@clappr/player 0.12.4 → 0.12.6

package/dist/clappr.js

@@ -311,9 +311,9 @@
         'z-index': 1,
         'zoom': 1
       },
-      fragmentRE = /^\s*<(\w+|!)[^>]*>/,
+      fragmentRE = /^\s*<(!|\w+(?!\w))[^>]*>/,
       singleTagRE = /^<(\w+)\s*\/?>(?:<\/\1>|)$/,
-      tagExpanderRE = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,
+      tagExpanderRE = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)(?![\w:])(?:"[^"]*"|'[^']*'|\/(?!>)|[^>"'\/])*)\/>/ig,
       rootNodeRE = /^(?:body|html)$/i,
       capitalRE = /([A-Z])/g,
       // special attributes that should be get/set via method calls
@@ -449,14 +449,18 @@
     // This function can be overridden in plugins for example to make
     // it compatible with browsers that don't support the DOM fully.
     zepto.fragment = function (html, name, properties) {
-      var dom, nodes, container;
+      var dom, nodes, container, match;
 
       // A special case optimization for a single tag
-      if (singleTagRE.test(html)) dom = $(document.createElement(RegExp.$1));
+      if (match = singleTagRE.exec(html)) dom = $(document.createElement(match[1]));
       if (!dom) {
         if (html.replace) html = html.replace(tagExpanderRE, "<$1></$2>");
-        if (name === undefined$1) name = fragmentRE.test(html) && RegExp.$1;
-        if (!(name in containers)) name = '*';
+        // exec() yields null without a match; previously test() && RegExp.$1
+        // yielded false. Both fall through to name = '*' below.
+        if (name === undefined$1) name = (match = fragmentRE.exec(html)) && match[1];
+        // Own-property check: `in` walks the prototype (`toString`, etc.) and
+        // would make container a function — childNodes then throws TypeError.
+        if (!Object.prototype.hasOwnProperty.call(containers, name)) name = '*';
         container = containers[name];
         container.innerHTML = '' + html;
         dom = $.each(slice.call(container.childNodes), function () {
@@ -490,7 +494,7 @@
     // special cases).
     // This method can be overridden in plugins.
     zepto.init = function (selector, context) {
-      var dom;
+      var dom, match;
       // If nothing given, return an empty Zepto collection
       if (!selector) return zepto.Z();
       // Optimize for string selectors
@@ -499,7 +503,7 @@
         // If it's a html fragment, create nodes from it
         // Note: In both Chrome 21 and Firefox 15, DOM error 12
         // is thrown if the fragment doesn't begin with <
-        if (selector[0] == '<' && fragmentRE.test(selector)) dom = zepto.fragment(selector, RegExp.$1, context), selector = null;
+        if (selector[0] == '<' && (match = fragmentRE.exec(selector))) dom = zepto.fragment(selector, match[1], context), selector = null;
         // If there's a context, create a collection on that context first, and select
         // nodes from there
         else if (context !== undefined$1) return $(context).find(selector);
@@ -515,7 +519,7 @@
         // Wrap DOM nodes.
         else if (isObject(selector)) dom = [selector], selector = null;
         // If it's a html fragment, create nodes from it
-        else if (fragmentRE.test(selector)) dom = zepto.fragment(selector.trim(), RegExp.$1, context), selector = null;
+        else if (match = fragmentRE.exec(selector)) dom = zepto.fragment(selector.trim(), match[1], context), selector = null;
         // If there's a context, create a collection on that context first, and select
         // nodes from there
         else if (context !== undefined$1) return $(context).find(selector);
@@ -1203,7 +1207,6 @@
       document = window.document,
       key,
       name,
-      rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
       scriptTypeRE = /^(?:text|application)\/javascript/i,
       xmlTypeRE = /^(?:text|application)\/xml/i,
       jsonType = 'application/json',
@@ -1304,7 +1307,13 @@
       window[callbackName] = function () {
         responseData = arguments;
       };
-      script.src = options.url.replace(/\?(.+)=\?/, '?$1=' + callbackName);
+
+      // Rewrite the last `=?` after `?` without a regex (avoids ReDoS on `.+`).
+      // `i > q + 1` preserves the original `.+` requirement of at least one
+      // character between `?` and `=?`.
+      var q = options.url.indexOf('?'),
+        i = q > -1 ? options.url.lastIndexOf('=?') : -1;
+      script.src = i > q + 1 ? options.url.slice(0, i + 1) + callbackName + options.url.slice(i + 2) : options.url;
       document.head.appendChild(script);
       if (options.timeout > 0) abortTimeout = setTimeout(function () {
         abort('timeout');
@@ -1492,7 +1501,17 @@
         callback = options.success;
       if (parts.length > 1) options.url = parts[0], selector = parts[1];
       options.success = function (response) {
-        self.html(selector ? $('<div>').html(response.replace(rscript, "")).find(selector) : response);
+        // With a selector, parse into a detached container and drop <script>
+        // nodes structurally before finding matches. Without a selector the
+        // response is inserted as-is (same asymmetry as jQuery). This is not
+        // a sanitizer: event-handler attrs and javascript: URLs still pass.
+        if (selector) {
+          var container = $('<div>').html(response);
+          container.find('script').remove();
+          self.html(container.find(selector));
+        } else {
+          self.html(response);
+        }
         callback && callback.apply(self, arguments);
       };
       $.ajax(options);
@@ -1753,7 +1772,9 @@
       isString = function (obj) {
         return typeof obj == 'string';
       },
-      handlers = {},
+      // Prototype-less map: handlers['__proto__'] must never resolve to
+      // Object.prototype (CodeQL js/prototype-polluting-assignment).
+      handlers = Object.create(null),
       specialEvents = {},
       focusinSupported = 'onfocusin' in window,
       focus = {
@@ -1766,7 +1787,11 @@
       };
     specialEvents.click = specialEvents.mousedown = specialEvents.mouseup = specialEvents.mousemove = 'MouseEvents';
     function zid(element) {
-      return element._zid || (element._zid = _zid++);
+      // Always a number — a forged element._zid string must not become a
+      // dynamic key into handlers.
+      var id = element._zid;
+      if (typeof id !== 'number') element._zid = id = _zid++;
+      return id;
     }
     function findHandlers(element, event, fn, selector) {
       event = parse(event);
@@ -1823,6 +1848,7 @@
       var id = zid(element);
       (events || '').split(/\s/).forEach(function (event) {
         findHandlers(element, event, fn, selector).forEach(function (handler) {
+          // Keep delete (not splice) so handler.i remains a stable index for off().
           delete handlers[id][handler.i];
           if ('removeEventListener' in element) element.removeEventListener(realEvent(handler.e), handler.proxy, eventCapture(handler, capture));
         });
@@ -1982,9 +2008,12 @@
       return result;
     }
 
-    // shortcut methods for `.bind(event, fn)` for each event type
+    // shortcut methods for `.bind(event, fn)` for each event type.
+    // Skip names already defined (e.g. ajax $.fn.load) — this fork concatenates
+    // ajax before event, unlike upstream's default `event ajax` order.
   ;
     ('focusin focusout focus blur load resize scroll unload click dblclick ' + 'mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave ' + 'change select keydown keypress keyup error').split(' ').forEach(function (event) {
+      if ($.fn[event]) return;
       $.fn[event] = function (callback) {
         return 0 in arguments ? this.bind(event, callback) : this.trigger(event);
       };
@@ -6722,7 +6751,7 @@
       plugins: {},
       playbacks: []
     };
-    var currentVersion = "0.14.4";
+    var currentVersion = "0.14.5";
     return /*#__PURE__*/function () {
       /**
        * builds the loader
@@ -7900,7 +7929,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -8704,7 +8733,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -8759,7 +8788,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -8839,7 +8868,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -8971,7 +9000,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9112,7 +9141,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9141,7 +9170,7 @@
       @type {string}
       @default
   */
-  var version$2 = "0.14.4";
+  var version$2 = "0.14.5";
 
   // Built-in Plugins/Playbacks
 
@@ -9290,7 +9319,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9353,7 +9382,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9518,7 +9547,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9649,7 +9678,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9699,7 +9728,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9819,7 +9848,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -9942,7 +9971,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -10443,7 +10472,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -11273,7 +11302,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -11492,7 +11521,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -11696,7 +11725,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -11778,7 +11807,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -11905,7 +11934,7 @@
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {
@@ -11979,7 +12008,7 @@
     WaterMark: WaterMarkPlugin
   };
 
-  var version$1 = "0.12.4";
+  var version$1 = "0.12.6";
   for (var _i = 0, _Object$values = Object.values(Plugins); _i < _Object$values.length; _i++) {
     var plugin = _Object$values[_i];
     Loader.registerPlugin(plugin);
@@ -48737,7 +48766,7 @@ Schedule: ${scheduleItems.map(seg => segmentToString(seg))} pos: ${this.timeline
       key: "supportedVersion",
       get: function get() {
         return {
-          min: "0.14.4"
+          min: "0.14.5"
         };
       }
     }, {