@codingame/monaco-vscode-api 17.1.1 → 17.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@codingame/monaco-vscode-api",
3
- "version": "17.1.1",
3
+ "version": "17.1.2",
4
4
  "private": false,
5
5
  "description": "VSCode public API plugged on the monaco editor",
6
6
  "keywords": [],
@@ -15,14 +15,15 @@
15
15
  },
16
16
  "type": "module",
17
17
  "dependencies": {
18
- "@codingame/monaco-vscode-base-service-override": "17.1.1",
19
- "@codingame/monaco-vscode-environment-service-override": "17.1.1",
20
- "@codingame/monaco-vscode-extensions-service-override": "17.1.1",
21
- "@codingame/monaco-vscode-files-service-override": "17.1.1",
22
- "@codingame/monaco-vscode-host-service-override": "17.1.1",
23
- "@codingame/monaco-vscode-layout-service-override": "17.1.1",
24
- "@codingame/monaco-vscode-quickaccess-service-override": "17.1.1",
18
+ "@codingame/monaco-vscode-base-service-override": "17.1.2",
19
+ "@codingame/monaco-vscode-environment-service-override": "17.1.2",
20
+ "@codingame/monaco-vscode-extensions-service-override": "17.1.2",
21
+ "@codingame/monaco-vscode-files-service-override": "17.1.2",
22
+ "@codingame/monaco-vscode-host-service-override": "17.1.2",
23
+ "@codingame/monaco-vscode-layout-service-override": "17.1.2",
24
+ "@codingame/monaco-vscode-quickaccess-service-override": "17.1.2",
25
25
  "@vscode/iconv-lite-umd": "0.7.0",
26
+ "dompurify": "3.2.6",
26
27
  "jschardet": "3.1.4",
27
28
  "marked": "14.0.0"
28
29
  },
package/services.js CHANGED
@@ -182,10 +182,10 @@ export { IKeybindingService } from './vscode/src/vs/platform/keybinding/common/k
182
182
  export { ISecretStorageService } from './vscode/src/vs/platform/secrets/common/secrets.service.js';
183
183
  export { ConfigurationTarget } from './vscode/src/vs/platform/configuration/common/configuration.js';
184
184
 
185
- if (window.monacoVscodeApiBuildId != null && window.monacoVscodeApiBuildId !== "1.100.2-71b00727-b59a-4f1f-85a0-4d406e3dda87") {
186
- throw new Error(`Another version of monaco-vscode-api has already been loaded. Trying to load ${"1.100.2-71b00727-b59a-4f1f-85a0-4d406e3dda87"}, ${window.monacoVscodeApiBuildId} is already loaded`);
185
+ if (window.monacoVscodeApiBuildId != null && window.monacoVscodeApiBuildId !== "1.100.2-96059d24-c618-43d0-a4f0-2db455db4fcc") {
186
+ throw new Error(`Another version of monaco-vscode-api has already been loaded. Trying to load ${"1.100.2-96059d24-c618-43d0-a4f0-2db455db4fcc"}, ${window.monacoVscodeApiBuildId} is already loaded`);
187
187
  }
188
- window.monacoVscodeApiBuildId = "1.100.2-71b00727-b59a-4f1f-85a0-4d406e3dda87";
188
+ window.monacoVscodeApiBuildId = "1.100.2-96059d24-c618-43d0-a4f0-2db455db4fcc";
189
189
  async function initialize(overrides, container = document.body, configuration = {}, env) {
190
190
  checkServicesNotInitialized();
191
191
  injectCss(container);
@@ -6,7 +6,7 @@ import { StandardMouseEvent } from './mouseEvent.js';
6
6
  import { _runWhenIdle, AbstractIdleValue, IntervalTimer, TimeoutTimer } from '../common/async.js';
7
7
  import { onUnexpectedError } from '../common/errors.js';
8
8
  import { Emitter, Event } from '../common/event.js';
9
- import purify from './dompurify/dompurify.js';
9
+ import dompurify from 'dompurify';
10
10
  import { KeyCode } from '../common/keyCodes.js';
11
11
  import { DisposableStore, Disposable, toDisposable } from '../common/lifecycle.js';
12
12
  import { RemoteAuthorities, Schemas } from '../common/network.js';
@@ -1013,7 +1013,7 @@ function detectFullscreen(targetWindow) {
1013
1013
  }
1014
1014
  function hookDomPurifyHrefAndSrcSanitizer(allowedProtocols, allowDataImages = false) {
1015
1015
  const anchor = document.createElement('a');
1016
- purify.addHook('afterSanitizeAttributes', (node) => {
1016
+ dompurify.addHook('afterSanitizeAttributes', (node) => {
1017
1017
  for (const attr of ['href', 'src']) {
1018
1018
  if (node.hasAttribute(attr)) {
1019
1019
  const attrValue = node.getAttribute(attr);
@@ -1031,7 +1031,7 @@ function hookDomPurifyHrefAndSrcSanitizer(allowedProtocols, allowDataImages = fa
1031
1031
  }
1032
1032
  });
1033
1033
  return toDisposable(() => {
1034
- purify.removeHook('afterSanitizeAttributes');
1034
+ dompurify.removeHook('afterSanitizeAttributes');
1035
1035
  });
1036
1036
  }
1037
1037
  const defaultSafeProtocols = [
@@ -1118,7 +1118,7 @@ const defaultDomPurifyConfig = ( Object.freeze({
1118
1118
  function safeInnerHtml(node, value, extraDomPurifyConfig) {
1119
1119
  const hook = hookDomPurifyHrefAndSrcSanitizer(defaultSafeProtocols);
1120
1120
  try {
1121
- const html = purify.sanitize(value, { ...defaultDomPurifyConfig, ...extraDomPurifyConfig });
1121
+ const html = dompurify.sanitize(value, { ...defaultDomPurifyConfig, ...extraDomPurifyConfig });
1122
1122
  node.innerHTML = html;
1123
1123
  }
1124
1124
  finally {
@@ -15,7 +15,7 @@ import { resolvePath, dirname } from '../common/resources.js';
15
15
  import { escape } from '../common/strings.js';
16
16
  import { URI } from '../common/uri.js';
17
17
  import { reset, addDisposableListener, getWindow, $, isHTMLElement, hookDomPurifyHrefAndSrcSanitizer, basicMarkupHtmlTags } from './dom.js';
18
- import purify from './dompurify/dompurify.js';
18
+ import dompurify from 'dompurify';
19
19
  import { DomEmitter } from './event.js';
20
20
  import { createElement } from './formattedTextRenderer.js';
21
21
  import { StandardKeyboardEvent } from './keyboardEvent.js';
@@ -394,7 +394,7 @@ function sanitizeRenderedMarkdown(options, renderedMarkdown) {
394
394
  }));
395
395
  store.add(hookDomPurifyHrefAndSrcSanitizer(allowedSchemes));
396
396
  try {
397
- return purify.sanitize(renderedMarkdown, { ...config, RETURN_TRUSTED_TYPE: true });
397
+ return dompurify.sanitize(renderedMarkdown, { ...config, RETURN_TRUSTED_TYPE: true });
398
398
  }
399
399
  finally {
400
400
  store.dispose();
@@ -741,8 +741,8 @@ function completeTable(tokens) {
741
741
  return undefined;
742
742
  }
743
743
  function addDompurifyHook(hook, cb) {
744
- purify.addHook(hook, cb);
745
- return toDisposable(() => purify.removeHook(hook));
744
+ dompurify.addHook(hook, cb);
745
+ return toDisposable(() => dompurify.removeHook(hook));
746
746
  }
747
747
 
748
748
  export { allowedMarkdownAttr, fillInIncompleteTokens, renderMarkdown, renderMarkdownAsPlaintext, renderStringAsPlaintext };
@@ -1,7 +1,7 @@
1
1
 
2
2
  import { registerCss } from '@codingame/monaco-vscode-api/css';
3
3
  import { EventType, addDisposableListener, EventHelper, trackFocus, reset, isActiveElement, $ } from '../../dom.js';
4
- import purify from '../../dompurify/dompurify.js';
4
+ import dompurify from 'dompurify';
5
5
  import { StandardKeyboardEvent } from '../../keyboardEvent.js';
6
6
  import { renderMarkdown, renderStringAsPlaintext } from '../../markdownRenderer.js';
7
7
  import { Gesture, EventType as EventType$1 } from '../../touch.js';
@@ -157,7 +157,7 @@ class Button extends Disposable {
157
157
  rendered.dispose();
158
158
  const root = rendered.element.querySelector('p')?.innerHTML;
159
159
  if (root) {
160
- const sanitized = purify.sanitize(root, { ADD_TAGS: ['b', 'i', 'u', 'code', 'span'], ALLOWED_ATTR: ['class'], RETURN_TRUSTED_TYPE: true });
160
+ const sanitized = dompurify.sanitize(root, { ADD_TAGS: ['b', 'i', 'u', 'code', 'span'], ALLOWED_ATTR: ['class'], RETURN_TRUSTED_TYPE: true });
161
161
  labelElement.innerHTML = sanitized;
162
162
  }
163
163
  else {
@@ -466,7 +466,7 @@ class ButtonWithIcon extends Button {
466
466
  rendered.dispose();
467
467
  const root = rendered.element.querySelector('p')?.innerHTML;
468
468
  if (root) {
469
- const sanitized = purify.sanitize(root, { ADD_TAGS: ['b', 'i', 'u', 'code', 'span'], ALLOWED_ATTR: ['class'], RETURN_TRUSTED_TYPE: true });
469
+ const sanitized = dompurify.sanitize(root, { ADD_TAGS: ['b', 'i', 'u', 'code', 'span'], ALLOWED_ATTR: ['class'], RETURN_TRUSTED_TYPE: true });
470
470
  this._mdlabelElement.innerHTML = sanitized;
471
471
  }
472
472
  else {
@@ -6,7 +6,7 @@ var product = {
6
6
  quality: 'stable',
7
7
  version: '1.100.2',
8
8
  commit: '848b80aeb52026648a8ff9f7c45a9b0a80641e2e',
9
- date: '2025-05-20T09:24:53.245Z',
9
+ date: '2025-05-27T15:32:23.832Z',
10
10
  ...(globalThis._VSCODE_PRODUCT_JSON ?? {})
11
11
  };
12
12
 
@@ -13,7 +13,11 @@ function initialize(createFn) {
13
13
  }
14
14
  };
15
15
  }
16
- return requestHandler?.[propKey];
16
+ const value = requestHandler?.[propKey];
17
+ if (typeof value === 'function') {
18
+ return value.bind(requestHandler);
19
+ }
20
+ return value;
17
21
  }
18
22
  });
19
23
  const context = start(foreignModule);
@@ -1,937 +0,0 @@
1
-
2
-
3
- const {
4
- entries,
5
- setPrototypeOf,
6
- isFrozen,
7
- getPrototypeOf,
8
- getOwnPropertyDescriptor
9
- } = Object;
10
- let {
11
- freeze,
12
- seal,
13
- create
14
- } = Object;
15
- let {
16
- apply,
17
- construct
18
- } = typeof Reflect !== 'undefined' && Reflect;
19
- if (!freeze) {
20
- freeze = function freeze(x) {
21
- return x;
22
- };
23
- }
24
- if (!seal) {
25
- seal = function seal(x) {
26
- return x;
27
- };
28
- }
29
- if (!apply) {
30
- apply = function apply(fun, thisValue, args) {
31
- return fun.apply(thisValue, args);
32
- };
33
- }
34
- if (!construct) {
35
- construct = function construct(Func, args) {
36
- return ( new Func(...args));
37
- };
38
- }
39
- const arrayForEach = unapply(Array.prototype.forEach);
40
- const arrayPop = unapply(Array.prototype.pop);
41
- const arrayPush = unapply(Array.prototype.push);
42
- const stringToLowerCase = unapply(String.prototype.toLowerCase);
43
- const stringToString = unapply(String.prototype.toString);
44
- const stringMatch = unapply(String.prototype.match);
45
- const stringReplace = unapply(String.prototype.replace);
46
- const stringIndexOf = unapply(String.prototype.indexOf);
47
- const stringTrim = unapply(String.prototype.trim);
48
- const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
49
- const regExpTest = unapply(RegExp.prototype.test);
50
- const typeErrorCreate = unconstruct(TypeError);
51
- function unapply(func) {
52
- return function (thisArg) {
53
- for (var _len = arguments.length, args = ( new Array(_len > 1 ? _len - 1 : 0)), _key = 1; _key < _len; _key++) {
54
- args[_key - 1] = arguments[_key];
55
- }
56
- return apply(func, thisArg, args);
57
- };
58
- }
59
- function unconstruct(func) {
60
- return function () {
61
- for (var _len2 = arguments.length, args = ( new Array(_len2)), _key2 = 0; _key2 < _len2; _key2++) {
62
- args[_key2] = arguments[_key2];
63
- }
64
- return construct(func, args);
65
- };
66
- }
67
- function addToSet(set, array) {
68
- let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
69
- if (setPrototypeOf) {
70
- setPrototypeOf(set, null);
71
- }
72
- let l = array.length;
73
- while (l--) {
74
- let element = array[l];
75
- if (typeof element === 'string') {
76
- const lcElement = transformCaseFunc(element);
77
- if (lcElement !== element) {
78
- if (!isFrozen(array)) {
79
- array[l] = lcElement;
80
- }
81
- element = lcElement;
82
- }
83
- }
84
- set[element] = true;
85
- }
86
- return set;
87
- }
88
- function cleanArray(array) {
89
- for (let index = 0; index < array.length; index++) {
90
- const isPropertyExist = objectHasOwnProperty(array, index);
91
- if (!isPropertyExist) {
92
- array[index] = null;
93
- }
94
- }
95
- return array;
96
- }
97
- function clone(object) {
98
- const newObject = create(null);
99
- for (const [property, value] of entries(object)) {
100
- const isPropertyExist = objectHasOwnProperty(object, property);
101
- if (isPropertyExist) {
102
- if (Array.isArray(value)) {
103
- newObject[property] = cleanArray(value);
104
- } else if (value && typeof value === 'object' && value.constructor === Object) {
105
- newObject[property] = clone(value);
106
- } else {
107
- newObject[property] = value;
108
- }
109
- }
110
- }
111
- return newObject;
112
- }
113
- function lookupGetter(object, prop) {
114
- while (object !== null) {
115
- const desc = getOwnPropertyDescriptor(object, prop);
116
- if (desc) {
117
- if (desc.get) {
118
- return unapply(desc.get);
119
- }
120
- if (typeof desc.value === 'function') {
121
- return unapply(desc.value);
122
- }
123
- }
124
- object = getPrototypeOf(object);
125
- }
126
- function fallbackValue() {
127
- return null;
128
- }
129
- return fallbackValue;
130
- }
131
- const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
132
- const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
133
- const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
134
- const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
135
- const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
136
- const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
137
- const text = freeze(['#text']);
138
- const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
139
- const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
140
- const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
141
- const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
142
- const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm);
143
- const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
144
- const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
145
- const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/);
146
- const ARIA_ATTR = seal(/^aria-[\-\w]+$/);
147
- const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
148
- );
149
- const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
150
- const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
151
- );
152
- const DOCTYPE_NAME = seal(/^html$/i);
153
- const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
154
- var EXPRESSIONS = Object.freeze({
155
- __proto__: null,
156
- MUSTACHE_EXPR: MUSTACHE_EXPR,
157
- ERB_EXPR: ERB_EXPR,
158
- TMPLIT_EXPR: TMPLIT_EXPR,
159
- DATA_ATTR: DATA_ATTR,
160
- ARIA_ATTR: ARIA_ATTR,
161
- IS_ALLOWED_URI: IS_ALLOWED_URI,
162
- IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
163
- ATTR_WHITESPACE: ATTR_WHITESPACE,
164
- DOCTYPE_NAME: DOCTYPE_NAME,
165
- CUSTOM_ELEMENT: CUSTOM_ELEMENT
166
- });
167
- const NODE_TYPE = {
168
- element: 1,
169
- text: 3,
170
- progressingInstruction: 7,
171
- comment: 8,
172
- document: 9};
173
- const getGlobal = function getGlobal() {
174
- return typeof window === 'undefined' ? null : window;
175
- };
176
- const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
177
- if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
178
- return null;
179
- }
180
- let suffix = null;
181
- const ATTR_NAME = 'data-tt-policy-suffix';
182
- if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
183
- suffix = purifyHostElement.getAttribute(ATTR_NAME);
184
- }
185
- const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
186
- try {
187
- return trustedTypes.createPolicy(policyName, {
188
- createHTML(html) {
189
- return html;
190
- },
191
- createScriptURL(scriptUrl) {
192
- return scriptUrl;
193
- }
194
- });
195
- } catch (_) {
196
- console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
197
- return null;
198
- }
199
- };
200
- function createDOMPurify() {
201
- let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
202
- const DOMPurify = root => createDOMPurify(root);
203
- DOMPurify.version = '3.1.7';
204
- DOMPurify.removed = [];
205
- if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document) {
206
- DOMPurify.isSupported = false;
207
- return DOMPurify;
208
- }
209
- let {
210
- document
211
- } = window;
212
- const originalDocument = document;
213
- const currentScript = originalDocument.currentScript;
214
- const {
215
- DocumentFragment,
216
- HTMLTemplateElement,
217
- Node,
218
- Element,
219
- NodeFilter,
220
- NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,
221
- HTMLFormElement,
222
- DOMParser,
223
- trustedTypes
224
- } = window;
225
- const ElementPrototype = Element.prototype;
226
- const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
227
- const remove = lookupGetter(ElementPrototype, 'remove');
228
- const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
229
- const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
230
- const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
231
- if (typeof HTMLTemplateElement === 'function') {
232
- const template = document.createElement('template');
233
- if (template.content && template.content.ownerDocument) {
234
- document = template.content.ownerDocument;
235
- }
236
- }
237
- let trustedTypesPolicy;
238
- let emptyHTML = '';
239
- const {
240
- implementation,
241
- createNodeIterator,
242
- createDocumentFragment,
243
- getElementsByTagName
244
- } = document;
245
- const {
246
- importNode
247
- } = originalDocument;
248
- let hooks = {};
249
- DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
250
- const {
251
- MUSTACHE_EXPR,
252
- ERB_EXPR,
253
- TMPLIT_EXPR,
254
- DATA_ATTR,
255
- ARIA_ATTR,
256
- IS_SCRIPT_OR_DATA,
257
- ATTR_WHITESPACE,
258
- CUSTOM_ELEMENT
259
- } = EXPRESSIONS;
260
- let {
261
- IS_ALLOWED_URI: IS_ALLOWED_URI$1
262
- } = EXPRESSIONS;
263
- let ALLOWED_TAGS = null;
264
- const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
265
- let ALLOWED_ATTR = null;
266
- const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
267
- let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
268
- tagNameCheck: {
269
- writable: true,
270
- configurable: false,
271
- enumerable: true,
272
- value: null
273
- },
274
- attributeNameCheck: {
275
- writable: true,
276
- configurable: false,
277
- enumerable: true,
278
- value: null
279
- },
280
- allowCustomizedBuiltInElements: {
281
- writable: true,
282
- configurable: false,
283
- enumerable: true,
284
- value: false
285
- }
286
- }));
287
- let FORBID_TAGS = null;
288
- let FORBID_ATTR = null;
289
- let ALLOW_ARIA_ATTR = true;
290
- let ALLOW_DATA_ATTR = true;
291
- let ALLOW_UNKNOWN_PROTOCOLS = false;
292
- let ALLOW_SELF_CLOSE_IN_ATTR = true;
293
- let SAFE_FOR_TEMPLATES = false;
294
- let SAFE_FOR_XML = true;
295
- let WHOLE_DOCUMENT = false;
296
- let SET_CONFIG = false;
297
- let FORCE_BODY = false;
298
- let RETURN_DOM = false;
299
- let RETURN_DOM_FRAGMENT = false;
300
- let RETURN_TRUSTED_TYPE = false;
301
- let SANITIZE_DOM = true;
302
- let SANITIZE_NAMED_PROPS = false;
303
- const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
304
- let KEEP_CONTENT = true;
305
- let IN_PLACE = false;
306
- let USE_PROFILES = {};
307
- let FORBID_CONTENTS = null;
308
- const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
309
- let DATA_URI_TAGS = null;
310
- const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
311
- let URI_SAFE_ATTRIBUTES = null;
312
- const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
313
- const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
314
- const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
315
- const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
316
- let NAMESPACE = HTML_NAMESPACE;
317
- let IS_EMPTY_INPUT = false;
318
- let ALLOWED_NAMESPACES = null;
319
- const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
320
- let PARSER_MEDIA_TYPE = null;
321
- const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
322
- const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
323
- let transformCaseFunc = null;
324
- let CONFIG = null;
325
- const formElement = document.createElement('form');
326
- const isRegexOrFunction = function isRegexOrFunction(testValue) {
327
- return testValue instanceof RegExp || testValue instanceof Function;
328
- };
329
- const _parseConfig = function _parseConfig() {
330
- let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
331
- if (CONFIG && CONFIG === cfg) {
332
- return;
333
- }
334
- if (!cfg || typeof cfg !== 'object') {
335
- cfg = {};
336
- }
337
- cfg = clone(cfg);
338
- PARSER_MEDIA_TYPE =
339
- SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
340
- transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
341
- ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
342
- ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
343
- ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
344
- URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES),
345
- cfg.ADD_URI_SAFE_ATTR,
346
- transformCaseFunc
347
- )
348
- : DEFAULT_URI_SAFE_ATTRIBUTES;
349
- DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS),
350
- cfg.ADD_DATA_URI_TAGS,
351
- transformCaseFunc
352
- )
353
- : DEFAULT_DATA_URI_TAGS;
354
- FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
355
- FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
356
- FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
357
- USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
358
- ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
359
- ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
360
- ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false;
361
- ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false;
362
- SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false;
363
- SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false;
364
- WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false;
365
- RETURN_DOM = cfg.RETURN_DOM || false;
366
- RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false;
367
- RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false;
368
- FORCE_BODY = cfg.FORCE_BODY || false;
369
- SANITIZE_DOM = cfg.SANITIZE_DOM !== false;
370
- SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false;
371
- KEEP_CONTENT = cfg.KEEP_CONTENT !== false;
372
- IN_PLACE = cfg.IN_PLACE || false;
373
- IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
374
- NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
375
- CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
376
- if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
377
- CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
378
- }
379
- if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
380
- CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
381
- }
382
- if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
383
- CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
384
- }
385
- if (SAFE_FOR_TEMPLATES) {
386
- ALLOW_DATA_ATTR = false;
387
- }
388
- if (RETURN_DOM_FRAGMENT) {
389
- RETURN_DOM = true;
390
- }
391
- if (USE_PROFILES) {
392
- ALLOWED_TAGS = addToSet({}, text);
393
- ALLOWED_ATTR = [];
394
- if (USE_PROFILES.html === true) {
395
- addToSet(ALLOWED_TAGS, html$1);
396
- addToSet(ALLOWED_ATTR, html);
397
- }
398
- if (USE_PROFILES.svg === true) {
399
- addToSet(ALLOWED_TAGS, svg$1);
400
- addToSet(ALLOWED_ATTR, svg);
401
- addToSet(ALLOWED_ATTR, xml);
402
- }
403
- if (USE_PROFILES.svgFilters === true) {
404
- addToSet(ALLOWED_TAGS, svgFilters);
405
- addToSet(ALLOWED_ATTR, svg);
406
- addToSet(ALLOWED_ATTR, xml);
407
- }
408
- if (USE_PROFILES.mathMl === true) {
409
- addToSet(ALLOWED_TAGS, mathMl$1);
410
- addToSet(ALLOWED_ATTR, mathMl);
411
- addToSet(ALLOWED_ATTR, xml);
412
- }
413
- }
414
- if (cfg.ADD_TAGS) {
415
- if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
416
- ALLOWED_TAGS = clone(ALLOWED_TAGS);
417
- }
418
- addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
419
- }
420
- if (cfg.ADD_ATTR) {
421
- if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
422
- ALLOWED_ATTR = clone(ALLOWED_ATTR);
423
- }
424
- addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
425
- }
426
- if (cfg.ADD_URI_SAFE_ATTR) {
427
- addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
428
- }
429
- if (cfg.FORBID_CONTENTS) {
430
- if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
431
- FORBID_CONTENTS = clone(FORBID_CONTENTS);
432
- }
433
- addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
434
- }
435
- if (KEEP_CONTENT) {
436
- ALLOWED_TAGS['#text'] = true;
437
- }
438
- if (WHOLE_DOCUMENT) {
439
- addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
440
- }
441
- if (ALLOWED_TAGS.table) {
442
- addToSet(ALLOWED_TAGS, ['tbody']);
443
- delete FORBID_TAGS.tbody;
444
- }
445
- if (cfg.TRUSTED_TYPES_POLICY) {
446
- if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
447
- throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
448
- }
449
- if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
450
- throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
451
- }
452
- trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
453
- emptyHTML = trustedTypesPolicy.createHTML('');
454
- } else {
455
- if (trustedTypesPolicy === undefined) {
456
- trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
457
- }
458
- if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
459
- emptyHTML = trustedTypesPolicy.createHTML('');
460
- }
461
- }
462
- if (freeze) {
463
- freeze(cfg);
464
- }
465
- CONFIG = cfg;
466
- };
467
- const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
468
- const HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
469
- const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
470
- const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
471
- const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
472
- const _checkValidNamespace = function _checkValidNamespace(element) {
473
- let parent = getParentNode(element);
474
- if (!parent || !parent.tagName) {
475
- parent = {
476
- namespaceURI: NAMESPACE,
477
- tagName: 'template'
478
- };
479
- }
480
- const tagName = stringToLowerCase(element.tagName);
481
- const parentTagName = stringToLowerCase(parent.tagName);
482
- if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
483
- return false;
484
- }
485
- if (element.namespaceURI === SVG_NAMESPACE) {
486
- if (parent.namespaceURI === HTML_NAMESPACE) {
487
- return tagName === 'svg';
488
- }
489
- if (parent.namespaceURI === MATHML_NAMESPACE) {
490
- return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
491
- }
492
- return Boolean(ALL_SVG_TAGS[tagName]);
493
- }
494
- if (element.namespaceURI === MATHML_NAMESPACE) {
495
- if (parent.namespaceURI === HTML_NAMESPACE) {
496
- return tagName === 'math';
497
- }
498
- if (parent.namespaceURI === SVG_NAMESPACE) {
499
- return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
500
- }
501
- return Boolean(ALL_MATHML_TAGS[tagName]);
502
- }
503
- if (element.namespaceURI === HTML_NAMESPACE) {
504
- if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
505
- return false;
506
- }
507
- if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
508
- return false;
509
- }
510
- return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
511
- }
512
- if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
513
- return true;
514
- }
515
- return false;
516
- };
517
- const _forceRemove = function _forceRemove(node) {
518
- arrayPush(DOMPurify.removed, {
519
- element: node
520
- });
521
- try {
522
- getParentNode(node).removeChild(node);
523
- } catch (_) {
524
- remove(node);
525
- }
526
- };
527
- const _removeAttribute = function _removeAttribute(name, node) {
528
- try {
529
- arrayPush(DOMPurify.removed, {
530
- attribute: node.getAttributeNode(name),
531
- from: node
532
- });
533
- } catch (_) {
534
- arrayPush(DOMPurify.removed, {
535
- attribute: null,
536
- from: node
537
- });
538
- }
539
- node.removeAttribute(name);
540
- if (name === 'is' && !ALLOWED_ATTR[name]) {
541
- if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
542
- try {
543
- _forceRemove(node);
544
- } catch (_) {}
545
- } else {
546
- try {
547
- node.setAttribute(name, '');
548
- } catch (_) {}
549
- }
550
- }
551
- };
552
- const _initDocument = function _initDocument(dirty) {
553
- let doc = null;
554
- let leadingWhitespace = null;
555
- if (FORCE_BODY) {
556
- dirty = '<remove></remove>' + dirty;
557
- } else {
558
- const matches = stringMatch(dirty, /^[\r\n\t ]+/);
559
- leadingWhitespace = matches && matches[0];
560
- }
561
- if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
562
- dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
563
- }
564
- const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
565
- if (NAMESPACE === HTML_NAMESPACE) {
566
- try {
567
- doc = ( new DOMParser()).parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
568
- } catch (_) {}
569
- }
570
- if (!doc || !doc.documentElement) {
571
- doc = implementation.createDocument(NAMESPACE, 'template', null);
572
- try {
573
- doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
574
- } catch (_) {
575
- }
576
- }
577
- const body = doc.body || doc.documentElement;
578
- if (dirty && leadingWhitespace) {
579
- body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
580
- }
581
- if (NAMESPACE === HTML_NAMESPACE) {
582
- return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
583
- }
584
- return WHOLE_DOCUMENT ? doc.documentElement : body;
585
- };
586
- const _createNodeIterator = function _createNodeIterator(root) {
587
- return createNodeIterator.call(root.ownerDocument || root, root,
588
- NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
589
- };
590
- const _isClobbered = function _isClobbered(elm) {
591
- return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
592
- };
593
- const _isNode = function _isNode(object) {
594
- return typeof Node === 'function' && object instanceof Node;
595
- };
596
- const _executeHook = function _executeHook(entryPoint, currentNode, data) {
597
- if (!hooks[entryPoint]) {
598
- return;
599
- }
600
- arrayForEach(hooks[entryPoint], hook => {
601
- hook.call(DOMPurify, currentNode, data, CONFIG);
602
- });
603
- };
604
- const _sanitizeElements = function _sanitizeElements(currentNode) {
605
- let content = null;
606
- _executeHook('beforeSanitizeElements', currentNode, null);
607
- if (_isClobbered(currentNode)) {
608
- _forceRemove(currentNode);
609
- return true;
610
- }
611
- const tagName = transformCaseFunc(currentNode.nodeName);
612
- _executeHook('uponSanitizeElement', currentNode, {
613
- tagName,
614
- allowedTags: ALLOWED_TAGS
615
- });
616
- if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
617
- _forceRemove(currentNode);
618
- return true;
619
- }
620
- if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
621
- _forceRemove(currentNode);
622
- return true;
623
- }
624
- if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
625
- _forceRemove(currentNode);
626
- return true;
627
- }
628
- if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
629
- if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
630
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
631
- return false;
632
- }
633
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
634
- return false;
635
- }
636
- }
637
- if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
638
- const parentNode = getParentNode(currentNode) || currentNode.parentNode;
639
- const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
640
- if (childNodes && parentNode) {
641
- const childCount = childNodes.length;
642
- for (let i = childCount - 1; i >= 0; --i) {
643
- const childClone = cloneNode(childNodes[i], true);
644
- childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
645
- parentNode.insertBefore(childClone, getNextSibling(currentNode));
646
- }
647
- }
648
- }
649
- _forceRemove(currentNode);
650
- return true;
651
- }
652
- if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
653
- _forceRemove(currentNode);
654
- return true;
655
- }
656
- if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
657
- _forceRemove(currentNode);
658
- return true;
659
- }
660
- if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
661
- content = currentNode.textContent;
662
- arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
663
- content = stringReplace(content, expr, ' ');
664
- });
665
- if (currentNode.textContent !== content) {
666
- arrayPush(DOMPurify.removed, {
667
- element: currentNode.cloneNode()
668
- });
669
- currentNode.textContent = content;
670
- }
671
- }
672
- _executeHook('afterSanitizeElements', currentNode, null);
673
- return false;
674
- };
675
- const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
676
- if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
677
- return false;
678
- }
679
- if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
680
- if (
681
- _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
682
- lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
683
- return false;
684
- }
685
- } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
686
- return false;
687
- } else ;
688
- return true;
689
- };
690
- const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
691
- return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
692
- };
693
- const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
694
- _executeHook('beforeSanitizeAttributes', currentNode, null);
695
- const {
696
- attributes
697
- } = currentNode;
698
- if (!attributes) {
699
- return;
700
- }
701
- const hookEvent = {
702
- attrName: '',
703
- attrValue: '',
704
- keepAttr: true,
705
- allowedAttributes: ALLOWED_ATTR
706
- };
707
- let l = attributes.length;
708
- while (l--) {
709
- const attr = attributes[l];
710
- const {
711
- name,
712
- namespaceURI,
713
- value: attrValue
714
- } = attr;
715
- const lcName = transformCaseFunc(name);
716
- let value = name === 'value' ? attrValue : stringTrim(attrValue);
717
- hookEvent.attrName = lcName;
718
- hookEvent.attrValue = value;
719
- hookEvent.keepAttr = true;
720
- hookEvent.forceKeepAttr = undefined;
721
- _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
722
- value = hookEvent.attrValue;
723
- if (hookEvent.forceKeepAttr) {
724
- continue;
725
- }
726
- _removeAttribute(name, currentNode);
727
- if (!hookEvent.keepAttr) {
728
- continue;
729
- }
730
- if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
731
- _removeAttribute(name, currentNode);
732
- continue;
733
- }
734
- if (SAFE_FOR_TEMPLATES) {
735
- arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
736
- value = stringReplace(value, expr, ' ');
737
- });
738
- }
739
- const lcTag = transformCaseFunc(currentNode.nodeName);
740
- if (!_isValidAttribute(lcTag, lcName, value)) {
741
- continue;
742
- }
743
- if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
744
- _removeAttribute(name, currentNode);
745
- value = SANITIZE_NAMED_PROPS_PREFIX + value;
746
- }
747
- if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
748
- _removeAttribute(name, currentNode);
749
- continue;
750
- }
751
- if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
752
- if (namespaceURI) ; else {
753
- switch (trustedTypes.getAttributeType(lcTag, lcName)) {
754
- case 'TrustedHTML':
755
- {
756
- value = trustedTypesPolicy.createHTML(value);
757
- break;
758
- }
759
- case 'TrustedScriptURL':
760
- {
761
- value = trustedTypesPolicy.createScriptURL(value);
762
- break;
763
- }
764
- }
765
- }
766
- }
767
- try {
768
- if (namespaceURI) {
769
- currentNode.setAttributeNS(namespaceURI, name, value);
770
- } else {
771
- currentNode.setAttribute(name, value);
772
- }
773
- if (_isClobbered(currentNode)) {
774
- _forceRemove(currentNode);
775
- } else {
776
- arrayPop(DOMPurify.removed);
777
- }
778
- } catch (_) {}
779
- }
780
- _executeHook('afterSanitizeAttributes', currentNode, null);
781
- };
782
- const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
783
- let shadowNode = null;
784
- const shadowIterator = _createNodeIterator(fragment);
785
- _executeHook('beforeSanitizeShadowDOM', fragment, null);
786
- while (shadowNode = shadowIterator.nextNode()) {
787
- _executeHook('uponSanitizeShadowNode', shadowNode, null);
788
- if (_sanitizeElements(shadowNode)) {
789
- continue;
790
- }
791
- if (shadowNode.content instanceof DocumentFragment) {
792
- _sanitizeShadowDOM(shadowNode.content);
793
- }
794
- _sanitizeAttributes(shadowNode);
795
- }
796
- _executeHook('afterSanitizeShadowDOM', fragment, null);
797
- };
798
- DOMPurify.sanitize = function (dirty) {
799
- let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
800
- let body = null;
801
- let importedNode = null;
802
- let currentNode = null;
803
- let returnNode = null;
804
- IS_EMPTY_INPUT = !dirty;
805
- if (IS_EMPTY_INPUT) {
806
- dirty = '<!-->';
807
- }
808
- if (typeof dirty !== 'string' && !_isNode(dirty)) {
809
- if (typeof dirty.toString === 'function') {
810
- dirty = ( dirty.toString());
811
- if (typeof dirty !== 'string') {
812
- throw typeErrorCreate('dirty is not a string, aborting');
813
- }
814
- } else {
815
- throw typeErrorCreate('toString is not a function');
816
- }
817
- }
818
- if (!DOMPurify.isSupported) {
819
- return dirty;
820
- }
821
- if (!SET_CONFIG) {
822
- _parseConfig(cfg);
823
- }
824
- DOMPurify.removed = [];
825
- if (typeof dirty === 'string') {
826
- IN_PLACE = false;
827
- }
828
- if (IN_PLACE) {
829
- if (dirty.nodeName) {
830
- const tagName = transformCaseFunc(dirty.nodeName);
831
- if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
832
- throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
833
- }
834
- }
835
- } else if (dirty instanceof Node) {
836
- body = _initDocument('<!---->');
837
- importedNode = body.ownerDocument.importNode(dirty, true);
838
- if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
839
- body = importedNode;
840
- } else if (importedNode.nodeName === 'HTML') {
841
- body = importedNode;
842
- } else {
843
- body.appendChild(importedNode);
844
- }
845
- } else {
846
- if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
847
- dirty.indexOf('<') === -1) {
848
- return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
849
- }
850
- body = _initDocument(dirty);
851
- if (!body) {
852
- return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
853
- }
854
- }
855
- if (body && FORCE_BODY) {
856
- _forceRemove(body.firstChild);
857
- }
858
- const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
859
- while (currentNode = nodeIterator.nextNode()) {
860
- if (_sanitizeElements(currentNode)) {
861
- continue;
862
- }
863
- if (currentNode.content instanceof DocumentFragment) {
864
- _sanitizeShadowDOM(currentNode.content);
865
- }
866
- _sanitizeAttributes(currentNode);
867
- }
868
- if (IN_PLACE) {
869
- return dirty;
870
- }
871
- if (RETURN_DOM) {
872
- if (RETURN_DOM_FRAGMENT) {
873
- returnNode = createDocumentFragment.call(body.ownerDocument);
874
- while (body.firstChild) {
875
- returnNode.appendChild(body.firstChild);
876
- }
877
- } else {
878
- returnNode = body;
879
- }
880
- if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
881
- returnNode = importNode.call(originalDocument, returnNode, true);
882
- }
883
- return returnNode;
884
- }
885
- let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
886
- if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
887
- serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
888
- }
889
- if (SAFE_FOR_TEMPLATES) {
890
- arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
891
- serializedHTML = stringReplace(serializedHTML, expr, ' ');
892
- });
893
- }
894
- return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
895
- };
896
- DOMPurify.setConfig = function () {
897
- let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
898
- _parseConfig(cfg);
899
- SET_CONFIG = true;
900
- };
901
- DOMPurify.clearConfig = function () {
902
- CONFIG = null;
903
- SET_CONFIG = false;
904
- };
905
- DOMPurify.isValidAttribute = function (tag, attr, value) {
906
- if (!CONFIG) {
907
- _parseConfig({});
908
- }
909
- const lcTag = transformCaseFunc(tag);
910
- const lcName = transformCaseFunc(attr);
911
- return _isValidAttribute(lcTag, lcName, value);
912
- };
913
- DOMPurify.addHook = function (entryPoint, hookFunction) {
914
- if (typeof hookFunction !== 'function') {
915
- return;
916
- }
917
- hooks[entryPoint] = hooks[entryPoint] || [];
918
- arrayPush(hooks[entryPoint], hookFunction);
919
- };
920
- DOMPurify.removeHook = function (entryPoint) {
921
- if (hooks[entryPoint]) {
922
- return arrayPop(hooks[entryPoint]);
923
- }
924
- };
925
- DOMPurify.removeHooks = function (entryPoint) {
926
- if (hooks[entryPoint]) {
927
- hooks[entryPoint] = [];
928
- }
929
- };
930
- DOMPurify.removeAllHooks = function () {
931
- hooks = {};
932
- };
933
- return DOMPurify;
934
- }
935
- var purify = createDOMPurify();
936
-
937
- export { purify as default };