@instructure/platform-sanitize 0.3.17 → 0.4.0

package/dist/index.js

@@ -252,16 +252,7 @@ const m = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), h = [
-  "background",
-  "background-image",
-  "list-style",
-  "list-style-image",
-  "cursor",
-  // content: url(...) triggers an HTTP GET even on non-pseudo elements in some
-  // browsers; strip it as defense-in-depth against tracking-pixel exfiltration.
-  "content"
-], y = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, k = /* @__PURE__ */ new Set([
+]), h = ["content"], y = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, A = /* @__PURE__ */ new Set([
   "allow-downloads",
   "allow-forms",
   "allow-modals",
@@ -320,7 +311,7 @@ const m = /* @__PURE__ */ new Set([
   FORCE_BODY: !0
 };
 let a = null;
-function A() {
+function k() {
   return a || (a = typeof d == "function" ? d(window) : d, a.addHook("afterSanitizeAttributes", (r) => {
     if (!(r instanceof Element) || !r.hasAttribute("style")) return;
     const t = r.style, e = [];
@@ -374,7 +365,7 @@ function A() {
     e.add("noopener"), r.setAttribute("rel", [...e].join(" "));
   }), a.addHook("afterSanitizeAttributes", (r) => {
     if (!(r instanceof Element) || r.tagName !== "IFRAME" || !r.hasAttribute("sandbox")) return;
-    const e = (r.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), o = e.filter((l) => k.has(l));
+    const e = (r.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), o = e.filter((l) => A.has(l));
     o.length !== e.length && r.setAttribute("sandbox", o.join(" "));
   }), a);
 }
@@ -382,9 +373,9 @@ function v(r, t) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
   const e = t != null && t.allowFormAttributeNames ? { ...f, SANITIZE_DOM: !1 } : f;
-  return A().sanitize(r ?? "", e);
+  return k().sanitize(r ?? "", e);
 }
-const p = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), c = "http://platform-sanitize.invalid/", g = /^\s*\/\//, b = (
+const p = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), c = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
   // oxlint-disable-next-line no-control-regex -- intentional security guard
   /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
 ), S = {
@@ -422,10 +413,10 @@ function E(r) {
 function R(r) {
   if (!r || !r.trim()) return "about:blank";
   const t = r.replace(/\\/g, "/");
-  if (g.test(t) || b.test(t)) return "about:blank";
+  if (b.test(t) || g.test(t)) return "about:blank";
   if (/&[#A-Za-z]/.test(t)) {
     const e = E(t);
-    if (g.test(e) || b.test(e))
+    if (b.test(e) || g.test(e))
       return "about:blank";
     try {
       const o = new URL(e, c);

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAgeA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA6dA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.3.17",
+  "version": "0.4.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",