@blogmcp/mdx-render-vue 0.9.3 → 0.9.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/node_modules/dompurify/dist/purify.es.js +1394 -582
  2. package/package.json +3 -3
package/dist/node_modules/dompurify/dist/purify.es.js CHANGED
@@ -38,41 +38,41 @@ function _unsupportedIterableToArray(r, a) {
38
38
  return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
39
39
  }
40
40
  }
41
- const entries = Object.entries, setPrototypeOf = Object.setPrototypeOf, isFrozen = Object.isFrozen, getPrototypeOf = Object.getPrototypeOf, getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
42
- let freeze = Object.freeze, seal = Object.seal, create = Object.create;
43
- let _ref = typeof Reflect !== "undefined" && Reflect, apply = _ref.apply, construct = _ref.construct;
44
- if (!freeze) {
45
- freeze = function freeze2(x) {
46
- return x;
47
- };
48
- }
49
- if (!seal) {
50
- seal = function seal2(x) {
51
- return x;
52
- };
53
- }
54
- if (!apply) {
55
- apply = function apply2(func, thisArg) {
56
- for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) {
57
- args[_key - 2] = arguments[_key];
58
- }
59
- return func.apply(thisArg, args);
60
- };
61
- }
62
- if (!construct) {
63
- construct = function construct2(Func) {
64
- for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) {
65
- args[_key2 - 1] = arguments[_key2];
66
- }
67
- return new Func(...args);
68
- };
69
- }
41
+ const entries = Object.entries;
42
+ const setPrototypeOf = Object.setPrototypeOf;
43
+ const isFrozen = Object.isFrozen;
44
+ const getPrototypeOf = Object.getPrototypeOf;
45
+ const getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
46
+ let freeze = Object.freeze;
47
+ let seal = Object.seal;
48
+ let create = Object.create;
49
+ let _ref = typeof Reflect !== "undefined" && Reflect;
50
+ let apply = _ref.apply;
51
+ let construct = _ref.construct;
52
+ if (!freeze) freeze = function freeze2(x) {
53
+ return x;
54
+ };
55
+ if (!seal) seal = function seal2(x) {
56
+ return x;
57
+ };
58
+ if (!apply) apply = function apply2(func, thisArg) {
59
+ for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) args[_key - 2] = arguments[_key];
60
+ return func.apply(thisArg, args);
61
+ };
62
+ if (!construct) construct = function construct2(Func) {
63
+ for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) args[_key2 - 1] = arguments[_key2];
64
+ return new Func(...args);
65
+ };
70
66
  const arrayForEach = unapply(Array.prototype.forEach);
71
67
  const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
72
68
  const arrayPop = unapply(Array.prototype.pop);
73
69
  const arrayPush = unapply(Array.prototype.push);
70
+ const arraySlice = unapply(Array.prototype.slice);
74
71
  const arraySplice = unapply(Array.prototype.splice);
75
72
  const arrayIsArray = Array.isArray;
73
+ const setCreate = unconstruct(Set);
74
+ const setAdd = unapply(Set.prototype.add);
75
+ const setHas = unapply(Set.prototype.has);
76
76
  const stringToLowerCase = unapply(String.prototype.toLowerCase);
77
77
  const stringToString = unapply(String.prototype.toString);
78
78
  const stringMatch = unapply(String.prototype.match);
@@ -89,40 +89,28 @@ const regExpTest = unapply(RegExp.prototype.test);
89
89
  const typeErrorCreate = unconstruct(TypeError);
90
90
  function unapply(func) {
91
91
  return function(thisArg) {
92
- if (thisArg instanceof RegExp) {
93
- thisArg.lastIndex = 0;
94
- }
95
- for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) {
96
- args[_key3 - 1] = arguments[_key3];
97
- }
92
+ if (thisArg instanceof RegExp) thisArg.lastIndex = 0;
93
+ for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) args[_key3 - 1] = arguments[_key3];
98
94
  return apply(func, thisArg, args);
99
95
  };
100
96
  }
101
97
  function unconstruct(Func) {
102
98
  return function() {
103
- for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) {
104
- args[_key4] = arguments[_key4];
105
- }
99
+ for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) args[_key4] = arguments[_key4];
106
100
  return construct(Func, args);
107
101
  };
108
102
  }
109
103
  function addToSet(set, array) {
110
104
  let transformCaseFunc = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : stringToLowerCase;
111
- if (setPrototypeOf) {
112
- setPrototypeOf(set, null);
113
- }
114
- if (!arrayIsArray(array)) {
115
- return set;
116
- }
105
+ if (setPrototypeOf) setPrototypeOf(set, null);
106
+ if (!arrayIsArray(array)) return set;
117
107
  let l = array.length;
118
108
  while (l--) {
119
109
  let element = array[l];
120
110
  if (typeof element === "string") {
121
111
  const lcElement = transformCaseFunc(element);
122
112
  if (lcElement !== element) {
123
- if (!isFrozen(array)) {
124
- array[l] = lcElement;
125
- }
113
+ if (!isFrozen(array)) array[l] = lcElement;
126
114
  element = lcElement;
127
115
  }
128
116
  }
@@ -131,12 +119,7 @@ function addToSet(set, array) {
131
119
  return set;
132
120
  }
133
121
  function cleanArray(array) {
134
- for (let index = 0; index < array.length; index++) {
135
- const isPropertyExist = objectHasOwnProperty(array, index);
136
- if (!isPropertyExist) {
137
- array[index] = null;
138
- }
139
- }
122
+ for (let index = 0; index < array.length; index++) if (!objectHasOwnProperty(array, index)) array[index] = null;
140
123
  return array;
141
124
  }
142
125
  function clone(object) {
@@ -145,44 +128,31 @@ function clone(object) {
145
128
  var _ref3 = _slicedToArray(_ref2, 2);
146
129
  const property = _ref3[0];
147
130
  const value = _ref3[1];
148
- const isPropertyExist = objectHasOwnProperty(object, property);
149
- if (isPropertyExist) {
150
- if (arrayIsArray(value)) {
151
- newObject[property] = cleanArray(value);
152
- } else if (value && typeof value === "object" && value.constructor === Object) {
153
- newObject[property] = clone(value);
154
- } else {
155
- newObject[property] = value;
156
- }
131
+ if (objectHasOwnProperty(object, property)) {
132
+ if (arrayIsArray(value)) newObject[property] = cleanArray(value);
133
+ else if (value && typeof value === "object" && value.constructor === Object) newObject[property] = clone(value);
134
+ else newObject[property] = value;
157
135
  }
158
136
  }
159
137
  return newObject;
160
138
  }
161
139
  function stringifyValue(value) {
162
140
  switch (typeof value) {
163
- case "string": {
141
+ case "string":
164
142
  return value;
165
- }
166
- case "number": {
143
+ case "number":
167
144
  return numberToString(value);
168
- }
169
- case "boolean": {
145
+ case "boolean":
170
146
  return booleanToString(value);
171
- }
172
- case "bigint": {
147
+ case "bigint":
173
148
  return bigintToString ? bigintToString(value) : "0";
174
- }
175
- case "symbol": {
149
+ case "symbol":
176
150
  return symbolToString ? symbolToString(value) : "Symbol()";
177
- }
178
- case "undefined": {
151
+ case "undefined":
179
152
  return objectToString(value);
180
- }
181
153
  case "function":
182
154
  case "object": {
183
- if (value === null) {
184
- return objectToString(value);
185
- }
155
+ if (value === null) return objectToString(value);
186
156
  const valueAsRecord = value;
187
157
  const valueToString = lookupGetter(valueAsRecord, "toString");
188
158
  if (typeof valueToString === "function") {
@@ -191,21 +161,16 @@ function stringifyValue(value) {
191
161
  }
192
162
  return objectToString(value);
193
163
  }
194
- default: {
164
+ default:
195
165
  return objectToString(value);
196
- }
197
166
  }
198
167
  }
199
168
  function lookupGetter(object, prop) {
200
169
  while (object !== null) {
201
170
  const desc = getOwnPropertyDescriptor(object, prop);
202
171
  if (desc) {
203
- if (desc.get) {
204
- return unapply(desc.get);
205
- }
206
- if (typeof desc.value === "function") {
207
- return unapply(desc.value);
208
- }
172
+ if (desc.get) return unapply(desc.get);
173
+ if (typeof desc.value === "function") return unapply(desc.value);
209
174
  }
210
175
  object = getPrototypeOf(object);
211
176
  }
@@ -214,6 +179,14 @@ function lookupGetter(object, prop) {
214
179
  }
215
180
  return fallbackValue;
216
181
  }
182
+ function lookupAccessor(object, prop) {
183
+ while (object !== null) {
184
+ const desc = getOwnPropertyDescriptor(object, prop);
185
+ if (desc) return desc.get ? unapply(desc.get) : null;
186
+ object = getPrototypeOf(object);
187
+ }
188
+ return null;
189
+ }
217
190
  function isRegex(value) {
218
191
  try {
219
192
  regExpTest(value, "");
@@ -222,62 +195,700 @@ function isRegex(value) {
222
195
  return false;
223
196
  }
224
197
  }
225
- const html$1 = freeze(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "search", "section", "select", "shadow", "slot", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]);
226
- const svg$1 = freeze(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "enterkeyhint", "exportparts", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "inputmode", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "part", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]);
227
- const svgFilters = freeze(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]);
228
- const svgDisallowed = freeze(["animate", "color-profile", "cursor", "discard", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]);
229
- const mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]);
230
- const mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]);
198
+ const html$1 = freeze([
199
+ "a",
200
+ "abbr",
201
+ "acronym",
202
+ "address",
203
+ "area",
204
+ "article",
205
+ "aside",
206
+ "audio",
207
+ "b",
208
+ "bdi",
209
+ "bdo",
210
+ "big",
211
+ "blink",
212
+ "blockquote",
213
+ "body",
214
+ "br",
215
+ "button",
216
+ "canvas",
217
+ "caption",
218
+ "center",
219
+ "cite",
220
+ "code",
221
+ "col",
222
+ "colgroup",
223
+ "content",
224
+ "data",
225
+ "datalist",
226
+ "dd",
227
+ "decorator",
228
+ "del",
229
+ "details",
230
+ "dfn",
231
+ "dialog",
232
+ "dir",
233
+ "div",
234
+ "dl",
235
+ "dt",
236
+ "element",
237
+ "em",
238
+ "fieldset",
239
+ "figcaption",
240
+ "figure",
241
+ "font",
242
+ "footer",
243
+ "form",
244
+ "h1",
245
+ "h2",
246
+ "h3",
247
+ "h4",
248
+ "h5",
249
+ "h6",
250
+ "head",
251
+ "header",
252
+ "hgroup",
253
+ "hr",
254
+ "html",
255
+ "i",
256
+ "img",
257
+ "input",
258
+ "ins",
259
+ "kbd",
260
+ "label",
261
+ "legend",
262
+ "li",
263
+ "main",
264
+ "map",
265
+ "mark",
266
+ "marquee",
267
+ "menu",
268
+ "menuitem",
269
+ "meter",
270
+ "nav",
271
+ "nobr",
272
+ "ol",
273
+ "optgroup",
274
+ "option",
275
+ "output",
276
+ "p",
277
+ "picture",
278
+ "pre",
279
+ "progress",
280
+ "q",
281
+ "rp",
282
+ "rt",
283
+ "ruby",
284
+ "s",
285
+ "samp",
286
+ "search",
287
+ "section",
288
+ "select",
289
+ "shadow",
290
+ "slot",
291
+ "small",
292
+ "source",
293
+ "spacer",
294
+ "span",
295
+ "strike",
296
+ "strong",
297
+ "style",
298
+ "sub",
299
+ "summary",
300
+ "sup",
301
+ "table",
302
+ "tbody",
303
+ "td",
304
+ "template",
305
+ "textarea",
306
+ "tfoot",
307
+ "th",
308
+ "thead",
309
+ "time",
310
+ "tr",
311
+ "track",
312
+ "tt",
313
+ "u",
314
+ "ul",
315
+ "var",
316
+ "video",
317
+ "wbr"
318
+ ]);
319
+ const svg$1 = freeze([
320
+ "svg",
321
+ "a",
322
+ "altglyph",
323
+ "altglyphdef",
324
+ "altglyphitem",
325
+ "animatecolor",
326
+ "animatemotion",
327
+ "animatetransform",
328
+ "circle",
329
+ "clippath",
330
+ "defs",
331
+ "desc",
332
+ "ellipse",
333
+ "enterkeyhint",
334
+ "exportparts",
335
+ "filter",
336
+ "font",
337
+ "g",
338
+ "glyph",
339
+ "glyphref",
340
+ "hkern",
341
+ "image",
342
+ "inputmode",
343
+ "line",
344
+ "lineargradient",
345
+ "marker",
346
+ "mask",
347
+ "metadata",
348
+ "mpath",
349
+ "part",
350
+ "path",
351
+ "pattern",
352
+ "polygon",
353
+ "polyline",
354
+ "radialgradient",
355
+ "rect",
356
+ "stop",
357
+ "style",
358
+ "switch",
359
+ "symbol",
360
+ "text",
361
+ "textpath",
362
+ "title",
363
+ "tref",
364
+ "tspan",
365
+ "view",
366
+ "vkern"
367
+ ]);
368
+ const svgFilters = freeze([
369
+ "feBlend",
370
+ "feColorMatrix",
371
+ "feComponentTransfer",
372
+ "feComposite",
373
+ "feConvolveMatrix",
374
+ "feDiffuseLighting",
375
+ "feDisplacementMap",
376
+ "feDistantLight",
377
+ "feDropShadow",
378
+ "feFlood",
379
+ "feFuncA",
380
+ "feFuncB",
381
+ "feFuncG",
382
+ "feFuncR",
383
+ "feGaussianBlur",
384
+ "feImage",
385
+ "feMerge",
386
+ "feMergeNode",
387
+ "feMorphology",
388
+ "feOffset",
389
+ "fePointLight",
390
+ "feSpecularLighting",
391
+ "feSpotLight",
392
+ "feTile",
393
+ "feTurbulence"
394
+ ]);
395
+ const svgDisallowed = freeze([
396
+ "animate",
397
+ "color-profile",
398
+ "cursor",
399
+ "discard",
400
+ "font-face",
401
+ "font-face-format",
402
+ "font-face-name",
403
+ "font-face-src",
404
+ "font-face-uri",
405
+ "foreignobject",
406
+ "hatch",
407
+ "hatchpath",
408
+ "mesh",
409
+ "meshgradient",
410
+ "meshpatch",
411
+ "meshrow",
412
+ "missing-glyph",
413
+ "script",
414
+ "set",
415
+ "solidcolor",
416
+ "unknown",
417
+ "use"
418
+ ]);
419
+ const mathMl$1 = freeze([
420
+ "math",
421
+ "menclose",
422
+ "merror",
423
+ "mfenced",
424
+ "mfrac",
425
+ "mglyph",
426
+ "mi",
427
+ "mlabeledtr",
428
+ "mmultiscripts",
429
+ "mn",
430
+ "mo",
431
+ "mover",
432
+ "mpadded",
433
+ "mphantom",
434
+ "mroot",
435
+ "mrow",
436
+ "ms",
437
+ "mspace",
438
+ "msqrt",
439
+ "mstyle",
440
+ "msub",
441
+ "msup",
442
+ "msubsup",
443
+ "mtable",
444
+ "mtd",
445
+ "mtext",
446
+ "mtr",
447
+ "munder",
448
+ "munderover",
449
+ "mprescripts"
450
+ ]);
451
+ const mathMlDisallowed = freeze([
452
+ "maction",
453
+ "maligngroup",
454
+ "malignmark",
455
+ "mlongdiv",
456
+ "mscarries",
457
+ "mscarry",
458
+ "msgroup",
459
+ "mstack",
460
+ "msline",
461
+ "msrow",
462
+ "semantics",
463
+ "annotation",
464
+ "annotation-xml",
465
+ "mprescripts",
466
+ "none"
467
+ ]);
231
468
  const text = freeze(["#text"]);
232
- const html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "command", "commandfor", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns"]);
233
- const svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
234
- const mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnalign", "columnlines", "columnspacing", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lquote", "lspace", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]);
235
- const xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
469
+ const html = freeze([
470
+ "accept",
471
+ "action",
472
+ "align",
473
+ "alt",
474
+ "autocapitalize",
475
+ "autocomplete",
476
+ "autopictureinpicture",
477
+ "autoplay",
478
+ "background",
479
+ "bgcolor",
480
+ "border",
481
+ "capture",
482
+ "cellpadding",
483
+ "cellspacing",
484
+ "checked",
485
+ "cite",
486
+ "class",
487
+ "clear",
488
+ "color",
489
+ "cols",
490
+ "colspan",
491
+ "command",
492
+ "commandfor",
493
+ "controls",
494
+ "controlslist",
495
+ "coords",
496
+ "crossorigin",
497
+ "datetime",
498
+ "decoding",
499
+ "default",
500
+ "dir",
501
+ "disabled",
502
+ "disablepictureinpicture",
503
+ "disableremoteplayback",
504
+ "download",
505
+ "draggable",
506
+ "enctype",
507
+ "enterkeyhint",
508
+ "exportparts",
509
+ "face",
510
+ "for",
511
+ "headers",
512
+ "height",
513
+ "hidden",
514
+ "high",
515
+ "href",
516
+ "hreflang",
517
+ "id",
518
+ "inert",
519
+ "inputmode",
520
+ "integrity",
521
+ "ismap",
522
+ "kind",
523
+ "label",
524
+ "lang",
525
+ "list",
526
+ "loading",
527
+ "loop",
528
+ "low",
529
+ "max",
530
+ "maxlength",
531
+ "media",
532
+ "method",
533
+ "min",
534
+ "minlength",
535
+ "multiple",
536
+ "muted",
537
+ "name",
538
+ "nonce",
539
+ "noshade",
540
+ "novalidate",
541
+ "nowrap",
542
+ "open",
543
+ "optimum",
544
+ "part",
545
+ "pattern",
546
+ "placeholder",
547
+ "playsinline",
548
+ "popover",
549
+ "popovertarget",
550
+ "popovertargetaction",
551
+ "poster",
552
+ "preload",
553
+ "pubdate",
554
+ "radiogroup",
555
+ "readonly",
556
+ "rel",
557
+ "required",
558
+ "rev",
559
+ "reversed",
560
+ "role",
561
+ "rows",
562
+ "rowspan",
563
+ "spellcheck",
564
+ "scope",
565
+ "selected",
566
+ "shape",
567
+ "size",
568
+ "sizes",
569
+ "slot",
570
+ "span",
571
+ "srclang",
572
+ "start",
573
+ "src",
574
+ "srcset",
575
+ "step",
576
+ "style",
577
+ "summary",
578
+ "tabindex",
579
+ "title",
580
+ "translate",
581
+ "type",
582
+ "usemap",
583
+ "valign",
584
+ "value",
585
+ "width",
586
+ "wrap",
587
+ "xmlns"
588
+ ]);
589
+ const svg = freeze([
590
+ "accent-height",
591
+ "accumulate",
592
+ "additive",
593
+ "alignment-baseline",
594
+ "amplitude",
595
+ "ascent",
596
+ "attributename",
597
+ "attributetype",
598
+ "azimuth",
599
+ "basefrequency",
600
+ "baseline-shift",
601
+ "begin",
602
+ "bias",
603
+ "by",
604
+ "class",
605
+ "clip",
606
+ "clippathunits",
607
+ "clip-path",
608
+ "clip-rule",
609
+ "color",
610
+ "color-interpolation",
611
+ "color-interpolation-filters",
612
+ "color-profile",
613
+ "color-rendering",
614
+ "cx",
615
+ "cy",
616
+ "d",
617
+ "dx",
618
+ "dy",
619
+ "diffuseconstant",
620
+ "direction",
621
+ "display",
622
+ "divisor",
623
+ "dominant-baseline",
624
+ "dur",
625
+ "edgemode",
626
+ "elevation",
627
+ "end",
628
+ "exponent",
629
+ "fill",
630
+ "fill-opacity",
631
+ "fill-rule",
632
+ "filter",
633
+ "filterunits",
634
+ "flood-color",
635
+ "flood-opacity",
636
+ "font-family",
637
+ "font-size",
638
+ "font-size-adjust",
639
+ "font-stretch",
640
+ "font-style",
641
+ "font-variant",
642
+ "font-weight",
643
+ "fx",
644
+ "fy",
645
+ "g1",
646
+ "g2",
647
+ "glyph-name",
648
+ "glyphref",
649
+ "gradientunits",
650
+ "gradienttransform",
651
+ "height",
652
+ "href",
653
+ "id",
654
+ "image-rendering",
655
+ "in",
656
+ "in2",
657
+ "intercept",
658
+ "k",
659
+ "k1",
660
+ "k2",
661
+ "k3",
662
+ "k4",
663
+ "kerning",
664
+ "keypoints",
665
+ "keysplines",
666
+ "keytimes",
667
+ "lang",
668
+ "lengthadjust",
669
+ "letter-spacing",
670
+ "kernelmatrix",
671
+ "kernelunitlength",
672
+ "lighting-color",
673
+ "local",
674
+ "marker-end",
675
+ "marker-mid",
676
+ "marker-start",
677
+ "markerheight",
678
+ "markerunits",
679
+ "markerwidth",
680
+ "maskcontentunits",
681
+ "maskunits",
682
+ "max",
683
+ "mask",
684
+ "mask-type",
685
+ "media",
686
+ "method",
687
+ "mode",
688
+ "min",
689
+ "name",
690
+ "numoctaves",
691
+ "offset",
692
+ "operator",
693
+ "opacity",
694
+ "order",
695
+ "orient",
696
+ "orientation",
697
+ "origin",
698
+ "overflow",
699
+ "paint-order",
700
+ "path",
701
+ "pathlength",
702
+ "patterncontentunits",
703
+ "patterntransform",
704
+ "patternunits",
705
+ "pointer-events",
706
+ "points",
707
+ "preservealpha",
708
+ "preserveaspectratio",
709
+ "primitiveunits",
710
+ "r",
711
+ "rx",
712
+ "ry",
713
+ "radius",
714
+ "refx",
715
+ "refy",
716
+ "repeatcount",
717
+ "repeatdur",
718
+ "restart",
719
+ "result",
720
+ "rotate",
721
+ "scale",
722
+ "seed",
723
+ "shape-rendering",
724
+ "slope",
725
+ "specularconstant",
726
+ "specularexponent",
727
+ "spreadmethod",
728
+ "startoffset",
729
+ "stddeviation",
730
+ "stitchtiles",
731
+ "stop-color",
732
+ "stop-opacity",
733
+ "stroke-dasharray",
734
+ "stroke-dashoffset",
735
+ "stroke-linecap",
736
+ "stroke-linejoin",
737
+ "stroke-miterlimit",
738
+ "stroke-opacity",
739
+ "stroke",
740
+ "stroke-width",
741
+ "style",
742
+ "surfacescale",
743
+ "systemlanguage",
744
+ "tabindex",
745
+ "tablevalues",
746
+ "targetx",
747
+ "targety",
748
+ "transform",
749
+ "transform-origin",
750
+ "text-anchor",
751
+ "text-decoration",
752
+ "text-orientation",
753
+ "text-rendering",
754
+ "textlength",
755
+ "type",
756
+ "u1",
757
+ "u2",
758
+ "unicode",
759
+ "values",
760
+ "vector-effect",
761
+ "viewbox",
762
+ "visibility",
763
+ "version",
764
+ "vert-adv-y",
765
+ "vert-origin-x",
766
+ "vert-origin-y",
767
+ "width",
768
+ "word-spacing",
769
+ "wrap",
770
+ "writing-mode",
771
+ "xchannelselector",
772
+ "ychannelselector",
773
+ "x",
774
+ "x1",
775
+ "x2",
776
+ "xmlns",
777
+ "y",
778
+ "y1",
779
+ "y2",
780
+ "z",
781
+ "zoomandpan"
782
+ ]);
783
+ const mathMl = freeze([
784
+ "accent",
785
+ "accentunder",
786
+ "align",
787
+ "bevelled",
788
+ "close",
789
+ "columnalign",
790
+ "columnlines",
791
+ "columnspacing",
792
+ "columnspan",
793
+ "denomalign",
794
+ "depth",
795
+ "dir",
796
+ "display",
797
+ "displaystyle",
798
+ "encoding",
799
+ "fence",
800
+ "frame",
801
+ "height",
802
+ "href",
803
+ "id",
804
+ "largeop",
805
+ "length",
806
+ "linethickness",
807
+ "lquote",
808
+ "lspace",
809
+ "mathbackground",
810
+ "mathcolor",
811
+ "mathsize",
812
+ "mathvariant",
813
+ "maxsize",
814
+ "minsize",
815
+ "movablelimits",
816
+ "notation",
817
+ "numalign",
818
+ "open",
819
+ "rowalign",
820
+ "rowlines",
821
+ "rowspacing",
822
+ "rowspan",
823
+ "rspace",
824
+ "rquote",
825
+ "scriptlevel",
826
+ "scriptminsize",
827
+ "scriptsizemultiplier",
828
+ "selection",
829
+ "separator",
830
+ "separators",
831
+ "stretchy",
832
+ "subscriptshift",
833
+ "supscriptshift",
834
+ "symmetric",
835
+ "voffset",
836
+ "width",
837
+ "xmlns"
838
+ ]);
839
+ const xml = freeze([
840
+ "xlink:href",
841
+ "xml:id",
842
+ "xlink:title",
843
+ "xml:space",
844
+ "xmlns:xlink"
845
+ ]);
236
846
  const MUSTACHE_EXPR = seal(/{{[\w\W]*|^[\w\W]*}}/g);
237
847
  const ERB_EXPR = seal(/<%[\w\W]*|^[\w\W]*%>/g);
238
848
  const TMPLIT_EXPR = seal(/\${[\w\W]*/g);
239
849
  const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/);
240
850
  const ARIA_ATTR = seal(/^aria-[\-\w]+$/);
241
- const IS_ALLOWED_URI = seal(
242
- /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
243
- // eslint-disable-line no-useless-escape
244
- );
851
+ const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i);
245
852
  const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
246
- const ATTR_WHITESPACE = seal(
247
- /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
248
- // eslint-disable-line no-control-regex
249
- );
853
+ const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g);
250
854
  const DOCTYPE_NAME = seal(/^html$/i);
251
855
  const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
856
+ const ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g);
857
+ const COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
858
+ const FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
859
+ const SELF_CLOSING_TAG = seal(/\/>/i);
252
860
  const NODE_TYPE = {
253
861
  element: 1,
254
862
  attribute: 2,
255
863
  text: 3,
256
864
  cdataSection: 4,
257
865
  entityReference: 5,
258
- // Deprecated
259
866
  entityNode: 6,
260
- // Deprecated
261
- progressingInstruction: 7,
867
+ processingInstruction: 7,
262
868
  comment: 8,
263
869
  document: 9,
264
870
  documentType: 10,
265
871
  documentFragment: 11,
266
872
  notation: 12
267
- // Deprecated
268
873
  };
874
+ const LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, [
875
+ "style",
876
+ "script",
877
+ "xmp",
878
+ "iframe",
879
+ "noembed",
880
+ "noframes",
881
+ "plaintext",
882
+ "noscript"
883
+ ]));
269
884
  const getGlobal = function getGlobal2() {
270
885
  return typeof window === "undefined" ? null : window;
271
886
  };
272
887
  const _createTrustedTypesPolicy = function _createTrustedTypesPolicy2(trustedTypes, purifyHostElement) {
273
- if (typeof trustedTypes !== "object" || typeof trustedTypes.createPolicy !== "function") {
274
- return null;
275
- }
888
+ if (typeof trustedTypes !== "object" || typeof trustedTypes.createPolicy !== "function") return null;
276
889
  let suffix = null;
277
890
  const ATTR_NAME = "data-tt-policy-suffix";
278
- if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
279
- suffix = purifyHostElement.getAttribute(ATTR_NAME);
280
- }
891
+ if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) suffix = purifyHostElement.getAttribute(ATTR_NAME);
281
892
  const policyName = "dompurify" + (suffix ? "#" + suffix : "");
282
893
  try {
283
894
  return trustedTypes.createPolicy(policyName, {
@@ -306,10 +917,17 @@ const _createHooksMap = function _createHooksMap2() {
306
917
  uponSanitizeShadowNode: []
307
918
  };
308
919
  };
920
+ const _resolveSetOption = function _resolveSetOption2(cfg, key, fallback, options) {
921
+ return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback;
922
+ };
923
+ const _resolveObjectOption = function _resolveObjectOption2(cfg, key, makeFallback) {
924
+ const value = objectHasOwnProperty(cfg, key) ? cfg[key] : void 0;
925
+ return value && typeof value === "object" ? clone(value) : makeFallback();
926
+ };
309
927
  function createDOMPurify() {
310
928
  let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
311
929
  const DOMPurify = (root) => createDOMPurify(root);
312
- DOMPurify.version = "3.4.7";
930
+ DOMPurify.version = "3.4.17";
313
931
  DOMPurify.removed = [];
314
932
  if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document || !window2.Element) {
315
933
  DOMPurify.isSupported = false;
@@ -319,13 +937,14 @@ function createDOMPurify() {
319
937
  const originalDocument = document;
320
938
  const currentScript = originalDocument.currentScript;
321
939
  window2.DocumentFragment;
322
- const HTMLTemplateElement = window2.HTMLTemplateElement, Node = window2.Node, Element = window2.Element, NodeFilter = window2.NodeFilter, _window$NamedNodeMap = window2.NamedNodeMap;
323
- _window$NamedNodeMap === void 0 ? window2.NamedNodeMap || window2.MozNamedAttrMap : _window$NamedNodeMap;
940
+ const HTMLTemplateElement = window2.HTMLTemplateElement, Node = window2.Node, Element = window2.Element, NodeFilter = window2.NodeFilter;
941
+ window2.NamedNodeMap === void 0 && (window2.NamedNodeMap || window2.MozNamedAttrMap);
324
942
  window2.HTMLFormElement;
325
943
  const DOMParser = window2.DOMParser, trustedTypes = window2.trustedTypes;
326
944
  const ElementPrototype = Element.prototype;
327
945
  const cloneNode = lookupGetter(ElementPrototype, "cloneNode");
328
946
  const remove = lookupGetter(ElementPrototype, "remove");
947
+ const removeAttributeNode = lookupGetter(ElementPrototype, "removeAttributeNode");
329
948
  const getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
330
949
  const getChildNodes = lookupGetter(ElementPrototype, "childNodes");
331
950
  const getParentNode = lookupGetter(ElementPrototype, "parentNode");
@@ -333,14 +952,54 @@ function createDOMPurify() {
333
952
  const getAttributes = lookupGetter(ElementPrototype, "attributes");
334
953
  const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeType") : null;
335
954
  const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeName") : null;
955
+ const getOwnerDocument = Node && Node.prototype ? lookupGetter(Node.prototype, "ownerDocument") : null;
956
+ const _readNodeType = function _readNodeType2(node) {
957
+ return getNodeType ? getNodeType(node) : node.nodeType;
958
+ };
959
+ const _readNodeName = function _readNodeName2(node) {
960
+ return getNodeName ? getNodeName(node) : node.nodeName;
961
+ };
962
+ const getNamespaceURI = lookupAccessor(ElementPrototype, "namespaceURI");
963
+ const _readNamespaceURI = function _readNamespaceURI2(element) {
964
+ return getNamespaceURI ? getNamespaceURI(element) : element.namespaceURI;
965
+ };
336
966
  if (typeof HTMLTemplateElement === "function") {
337
967
  const template = document.createElement("template");
338
- if (template.content && template.content.ownerDocument) {
339
- document = template.content.ownerDocument;
340
- }
968
+ if (template.content && template.content.ownerDocument) document = template.content.ownerDocument;
341
969
  }
342
970
  let trustedTypesPolicy;
343
971
  let emptyHTML = "";
972
+ let defaultTrustedTypesPolicy;
973
+ let defaultTrustedTypesPolicyResolved = false;
974
+ let IN_TRUSTED_TYPES_POLICY = 0;
975
+ const _assertNotInTrustedTypesPolicy = function _assertNotInTrustedTypesPolicy2() {
976
+ if (IN_TRUSTED_TYPES_POLICY > 0) throw typeErrorCreate('A configured TRUSTED_TYPES_POLICY callback (createHTML or createScriptURL) must not call DOMPurify.sanitize, as that causes infinite recursion. Do not pass a policy whose callbacks wrap DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted Types" section of the README.');
977
+ };
978
+ const _createTrustedHTML = function _createTrustedHTML2(html2) {
979
+ _assertNotInTrustedTypesPolicy();
980
+ IN_TRUSTED_TYPES_POLICY++;
981
+ try {
982
+ return trustedTypesPolicy.createHTML(html2);
983
+ } finally {
984
+ IN_TRUSTED_TYPES_POLICY--;
985
+ }
986
+ };
987
+ const _createTrustedScriptURL = function _createTrustedScriptURL2(scriptUrl) {
988
+ _assertNotInTrustedTypesPolicy();
989
+ IN_TRUSTED_TYPES_POLICY++;
990
+ try {
991
+ return trustedTypesPolicy.createScriptURL(scriptUrl);
992
+ } finally {
993
+ IN_TRUSTED_TYPES_POLICY--;
994
+ }
995
+ };
996
+ const _getDefaultTrustedTypesPolicy = function _getDefaultTrustedTypesPolicy2() {
997
+ if (!defaultTrustedTypesPolicyResolved) {
998
+ defaultTrustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
999
+ defaultTrustedTypesPolicyResolved = true;
1000
+ }
1001
+ return defaultTrustedTypesPolicy;
1002
+ };
344
1003
  const _document = document, implementation = _document.implementation, createNodeIterator = _document.createNodeIterator, createDocumentFragment = _document.createDocumentFragment, getElementsByTagName = _document.getElementsByTagName;
345
1004
  const importNode = originalDocument.importNode;
346
1005
  let hooks = _createHooksMap();
@@ -348,9 +1007,20 @@ function createDOMPurify() {
348
1007
  const MUSTACHE_EXPR$1 = MUSTACHE_EXPR, ERB_EXPR$1 = ERB_EXPR, TMPLIT_EXPR$1 = TMPLIT_EXPR, DATA_ATTR$1 = DATA_ATTR, ARIA_ATTR$1 = ARIA_ATTR, IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA, ATTR_WHITESPACE$1 = ATTR_WHITESPACE, CUSTOM_ELEMENT$1 = CUSTOM_ELEMENT;
349
1008
  let IS_ALLOWED_URI$1 = IS_ALLOWED_URI;
350
1009
  let ALLOWED_TAGS = null;
351
- const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
1010
+ const DEFAULT_ALLOWED_TAGS = addToSet({}, [
1011
+ ...html$1,
1012
+ ...svg$1,
1013
+ ...svgFilters,
1014
+ ...mathMl$1,
1015
+ ...text
1016
+ ]);
352
1017
  let ALLOWED_ATTR = null;
353
- const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
1018
+ const DEFAULT_ALLOWED_ATTR = addToSet({}, [
1019
+ ...html,
1020
+ ...svg,
1021
+ ...mathMl,
1022
+ ...xml
1023
+ ]);
354
1024
  let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
355
1025
  tagNameCheck: {
356
1026
  writable: true,
@@ -395,6 +1065,8 @@ function createDOMPurify() {
395
1065
  let SAFE_FOR_XML = true;
396
1066
  let WHOLE_DOCUMENT = false;
397
1067
  let SET_CONFIG = false;
1068
+ let SET_CONFIG_ALLOWED_TAGS = null;
1069
+ let SET_CONFIG_ALLOWED_ATTR = null;
398
1070
  let FORCE_BODY = false;
399
1071
  let RETURN_DOM = false;
400
1072
  let RETURN_DOM_FRAGMENT = false;
@@ -404,23 +1076,91 @@ function createDOMPurify() {
404
1076
  const SANITIZE_NAMED_PROPS_PREFIX = "user-content-";
405
1077
  let KEEP_CONTENT = true;
406
1078
  let IN_PLACE = false;
1079
+ let IN_PLACE_VISITED = null;
407
1080
  let USE_PROFILES = {};
408
1081
  let FORBID_CONTENTS = null;
409
- const DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
1082
+ const DEFAULT_FORBID_CONTENTS = addToSet({}, [
1083
+ "annotation-xml",
1084
+ "audio",
1085
+ "colgroup",
1086
+ "desc",
1087
+ "foreignobject",
1088
+ "head",
1089
+ "iframe",
1090
+ "math",
1091
+ "mi",
1092
+ "mn",
1093
+ "mo",
1094
+ "ms",
1095
+ "mtext",
1096
+ "noembed",
1097
+ "noframes",
1098
+ "noscript",
1099
+ "plaintext",
1100
+ "script",
1101
+ "selectedcontent",
1102
+ "style",
1103
+ "svg",
1104
+ "template",
1105
+ "thead",
1106
+ "title",
1107
+ "video",
1108
+ "xmp"
1109
+ ]);
410
1110
  let DATA_URI_TAGS = null;
411
- const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]);
1111
+ const DEFAULT_DATA_URI_TAGS = addToSet({}, [
1112
+ "audio",
1113
+ "video",
1114
+ "img",
1115
+ "source",
1116
+ "image",
1117
+ "track"
1118
+ ]);
412
1119
  let URI_SAFE_ATTRIBUTES = null;
413
- const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]);
1120
+ const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, [
1121
+ "alt",
1122
+ "class",
1123
+ "for",
1124
+ "id",
1125
+ "label",
1126
+ "name",
1127
+ "pattern",
1128
+ "placeholder",
1129
+ "role",
1130
+ "summary",
1131
+ "title",
1132
+ "value",
1133
+ "style",
1134
+ "xmlns"
1135
+ ]);
414
1136
  const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML";
415
1137
  const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
416
1138
  const HTML_NAMESPACE = "http://www.w3.org/1999/xhtml";
417
1139
  let NAMESPACE = HTML_NAMESPACE;
418
1140
  let IS_EMPTY_INPUT = false;
419
1141
  let ALLOWED_NAMESPACES = null;
420
- const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
421
- let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
422
- let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
423
- const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]);
1142
+ const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [
1143
+ MATHML_NAMESPACE,
1144
+ SVG_NAMESPACE,
1145
+ HTML_NAMESPACE
1146
+ ], stringToString);
1147
+ const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze([
1148
+ "mi",
1149
+ "mo",
1150
+ "mn",
1151
+ "ms",
1152
+ "mtext"
1153
+ ]);
1154
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
1155
+ const DEFAULT_HTML_INTEGRATION_POINTS = freeze(["annotation-xml"]);
1156
+ let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
1157
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, [
1158
+ "title",
1159
+ "style",
1160
+ "font",
1161
+ "a",
1162
+ "script"
1163
+ ]);
424
1164
  let PARSER_MEDIA_TYPE = null;
425
1165
  const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"];
426
1166
  const DEFAULT_PARSER_MEDIA_TYPE = "text/html";
@@ -432,24 +1172,25 @@ function createDOMPurify() {
432
1172
  };
433
1173
  const _parseConfig = function _parseConfig2() {
434
1174
  let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
435
- if (CONFIG && CONFIG === cfg) {
436
- return;
437
- }
438
- if (!cfg || typeof cfg !== "object") {
439
- cfg = {};
440
- }
1175
+ if (CONFIG && CONFIG === cfg) return;
1176
+ if (!cfg || typeof cfg !== "object") cfg = {};
441
1177
  cfg = clone(cfg);
442
- PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
443
- SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
1178
+ PARSER_MEDIA_TYPE = SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
444
1179
  transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
445
- ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") && arrayIsArray(cfg.ALLOWED_TAGS) ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
446
- ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") && arrayIsArray(cfg.ALLOWED_ATTR) ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
447
- ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") && arrayIsArray(cfg.ALLOWED_NAMESPACES) ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
448
- URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR) ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
449
- DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") && arrayIsArray(cfg.ADD_DATA_URI_TAGS) ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
450
- FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS) ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
451
- FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") && arrayIsArray(cfg.FORBID_TAGS) ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
452
- FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") && arrayIsArray(cfg.FORBID_ATTR) ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
1180
+ ALLOWED_TAGS = _resolveSetOption(cfg, "ALLOWED_TAGS", DEFAULT_ALLOWED_TAGS, { transform: transformCaseFunc });
1181
+ ALLOWED_ATTR = _resolveSetOption(cfg, "ALLOWED_ATTR", DEFAULT_ALLOWED_ATTR, { transform: transformCaseFunc });
1182
+ ALLOWED_NAMESPACES = _resolveSetOption(cfg, "ALLOWED_NAMESPACES", DEFAULT_ALLOWED_NAMESPACES, { transform: stringToString });
1183
+ URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, "ADD_URI_SAFE_ATTR", DEFAULT_URI_SAFE_ATTRIBUTES, {
1184
+ transform: transformCaseFunc,
1185
+ base: DEFAULT_URI_SAFE_ATTRIBUTES
1186
+ });
1187
+ DATA_URI_TAGS = _resolveSetOption(cfg, "ADD_DATA_URI_TAGS", DEFAULT_DATA_URI_TAGS, {
1188
+ transform: transformCaseFunc,
1189
+ base: DEFAULT_DATA_URI_TAGS
1190
+ });
1191
+ FORBID_CONTENTS = _resolveSetOption(cfg, "FORBID_CONTENTS", DEFAULT_FORBID_CONTENTS, { transform: transformCaseFunc });
1192
+ FORBID_TAGS = _resolveSetOption(cfg, "FORBID_TAGS", clone({}), { transform: transformCaseFunc });
1193
+ FORBID_ATTR = _resolveSetOption(cfg, "FORBID_ATTR", clone({}), { transform: transformCaseFunc });
453
1194
  USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === "object" ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false;
454
1195
  ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
455
1196
  ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
@@ -468,25 +1209,16 @@ function createDOMPurify() {
468
1209
  IN_PLACE = cfg.IN_PLACE || false;
469
1210
  IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI;
470
1211
  NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE;
471
- MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
472
- HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, ["annotation-xml"]);
473
- const customElementHandling = objectHasOwnProperty(cfg, "CUSTOM_ELEMENT_HANDLING") && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === "object" ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
1212
+ MATHML_TEXT_INTEGRATION_POINTS = _resolveObjectOption(cfg, "MATHML_TEXT_INTEGRATION_POINTS", () => addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS));
1213
+ HTML_INTEGRATION_POINTS = _resolveObjectOption(cfg, "HTML_INTEGRATION_POINTS", () => addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS));
1214
+ const customElementHandling = _resolveObjectOption(cfg, "CUSTOM_ELEMENT_HANDLING", () => create(null));
474
1215
  CUSTOM_ELEMENT_HANDLING = create(null);
475
- if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) {
476
- CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck;
477
- }
478
- if (objectHasOwnProperty(customElementHandling, "attributeNameCheck") && isRegexOrFunction(customElementHandling.attributeNameCheck)) {
479
- CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck;
480
- }
481
- if (objectHasOwnProperty(customElementHandling, "allowCustomizedBuiltInElements") && typeof customElementHandling.allowCustomizedBuiltInElements === "boolean") {
482
- CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements;
483
- }
484
- if (SAFE_FOR_TEMPLATES) {
485
- ALLOW_DATA_ATTR = false;
486
- }
487
- if (RETURN_DOM_FRAGMENT) {
488
- RETURN_DOM = true;
489
- }
1216
+ if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck;
1217
+ if (objectHasOwnProperty(customElementHandling, "attributeNameCheck") && isRegexOrFunction(customElementHandling.attributeNameCheck)) CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck;
1218
+ if (objectHasOwnProperty(customElementHandling, "allowCustomizedBuiltInElements") && typeof customElementHandling.allowCustomizedBuiltInElements === "boolean") CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements;
1219
+ seal(CUSTOM_ELEMENT_HANDLING);
1220
+ if (SAFE_FOR_TEMPLATES) ALLOW_DATA_ATTR = false;
1221
+ if (RETURN_DOM_FRAGMENT) RETURN_DOM = true;
490
1222
  if (USE_PROFILES) {
491
1223
  ALLOWED_TAGS = addToSet({}, text);
492
1224
  ALLOWED_ATTR = create(null);
@@ -513,180 +1245,299 @@ function createDOMPurify() {
513
1245
  EXTRA_ELEMENT_HANDLING.tagCheck = null;
514
1246
  EXTRA_ELEMENT_HANDLING.attributeCheck = null;
515
1247
  if (objectHasOwnProperty(cfg, "ADD_TAGS")) {
516
- if (typeof cfg.ADD_TAGS === "function") {
517
- EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS;
518
- } else if (arrayIsArray(cfg.ADD_TAGS)) {
519
- if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
520
- ALLOWED_TAGS = clone(ALLOWED_TAGS);
521
- }
1248
+ if (typeof cfg.ADD_TAGS === "function") EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS;
1249
+ else if (arrayIsArray(cfg.ADD_TAGS)) {
1250
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) ALLOWED_TAGS = clone(ALLOWED_TAGS);
522
1251
  addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
523
1252
  }
524
1253
  }
525
1254
  if (objectHasOwnProperty(cfg, "ADD_ATTR")) {
526
- if (typeof cfg.ADD_ATTR === "function") {
527
- EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR;
528
- } else if (arrayIsArray(cfg.ADD_ATTR)) {
529
- if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
530
- ALLOWED_ATTR = clone(ALLOWED_ATTR);
531
- }
1255
+ if (typeof cfg.ADD_ATTR === "function") EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR;
1256
+ else if (arrayIsArray(cfg.ADD_ATTR)) {
1257
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) ALLOWED_ATTR = clone(ALLOWED_ATTR);
532
1258
  addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
533
1259
  }
534
1260
  }
535
- if (objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR)) {
536
- addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
537
- }
538
- if (objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS)) {
539
- if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
540
- FORBID_CONTENTS = clone(FORBID_CONTENTS);
541
- }
542
- addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
543
- }
544
1261
  if (objectHasOwnProperty(cfg, "ADD_FORBID_CONTENTS") && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) {
545
- if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
546
- FORBID_CONTENTS = clone(FORBID_CONTENTS);
547
- }
1262
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) FORBID_CONTENTS = clone(FORBID_CONTENTS);
548
1263
  addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
549
1264
  }
550
- if (KEEP_CONTENT) {
551
- ALLOWED_TAGS["#text"] = true;
552
- }
553
- if (WHOLE_DOCUMENT) {
554
- addToSet(ALLOWED_TAGS, ["html", "head", "body"]);
555
- }
1265
+ if (KEEP_CONTENT) ALLOWED_TAGS["#text"] = true;
1266
+ if (WHOLE_DOCUMENT) addToSet(ALLOWED_TAGS, [
1267
+ "html",
1268
+ "head",
1269
+ "body"
1270
+ ]);
556
1271
  if (ALLOWED_TAGS.table) {
557
1272
  addToSet(ALLOWED_TAGS, ["tbody"]);
558
1273
  delete FORBID_TAGS.tbody;
559
1274
  }
560
1275
  if (cfg.TRUSTED_TYPES_POLICY) {
561
- if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== "function") {
562
- throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
563
- }
564
- if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") {
565
- throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
566
- }
1276
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== "function") throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
1277
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
1278
+ const previousTrustedTypesPolicy = trustedTypesPolicy;
567
1279
  trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
568
- emptyHTML = trustedTypesPolicy.createHTML("");
569
- } else {
570
- if (trustedTypesPolicy === void 0) {
571
- trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
572
- }
573
- if (trustedTypesPolicy !== null && typeof emptyHTML === "string") {
574
- emptyHTML = trustedTypesPolicy.createHTML("");
1280
+ try {
1281
+ emptyHTML = _createTrustedHTML("");
1282
+ } catch (error) {
1283
+ trustedTypesPolicy = previousTrustedTypesPolicy;
1284
+ throw error;
575
1285
  }
1286
+ } else if (cfg.TRUSTED_TYPES_POLICY === null) {
1287
+ trustedTypesPolicy = void 0;
1288
+ emptyHTML = "";
1289
+ } else {
1290
+ if (trustedTypesPolicy === void 0) trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
1291
+ if (trustedTypesPolicy && typeof emptyHTML === "string") emptyHTML = _createTrustedHTML("");
576
1292
  }
577
- if ((hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) && ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
578
- ALLOWED_TAGS = clone(ALLOWED_TAGS);
579
- }
580
- if (hooks.uponSanitizeAttribute.length > 0 && ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
581
- ALLOWED_ATTR = clone(ALLOWED_ATTR);
582
- }
583
- if (freeze) {
584
- freeze(cfg);
585
- }
1293
+ if (freeze) freeze(cfg);
586
1294
  CONFIG = cfg;
587
1295
  };
588
- const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
1296
+ const ALL_SVG_TAGS = addToSet({}, [
1297
+ ...svg$1,
1298
+ ...svgFilters,
1299
+ ...svgDisallowed
1300
+ ]);
589
1301
  const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
1302
+ const _checkSvgNamespace = function _checkSvgNamespace2(tagName, parent, parentTagName) {
1303
+ if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "svg";
1304
+ if (parent.namespaceURI === MATHML_NAMESPACE) return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
1305
+ return Boolean(ALL_SVG_TAGS[tagName]);
1306
+ };
1307
+ const _checkMathMlNamespace = function _checkMathMlNamespace2(tagName, parent, parentTagName) {
1308
+ if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "math";
1309
+ if (parent.namespaceURI === SVG_NAMESPACE) return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
1310
+ return Boolean(ALL_MATHML_TAGS[tagName]);
1311
+ };
1312
+ const _checkHtmlNamespace = function _checkHtmlNamespace2(tagName, parent, parentTagName) {
1313
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) return false;
1314
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) return false;
1315
+ return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
1316
+ };
590
1317
  const _checkValidNamespace = function _checkValidNamespace2(element) {
591
- let parent = getParentNode(element);
592
- if (!parent || !parent.tagName) {
593
- parent = {
594
- namespaceURI: NAMESPACE,
595
- tagName: "template"
596
- };
597
- }
598
- const tagName = stringToLowerCase(element.tagName);
599
- const parentTagName = stringToLowerCase(parent.tagName);
600
- if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
601
- return false;
1318
+ const elementNamespace = _readNamespaceURI(element);
1319
+ const tagName = stringToLowerCase(_readNodeName(element));
1320
+ const parentNode = getParentNode(element);
1321
+ let parent;
1322
+ let parentTagName;
1323
+ if (parentNode && _readNodeType(parentNode) === NODE_TYPE.element) {
1324
+ parent = { namespaceURI: _readNamespaceURI(parentNode) };
1325
+ parentTagName = stringToLowerCase(_readNodeName(parentNode));
1326
+ } else {
1327
+ parent = { namespaceURI: NAMESPACE };
1328
+ parentTagName = "template";
1329
+ }
1330
+ if (!ALLOWED_NAMESPACES[elementNamespace]) return false;
1331
+ if (elementNamespace === SVG_NAMESPACE) return _checkSvgNamespace(tagName, parent, parentTagName);
1332
+ if (elementNamespace === MATHML_NAMESPACE) return _checkMathMlNamespace(tagName, parent, parentTagName);
1333
+ if (elementNamespace === HTML_NAMESPACE) return _checkHtmlNamespace(tagName, parent, parentTagName);
1334
+ if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[elementNamespace]) return true;
1335
+ return false;
1336
+ };
1337
+ const _forceRemove = function _forceRemove2(node) {
1338
+ arrayPush(DOMPurify.removed, { element: node });
1339
+ try {
1340
+ getParentNode(node).removeChild(node);
1341
+ } catch (_) {
1342
+ remove(node);
1343
+ if (!getParentNode(node)) throw typeErrorCreate("a node selected for removal could not be detached from its tree and cannot be safely returned; refusing to sanitize in place");
602
1344
  }
603
- if (element.namespaceURI === SVG_NAMESPACE) {
604
- if (parent.namespaceURI === HTML_NAMESPACE) {
605
- return tagName === "svg";
606
- }
607
- if (parent.namespaceURI === MATHML_NAMESPACE) {
608
- return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
1345
+ };
1346
+ const _stripAttributeNode = function _stripAttributeNode2(element, attribute, name) {
1347
+ try {
1348
+ removeAttributeNode(element, attribute);
1349
+ } catch (_) {
1350
+ try {
1351
+ element.removeAttribute(name);
1352
+ } catch (_2) {
609
1353
  }
610
- return Boolean(ALL_SVG_TAGS[tagName]);
611
1354
  }
612
- if (element.namespaceURI === MATHML_NAMESPACE) {
613
- if (parent.namespaceURI === HTML_NAMESPACE) {
614
- return tagName === "math";
1355
+ };
1356
+ const _neutralizeRoot = function _neutralizeRoot2(root) {
1357
+ _neutralizeSubtree(root);
1358
+ const childNodes = getChildNodes(root);
1359
+ if (childNodes) arrayForEach(arraySlice(childNodes), (child) => {
1360
+ try {
1361
+ remove(child);
1362
+ } catch (_) {
615
1363
  }
616
- if (parent.namespaceURI === SVG_NAMESPACE) {
617
- return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
1364
+ });
1365
+ const attributes = _readNodeType(root) === NODE_TYPE.element ? getAttributes(root) : null;
1366
+ if (attributes) for (let i = attributes.length - 1; i >= 0; --i) {
1367
+ const attribute = attributes[i];
1368
+ const name = attribute && attribute.name;
1369
+ if (typeof name === "string") _stripAttributeNode(root, attribute, name);
1370
+ }
1371
+ };
1372
+ const _removeAttribute = function _removeAttribute2(name, element, attr) {
1373
+ if (!attr) try {
1374
+ attr = element.getAttributeNode(name);
1375
+ } catch (_) {
1376
+ attr = null;
1377
+ }
1378
+ arrayPush(DOMPurify.removed, {
1379
+ attribute: attr || null,
1380
+ from: element
1381
+ });
1382
+ try {
1383
+ if (attr) removeAttributeNode(element, attr);
1384
+ else element.removeAttribute(name);
1385
+ } catch (_) {
1386
+ try {
1387
+ element.removeAttribute(name);
1388
+ } catch (_2) {
618
1389
  }
619
- return Boolean(ALL_MATHML_TAGS[tagName]);
620
1390
  }
621
- if (element.namespaceURI === HTML_NAMESPACE) {
622
- if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
623
- return false;
1391
+ if (name === "is") {
1392
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) try {
1393
+ _forceRemove(element);
1394
+ } catch (_) {
624
1395
  }
625
- if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
626
- return false;
1396
+ else try {
1397
+ element.setAttribute(name, "");
1398
+ } catch (_) {
627
1399
  }
628
- return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
629
1400
  }
630
- if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) {
631
- return true;
1401
+ };
1402
+ const _stripDisallowedAttributes = function _stripDisallowedAttributes2(element) {
1403
+ const attributes = getAttributes(element);
1404
+ if (!attributes) return;
1405
+ for (let i = attributes.length - 1; i >= 0; --i) {
1406
+ const attribute = attributes[i];
1407
+ const name = attribute && attribute.name;
1408
+ if (typeof name !== "string" || ALLOWED_ATTR[transformCaseFunc(name)]) continue;
1409
+ _stripAttributeNode(element, attribute, name);
632
1410
  }
633
- return false;
634
1411
  };
635
- const _forceRemove = function _forceRemove2(node) {
636
- arrayPush(DOMPurify.removed, {
637
- element: node
638
- });
639
- try {
640
- getParentNode(node).removeChild(node);
641
- } catch (_) {
642
- remove(node);
1412
+ const _walkTree = function _walkTree2(root, visit) {
1413
+ let intoShadow = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : false;
1414
+ const stack = [root];
1415
+ while (stack.length > 0) {
1416
+ const node = stack.pop();
1417
+ if (visit(node) === false) continue;
1418
+ if (intoShadow && _readNodeType(node) === NODE_TYPE.element) {
1419
+ const shadowRoot = getShadowRoot(node);
1420
+ if (_isDocumentFragment(shadowRoot)) stack.push(shadowRoot);
1421
+ }
1422
+ const childNodes = getChildNodes(node);
1423
+ if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
643
1424
  }
644
1425
  };
645
- const _removeAttribute = function _removeAttribute2(name, element) {
646
- try {
647
- arrayPush(DOMPurify.removed, {
648
- attribute: element.getAttributeNode(name),
649
- from: element
1426
+ const _neutralizeSubtree = function _neutralizeSubtree2(root) {
1427
+ _walkTree(root, (node) => {
1428
+ if (_readNodeType(node) === NODE_TYPE.element) _stripDisallowedAttributes(node);
1429
+ });
1430
+ };
1431
+ const _collectLiveNodes = function _collectLiveNodes2(root) {
1432
+ const nodes = [];
1433
+ _walkTree(root, (node) => {
1434
+ nodes.push(node);
1435
+ }, true);
1436
+ return nodes;
1437
+ };
1438
+ const _neutralizeEscapedElements = function _neutralizeEscapedElements2(root, before) {
1439
+ const reachable = setCreate();
1440
+ arrayForEach(_collectLiveNodes(root), (node) => {
1441
+ if (_readNodeType(node) === NODE_TYPE.element) setAdd(reachable, node);
1442
+ });
1443
+ arrayForEach(before, (node) => {
1444
+ if (_readNodeType(node) === NODE_TYPE.element && !setHas(reachable, node)) _stripDisallowedAttributes(node);
1445
+ });
1446
+ };
1447
+ const _neutralizeDiscarded = function _neutralizeDiscarded2(root, before) {
1448
+ let rootRemoved = false;
1449
+ arrayForEach(DOMPurify.removed, (entry) => {
1450
+ if (entry.element) {
1451
+ rootRemoved = rootRemoved || entry.element === root;
1452
+ _neutralizeSubtree(entry.element);
1453
+ }
1454
+ });
1455
+ _neutralizeEscapedElements(root, before);
1456
+ return rootRemoved;
1457
+ };
1458
+ const MAX_UNVISITED_ROUNDS = 8;
1459
+ const _sanitizeUnvisitedNodes = function _sanitizeUnvisitedNodes2(root, before) {
1460
+ const visited = IN_PLACE_VISITED;
1461
+ let original = null;
1462
+ const getOriginal = () => {
1463
+ if (!original) {
1464
+ original = setCreate();
1465
+ arrayForEach(before, (beforeNode) => {
1466
+ setAdd(original, beforeNode);
1467
+ });
1468
+ }
1469
+ return original;
1470
+ };
1471
+ for (let round = 0; ; round++) {
1472
+ const live = _collectLiveNodes(root);
1473
+ const containers = [root];
1474
+ let pending = false;
1475
+ arrayForEach(live, (node) => {
1476
+ if (_readNodeType(node) === NODE_TYPE.documentFragment) arrayPush(containers, node);
1477
+ else if (!pending && !setHas(visited, node)) pending = setHas(getOriginal(), node);
650
1478
  });
651
- } catch (_) {
652
- arrayPush(DOMPurify.removed, {
653
- attribute: null,
654
- from: element
1479
+ if (!pending) return;
1480
+ if (round >= MAX_UNVISITED_ROUNDS) throw typeErrorCreate("the tree kept changing during in-place sanitization; refusing to return it");
1481
+ arrayForEach(containers, (container, index) => {
1482
+ _sanitizeUnvisitedIn(container, index > 0, root, getOriginal());
655
1483
  });
656
1484
  }
657
- element.removeAttribute(name);
658
- if (name === "is") {
659
- if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
1485
+ };
1486
+ const _sanitizeUnvisitedIn = function _sanitizeUnvisitedIn2(container, inShadow, root, original) {
1487
+ const iterator = _createNodeIterator(container);
1488
+ let node;
1489
+ while (node = iterator.nextNode()) {
1490
+ if (!setHas(original, node) || setHas(IN_PLACE_VISITED, node)) continue;
1491
+ if (inShadow) _executeHooks(hooks.uponSanitizeShadowNode, node, null);
1492
+ _sanitizeElements(node, root);
1493
+ _sanitizeAttributes(node, root);
1494
+ if (_isDocumentFragment(node.content)) _sanitizeShadowDOM2(node.content);
1495
+ }
1496
+ };
1497
+ const _markVisited = function _markVisited2(node) {
1498
+ if (IN_PLACE_VISITED) setAdd(IN_PLACE_VISITED, node);
1499
+ };
1500
+ const _isPatchLinkageAttribute = function _isPatchLinkageAttribute2(lcName, lcTag) {
1501
+ if (!SAFE_FOR_XML) return false;
1502
+ if (lcName === "patchsrc") return true;
1503
+ return lcName === "for" && lcTag !== "label" && lcTag !== "output";
1504
+ };
1505
+ const _neutralizePatchLinkage = function _neutralizePatchLinkage2(root) {
1506
+ if (!SAFE_FOR_XML) return;
1507
+ _walkTree(root, (node) => {
1508
+ const nodeType = _readNodeType(node);
1509
+ if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
660
1510
  try {
661
- _forceRemove(element);
1511
+ remove(node);
662
1512
  } catch (_) {
663
1513
  }
664
- } else {
1514
+ return false;
1515
+ }
1516
+ if (nodeType === NODE_TYPE.element) {
1517
+ const element = node;
1518
+ const lcTag = transformCaseFunc(_readNodeName(node));
665
1519
  try {
666
- element.setAttribute(name, "");
1520
+ if (element.hasAttribute && element.hasAttribute("patchsrc")) element.removeAttribute("patchsrc");
1521
+ if (element.hasAttribute && element.hasAttribute("for") && _isPatchLinkageAttribute("for", lcTag)) element.removeAttribute("for");
667
1522
  } catch (_) {
668
1523
  }
669
1524
  }
670
- }
1525
+ return true;
1526
+ });
671
1527
  };
672
1528
  const _initDocument = function _initDocument2(dirty) {
673
1529
  let doc = null;
674
1530
  let leadingWhitespace = null;
675
- if (FORCE_BODY) {
676
- dirty = "<remove></remove>" + dirty;
677
- } else {
1531
+ if (FORCE_BODY) dirty = "<remove></remove>" + dirty;
1532
+ else {
678
1533
  const matches = stringMatch(dirty, /^[\r\n\t ]+/);
679
1534
  leadingWhitespace = matches && matches[0];
680
1535
  }
681
- if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) {
682
- dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
683
- }
684
- const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
685
- if (NAMESPACE === HTML_NAMESPACE) {
686
- try {
687
- doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
688
- } catch (_) {
689
- }
1536
+ if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
1537
+ const dirtyPayload = trustedTypesPolicy ? _createTrustedHTML(dirty) : dirty;
1538
+ if (NAMESPACE === HTML_NAMESPACE) try {
1539
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
1540
+ } catch (_) {
690
1541
  }
691
1542
  if (!doc || !doc.documentElement) {
692
1543
  doc = implementation.createDocument(NAMESPACE, "template", null);
@@ -696,79 +1547,46 @@ function createDOMPurify() {
696
1547
  }
697
1548
  }
698
1549
  const body = doc.body || doc.documentElement;
699
- if (dirty && leadingWhitespace) {
700
- body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
701
- }
702
- if (NAMESPACE === HTML_NAMESPACE) {
703
- return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0];
704
- }
1550
+ if (dirty && leadingWhitespace) body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
1551
+ if (NAMESPACE === HTML_NAMESPACE) return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0];
705
1552
  return WHOLE_DOCUMENT ? doc.documentElement : body;
706
1553
  };
707
1554
  const _createNodeIterator = function _createNodeIterator2(root) {
708
- return createNodeIterator.call(
709
- root.ownerDocument || root,
710
- root,
711
- // eslint-disable-next-line no-bitwise
712
- NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION,
713
- null
714
- );
1555
+ const doc = getOwnerDocument ? getOwnerDocument(root) : root.ownerDocument;
1556
+ return createNodeIterator.call(doc || root, root, NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
715
1557
  };
716
- const _scrubTemplateExpressions = function _scrubTemplateExpressions2(node) {
1558
+ const _stripTemplateExpressions = function _stripTemplateExpressions2(value) {
1559
+ value = stringReplace(value, MUSTACHE_EXPR$1, " ");
1560
+ value = stringReplace(value, ERB_EXPR$1, " ");
1561
+ value = stringReplace(value, TMPLIT_EXPR$1, " ");
1562
+ return value;
1563
+ };
1564
+ const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
1565
+ var _node$querySelectorAl;
1566
+ _scrubOwnCharacterData(node);
1567
+ const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template");
1568
+ if (templates) arrayForEach(templates, (tmpl) => {
1569
+ if (_isDocumentFragment(tmpl.content)) _scrubTemplateExpressions2(tmpl.content);
1570
+ });
1571
+ };
1572
+ const _scrubOwnCharacterData = function _scrubOwnCharacterData2(node) {
717
1573
  node.normalize();
718
- const walker = createNodeIterator.call(
719
- node.ownerDocument || node,
720
- node,
721
- // eslint-disable-next-line no-bitwise
722
- NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION,
723
- null
724
- );
1574
+ const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument;
1575
+ const walker = createNodeIterator.call(doc || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
725
1576
  let currentNode = walker.nextNode();
726
1577
  while (currentNode) {
727
- let data = currentNode.data;
728
- arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
729
- data = stringReplace(data, expr, " ");
730
- });
731
- currentNode.data = data;
1578
+ currentNode.data = _stripTemplateExpressions(currentNode.data);
732
1579
  currentNode = walker.nextNode();
733
1580
  }
734
1581
  };
735
1582
  const _isClobbered = function _isClobbered2(element) {
736
1583
  const realTagName = getNodeName ? getNodeName(element) : null;
737
- if (typeof realTagName !== "string") {
738
- return false;
739
- }
740
- if (transformCaseFunc(realTagName) !== "form") {
741
- return false;
742
- }
743
- return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || // Realm-safe NamedNodeMap detection: equality against the cached
744
- // prototype getter. Clobbered .attributes (e.g. <input name="attributes">)
745
- // makes the direct read diverge from the cached read; a clean form
746
- // (same-realm OR foreign-realm) has both reads pointing at the same
747
- // canonical NamedNodeMap.
748
- element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || // NodeType clobbering probe. Cached Node.prototype.nodeType getter
749
- // returns the integer 1 for any Element regardless of realm; direct
750
- // read on a clobbered form (e.g. <input name="nodeType">) returns
751
- // the named child element. Cheap addition — nodeType is read from
752
- // an internal slot, no serialization cost — and removes a residual
753
- // clobbering surface used by several mXSS / PI / comment branches
754
- // in _sanitizeElements that compare currentNode.nodeType directly.
755
- element.nodeType !== getNodeType(element) || // HTMLFormElement has [LegacyOverrideBuiltIns]: a descendant named
756
- // "childNodes" shadows the prototype getter. Direct reads of
757
- // form.childNodes from a clobbered form return the named child
758
- // instead of the real NodeList, so any walk that reads it directly
759
- // skips the form's real children. Compare the direct read to the
760
- // cached Node.prototype getter — when the form's named-property
761
- // getter intercepts the read, the two values differ and we flag
762
- // the form. This catches every clobbering child type (input,
763
- // select, etc.) regardless of whether the named child happens to
764
- // carry a numeric .length, which a typeof-based probe would miss
765
- // (e.g. HTMLSelectElement.length is a defined unsigned-long).
766
- element.childNodes !== getChildNodes(element);
1584
+ if (typeof realTagName !== "string") return false;
1585
+ if (transformCaseFunc(realTagName) !== "form") return false;
1586
+ return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.removeAttributeNode !== "function" || typeof element.getAttributeNode !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || element.nodeType !== getNodeType(element) || element.childNodes !== getChildNodes(element);
767
1587
  };
768
1588
  const _isDocumentFragment = function _isDocumentFragment2(value) {
769
- if (!getNodeType || typeof value !== "object" || value === null) {
770
- return false;
771
- }
1589
+ if (!getNodeType || typeof value !== "object" || value === null) return false;
772
1590
  try {
773
1591
  return getNodeType(value) === NODE_TYPE.documentFragment;
774
1592
  } catch (_) {
@@ -776,9 +1594,7 @@ function createDOMPurify() {
776
1594
  }
777
1595
  };
778
1596
  const _isNode = function _isNode2(value) {
779
- if (!getNodeType || typeof value !== "object" || value === null) {
780
- return false;
781
- }
1597
+ if (!getNodeType || typeof value !== "object" || value === null) return false;
782
1598
  try {
783
1599
  return typeof getNodeType(value) === "number";
784
1600
  } catch (_) {
@@ -786,126 +1602,156 @@ function createDOMPurify() {
786
1602
  }
787
1603
  };
788
1604
  function _executeHooks(hooks2, currentNode, data) {
1605
+ if (hooks2.length === 0) return;
789
1606
  arrayForEach(hooks2, (hook) => {
790
1607
  hook.call(DOMPurify, currentNode, data, CONFIG);
791
1608
  });
792
1609
  }
793
- const _sanitizeElements = function _sanitizeElements2(currentNode) {
794
- let content = null;
1610
+ const _isUnsafeNode = function _isUnsafeNode2(currentNode, tagName) {
1611
+ if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) return true;
1612
+ if (SAFE_FOR_XML && LITERAL_TEXT_ELEMENTS[tagName] && _readNodeType(currentNode) === NODE_TYPE.element && _readNamespaceURI(currentNode) === HTML_NAMESPACE && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent))) return true;
1613
+ if (currentNode.nodeType === NODE_TYPE.processingInstruction) return true;
1614
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) return true;
1615
+ return false;
1616
+ };
1617
+ const _matchesNameCheck = function _matchesNameCheck2(check, name) {
1618
+ if (check instanceof RegExp) return regExpTest(check, name);
1619
+ if (check instanceof Function) {
1620
+ for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) args[_key - 2] = arguments[_key];
1621
+ return Boolean(check(name, ...args));
1622
+ }
1623
+ return false;
1624
+ };
1625
+ const _sanitizeDisallowedNode = function _sanitizeDisallowedNode2(currentNode, tagName, root) {
1626
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
1627
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName] && !FORBID_CONTENTS[stringToLowerCase(tagName)]) {
1628
+ const parentNode = getParentNode(currentNode);
1629
+ const childNodes = getChildNodes(currentNode);
1630
+ if (childNodes && parentNode) {
1631
+ const childCount = childNodes.length;
1632
+ for (let i = childCount - 1; i >= 0; --i) {
1633
+ const hoisted = currentNode === root ? cloneNode(childNodes[i], true) : childNodes[i];
1634
+ parentNode.insertBefore(hoisted, getNextSibling(currentNode));
1635
+ }
1636
+ }
1637
+ }
1638
+ _forceRemove(currentNode);
1639
+ return true;
1640
+ };
1641
+ const _forkSharedAllowlist = function _forkSharedAllowlist2(hookList, set, defaultSet, setConfigSet) {
1642
+ if (hookList.length === 0) return set;
1643
+ return set === defaultSet || set === setConfigSet ? clone(set) : set;
1644
+ };
1645
+ const _handleHookDetachedNode = function _handleHookDetachedNode2(currentNode, root) {
1646
+ if (currentNode === root || getParentNode(currentNode) !== null) return false;
1647
+ if (IN_PLACE) _neutralizeSubtree(currentNode);
1648
+ return true;
1649
+ };
1650
+ const _sanitizeElements = function _sanitizeElements2(currentNode, root) {
1651
+ _markVisited(currentNode);
795
1652
  _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
1653
+ if (_handleHookDetachedNode(currentNode, root)) return true;
796
1654
  if (_isClobbered(currentNode)) {
797
1655
  _forceRemove(currentNode);
798
1656
  return true;
799
1657
  }
800
- const tagName = transformCaseFunc(currentNode.nodeName);
1658
+ const tagName = transformCaseFunc(_readNodeName(currentNode));
1659
+ ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS);
801
1660
  _executeHooks(hooks.uponSanitizeElement, currentNode, {
802
1661
  tagName,
803
1662
  allowedTags: ALLOWED_TAGS
804
1663
  });
805
- if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
806
- _forceRemove(currentNode);
807
- return true;
808
- }
809
- if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) {
810
- _forceRemove(currentNode);
811
- return true;
812
- }
813
- if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
814
- _forceRemove(currentNode);
815
- return true;
816
- }
817
- if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
1664
+ if (_handleHookDetachedNode(currentNode, root)) return true;
1665
+ if (_isUnsafeNode(currentNode, tagName)) {
818
1666
  _forceRemove(currentNode);
819
1667
  return true;
820
1668
  }
821
1669
  if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
822
- if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
823
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
824
- return false;
825
- }
826
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
827
- return false;
828
- }
829
- }
830
- if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
831
- const parentNode = getParentNode(currentNode);
832
- const childNodes = getChildNodes(currentNode);
833
- if (childNodes && parentNode) {
834
- const childCount = childNodes.length;
835
- for (let i = childCount - 1; i >= 0; --i) {
836
- const childClone = cloneNode(childNodes[i], true);
837
- parentNode.insertBefore(childClone, getNextSibling(currentNode));
838
- }
839
- }
1670
+ const removed = _sanitizeDisallowedNode(currentNode, tagName, root);
1671
+ if (removed === false) {
1672
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
1673
+ if (_handleHookDetachedNode(currentNode, root)) return true;
840
1674
  }
841
- _forceRemove(currentNode);
842
- return true;
1675
+ return removed;
843
1676
  }
844
- const nt = getNodeType ? getNodeType(currentNode) : currentNode.nodeType;
845
- if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
1677
+ if (_readNodeType(currentNode) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
846
1678
  _forceRemove(currentNode);
847
1679
  return true;
848
1680
  }
849
- if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
1681
+ if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) {
850
1682
  _forceRemove(currentNode);
851
1683
  return true;
852
1684
  }
853
1685
  if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
854
- content = currentNode.textContent;
855
- arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
856
- content = stringReplace(content, expr, " ");
857
- });
1686
+ const content = _stripTemplateExpressions(currentNode.textContent);
858
1687
  if (currentNode.textContent !== content) {
859
- arrayPush(DOMPurify.removed, {
860
- element: currentNode.cloneNode()
861
- });
1688
+ arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });
862
1689
  currentNode.textContent = content;
863
1690
  }
864
1691
  }
865
1692
  _executeHooks(hooks.afterSanitizeElements, currentNode, null);
866
- return false;
1693
+ return _handleHookDetachedNode(currentNode, root);
867
1694
  };
868
1695
  const _isValidAttribute = function _isValidAttribute2(lcTag, lcName, value) {
869
- if (FORBID_ATTR[lcName]) {
870
- return false;
871
- }
872
- if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) {
873
- return false;
874
- }
1696
+ if (FORBID_ATTR[lcName]) return false;
1697
+ if (_isPatchLinkageAttribute(lcName, lcTag)) return false;
1698
+ if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) return false;
875
1699
  const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
876
- if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName)) ;
877
- else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ;
878
- else if (!nameIsPermitted || FORBID_ATTR[lcName]) {
879
- if (
880
- // First condition does a very basic check if a) it's basically a valid custom element tagname AND
881
- // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
882
- // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
883
- _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || // Alternative, second condition checks if it's an `is`-attribute, AND
884
- // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
885
- lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))
886
- ) ;
887
- else {
1700
+ if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) return true;
1701
+ if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) return true;
1702
+ if (!nameIsPermitted) return _isBasicCustomElement(lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName, lcTag) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value);
1703
+ if (URI_SAFE_ATTRIBUTES[lcName]) return true;
1704
+ if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) return true;
1705
+ if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) return true;
1706
+ if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) return true;
1707
+ return !value;
1708
+ };
1709
+ const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, [
1710
+ "annotation-xml",
1711
+ "color-profile",
1712
+ "font-face",
1713
+ "font-face-format",
1714
+ "font-face-name",
1715
+ "font-face-src",
1716
+ "font-face-uri",
1717
+ "missing-glyph"
1718
+ ]);
1719
+ const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
1720
+ return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
1721
+ };
1722
+ const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute2(lcTag, lcName, namespaceURI, value) {
1723
+ if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function" && !namespaceURI) switch (trustedTypes.getAttributeType(lcTag, lcName)) {
1724
+ case "TrustedHTML":
1725
+ return _createTrustedHTML(value);
1726
+ case "TrustedScriptURL":
1727
+ return _createTrustedScriptURL(value);
1728
+ }
1729
+ return value;
1730
+ };
1731
+ const _setAttributeValue = function _setAttributeValue2(currentNode, name, namespaceURI, value) {
1732
+ try {
1733
+ if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
1734
+ else currentNode.setAttribute(name, value);
1735
+ if (_isClobbered(currentNode)) {
1736
+ _forceRemove(currentNode);
888
1737
  return false;
889
1738
  }
890
- } else if (URI_SAFE_ATTRIBUTES[lcName]) ;
891
- else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) ;
892
- else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) ;
893
- else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) ;
894
- else if (value) {
1739
+ return true;
1740
+ } catch (_) {
1741
+ _removeAttribute(name, currentNode);
895
1742
  return false;
896
- } else ;
897
- return true;
1743
+ }
898
1744
  };
899
- const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, ["annotation-xml", "color-profile", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "missing-glyph"]);
900
- const _isBasicCustomElement = function _isBasicCustomElement2(tagName) {
901
- return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
1745
+ const _isUnsafeAttributeValue = function _isUnsafeAttributeValue2(name, value) {
1746
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) return true;
1747
+ return stringToLowerCase(name) === "attributename" && stringMatch(value, "href") !== null;
902
1748
  };
903
- const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) {
1749
+ const _sanitizeAttributes = function _sanitizeAttributes2(currentNode, root) {
904
1750
  _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
1751
+ if (_handleHookDetachedNode(currentNode, root)) return;
905
1752
  const attributes = currentNode.attributes;
906
- if (!attributes || _isClobbered(currentNode)) {
907
- return;
908
- }
1753
+ if (!attributes || _isClobbered(currentNode)) return;
1754
+ ALLOWED_ATTR = _forkSharedAllowlist(hooks.uponSanitizeAttribute, ALLOWED_ATTR, DEFAULT_ALLOWED_ATTR, SET_CONFIG_ALLOWED_ATTR);
909
1755
  const hookEvent = {
910
1756
  attrName: "",
911
1757
  attrValue: "",
@@ -914,12 +1760,14 @@ function createDOMPurify() {
914
1760
  forceKeepAttr: void 0
915
1761
  };
916
1762
  let l = attributes.length;
1763
+ const lcTag = transformCaseFunc(currentNode.nodeName);
917
1764
  while (l--) {
918
1765
  const attr = attributes[l];
919
1766
  const name = attr.name, namespaceURI = attr.namespaceURI, attrValue = attr.value;
920
1767
  const lcName = transformCaseFunc(name);
921
1768
  const initValue = attrValue;
922
1769
  let value = name === "value" ? initValue : stringTrim(initValue);
1770
+ let recreatedNamedProp = false;
923
1771
  hookEvent.attrName = lcName;
924
1772
  hookEvent.attrValue = value;
925
1773
  hookEvent.keepAttr = true;
@@ -927,71 +1775,35 @@ function createDOMPurify() {
927
1775
  _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
928
1776
  value = hookEvent.attrValue;
929
1777
  if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
930
- _removeAttribute(name, currentNode);
1778
+ _removeAttribute(name, currentNode, attr);
931
1779
  value = SANITIZE_NAMED_PROPS_PREFIX + value;
1780
+ recreatedNamedProp = true;
932
1781
  }
933
- if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
934
- _removeAttribute(name, currentNode);
935
- continue;
936
- }
937
- if (lcName === "attributename" && stringMatch(value, "href")) {
938
- _removeAttribute(name, currentNode);
939
- continue;
940
- }
941
- if (hookEvent.forceKeepAttr) {
1782
+ if (_isUnsafeAttributeValue(name, value)) {
1783
+ _removeAttribute(name, currentNode, attr);
942
1784
  continue;
943
1785
  }
1786
+ if (hookEvent.forceKeepAttr) continue;
944
1787
  if (!hookEvent.keepAttr) {
945
- _removeAttribute(name, currentNode);
1788
+ _removeAttribute(name, currentNode, attr);
946
1789
  continue;
947
1790
  }
948
- if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
949
- _removeAttribute(name, currentNode);
1791
+ if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
1792
+ _removeAttribute(name, currentNode, attr);
950
1793
  continue;
951
1794
  }
952
- if (SAFE_FOR_TEMPLATES) {
953
- arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
954
- value = stringReplace(value, expr, " ");
955
- });
956
- }
957
- const lcTag = transformCaseFunc(currentNode.nodeName);
1795
+ if (SAFE_FOR_TEMPLATES) value = _stripTemplateExpressions(value);
958
1796
  if (!_isValidAttribute(lcTag, lcName, value)) {
959
- _removeAttribute(name, currentNode);
1797
+ _removeAttribute(name, currentNode, attr);
960
1798
  continue;
961
1799
  }
962
- if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") {
963
- if (namespaceURI) ;
964
- else {
965
- switch (trustedTypes.getAttributeType(lcTag, lcName)) {
966
- case "TrustedHTML": {
967
- value = trustedTypesPolicy.createHTML(value);
968
- break;
969
- }
970
- case "TrustedScriptURL": {
971
- value = trustedTypesPolicy.createScriptURL(value);
972
- break;
973
- }
974
- }
975
- }
976
- }
1800
+ value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
977
1801
  if (value !== initValue) {
978
- try {
979
- if (namespaceURI) {
980
- currentNode.setAttributeNS(namespaceURI, name, value);
981
- } else {
982
- currentNode.setAttribute(name, value);
983
- }
984
- if (_isClobbered(currentNode)) {
985
- _forceRemove(currentNode);
986
- } else {
987
- arrayPop(DOMPurify.removed);
988
- }
989
- } catch (_) {
990
- _removeAttribute(name, currentNode);
991
- }
1802
+ if (_setAttributeValue(currentNode, name, namespaceURI, value) && recreatedNamedProp) arrayPop(DOMPurify.removed);
992
1803
  }
993
1804
  }
994
1805
  _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
1806
+ _handleHookDetachedNode(currentNode, root);
995
1807
  };
996
1808
  const _sanitizeShadowDOM2 = function _sanitizeShadowDOM(fragment) {
997
1809
  let shadowNode = null;
@@ -999,50 +1811,58 @@ function createDOMPurify() {
999
1811
  _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
1000
1812
  while (shadowNode = shadowIterator.nextNode()) {
1001
1813
  _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
1002
- _sanitizeElements(shadowNode);
1003
- _sanitizeAttributes(shadowNode);
1004
- if (_isDocumentFragment(shadowNode.content)) {
1005
- _sanitizeShadowDOM2(shadowNode.content);
1006
- }
1007
- const shadowNodeType = getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType;
1008
- if (shadowNodeType === NODE_TYPE.element) {
1009
- const innerSr = getShadowRoot ? getShadowRoot(shadowNode) : shadowNode.shadowRoot;
1814
+ _sanitizeElements(shadowNode, fragment);
1815
+ _sanitizeAttributes(shadowNode, fragment);
1816
+ if (_isDocumentFragment(shadowNode.content)) _sanitizeShadowDOM2(shadowNode.content);
1817
+ if (_readNodeType(shadowNode) === NODE_TYPE.element) {
1818
+ const innerSr = getShadowRoot(shadowNode);
1010
1819
  if (_isDocumentFragment(innerSr)) {
1011
- _sanitizeAttachedShadowRoots2(innerSr);
1820
+ _sanitizeAttachedShadowRoots(innerSr);
1012
1821
  _sanitizeShadowDOM2(innerSr);
1013
1822
  }
1014
1823
  }
1015
1824
  }
1825
+ if (SAFE_FOR_TEMPLATES) _scrubOwnCharacterData(fragment);
1016
1826
  _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
1017
1827
  };
1018
- const _sanitizeAttachedShadowRoots2 = function _sanitizeAttachedShadowRoots(root) {
1019
- const nodeType = getNodeType ? getNodeType(root) : root.nodeType;
1020
- if (nodeType === NODE_TYPE.element) {
1021
- const sr = getShadowRoot ? getShadowRoot(root) : root.shadowRoot;
1022
- if (_isDocumentFragment(sr)) {
1023
- _sanitizeAttachedShadowRoots2(sr);
1024
- _sanitizeShadowDOM2(sr);
1828
+ const _sanitizeAttachedShadowRoots = function _sanitizeAttachedShadowRoots2(root) {
1829
+ const stack = [{
1830
+ node: root,
1831
+ shadow: null
1832
+ }];
1833
+ while (stack.length > 0) {
1834
+ const item = stack.pop();
1835
+ if (item.shadow) {
1836
+ _sanitizeShadowDOM2(item.shadow);
1837
+ continue;
1025
1838
  }
1026
- }
1027
- const childNodes = getChildNodes ? getChildNodes(root) : root.childNodes;
1028
- if (!childNodes) {
1029
- return;
1030
- }
1031
- const snapshot = [];
1032
- arrayForEach(childNodes, (child) => {
1033
- arrayPush(snapshot, child);
1034
- });
1035
- for (const child of snapshot) {
1036
- _sanitizeAttachedShadowRoots2(child);
1037
- }
1038
- if (nodeType === NODE_TYPE.element) {
1039
- const rootName = getNodeName ? getNodeName(root) : null;
1040
- if (typeof rootName === "string" && transformCaseFunc(rootName) === "template") {
1041
- const content = root.content;
1042
- if (_isDocumentFragment(content)) {
1043
- _sanitizeAttachedShadowRoots2(content);
1839
+ const node = item.node;
1840
+ const isElement = _readNodeType(node) === NODE_TYPE.element;
1841
+ const childNodes = getChildNodes(node);
1842
+ if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push({
1843
+ node: childNodes[i],
1844
+ shadow: null
1845
+ });
1846
+ if (isElement) {
1847
+ const rootName = getNodeName ? getNodeName(node) : null;
1848
+ if (typeof rootName === "string" && transformCaseFunc(rootName) === "template") {
1849
+ const content = node.content;
1850
+ if (_isDocumentFragment(content)) stack.push({
1851
+ node: content,
1852
+ shadow: null
1853
+ });
1044
1854
  }
1045
1855
  }
1856
+ if (isElement) {
1857
+ const sr = getShadowRoot(node);
1858
+ if (_isDocumentFragment(sr)) stack.push({
1859
+ node: null,
1860
+ shadow: sr
1861
+ }, {
1862
+ node: sr,
1863
+ shadow: null
1864
+ });
1865
+ }
1046
1866
  }
1047
1867
  };
1048
1868
  DOMPurify.sanitize = function(dirty) {
@@ -1052,127 +1872,118 @@ function createDOMPurify() {
1052
1872
  let currentNode = null;
1053
1873
  let returnNode = null;
1054
1874
  IS_EMPTY_INPUT = !dirty;
1055
- if (IS_EMPTY_INPUT) {
1056
- dirty = "<!-->";
1057
- }
1875
+ if (IS_EMPTY_INPUT) dirty = "<!-->";
1058
1876
  if (typeof dirty !== "string" && !_isNode(dirty)) {
1059
1877
  dirty = stringifyValue(dirty);
1060
- if (typeof dirty !== "string") {
1061
- throw typeErrorCreate("dirty is not a string, aborting");
1062
- }
1063
- }
1064
- if (!DOMPurify.isSupported) {
1065
- return dirty;
1066
- }
1067
- if (!SET_CONFIG) {
1068
- _parseConfig(cfg);
1069
- }
1878
+ if (typeof dirty !== "string") throw typeErrorCreate("dirty is not a string, aborting");
1879
+ }
1880
+ if (!DOMPurify.isSupported) return dirty;
1881
+ if (SET_CONFIG) {
1882
+ ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
1883
+ ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
1884
+ } else _parseConfig(cfg);
1885
+ if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) ALLOWED_TAGS = clone(ALLOWED_TAGS);
1886
+ if (hooks.uponSanitizeAttribute.length > 0) ALLOWED_ATTR = clone(ALLOWED_ATTR);
1070
1887
  DOMPurify.removed = [];
1071
- if (typeof dirty === "string") {
1072
- IN_PLACE = false;
1073
- }
1074
- if (IN_PLACE) {
1075
- const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
1888
+ const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
1889
+ let inPlaceNodes = [];
1890
+ const outerVisited = IN_PLACE_VISITED;
1891
+ if (inPlace) {
1892
+ _neutralizePatchLinkage(dirty);
1893
+ const nn = _readNodeName(dirty);
1076
1894
  if (typeof nn === "string") {
1077
1895
  const tagName = transformCaseFunc(nn);
1078
1896
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1897
+ _neutralizeRoot(dirty);
1079
1898
  throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
1080
1899
  }
1081
1900
  }
1082
1901
  if (_isClobbered(dirty)) {
1902
+ _neutralizeRoot(dirty);
1083
1903
  throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
1084
1904
  }
1085
- _sanitizeAttachedShadowRoots2(dirty);
1905
+ inPlaceNodes = _collectLiveNodes(dirty);
1906
+ IN_PLACE_VISITED = setCreate();
1086
1907
  } else if (_isNode(dirty)) {
1087
1908
  body = _initDocument("<!---->");
1088
1909
  importedNode = body.ownerDocument.importNode(dirty, true);
1089
- if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") {
1090
- body = importedNode;
1091
- } else if (importedNode.nodeName === "HTML") {
1092
- body = importedNode;
1093
- } else {
1094
- body.appendChild(importedNode);
1095
- }
1096
- _sanitizeAttachedShadowRoots2(importedNode);
1910
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") body = importedNode;
1911
+ else if (importedNode.nodeName === "HTML") body = importedNode;
1912
+ else body.appendChild(importedNode);
1913
+ _sanitizeAttachedShadowRoots(body);
1097
1914
  } else {
1098
- if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
1099
- dirty.indexOf("<") === -1) {
1100
- return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
1101
- }
1915
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && dirty.indexOf("<") === -1) return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty;
1102
1916
  body = _initDocument(dirty);
1103
- if (!body) {
1104
- return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
1105
- }
1917
+ if (!body) return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
1106
1918
  }
1107
- if (body && FORCE_BODY) {
1108
- _forceRemove(body.firstChild);
1109
- }
1110
- const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
1111
- while (currentNode = nodeIterator.nextNode()) {
1112
- _sanitizeElements(currentNode);
1113
- _sanitizeAttributes(currentNode);
1114
- if (_isDocumentFragment(currentNode.content)) {
1115
- _sanitizeShadowDOM2(currentNode.content);
1919
+ if (body && FORCE_BODY) _forceRemove(body.firstChild);
1920
+ const walkRoot = inPlace ? dirty : body;
1921
+ try {
1922
+ if (inPlace) _sanitizeAttachedShadowRoots(dirty);
1923
+ const nodeIterator = _createNodeIterator(walkRoot);
1924
+ while (currentNode = nodeIterator.nextNode()) {
1925
+ _sanitizeElements(currentNode, walkRoot);
1926
+ _sanitizeAttributes(currentNode, walkRoot);
1927
+ if (_isDocumentFragment(currentNode.content)) _sanitizeShadowDOM2(currentNode.content);
1116
1928
  }
1117
- }
1118
- if (IN_PLACE) {
1119
- if (SAFE_FOR_TEMPLATES) {
1120
- _scrubTemplateExpressions(dirty);
1929
+ if (inPlace) _sanitizeUnvisitedNodes(dirty, inPlaceNodes);
1930
+ } catch (error) {
1931
+ if (inPlace) {
1932
+ _neutralizeRoot(dirty);
1933
+ _neutralizeDiscarded(dirty, inPlaceNodes);
1121
1934
  }
1935
+ throw error;
1936
+ } finally {
1937
+ IN_PLACE_VISITED = outerVisited;
1938
+ }
1939
+ if (inPlace) {
1940
+ if (_neutralizeDiscarded(dirty, inPlaceNodes)) throw typeErrorCreate("a node selected for removal could not be safely returned; refusing to sanitize in place");
1941
+ if (SAFE_FOR_TEMPLATES) _scrubTemplateExpressions2(dirty);
1122
1942
  return dirty;
1123
1943
  }
1124
1944
  if (RETURN_DOM) {
1125
- if (SAFE_FOR_TEMPLATES) {
1126
- _scrubTemplateExpressions(body);
1127
- }
1945
+ if (SAFE_FOR_TEMPLATES) _scrubTemplateExpressions2(body);
1128
1946
  if (RETURN_DOM_FRAGMENT) {
1129
1947
  returnNode = createDocumentFragment.call(body.ownerDocument);
1130
- while (body.firstChild) {
1131
- returnNode.appendChild(body.firstChild);
1132
- }
1133
- } else {
1134
- returnNode = body;
1135
- }
1136
- if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
1137
- returnNode = importNode.call(originalDocument, returnNode, true);
1138
- }
1948
+ while (body.firstChild) returnNode.appendChild(body.firstChild);
1949
+ } else returnNode = body;
1950
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) returnNode = importNode.call(originalDocument, returnNode, true);
1139
1951
  return returnNode;
1140
1952
  }
1141
1953
  let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1142
- if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1143
- serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
1144
- }
1145
- if (SAFE_FOR_TEMPLATES) {
1146
- arrayForEach([MUSTACHE_EXPR$1, ERB_EXPR$1, TMPLIT_EXPR$1], (expr) => {
1147
- serializedHTML = stringReplace(serializedHTML, expr, " ");
1148
- });
1149
- }
1150
- return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1954
+ if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
1955
+ if (SAFE_FOR_TEMPLATES) serializedHTML = _stripTemplateExpressions(serializedHTML);
1956
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML;
1151
1957
  };
1152
1958
  DOMPurify.setConfig = function() {
1153
1959
  let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
1154
1960
  _parseConfig(cfg);
1155
1961
  SET_CONFIG = true;
1962
+ SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
1963
+ SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
1156
1964
  };
1157
1965
  DOMPurify.clearConfig = function() {
1158
1966
  CONFIG = null;
1159
1967
  SET_CONFIG = false;
1968
+ SET_CONFIG_ALLOWED_TAGS = null;
1969
+ SET_CONFIG_ALLOWED_ATTR = null;
1970
+ trustedTypesPolicy = defaultTrustedTypesPolicy;
1971
+ emptyHTML = "";
1160
1972
  };
1161
1973
  DOMPurify.isValidAttribute = function(tag, attr, value) {
1162
- if (!CONFIG) {
1163
- _parseConfig({});
1164
- }
1974
+ if (!CONFIG) _parseConfig({});
1165
1975
  const lcTag = transformCaseFunc(tag);
1166
1976
  const lcName = transformCaseFunc(attr);
1977
+ if (typeof value === "string" && (_isUnsafeAttributeValue(attr, value) || !ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value))) return false;
1167
1978
  return _isValidAttribute(lcTag, lcName, value);
1168
1979
  };
1169
1980
  DOMPurify.addHook = function(entryPoint, hookFunction) {
1170
- if (typeof hookFunction !== "function") {
1171
- return;
1172
- }
1981
+ if (typeof hookFunction !== "function") return;
1982
+ if (!objectHasOwnProperty(hooks, entryPoint)) return;
1173
1983
  arrayPush(hooks[entryPoint], hookFunction);
1174
1984
  };
1175
1985
  DOMPurify.removeHook = function(entryPoint, hookFunction) {
1986
+ if (!objectHasOwnProperty(hooks, entryPoint)) return;
1176
1987
  if (hookFunction !== void 0) {
1177
1988
  const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
1178
1989
  return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0];
@@ -1180,6 +1991,7 @@ function createDOMPurify() {
1180
1991
  return arrayPop(hooks[entryPoint]);
1181
1992
  };
1182
1993
  DOMPurify.removeHooks = function(entryPoint) {
1994
+ if (!objectHasOwnProperty(hooks, entryPoint)) return;
1183
1995
  hooks[entryPoint] = [];
1184
1996
  };
1185
1997
  DOMPurify.removeAllHooks = function() {