@evolvere/sgp-ui 1.6.8 → 1.6.10

package/lib/utils/util.js

@@ -0,0 +1,268 @@
+'use strict';
+
+exports.__esModule = true;
+exports.isEmpty = exports.isEqual = exports.arrayEquals = exports.looseEqual = exports.capitalize = exports.kebabCase = exports.autoprefixer = exports.isFirefox = exports.isEdge = exports.isIE = exports.coerceTruthyValueToArray = exports.arrayFind = exports.arrayFindIndex = exports.escapeRegexpString = exports.valueEquals = exports.generateId = exports.getValueByPath = undefined;
+
+var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };
+
+exports.noop = noop;
+exports.hasOwn = hasOwn;
+exports.toObject = toObject;
+exports.getPropByPath = getPropByPath;
+exports.rafThrottle = rafThrottle;
+exports.objToArray = objToArray;
+
+var _vue = require('vue');
+
+var _vue2 = _interopRequireDefault(_vue);
+
+var _types = require('@evolvere/sgp-ui/lib/utils/types');
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+
+function noop() {};
+
+function hasOwn(obj, key) {
+  return hasOwnProperty.call(obj, key);
+};
+
+function extend(to, _from) {
+  for (var key in _from) {
+    to[key] = _from[key];
+  }
+  return to;
+};
+
+function toObject(arr) {
+  var res = {};
+  for (var i = 0; i < arr.length; i++) {
+    if (arr[i]) {
+      extend(res, arr[i]);
+    }
+  }
+  return res;
+};
+
+var getValueByPath = exports.getValueByPath = function getValueByPath(object, prop) {
+  prop = prop || '';
+  var paths = prop.split('.');
+  var current = object;
+  var result = null;
+  for (var i = 0, j = paths.length; i < j; i++) {
+    var path = paths[i];
+    if (!current) break;
+
+    if (i === j - 1) {
+      result = current[path];
+      break;
+    }
+    current = current[path];
+  }
+  return result;
+};
+
+function getPropByPath(obj, path, strict) {
+  var tempObj = obj;
+  path = path.replace(/\[(\w+)\]/g, '.$1');
+  path = path.replace(/^\./, '');
+
+  var keyArr = path.split('.');
+  var i = 0;
+  for (var len = keyArr.length; i < len - 1; ++i) {
+    if (!tempObj && !strict) break;
+    var key = keyArr[i];
+    if (key in tempObj) {
+      tempObj = tempObj[key];
+    } else {
+      if (strict) {
+        throw new Error('please transfer a valid prop path to form item!');
+      }
+      break;
+    }
+  }
+  return {
+    o: tempObj,
+    k: keyArr[i],
+    v: tempObj ? tempObj[keyArr[i]] : null
+  };
+};
+
+var generateId = exports.generateId = function generateId() {
+  return Math.floor(Math.random() * 10000);
+};
+
+var valueEquals = exports.valueEquals = function valueEquals(a, b) {
+  // see: https://stackoverflow.com/questions/3115982/how-to-check-if-two-arrays-are-equal-with-javascript
+  if (a === b) return true;
+  if (!(a instanceof Array)) return false;
+  if (!(b instanceof Array)) return false;
+  if (a.length !== b.length) return false;
+  for (var i = 0; i !== a.length; ++i) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+};
+
+var escapeRegexpString = exports.escapeRegexpString = function escapeRegexpString() {
+  var value = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : '';
+  return String(value).replace(/[|\\{}()[\]^$+*?.]/g, '\\$&');
+};
+
+// TODO: use native Array.find, Array.findIndex when IE support is dropped
+var arrayFindIndex = exports.arrayFindIndex = function arrayFindIndex(arr, pred) {
+  for (var i = 0; i !== arr.length; ++i) {
+    if (pred(arr[i])) {
+      return i;
+    }
+  }
+  return -1;
+};
+
+var arrayFind = exports.arrayFind = function arrayFind(arr, pred) {
+  var idx = arrayFindIndex(arr, pred);
+  return idx !== -1 ? arr[idx] : undefined;
+};
+
+// coerce truthy value to array
+var coerceTruthyValueToArray = exports.coerceTruthyValueToArray = function coerceTruthyValueToArray(val) {
+  if (Array.isArray(val)) {
+    return val;
+  } else if (val) {
+    return [val];
+  } else {
+    return [];
+  }
+};
+
+var isIE = exports.isIE = function isIE() {
+  return !_vue2.default.prototype.$isServer && !isNaN(Number(document.documentMode));
+};
+
+var isEdge = exports.isEdge = function isEdge() {
+  return !_vue2.default.prototype.$isServer && navigator.userAgent.indexOf('Edge') > -1;
+};
+
+var isFirefox = exports.isFirefox = function isFirefox() {
+  return !_vue2.default.prototype.$isServer && !!window.navigator.userAgent.match(/firefox/i);
+};
+
+var autoprefixer = exports.autoprefixer = function autoprefixer(style) {
+  if ((typeof style === 'undefined' ? 'undefined' : _typeof(style)) !== 'object') return style;
+  var rules = ['transform', 'transition', 'animation'];
+  var prefixes = ['ms-', 'webkit-'];
+  rules.forEach(function (rule) {
+    var value = style[rule];
+    if (rule && value) {
+      prefixes.forEach(function (prefix) {
+        style[prefix + rule] = value;
+      });
+    }
+  });
+  return style;
+};
+
+var kebabCase = exports.kebabCase = function kebabCase(str) {
+  var hyphenateRE = /([^-])([A-Z])/g;
+  return str.replace(hyphenateRE, '$1-$2').replace(hyphenateRE, '$1-$2').toLowerCase();
+};
+
+var capitalize = exports.capitalize = function capitalize(str) {
+  if (!(0, _types.isString)(str)) return str;
+  return str.charAt(0).toUpperCase() + str.slice(1);
+};
+
+var looseEqual = exports.looseEqual = function looseEqual(a, b) {
+  var isObjectA = (0, _types.isObject)(a);
+  var isObjectB = (0, _types.isObject)(b);
+  if (isObjectA && isObjectB) {
+    return JSON.stringify(a) === JSON.stringify(b);
+  } else if (!isObjectA && !isObjectB) {
+    return String(a) === String(b);
+  } else {
+    return false;
+  }
+};
+
+var arrayEquals = exports.arrayEquals = function arrayEquals(arrayA, arrayB) {
+  arrayA = arrayA || [];
+  arrayB = arrayB || [];
+
+  if (arrayA.length !== arrayB.length) {
+    return false;
+  }
+
+  for (var i = 0; i < arrayA.length; i++) {
+    if (!looseEqual(arrayA[i], arrayB[i])) {
+      return false;
+    }
+  }
+
+  return true;
+};
+
+var isEqual = exports.isEqual = function isEqual(value1, value2) {
+  if (Array.isArray(value1) && Array.isArray(value2)) {
+    return arrayEquals(value1, value2);
+  }
+  return looseEqual(value1, value2);
+};
+
+var isEmpty = exports.isEmpty = function isEmpty(val) {
+  // null or undefined
+  if (val == null) return true;
+
+  if (typeof val === 'boolean') return false;
+
+  if (typeof val === 'number') return !val;
+
+  if (val instanceof Error) return val.message === '';
+
+  switch (Object.prototype.toString.call(val)) {
+    // String or Array
+    case '[object String]':
+    case '[object Array]':
+      return !val.length;
+
+    // Map or Set or File
+    case '[object File]':
+    case '[object Map]':
+    case '[object Set]':
+      {
+        return !val.size;
+      }
+    // Plain Object
+    case '[object Object]':
+      {
+        return !Object.keys(val).length;
+      }
+  }
+
+  return false;
+};
+
+function rafThrottle(fn) {
+  var locked = false;
+  return function () {
+    var _this = this;
+
+    for (var _len = arguments.length, args = Array(_len), _key = 0; _key < _len; _key++) {
+      args[_key] = arguments[_key];
+    }
+
+    if (locked) return;
+    locked = true;
+    window.requestAnimationFrame(function (_) {
+      fn.apply(_this, args);
+      locked = false;
+    });
+  };
+}
+
+function objToArray(obj) {
+  if (Array.isArray(obj)) {
+    return obj;
+  }
+  return isEmpty(obj) ? [] : [obj];
+}

package/lib/utils/vdom.js

@@ -0,0 +1,13 @@
+'use strict';
+
+exports.__esModule = true;
+
+var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };
+
+exports.isVNode = isVNode;
+
+var _util = require('@evolvere/sgp-ui/lib/utils/util');
+
+function isVNode(node) {
+  return node !== null && (typeof node === 'undefined' ? 'undefined' : _typeof(node)) === 'object' && (0, _util.hasOwn)(node, 'componentOptions');
+};

package/lib/utils/vue-popper.js

@@ -0,0 +1,202 @@
+'use strict';
+
+exports.__esModule = true;
+
+var _vue = require('vue');
+
+var _vue2 = _interopRequireDefault(_vue);
+
+var _popup = require('@evolvere/sgp-ui/lib/utils/popup');
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var PopperJS = _vue2.default.prototype.$isServer ? function () {} : require('./popper');
+var stop = function stop(e) {
+  return e.stopPropagation();
+};
+
+/**
+ * @param {HTMLElement} [reference=$refs.reference] - The reference element used to position the popper.
+ * @param {HTMLElement} [popper=$refs.popper] - The HTML element used as popper, or a configuration used to generate the popper.
+ * @param {String} [placement=button] - Placement of the popper accepted values: top(-start, -end), right(-start, -end), bottom(-start, -end), left(-start, -end)
+ * @param {Number} [offset=0] - Amount of pixels the popper will be shifted (can be negative).
+ * @param {Boolean} [visible=false] Visibility of the popup element.
+ * @param {Boolean} [visible-arrow=false] Visibility of the arrow, no style.
+ */
+exports.default = {
+  props: {
+    transformOrigin: {
+      type: [Boolean, String],
+      default: true
+    },
+    placement: {
+      type: String,
+      default: 'bottom'
+    },
+    boundariesPadding: {
+      type: Number,
+      default: 5
+    },
+    reference: {},
+    popper: {},
+    offset: {
+      default: 0
+    },
+    value: Boolean,
+    visibleArrow: Boolean,
+    arrowOffset: {
+      type: Number,
+      default: 35
+    },
+    appendToBody: {
+      type: Boolean,
+      default: true
+    },
+    popperOptions: {
+      type: Object,
+      default: function _default() {
+        return {
+          gpuAcceleration: false
+        };
+      }
+    }
+  },
+
+  data: function data() {
+    return {
+      showPopper: false,
+      currentPlacement: ''
+    };
+  },
+
+
+  watch: {
+    value: {
+      immediate: true,
+      handler: function handler(val) {
+        this.showPopper = val;
+        this.$emit('input', val);
+      }
+    },
+
+    showPopper: function showPopper(val) {
+      if (this.disabled) return;
+      val ? this.updatePopper() : this.destroyPopper();
+      this.$emit('input', val);
+    }
+  },
+
+  methods: {
+    createPopper: function createPopper() {
+      var _this = this;
+
+      if (this.$isServer) return;
+      this.currentPlacement = this.currentPlacement || this.placement;
+      if (!/^(top|bottom|left|right)(-start|-end)?$/g.test(this.currentPlacement)) {
+        return;
+      }
+
+      var options = this.popperOptions;
+      var popper = this.popperElm = this.popperElm || this.popper || this.$refs.popper;
+      var reference = this.referenceElm = this.referenceElm || this.reference || this.$refs.reference;
+
+      if (!reference && this.$slots.reference && this.$slots.reference[0]) {
+        reference = this.referenceElm = this.$slots.reference[0].elm;
+      }
+
+      if (!popper || !reference) return;
+      if (this.visibleArrow) this.appendArrow(popper);
+      if (this.appendToBody) document.body.appendChild(this.popperElm);
+      if (this.popperJS && this.popperJS.destroy) {
+        this.popperJS.destroy();
+      }
+
+      options.placement = this.currentPlacement;
+      options.offset = this.offset;
+      options.arrowOffset = this.arrowOffset;
+      this.popperJS = new PopperJS(reference, popper, options);
+      this.popperJS.onCreate(function (_) {
+        _this.$emit('created', _this);
+        _this.resetTransformOrigin();
+        _this.$nextTick(_this.updatePopper);
+      });
+      if (typeof options.onUpdate === 'function') {
+        this.popperJS.onUpdate(options.onUpdate);
+      }
+      this.popperJS._popper.style.zIndex = _popup.PopupManager.nextZIndex();
+      this.popperElm.addEventListener('click', stop);
+    },
+    updatePopper: function updatePopper() {
+      var popperJS = this.popperJS;
+      if (popperJS) {
+        popperJS.update();
+        if (popperJS._popper) {
+          popperJS._popper.style.zIndex = _popup.PopupManager.nextZIndex();
+        }
+      } else {
+        this.createPopper();
+      }
+    },
+    doDestroy: function doDestroy(forceDestroy) {
+      /* istanbul ignore if */
+      if (!this.popperJS || this.showPopper && !forceDestroy) return;
+      this.popperJS.destroy();
+      this.popperJS = null;
+    },
+    destroyPopper: function destroyPopper() {
+      if (this.popperJS) {
+        this.resetTransformOrigin();
+      }
+    },
+    resetTransformOrigin: function resetTransformOrigin() {
+      if (!this.transformOrigin) return;
+      var placementMap = {
+        top: 'bottom',
+        bottom: 'top',
+        left: 'right',
+        right: 'left'
+      };
+      var placement = this.popperJS._popper.getAttribute('x-placement').split('-')[0];
+      var origin = placementMap[placement];
+      this.popperJS._popper.style.transformOrigin = typeof this.transformOrigin === 'string' ? this.transformOrigin : ['top', 'bottom'].indexOf(placement) > -1 ? 'center ' + origin : origin + ' center';
+    },
+    appendArrow: function appendArrow(element) {
+      var hash = void 0;
+      if (this.appended) {
+        return;
+      }
+
+      this.appended = true;
+
+      for (var item in element.attributes) {
+        if (/^_v-/.test(element.attributes[item].name)) {
+          hash = element.attributes[item].name;
+          break;
+        }
+      }
+
+      var arrow = document.createElement('div');
+
+      if (hash) {
+        arrow.setAttribute(hash, '');
+      }
+      arrow.setAttribute('x-arrow', '');
+      arrow.className = 'popper__arrow';
+      element.appendChild(arrow);
+    }
+  },
+
+  beforeDestroy: function beforeDestroy() {
+    this.doDestroy(true);
+    if (this.popperElm && this.popperElm.parentNode === document.body) {
+      this.popperElm.removeEventListener('click', stop);
+      document.body.removeChild(this.popperElm);
+    }
+  },
+
+
+  // call destroy in keep-alive mode
+  deactivated: function deactivated() {
+    this.$options.beforeDestroy[0].call(this);
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvere/sgp-ui",
-  "version": "1.6.8",
+  "version": "1.6.10",
   "description": "A Component Library for Vue.js.",
   "main": "lib/rdc-sgp-ui.common.js",
   "files": [
@@ -27,8 +27,9 @@
     "lint": "eslint src/**/* test/**/* packages/**/* build/**/* --quiet",
     "pub1": "npm run bootstrap && sh build/git-release.sh && sh build/release.sh && node build/bin/gen-indices.js && sh build/deploy-faas.sh",
     "test": "npm run lint && npm run build:theme && cross-env CI_ENV=/dev/ BABEL_ENV=test karma start test/unit/karma.conf.js --single-run",
+    "test:editor-security": "cross-env BABEL_ENV=test karma start test/unit/karma.editor-security.conf.js --single-run",
     "test:watch": "npm run build:theme && cross-env BABEL_ENV=test karma start test/unit/karma.conf.js",
-    "pub": "sh build/release.sh && sh build/deploy-faas.sh"
+    "pub": "sh build/release.sh"
   },
   "faas": [
     {
@@ -64,6 +65,7 @@
     "async-validator": "~1.8.1",
     "babel-helper-vue-jsx-merge-props": "^2.0.0",
     "deepmerge": "^1.2.0",
+    "dompurify": "3.4.14",
     "normalize-wheel": "^1.0.1",
     "resize-observer-polyfill": "^1.5.0",
     "throttle-debounce": "^1.0.1",

package/packages/editor/src/html-security.js

@@ -0,0 +1,180 @@
+import DOMPurify from 'dompurify';
+
+export const MAX_EDITOR_HTML_LENGTH = 1024 * 1024;
+export const MAX_IMAGE_SIZE = 5 * 1024 * 1024;
+export const MAX_IMAGE_COUNT = 10;
+
+const SAFE_PROTOCOLS = ['http:', 'https:'];
+const SAFE_LINK_PROTOCOLS = SAFE_PROTOCOLS.concat(['mailto:', 'tel:']);
+const SAFE_URI_PATTERN = /^(?:(?:https?|mailto|tel):|(?:\.{0,2}\/|#))/i;
+
+const PURIFY_OPTIONS = {
+  ALLOWED_TAGS: [
+    'a', 'b', 'blockquote', 'br', 'code', 'del', 'div', 'em', 'h1', 'h2',
+    'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'iframe', 'img', 'li', 'ol', 'p',
+    'pre', 's', 'span', 'strike', 'strong', 'sub', 'sup', 'table', 'tbody',
+    'td', 'tfoot', 'th', 'thead', 'tr', 'u', 'ul', 'video', 'source'
+  ],
+  ALLOWED_ATTR: [
+    'allow', 'allowfullscreen', 'alt', 'colspan', 'controls', 'frameborder',
+    'height', 'href', 'loading', 'loop', 'muted', 'playsinline', 'poster',
+    'preload', 'referrerpolicy', 'rel', 'rowspan', 'sandbox', 'src', 'style',
+    'target', 'title', 'webkitallowfullscreen', 'width'
+  ],
+  // These attributes carry fixed policy tokens rather than URLs. DOMPurify
+  // otherwise applies its URI value check and removes the security settings.
+  ADD_URI_SAFE_ATTR: ['loading', 'referrerpolicy', 'rel', 'sandbox', 'target'],
+  ALLOW_ARIA_ATTR: false,
+  ALLOW_DATA_ATTR: false,
+  ALLOW_UNKNOWN_PROTOCOLS: false,
+  ALLOWED_URI_REGEXP: SAFE_URI_PATTERN,
+  FORBID_TAGS: [
+    'base', 'button', 'embed', 'form', 'input', 'link', 'math', 'meta',
+    'noscript', 'object', 'option', 'script', 'select', 'style', 'svg',
+    'template', 'textarea'
+  ],
+  FORBID_ATTR: ['formaction', 'id', 'name', 'srcdoc', 'xlink:href'],
+  KEEP_CONTENT: true,
+  RETURN_TRUSTED_TYPE: false,
+  SANITIZE_DOM: true,
+  SANITIZE_NAMED_PROPS: true
+};
+
+const COLOR_VALUE = /^(?:#[0-9a-f]{3,8}|[a-z]{1,20}|rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}(?:\s*,\s*(?:0|1|0?\.\d+))?\s*\))$/i;
+const LENGTH_VALUE = /^\d+(?:\.\d+)?(?:px|em|rem|%)?$/i;
+const FONT_FAMILY_VALUE = /^[a-z0-9\u4e00-\u9fff ,'-]{1,120}$/i;
+
+const SAFE_STYLE_RULES = {
+  'background-color': COLOR_VALUE,
+  color: COLOR_VALUE,
+  'font-family': FONT_FAMILY_VALUE,
+  'font-size': LENGTH_VALUE,
+  'font-style': /^(?:normal|italic|oblique)$/i,
+  'font-weight': /^(?:normal|bold|bolder|lighter|[1-9]00)$/i,
+  'line-height': LENGTH_VALUE,
+  'list-style-type': /^(?:disc|circle|square|decimal|lower-alpha|upper-alpha|lower-roman|upper-roman|none)$/i,
+  'margin-left': LENGTH_VALUE,
+  'max-width': LENGTH_VALUE,
+  'padding-left': LENGTH_VALUE,
+  'text-align': /^(?:left|right|center|justify)$/i,
+  'text-decoration': /^(?:none|underline|line-through)(?:\s+(?:underline|line-through))*$/i,
+  'text-indent': LENGTH_VALUE,
+  'vertical-align': /^(?:baseline|sub|super|top|text-top|middle|bottom|text-bottom)$/i,
+  'white-space': /^(?:normal|nowrap|pre|pre-wrap|pre-line)$/i
+};
+
+function parseUrl(value) {
+  const url = (value || '').trim();
+  if (!url || /[\u0000-\u001f\u007f]/.test(url)) return null;
+
+  const parser = document.createElement('a');
+  parser.href = url;
+  return parser;
+}
+
+function hasSafeProtocol(value, protocols) {
+  const parser = parseUrl(value);
+  return !!parser && protocols.indexOf(parser.protocol.toLowerCase()) !== -1;
+}
+
+export function isSafeLink(link) {
+  return hasSafeProtocol(link, SAFE_LINK_PROTOCOLS);
+}
+
+export function isSafeMediaSource(source) {
+  return hasSafeProtocol(source, SAFE_PROTOCOLS);
+}
+
+function sanitizeStyle(styleText) {
+  if (!styleText || styleText.length > 500 || /[\\<>{}]|url\s*\(|expression\s*\(|@import|javascript\s*:|data\s*:|-moz-binding|behavior\s*:/i.test(styleText)) {
+    return '';
+  }
+
+  return styleText.split(';').reduce((rules, declaration) => {
+    const separator = declaration.indexOf(':');
+    if (separator === -1) return rules;
+
+    const property = declaration.slice(0, separator).trim().toLowerCase();
+    const value = declaration.slice(separator + 1).trim();
+    const rule = SAFE_STYLE_RULES[property];
+    if (rule && rule.test(value)) rules.push(`${property}: ${value}`);
+    return rules;
+  }, []).join('; ');
+}
+
+function normalizeDimension(element, attribute) {
+  if (!element.hasAttribute(attribute)) return;
+  const value = Number(element.getAttribute(attribute));
+  if (!Number.isInteger(value) || value < 1 || value > 10000) {
+    element.removeAttribute(attribute);
+  }
+}
+
+function normalizeRichText(html) {
+  const template = document.createElement('template');
+  template.innerHTML = html;
+  const elements = Array.prototype.slice.call(template.content.querySelectorAll('*'));
+
+  elements.forEach(element => {
+    const style = sanitizeStyle(element.getAttribute('style'));
+    if (style) element.setAttribute('style', style);
+    else element.removeAttribute('style');
+
+    normalizeDimension(element, 'width');
+    normalizeDimension(element, 'height');
+
+    if (element.tagName === 'A') {
+      if (!isSafeLink(element.getAttribute('href'))) element.removeAttribute('href');
+      if (element.getAttribute('target') === '_blank') {
+        element.setAttribute('rel', 'noopener noreferrer');
+      } else {
+        element.removeAttribute('target');
+        element.removeAttribute('rel');
+      }
+    }
+
+    if (element.tagName === 'IMG') {
+      if (!isSafeMediaSource(element.getAttribute('src'))) {
+        element.parentNode.removeChild(element);
+        return;
+      }
+      element.setAttribute('loading', 'lazy');
+      element.setAttribute('referrerpolicy', 'no-referrer');
+    }
+
+    if (element.tagName === 'IFRAME') {
+      if (!isSafeMediaSource(element.getAttribute('src'))) {
+        element.parentNode.removeChild(element);
+        return;
+      }
+      element.setAttribute('sandbox', 'allow-scripts allow-presentation allow-popups');
+      element.setAttribute('referrerpolicy', 'no-referrer');
+      element.setAttribute('loading', 'lazy');
+    }
+
+    if ((element.tagName === 'VIDEO' || element.tagName === 'SOURCE') &&
+      !isSafeMediaSource(element.getAttribute('src'))) {
+      element.parentNode.removeChild(element);
+    }
+  });
+
+  return template.innerHTML;
+}
+
+export function sanitizeEditorHtml(html) {
+  if (typeof html !== 'string' || html.length > MAX_EDITOR_HTML_LENGTH) return '';
+
+  const sanitized = DOMPurify.sanitize(html, PURIFY_OPTIONS);
+  const normalized = normalizeRichText(sanitized);
+  return DOMPurify.sanitize(normalized, PURIFY_OPTIONS);
+}
+
+export function validateImageFiles(files) {
+  if (!files || files.length < 1 || files.length > MAX_IMAGE_COUNT) return false;
+  return Array.prototype.every.call(files, file => (
+    !!file &&
+    file.size > 0 &&
+    file.size <= MAX_IMAGE_SIZE &&
+    /^(?:image\/jpeg|image\/png|image\/gif)$/i.test(file.type || '')
+  ));
+}