
|
|
2419
2488
|
}
|
|
2420
2489
|
}
|
|
2421
|
-
|
|
2422
|
-
|
|
2423
|
-
|
|
2424
|
-
|
|
2425
|
-
|
|
2426
|
-
|
|
2427
|
-
}
|
|
2428
|
-
return WHOLE_DOCUMENT ? doc.documentElement : body;
|
|
2429
|
-
};
|
|
2430
|
-
const _createNodeIterator = function _createNodeIterator2(root) {
|
|
2431
|
-
return createNodeIterator.call(
|
|
2432
|
-
root.ownerDocument || root,
|
|
2433
|
-
root,
|
|
2434
|
-
// eslint-disable-next-line no-bitwise
|
|
2435
|
-
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION,
|
|
2436
|
-
null
|
|
2437
|
-
);
|
|
2438
|
-
};
|
|
2439
|
-
const _isClobbered = function _isClobbered2(element) {
|
|
2440
|
-
return element instanceof HTMLFormElement && (typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function");
|
|
2441
|
-
};
|
|
2442
|
-
const _isNode = function _isNode2(value) {
|
|
2443
|
-
return typeof Node === "function" && value instanceof Node;
|
|
2444
|
-
};
|
|
2445
|
-
function _executeHooks(hooks2, currentNode, data) {
|
|
2446
|
-
arrayForEach(hooks2, (hook) => {
|
|
2447
|
-
hook.call(DOMPurify, currentNode, data, CONFIG);
|
|
2448
|
-
});
|
|
2490
|
+
_forceRemove(currentNode);
|
|
2491
|
+
return true;
|
|
2492
|
+
}
|
|
2493
|
+
if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
|
|
2494
|
+
_forceRemove(currentNode);
|
|
2495
|
+
return true;
|
|
2449
2496
|
}
|
|
2450
|
-
|
|
2451
|
-
|
|
2452
|
-
|
|
2453
|
-
|
|
2454
|
-
|
|
2455
|
-
|
|
2456
|
-
|
|
2457
|
-
|
|
2458
|
-
_executeHooks(hooks.uponSanitizeElement, currentNode, {
|
|
2459
|
-
tagName,
|
|
2460
|
-
allowedTags: ALLOWED_TAGS
|
|
2497
|
+
if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
2498
|
+
_forceRemove(currentNode);
|
|
2499
|
+
return true;
|
|
2500
|
+
}
|
|
2501
|
+
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
|
|
2502
|
+
content = currentNode.textContent;
|
|
2503
|
+
arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
|
|
2504
|
+
content = stringReplace(content, expr, " ");
|
|
2461
2505
|
});
|
|
2462
|
-
if (
|
|
2463
|
-
|
|
2464
|
-
|
|
2465
|
-
|
|
2466
|
-
|
|
2467
|
-
_forceRemove(currentNode);
|
|
2468
|
-
return true;
|
|
2469
|
-
}
|
|
2470
|
-
if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
|
|
2471
|
-
_forceRemove(currentNode);
|
|
2472
|
-
return true;
|
|
2473
|
-
}
|
|
2474
|
-
if (!(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName])) {
|
|
2475
|
-
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
|
|
2476
|
-
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
|
|
2477
|
-
return false;
|
|
2478
|
-
}
|
|
2479
|
-
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
|
|
2480
|
-
return false;
|
|
2481
|
-
}
|
|
2482
|
-
}
|
|
2483
|
-
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
|
|
2484
|
-
const parentNode = getParentNode(currentNode) || currentNode.parentNode;
|
|
2485
|
-
const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
|
|
2486
|
-
if (childNodes && parentNode) {
|
|
2487
|
-
const childCount = childNodes.length;
|
|
2488
|
-
for (let i = childCount - 1; i >= 0; --i) {
|
|
2489
|
-
const childClone = cloneNode(childNodes[i], true);
|
|
2490
|
-
childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
|
|
2491
|
-
parentNode.insertBefore(childClone, getNextSibling(currentNode));
|
|
2492
|
-
}
|
|
2493
|
-
}
|
|
2494
|
-
}
|
|
2495
|
-
_forceRemove(currentNode);
|
|
2496
|
-
return true;
|
|
2506
|
+
if (currentNode.textContent !== content) {
|
|
2507
|
+
arrayPush(DOMPurify.removed, {
|
|
2508
|
+
element: currentNode.cloneNode()
|
|
2509
|
+
});
|
|
2510
|
+
currentNode.textContent = content;
|
|
2497
2511
|
}
|
|
2498
|
-
|
|
2499
|
-
|
|
2500
|
-
|
|
2512
|
+
}
|
|
2513
|
+
_executeHooks(hooks.afterSanitizeElements, currentNode, null);
|
|
2514
|
+
return false;
|
|
2515
|
+
};
|
|
2516
|
+
const _isValidAttribute = function _isValidAttribute2(lcTag, lcName, value) {
|
|
2517
|
+
if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) {
|
|
2518
|
+
return false;
|
|
2519
|
+
}
|
|
2520
|
+
if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR2, lcName)) ;
|
|
2521
|
+
else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR2, lcName)) ;
|
|
2522
|
+
else if (EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag)) ;
|
|
2523
|
+
else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
|
|
2524
|
+
if (
|
|
2525
|
+
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
2526
|
+
// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
2527
|
+
// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
|
|
2528
|
+
_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || // Alternative, second condition checks if it's an `is`-attribute, AND
|
|
2529
|
+
// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
2530
|
+
lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))
|
|
2531
|
+
) ;
|
|
2532
|
+
else {
|
|
2533
|
+
return false;
|
|
2501
2534
|
}
|
|
2502
|
-
|
|
2503
|
-
|
|
2504
|
-
|
|
2535
|
+
} else if (URI_SAFE_ATTRIBUTES[lcName]) ;
|
|
2536
|
+
else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE2, ""))) ;
|
|
2537
|
+
else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) ;
|
|
2538
|
+
else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA2, stringReplace(value, ATTR_WHITESPACE2, ""))) ;
|
|
2539
|
+
else if (value) {
|
|
2540
|
+
return false;
|
|
2541
|
+
} else ;
|
|
2542
|
+
return true;
|
|
2543
|
+
};
|
|
2544
|
+
const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
|
|
2545
|
+
return tagName !== "annotation-xml" && stringMatch(tagName, CUSTOM_ELEMENT2);
|
|
2546
|
+
};
|
|
2547
|
+
const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) {
|
|
2548
|
+
_executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
|
|
2549
|
+
const {
|
|
2550
|
+
attributes
|
|
2551
|
+
} = currentNode;
|
|
2552
|
+
if (!attributes || _isClobbered(currentNode)) {
|
|
2553
|
+
return;
|
|
2554
|
+
}
|
|
2555
|
+
const hookEvent = {
|
|
2556
|
+
attrName: "",
|
|
2557
|
+
attrValue: "",
|
|
2558
|
+
keepAttr: true,
|
|
2559
|
+
allowedAttributes: ALLOWED_ATTR,
|
|
2560
|
+
forceKeepAttr: void 0
|
|
2561
|
+
};
|
|
2562
|
+
let l = attributes.length;
|
|
2563
|
+
while (l--) {
|
|
2564
|
+
const attr = attributes[l];
|
|
2565
|
+
const {
|
|
2566
|
+
name,
|
|
2567
|
+
namespaceURI,
|
|
2568
|
+
value: attrValue
|
|
2569
|
+
} = attr;
|
|
2570
|
+
const lcName = transformCaseFunc(name);
|
|
2571
|
+
const initValue = attrValue;
|
|
2572
|
+
let value = name === "value" ? initValue : stringTrim(initValue);
|
|
2573
|
+
hookEvent.attrName = lcName;
|
|
2574
|
+
hookEvent.attrValue = value;
|
|
2575
|
+
hookEvent.keepAttr = true;
|
|
2576
|
+
hookEvent.forceKeepAttr = void 0;
|
|
2577
|
+
_executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
|
|
2578
|
+
value = hookEvent.attrValue;
|
|
2579
|
+
if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name")) {
|
|
2580
|
+
_removeAttribute(name, currentNode);
|
|
2581
|
+
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
2582
|
+
}
|
|
2583
|
+
if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title|textarea)/i, value)) {
|
|
2584
|
+
_removeAttribute(name, currentNode);
|
|
2585
|
+
continue;
|
|
2586
|
+
}
|
|
2587
|
+
if (lcName === "attributename" && stringMatch(value, "href")) {
|
|
2588
|
+
_removeAttribute(name, currentNode);
|
|
2589
|
+
continue;
|
|
2590
|
+
}
|
|
2591
|
+
if (hookEvent.forceKeepAttr) {
|
|
2592
|
+
continue;
|
|
2593
|
+
}
|
|
2594
|
+
if (!hookEvent.keepAttr) {
|
|
2595
|
+
_removeAttribute(name, currentNode);
|
|
2596
|
+
continue;
|
|
2597
|
+
}
|
|
2598
|
+
if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
|
|
2599
|
+
_removeAttribute(name, currentNode);
|
|
2600
|
+
continue;
|
|
2505
2601
|
}
|
|
2506
|
-
if (SAFE_FOR_TEMPLATES
|
|
2507
|
-
content = currentNode.textContent;
|
|
2602
|
+
if (SAFE_FOR_TEMPLATES) {
|
|
2508
2603
|
arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
|
|
2509
|
-
|
|
2604
|
+
value = stringReplace(value, expr, " ");
|
|
2510
2605
|
});
|
|
2511
|
-
if (currentNode.textContent !== content) {
|
|
2512
|
-
arrayPush(DOMPurify.removed, {
|
|
2513
|
-
element: currentNode.cloneNode()
|
|
2514
|
-
});
|
|
2515
|
-
currentNode.textContent = content;
|
|
2516
|
-
}
|
|
2517
2606
|
}
|
|
2518
|
-
|
|
2519
|
-
|
|
2520
|
-
|
|
2521
|
-
|
|
2522
|
-
if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) {
|
|
2523
|
-
return false;
|
|
2607
|
+
const lcTag = transformCaseFunc(currentNode.nodeName);
|
|
2608
|
+
if (!_isValidAttribute(lcTag, lcName, value)) {
|
|
2609
|
+
_removeAttribute(name, currentNode);
|
|
2610
|
+
continue;
|
|
2524
2611
|
}
|
|
2525
|
-
if (
|
|
2526
|
-
|
|
2527
|
-
else if (EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag)) ;
|
|
2528
|
-
else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
|
|
2529
|
-
if (
|
|
2530
|
-
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
2531
|
-
// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
2532
|
-
// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
|
|
2533
|
-
_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || // Alternative, second condition checks if it's an `is`-attribute, AND
|
|
2534
|
-
// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
2535
|
-
lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))
|
|
2536
|
-
) ;
|
|
2612
|
+
if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") {
|
|
2613
|
+
if (namespaceURI) ;
|
|
2537
2614
|
else {
|
|
2538
|
-
|
|
2539
|
-
|
|
2540
|
-
|
|
2541
|
-
|
|
2542
|
-
else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) ;
|
|
2543
|
-
else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA2, stringReplace(value, ATTR_WHITESPACE2, ""))) ;
|
|
2544
|
-
else if (value) {
|
|
2545
|
-
return false;
|
|
2546
|
-
} else ;
|
|
2547
|
-
return true;
|
|
2548
|
-
};
|
|
2549
|
-
const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
|
|
2550
|
-
return tagName !== "annotation-xml" && stringMatch(tagName, CUSTOM_ELEMENT2);
|
|
2551
|
-
};
|
|
2552
|
-
const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) {
|
|
2553
|
-
_executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
|
|
2554
|
-
const {
|
|
2555
|
-
attributes
|
|
2556
|
-
} = currentNode;
|
|
2557
|
-
if (!attributes || _isClobbered(currentNode)) {
|
|
2558
|
-
return;
|
|
2559
|
-
}
|
|
2560
|
-
const hookEvent = {
|
|
2561
|
-
attrName: "",
|
|
2562
|
-
attrValue: "",
|
|
2563
|
-
keepAttr: true,
|
|
2564
|
-
allowedAttributes: ALLOWED_ATTR,
|
|
2565
|
-
forceKeepAttr: void 0
|
|
2566
|
-
};
|
|
2567
|
-
let l = attributes.length;
|
|
2568
|
-
while (l--) {
|
|
2569
|
-
const attr = attributes[l];
|
|
2570
|
-
const {
|
|
2571
|
-
name,
|
|
2572
|
-
namespaceURI,
|
|
2573
|
-
value: attrValue
|
|
2574
|
-
} = attr;
|
|
2575
|
-
const lcName = transformCaseFunc(name);
|
|
2576
|
-
const initValue = attrValue;
|
|
2577
|
-
let value = name === "value" ? initValue : stringTrim(initValue);
|
|
2578
|
-
hookEvent.attrName = lcName;
|
|
2579
|
-
hookEvent.attrValue = value;
|
|
2580
|
-
hookEvent.keepAttr = true;
|
|
2581
|
-
hookEvent.forceKeepAttr = void 0;
|
|
2582
|
-
_executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
|
|
2583
|
-
value = hookEvent.attrValue;
|
|
2584
|
-
if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name")) {
|
|
2585
|
-
_removeAttribute(name, currentNode);
|
|
2586
|
-
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
2587
|
-
}
|
|
2588
|
-
if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title|textarea)/i, value)) {
|
|
2589
|
-
_removeAttribute(name, currentNode);
|
|
2590
|
-
continue;
|
|
2591
|
-
}
|
|
2592
|
-
if (lcName === "attributename" && stringMatch(value, "href")) {
|
|
2593
|
-
_removeAttribute(name, currentNode);
|
|
2594
|
-
continue;
|
|
2595
|
-
}
|
|
2596
|
-
if (hookEvent.forceKeepAttr) {
|
|
2597
|
-
continue;
|
|
2598
|
-
}
|
|
2599
|
-
if (!hookEvent.keepAttr) {
|
|
2600
|
-
_removeAttribute(name, currentNode);
|
|
2601
|
-
continue;
|
|
2602
|
-
}
|
|
2603
|
-
if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
|
|
2604
|
-
_removeAttribute(name, currentNode);
|
|
2605
|
-
continue;
|
|
2606
|
-
}
|
|
2607
|
-
if (SAFE_FOR_TEMPLATES) {
|
|
2608
|
-
arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
|
|
2609
|
-
value = stringReplace(value, expr, " ");
|
|
2610
|
-
});
|
|
2611
|
-
}
|
|
2612
|
-
const lcTag = transformCaseFunc(currentNode.nodeName);
|
|
2613
|
-
if (!_isValidAttribute(lcTag, lcName, value)) {
|
|
2614
|
-
_removeAttribute(name, currentNode);
|
|
2615
|
-
continue;
|
|
2616
|
-
}
|
|
2617
|
-
if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") {
|
|
2618
|
-
if (namespaceURI) ;
|
|
2619
|
-
else {
|
|
2620
|
-
switch (trustedTypes.getAttributeType(lcTag, lcName)) {
|
|
2621
|
-
case "TrustedHTML": {
|
|
2622
|
-
value = trustedTypesPolicy.createHTML(value);
|
|
2623
|
-
break;
|
|
2624
|
-
}
|
|
2625
|
-
case "TrustedScriptURL": {
|
|
2626
|
-
value = trustedTypesPolicy.createScriptURL(value);
|
|
2627
|
-
break;
|
|
2628
|
-
}
|
|
2629
|
-
}
|
|
2630
|
-
}
|
|
2631
|
-
}
|
|
2632
|
-
if (value !== initValue) {
|
|
2633
|
-
try {
|
|
2634
|
-
if (namespaceURI) {
|
|
2635
|
-
currentNode.setAttributeNS(namespaceURI, name, value);
|
|
2636
|
-
} else {
|
|
2637
|
-
currentNode.setAttribute(name, value);
|
|
2615
|
+
switch (trustedTypes.getAttributeType(lcTag, lcName)) {
|
|
2616
|
+
case "TrustedHTML": {
|
|
2617
|
+
value = trustedTypesPolicy.createHTML(value);
|
|
2618
|
+
break;
|
|
2638
2619
|
}
|
|
2639
|
-
|
|
2640
|
-
|
|
2641
|
-
|
|
2642
|
-
arrayPop(DOMPurify.removed);
|
|
2620
|
+
case "TrustedScriptURL": {
|
|
2621
|
+
value = trustedTypesPolicy.createScriptURL(value);
|
|
2622
|
+
break;
|
|
2643
2623
|
}
|
|
2644
|
-
} catch (_) {
|
|
2645
|
-
_removeAttribute(name, currentNode);
|
|
2646
2624
|
}
|
|
2647
2625
|
}
|
|
2648
2626
|
}
|
|
2649
|
-
|
|
2650
|
-
|
|
2651
|
-
|
|
2652
|
-
|
|
2653
|
-
|
|
2654
|
-
|
|
2655
|
-
while (shadowNode = shadowIterator.nextNode()) {
|
|
2656
|
-
_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
|
|
2657
|
-
_sanitizeElements(shadowNode);
|
|
2658
|
-
_sanitizeAttributes(shadowNode);
|
|
2659
|
-
if (shadowNode.content instanceof DocumentFragment) {
|
|
2660
|
-
_sanitizeShadowDOM2(shadowNode.content);
|
|
2661
|
-
}
|
|
2662
|
-
}
|
|
2663
|
-
_executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
|
|
2664
|
-
};
|
|
2665
|
-
DOMPurify.sanitize = function(dirty) {
|
|
2666
|
-
let cfg = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {};
|
|
2667
|
-
let body = null;
|
|
2668
|
-
let importedNode = null;
|
|
2669
|
-
let currentNode = null;
|
|
2670
|
-
let returnNode = null;
|
|
2671
|
-
IS_EMPTY_INPUT = !dirty;
|
|
2672
|
-
if (IS_EMPTY_INPUT) {
|
|
2673
|
-
dirty = "<!-->";
|
|
2674
|
-
}
|
|
2675
|
-
if (typeof dirty !== "string" && !_isNode(dirty)) {
|
|
2676
|
-
if (typeof dirty.toString === "function") {
|
|
2677
|
-
dirty = dirty.toString();
|
|
2678
|
-
if (typeof dirty !== "string") {
|
|
2679
|
-
throw typeErrorCreate("dirty is not a string, aborting");
|
|
2627
|
+
if (value !== initValue) {
|
|
2628
|
+
try {
|
|
2629
|
+
if (namespaceURI) {
|
|
2630
|
+
currentNode.setAttributeNS(namespaceURI, name, value);
|
|
2631
|
+
} else {
|
|
2632
|
+
currentNode.setAttribute(name, value);
|
|
2680
2633
|
}
|
|
2681
|
-
|
|
2682
|
-
|
|
2683
|
-
|
|
2684
|
-
|
|
2685
|
-
if (!DOMPurify.isSupported) {
|
|
2686
|
-
return dirty;
|
|
2687
|
-
}
|
|
2688
|
-
if (!SET_CONFIG) {
|
|
2689
|
-
_parseConfig(cfg);
|
|
2690
|
-
}
|
|
2691
|
-
DOMPurify.removed = [];
|
|
2692
|
-
if (typeof dirty === "string") {
|
|
2693
|
-
IN_PLACE = false;
|
|
2694
|
-
}
|
|
2695
|
-
if (IN_PLACE) {
|
|
2696
|
-
if (dirty.nodeName) {
|
|
2697
|
-
const tagName = transformCaseFunc(dirty.nodeName);
|
|
2698
|
-
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
2699
|
-
throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
|
|
2634
|
+
if (_isClobbered(currentNode)) {
|
|
2635
|
+
_forceRemove(currentNode);
|
|
2636
|
+
} else {
|
|
2637
|
+
arrayPop(DOMPurify.removed);
|
|
2700
2638
|
}
|
|
2639
|
+
} catch (_) {
|
|
2640
|
+
_removeAttribute(name, currentNode);
|
|
2701
2641
|
}
|
|
2702
|
-
}
|
|
2703
|
-
|
|
2704
|
-
|
|
2705
|
-
|
|
2706
|
-
|
|
2707
|
-
|
|
2708
|
-
|
|
2709
|
-
|
|
2710
|
-
|
|
2642
|
+
}
|
|
2643
|
+
}
|
|
2644
|
+
_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
|
|
2645
|
+
};
|
|
2646
|
+
const _sanitizeShadowDOM = function _sanitizeShadowDOM2(fragment) {
|
|
2647
|
+
let shadowNode = null;
|
|
2648
|
+
const shadowIterator = _createNodeIterator(fragment);
|
|
2649
|
+
_executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
|
|
2650
|
+
while (shadowNode = shadowIterator.nextNode()) {
|
|
2651
|
+
_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
|
|
2652
|
+
_sanitizeElements(shadowNode);
|
|
2653
|
+
_sanitizeAttributes(shadowNode);
|
|
2654
|
+
if (shadowNode.content instanceof DocumentFragment) {
|
|
2655
|
+
_sanitizeShadowDOM2(shadowNode.content);
|
|
2656
|
+
}
|
|
2657
|
+
}
|
|
2658
|
+
_executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
|
|
2659
|
+
};
|
|
2660
|
+
DOMPurify.sanitize = function(dirty) {
|
|
2661
|
+
let cfg = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {};
|
|
2662
|
+
let body = null;
|
|
2663
|
+
let importedNode = null;
|
|
2664
|
+
let currentNode = null;
|
|
2665
|
+
let returnNode = null;
|
|
2666
|
+
IS_EMPTY_INPUT = !dirty;
|
|
2667
|
+
if (IS_EMPTY_INPUT) {
|
|
2668
|
+
dirty = "<!-->";
|
|
2669
|
+
}
|
|
2670
|
+
if (typeof dirty !== "string" && !_isNode(dirty)) {
|
|
2671
|
+
if (typeof dirty.toString === "function") {
|
|
2672
|
+
dirty = dirty.toString();
|
|
2673
|
+
if (typeof dirty !== "string") {
|
|
2674
|
+
throw typeErrorCreate("dirty is not a string, aborting");
|
|
2711
2675
|
}
|
|
2712
2676
|
} else {
|
|
2713
|
-
|
|
2714
|
-
dirty.indexOf("<") === -1) {
|
|
2715
|
-
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
2716
|
-
}
|
|
2717
|
-
body = _initDocument(dirty);
|
|
2718
|
-
if (!body) {
|
|
2719
|
-
return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
|
|
2720
|
-
}
|
|
2721
|
-
}
|
|
2722
|
-
if (body && FORCE_BODY) {
|
|
2723
|
-
_forceRemove(body.firstChild);
|
|
2677
|
+
throw typeErrorCreate("toString is not a function");
|
|
2724
2678
|
}
|
|
2725
|
-
|
|
2726
|
-
|
|
2727
|
-
|
|
2728
|
-
|
|
2729
|
-
|
|
2730
|
-
|
|
2679
|
+
}
|
|
2680
|
+
if (!DOMPurify.isSupported) {
|
|
2681
|
+
return dirty;
|
|
2682
|
+
}
|
|
2683
|
+
if (!SET_CONFIG) {
|
|
2684
|
+
_parseConfig(cfg);
|
|
2685
|
+
}
|
|
2686
|
+
DOMPurify.removed = [];
|
|
2687
|
+
if (typeof dirty === "string") {
|
|
2688
|
+
IN_PLACE = false;
|
|
2689
|
+
}
|
|
2690
|
+
if (IN_PLACE) {
|
|
2691
|
+
if (dirty.nodeName) {
|
|
2692
|
+
const tagName = transformCaseFunc(dirty.nodeName);
|
|
2693
|
+
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
2694
|
+
throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
|
|
2731
2695
|
}
|
|
2732
2696
|
}
|
|
2733
|
-
|
|
2734
|
-
|
|
2697
|
+
} else if (dirty instanceof Node) {
|
|
2698
|
+
body = _initDocument("<!---->");
|
|
2699
|
+
importedNode = body.ownerDocument.importNode(dirty, true);
|
|
2700
|
+
if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") {
|
|
2701
|
+
body = importedNode;
|
|
2702
|
+
} else if (importedNode.nodeName === "HTML") {
|
|
2703
|
+
body = importedNode;
|
|
2704
|
+
} else {
|
|
2705
|
+
body.appendChild(importedNode);
|
|
2735
2706
|
}
|
|
2736
|
-
|
|
2737
|
-
|
|
2738
|
-
|
|
2739
|
-
|
|
2740
|
-
returnNode.appendChild(body.firstChild);
|
|
2741
|
-
}
|
|
2742
|
-
} else {
|
|
2743
|
-
returnNode = body;
|
|
2744
|
-
}
|
|
2745
|
-
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
2746
|
-
returnNode = importNode.call(originalDocument, returnNode, true);
|
|
2747
|
-
}
|
|
2748
|
-
return returnNode;
|
|
2707
|
+
} else {
|
|
2708
|
+
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
|
|
2709
|
+
dirty.indexOf("<") === -1) {
|
|
2710
|
+
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
2749
2711
|
}
|
|
2750
|
-
|
|
2751
|
-
if (
|
|
2752
|
-
|
|
2712
|
+
body = _initDocument(dirty);
|
|
2713
|
+
if (!body) {
|
|
2714
|
+
return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
|
|
2753
2715
|
}
|
|
2754
|
-
|
|
2755
|
-
|
|
2756
|
-
|
|
2757
|
-
|
|
2758
|
-
|
|
2759
|
-
|
|
2760
|
-
|
|
2761
|
-
|
|
2762
|
-
|
|
2763
|
-
|
|
2764
|
-
SET_CONFIG = true;
|
|
2765
|
-
};
|
|
2766
|
-
DOMPurify.clearConfig = function() {
|
|
2767
|
-
CONFIG = null;
|
|
2768
|
-
SET_CONFIG = false;
|
|
2769
|
-
};
|
|
2770
|
-
DOMPurify.isValidAttribute = function(tag2, attr, value) {
|
|
2771
|
-
if (!CONFIG) {
|
|
2772
|
-
_parseConfig({});
|
|
2716
|
+
}
|
|
2717
|
+
if (body && FORCE_BODY) {
|
|
2718
|
+
_forceRemove(body.firstChild);
|
|
2719
|
+
}
|
|
2720
|
+
const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
|
|
2721
|
+
while (currentNode = nodeIterator.nextNode()) {
|
|
2722
|
+
_sanitizeElements(currentNode);
|
|
2723
|
+
_sanitizeAttributes(currentNode);
|
|
2724
|
+
if (currentNode.content instanceof DocumentFragment) {
|
|
2725
|
+
_sanitizeShadowDOM(currentNode.content);
|
|
2773
2726
|
}
|
|
2774
|
-
|
|
2775
|
-
|
|
2776
|
-
return
|
|
2777
|
-
}
|
|
2778
|
-
|
|
2779
|
-
if (
|
|
2780
|
-
|
|
2727
|
+
}
|
|
2728
|
+
if (IN_PLACE) {
|
|
2729
|
+
return dirty;
|
|
2730
|
+
}
|
|
2731
|
+
if (RETURN_DOM) {
|
|
2732
|
+
if (RETURN_DOM_FRAGMENT) {
|
|
2733
|
+
returnNode = createDocumentFragment.call(body.ownerDocument);
|
|
2734
|
+
while (body.firstChild) {
|
|
2735
|
+
returnNode.appendChild(body.firstChild);
|
|
2736
|
+
}
|
|
2737
|
+
} else {
|
|
2738
|
+
returnNode = body;
|
|
2781
2739
|
}
|
|
2782
|
-
|
|
2783
|
-
|
|
2784
|
-
DOMPurify.removeHook = function(entryPoint, hookFunction) {
|
|
2785
|
-
if (hookFunction !== void 0) {
|
|
2786
|
-
const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
|
|
2787
|
-
return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0];
|
|
2740
|
+
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
2741
|
+
returnNode = importNode.call(originalDocument, returnNode, true);
|
|
2788
2742
|
}
|
|
2789
|
-
return
|
|
2790
|
-
}
|
|
2791
|
-
|
|
2792
|
-
|
|
2793
|
-
|
|
2794
|
-
|
|
2795
|
-
|
|
2796
|
-
|
|
2797
|
-
|
|
2798
|
-
|
|
2799
|
-
|
|
2800
|
-
|
|
2801
|
-
|
|
2743
|
+
return returnNode;
|
|
2744
|
+
}
|
|
2745
|
+
let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
|
2746
|
+
if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
|
|
2747
|
+
serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
|
|
2748
|
+
}
|
|
2749
|
+
if (SAFE_FOR_TEMPLATES) {
|
|
2750
|
+
arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => {
|
|
2751
|
+
serializedHTML = stringReplace(serializedHTML, expr, " ");
|
|
2752
|
+
});
|
|
2753
|
+
}
|
|
2754
|
+
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
|
|
2755
|
+
};
|
|
2756
|
+
DOMPurify.setConfig = function() {
|
|
2757
|
+
let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
|
|
2758
|
+
_parseConfig(cfg);
|
|
2759
|
+
SET_CONFIG = true;
|
|
2760
|
+
};
|
|
2761
|
+
DOMPurify.clearConfig = function() {
|
|
2762
|
+
CONFIG = null;
|
|
2763
|
+
SET_CONFIG = false;
|
|
2764
|
+
};
|
|
2765
|
+
DOMPurify.isValidAttribute = function(tag2, attr, value) {
|
|
2766
|
+
if (!CONFIG) {
|
|
2767
|
+
_parseConfig({});
|
|
2768
|
+
}
|
|
2769
|
+
const lcTag = transformCaseFunc(tag2);
|
|
2770
|
+
const lcName = transformCaseFunc(attr);
|
|
2771
|
+
return _isValidAttribute(lcTag, lcName, value);
|
|
2772
|
+
};
|
|
2773
|
+
DOMPurify.addHook = function(entryPoint, hookFunction) {
|
|
2774
|
+
if (typeof hookFunction !== "function") {
|
|
2775
|
+
return;
|
|
2776
|
+
}
|
|
2777
|
+
arrayPush(hooks[entryPoint], hookFunction);
|
|
2778
|
+
};
|
|
2779
|
+
DOMPurify.removeHook = function(entryPoint, hookFunction) {
|
|
2780
|
+
if (hookFunction !== void 0) {
|
|
2781
|
+
const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
|
|
2782
|
+
return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0];
|
|
2783
|
+
}
|
|
2784
|
+
return arrayPop(hooks[entryPoint]);
|
|
2785
|
+
};
|
|
2786
|
+
DOMPurify.removeHooks = function(entryPoint) {
|
|
2787
|
+
hooks[entryPoint] = [];
|
|
2788
|
+
};
|
|
2789
|
+
DOMPurify.removeAllHooks = function() {
|
|
2790
|
+
hooks = _createHooksMap();
|
|
2791
|
+
};
|
|
2792
|
+
return DOMPurify;
|
|
2802
2793
|
}
|
|
2803
|
-
var
|
|
2804
|
-
function sanitizeHtml(
|
|
2794
|
+
var purify = createDOMPurify();
|
|
2795
|
+
function sanitizeHtml(html2, options) {
|
|
2805
2796
|
const defaultOptions = {
|
|
2806
2797
|
ALLOWED_TAGS: ["a", "b", "strong", "i", "em", "u", "br", "p", "span"],
|
|
2807
2798
|
ALLOWED_ATTR: ["href", "target", "rel"],
|
|
@@ -2816,11 +2807,11 @@ function sanitizeHtml(html, options) {
|
|
|
2816
2807
|
)
|
|
2817
2808
|
}
|
|
2818
2809
|
};
|
|
2819
|
-
return String(
|
|
2810
|
+
return String(purify.sanitize(html2, config));
|
|
2820
2811
|
}
|
|
2821
|
-
function linkifyText(
|
|
2812
|
+
function linkifyText(text2) {
|
|
2822
2813
|
const urlRegex = /(https?:\/\/[^\s]+)/g;
|
|
2823
|
-
const linked =
|
|
2814
|
+
const linked = text2.replace(
|
|
2824
2815
|
urlRegex,
|
|
2825
2816
|
'<a href="$1" target="_blank" rel="noopener noreferrer">$1</a>'
|
|
2826
2817
|
);
|
|
@@ -2829,8 +2820,8 @@ function linkifyText(text) {
|
|
|
2829
2820
|
allowedAttributes: { a: ["href", "target", "rel"] }
|
|
2830
2821
|
});
|
|
2831
2822
|
}
|
|
2832
|
-
function safeLinkifyText(
|
|
2833
|
-
return linkifyText(
|
|
2823
|
+
function safeLinkifyText(text2) {
|
|
2824
|
+
return linkifyText(text2);
|
|
2834
2825
|
}
|
|
2835
2826
|
export {
|
|
2836
2827
|
ChatResolvedError as C,
|
|
@@ -2840,4 +2831,4 @@ export {
|
|
|
2840
2831
|
linkifyText as l,
|
|
2841
2832
|
sendDialogflowMessage as s
|
|
2842
2833
|
};
|
|
2843
|
-
//# sourceMappingURL=sanitize-
|
|
2834
|
+
//# sourceMappingURL=sanitize-DA2IXhv_.mjs.map
|