@ionic/core 8.8.12-dev.11782342444.186b6e9c → 8.8.12-dev.11782931922.18ba507c

package/hydrate/index.js

@@ -8765,13 +8765,17 @@ const FOCUS_TRAP_DISABLE_CLASS = 'ion-disable-focus-trap';
  * Sanitize an untrusted HTML string.
  *
  * Parses the string into a detached DOM, removes blocked tags, strips
- * attributes outside the `allowedAttributes` list (refer `sanitizeElement`),
- * and scrubs script-scheme URLs. Returns the sanitized HTML string.
+ * attributes outside the narrow `domStringAllowedAttributes` list (refer
+ * `sanitizeElement`), and scrubs script-scheme URLs. Returns the sanitized
+ * HTML string.
  *
  * Use this when you have an HTML string from an unknown source and need to
  * render it via `innerHTML`. Use `sanitizeDOMTree` instead when you already
  * have a DOM tree and want to sanitize it in place without a string round
- * trip; both apply the same attribute policy.
+ * trip. The two apply the same dangerous-vector scrubbing but different
+ * attribute allowlists: this path stays narrow so existing consumers
+ * (toast, loading, alert message, etc.) are unaffected, while
+ * `sanitizeDOMTree` uses the wider rich-content allowlist.
  *
  * @param untrustedString - The HTML string to sanitize. Pass an
  * `IonicSafeString` to bypass sanitization, or `undefined` to short-circuit.
@@ -8827,7 +8831,7 @@ const sanitizeDOMString = (untrustedString) => {
                 const childElements = getElementChildren(element);
                 /* eslint-disable-next-line */
                 for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
-                    sanitizeElement(childElements[childIndex]);
+                    sanitizeElement(childElements[childIndex], domStringAllowedAttributes);
                 }
             }
         });
@@ -8839,7 +8843,7 @@ const sanitizeDOMString = (untrustedString) => {
         const dfChildren = getElementChildren(documentFragment);
         /* eslint-disable-next-line */
         for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
-            sanitizeElement(dfChildren[childIndex]);
+            sanitizeElement(dfChildren[childIndex], domStringAllowedAttributes);
         }
         // Append document fragment to div
         const fragmentDiv = document.createElement('div');
@@ -8857,8 +8861,8 @@ const sanitizeDOMString = (untrustedString) => {
  * Sanitize an entire trusted DOM tree in place.
  *
  * Removes blocked tags (`script`, `iframe`, etc.) from the subtree and
- * then sanitizes attributes on every remaining element using the same
- * allowlist policy as `sanitizeDOMString` (refer `sanitizeElement`).
+ * then sanitizes attributes on every remaining element using the wider
+ * `richContentAllowedAttributes` allowlist (refer `sanitizeElement`).
  * Component presentational attributes (`size`, `color`, `shape`, inline
  * SVG, `aria-*`, `data-*`) are preserved; `style`, event handlers (`on*`),
  * form/navigation-hijack attributes, script-scheme URLs, and non-image
@@ -8881,7 +8885,7 @@ const sanitizeDOMTree = (root) => {
             matches[i].remove();
         }
     });
-    sanitizeElement(root);
+    sanitizeElement(root, richContentAllowedAttributes, richContentAllowedAttributePrefixes);
 };
 /**
  * Clean up current element based on allowed attributes
@@ -8889,7 +8893,7 @@ const sanitizeDOMTree = (root) => {
  * clean those up as well
  */
 // TODO(FW-2832): type (using Element triggers other type errors as well)
-const sanitizeElement = (element) => {
+const sanitizeElement = (element, allowedAttributes, allowedAttributePrefixes = []) => {
     // IE uses childNodes, so ignore nodes that are not elements
     if (element.nodeType && element.nodeType !== 1) {
         return;
@@ -8922,7 +8926,7 @@ const sanitizeElement = (element) => {
          * (`formaction`, `action`, `target`), namespaced attributes like
          * `xlink:href`, and anything else not explicitly known to be safe.
          */
-        if (!isAttributeAllowed(lowerName)) {
+        if (!isAttributeAllowed(lowerName, allowedAttributes, allowedAttributePrefixes)) {
             element.removeAttribute(attributeName);
             continue;
         }
@@ -8965,7 +8969,7 @@ const sanitizeElement = (element) => {
     const childElements = getElementChildren(element);
     /* eslint-disable-next-line */
     for (let i = 0; i < childElements.length; i++) {
-        sanitizeElement(childElements[i]);
+        sanitizeElement(childElements[i], allowedAttributes, allowedAttributePrefixes);
     }
 };
 /**
@@ -9025,13 +9029,24 @@ const reflectPropertiesToAttributes = (root) => {
     }
 };
 /**
- * Attribute names that are always safe to keep. Covers global HTML
- * attributes, the Ionic component presentational props that cloned rich
- * content (e.g. `ion-select-option` markup) relies on, and the inert SVG
- * presentation attributes used by inline icons.
+ * Attribute allowlist for `sanitizeDOMString`. Intentionally narrow: this
+ * path sanitizes developer HTML strings rendered via `innerHTML` by
+ * `ion-toast`, `ion-loading`, the `ion-alert` message,
+ * `ion-refresher-content`, and `ion-infinite-scroll-content`, so the list
+ * is kept to the minimum those have always needed. Broadening it here would
+ * change sanitization output for all of those consumers, so the wider
+ * rich-content allowlist below is deliberately scoped to `sanitizeDOMTree`
+ * instead.
+ */
+const domStringAllowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
+/**
+ * Attribute allowlist for `sanitizeDOMTree` (the select rich-content path).
+ * Covers global HTML attributes, the Ionic component presentational props
+ * that cloned rich content (e.g. `ion-select-option` markup) relies on, and
+ * the inert SVG presentation attributes used by inline icons.
  *
  * `aria-*` and `data-*` are allowed separately by prefix (refer
- * `allowedAttributePrefixes`) since they are inert and not worth
+ * `richContentAllowedAttributePrefixes`) since they are inert and not worth
  * enumerating. URL-bearing names (`href`, `src`) are allowed here, but
  * their values are still scrubbed for script schemes in `sanitizeElement`.
  *
@@ -9039,7 +9054,7 @@ const reflectPropertiesToAttributes = (root) => {
  * form/navigation-hijack attributes (`formaction`, `action`, `target`),
  * which are therefore stripped.
  */
-const allowedAttributes = [
+const richContentAllowedAttributes = [
     // Global / structural
     'class',
     'id',
@@ -9103,16 +9118,16 @@ const allowedAttributes = [
     'opacity',
 ];
 /**
- * Attribute-name prefixes that are always safe to keep. `aria-*` and
- * `data-*` attributes cannot execute script or load resources, so they are
- * allowed wholesale rather than enumerated by name.
+ * Attribute-name prefixes that are always safe to keep in the rich-content
+ * path. `aria-*` and `data-*` attributes cannot execute script or load
+ * resources, so they are allowed wholesale rather than enumerated by name.
  */
-const allowedAttributePrefixes = ['aria-', 'data-'];
+const richContentAllowedAttributePrefixes = ['aria-', 'data-'];
 /**
  * Whether an attribute name (already lowercased) is safe to keep, by exact
  * match or by an allowed prefix.
  */
-const isAttributeAllowed = (lowerName) => {
+const isAttributeAllowed = (lowerName, allowedAttributes, allowedAttributePrefixes) => {
     if (allowedAttributes.includes(lowerName)) {
         return true;
     }
@@ -9233,6 +9248,14 @@ const cloneToVNode = (node, keyPrefix, index) => {
 const renderClonedContent = (id, content, className, useSpan = false) => {
     const Tag = useSpan ? 'span' : 'div';
     const keyPrefix = `${className}-${id}`;
+    /**
+     * Do not remove. This is the only sanitization pass for callers that pass
+     * an `HTMLElement` straight to `renderOptionLabel` (e.g. vanilla JS)
+     * without going through `getOptionContent`, which sanitizes upstream.
+     * `cloneToVNode` does pure structural conversion and no security
+     * filtering, so dropping this call would reopen an XSS hole on the
+     * direct `HTMLElement` path.
+     */
     sanitizeDOMTree(content);
     return (hAsync(Tag, { class: className, key: keyPrefix }, Array.from(content.childNodes).map((child, i) => cloneToVNode(child, keyPrefix, i))));
 };
@@ -38303,12 +38326,12 @@ class SelectOption {
         registerInstance(this, hostRef);
         this.inputId = `ion-selopt-${selectOptionIds++}`;
         /**
-         * If `true`, the user cannot interact with the select option. This property does not apply when `interface="action-sheet"` as `ion-action-sheet` does not allow for disabled buttons.
+         * If `true`, the user cannot interact with the select option.
          */
         this.disabled = false;
     }
     render() {
-        return hAsync(Host, { key: '4f284411b91b98eda59aadc401bc4d8e423caae9', role: "option", id: this.inputId, class: getIonMode$1(this) });
+        return hAsync(Host, { key: '8b8bef0f5a55f18048708c34d3ea3ff0ff2f1d47', role: "option", id: this.inputId, class: getIonMode$1(this) });
     }
     get el() { return getElement(this); }
     static get style() { return selectOptionCss(); }

package/hydrate/index.mjs

@@ -8763,13 +8763,17 @@ const FOCUS_TRAP_DISABLE_CLASS = 'ion-disable-focus-trap';
  * Sanitize an untrusted HTML string.
  *
  * Parses the string into a detached DOM, removes blocked tags, strips
- * attributes outside the `allowedAttributes` list (refer `sanitizeElement`),
- * and scrubs script-scheme URLs. Returns the sanitized HTML string.
+ * attributes outside the narrow `domStringAllowedAttributes` list (refer
+ * `sanitizeElement`), and scrubs script-scheme URLs. Returns the sanitized
+ * HTML string.
  *
  * Use this when you have an HTML string from an unknown source and need to
  * render it via `innerHTML`. Use `sanitizeDOMTree` instead when you already
  * have a DOM tree and want to sanitize it in place without a string round
- * trip; both apply the same attribute policy.
+ * trip. The two apply the same dangerous-vector scrubbing but different
+ * attribute allowlists: this path stays narrow so existing consumers
+ * (toast, loading, alert message, etc.) are unaffected, while
+ * `sanitizeDOMTree` uses the wider rich-content allowlist.
  *
  * @param untrustedString - The HTML string to sanitize. Pass an
  * `IonicSafeString` to bypass sanitization, or `undefined` to short-circuit.
@@ -8825,7 +8829,7 @@ const sanitizeDOMString = (untrustedString) => {
                 const childElements = getElementChildren(element);
                 /* eslint-disable-next-line */
                 for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
-                    sanitizeElement(childElements[childIndex]);
+                    sanitizeElement(childElements[childIndex], domStringAllowedAttributes);
                 }
             }
         });
@@ -8837,7 +8841,7 @@ const sanitizeDOMString = (untrustedString) => {
         const dfChildren = getElementChildren(documentFragment);
         /* eslint-disable-next-line */
         for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
-            sanitizeElement(dfChildren[childIndex]);
+            sanitizeElement(dfChildren[childIndex], domStringAllowedAttributes);
         }
         // Append document fragment to div
         const fragmentDiv = document.createElement('div');
@@ -8855,8 +8859,8 @@ const sanitizeDOMString = (untrustedString) => {
  * Sanitize an entire trusted DOM tree in place.
  *
  * Removes blocked tags (`script`, `iframe`, etc.) from the subtree and
- * then sanitizes attributes on every remaining element using the same
- * allowlist policy as `sanitizeDOMString` (refer `sanitizeElement`).
+ * then sanitizes attributes on every remaining element using the wider
+ * `richContentAllowedAttributes` allowlist (refer `sanitizeElement`).
  * Component presentational attributes (`size`, `color`, `shape`, inline
  * SVG, `aria-*`, `data-*`) are preserved; `style`, event handlers (`on*`),
  * form/navigation-hijack attributes, script-scheme URLs, and non-image
@@ -8879,7 +8883,7 @@ const sanitizeDOMTree = (root) => {
             matches[i].remove();
         }
     });
-    sanitizeElement(root);
+    sanitizeElement(root, richContentAllowedAttributes, richContentAllowedAttributePrefixes);
 };
 /**
  * Clean up current element based on allowed attributes
@@ -8887,7 +8891,7 @@ const sanitizeDOMTree = (root) => {
  * clean those up as well
  */
 // TODO(FW-2832): type (using Element triggers other type errors as well)
-const sanitizeElement = (element) => {
+const sanitizeElement = (element, allowedAttributes, allowedAttributePrefixes = []) => {
     // IE uses childNodes, so ignore nodes that are not elements
     if (element.nodeType && element.nodeType !== 1) {
         return;
@@ -8920,7 +8924,7 @@ const sanitizeElement = (element) => {
          * (`formaction`, `action`, `target`), namespaced attributes like
          * `xlink:href`, and anything else not explicitly known to be safe.
          */
-        if (!isAttributeAllowed(lowerName)) {
+        if (!isAttributeAllowed(lowerName, allowedAttributes, allowedAttributePrefixes)) {
             element.removeAttribute(attributeName);
             continue;
         }
@@ -8963,7 +8967,7 @@ const sanitizeElement = (element) => {
     const childElements = getElementChildren(element);
     /* eslint-disable-next-line */
     for (let i = 0; i < childElements.length; i++) {
-        sanitizeElement(childElements[i]);
+        sanitizeElement(childElements[i], allowedAttributes, allowedAttributePrefixes);
     }
 };
 /**
@@ -9023,13 +9027,24 @@ const reflectPropertiesToAttributes = (root) => {
     }
 };
 /**
- * Attribute names that are always safe to keep. Covers global HTML
- * attributes, the Ionic component presentational props that cloned rich
- * content (e.g. `ion-select-option` markup) relies on, and the inert SVG
- * presentation attributes used by inline icons.
+ * Attribute allowlist for `sanitizeDOMString`. Intentionally narrow: this
+ * path sanitizes developer HTML strings rendered via `innerHTML` by
+ * `ion-toast`, `ion-loading`, the `ion-alert` message,
+ * `ion-refresher-content`, and `ion-infinite-scroll-content`, so the list
+ * is kept to the minimum those have always needed. Broadening it here would
+ * change sanitization output for all of those consumers, so the wider
+ * rich-content allowlist below is deliberately scoped to `sanitizeDOMTree`
+ * instead.
+ */
+const domStringAllowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
+/**
+ * Attribute allowlist for `sanitizeDOMTree` (the select rich-content path).
+ * Covers global HTML attributes, the Ionic component presentational props
+ * that cloned rich content (e.g. `ion-select-option` markup) relies on, and
+ * the inert SVG presentation attributes used by inline icons.
  *
  * `aria-*` and `data-*` are allowed separately by prefix (refer
- * `allowedAttributePrefixes`) since they are inert and not worth
+ * `richContentAllowedAttributePrefixes`) since they are inert and not worth
  * enumerating. URL-bearing names (`href`, `src`) are allowed here, but
  * their values are still scrubbed for script schemes in `sanitizeElement`.
  *
@@ -9037,7 +9052,7 @@ const reflectPropertiesToAttributes = (root) => {
  * form/navigation-hijack attributes (`formaction`, `action`, `target`),
  * which are therefore stripped.
  */
-const allowedAttributes = [
+const richContentAllowedAttributes = [
     // Global / structural
     'class',
     'id',
@@ -9101,16 +9116,16 @@ const allowedAttributes = [
     'opacity',
 ];
 /**
- * Attribute-name prefixes that are always safe to keep. `aria-*` and
- * `data-*` attributes cannot execute script or load resources, so they are
- * allowed wholesale rather than enumerated by name.
+ * Attribute-name prefixes that are always safe to keep in the rich-content
+ * path. `aria-*` and `data-*` attributes cannot execute script or load
+ * resources, so they are allowed wholesale rather than enumerated by name.
  */
-const allowedAttributePrefixes = ['aria-', 'data-'];
+const richContentAllowedAttributePrefixes = ['aria-', 'data-'];
 /**
  * Whether an attribute name (already lowercased) is safe to keep, by exact
  * match or by an allowed prefix.
  */
-const isAttributeAllowed = (lowerName) => {
+const isAttributeAllowed = (lowerName, allowedAttributes, allowedAttributePrefixes) => {
     if (allowedAttributes.includes(lowerName)) {
         return true;
     }
@@ -9231,6 +9246,14 @@ const cloneToVNode = (node, keyPrefix, index) => {
 const renderClonedContent = (id, content, className, useSpan = false) => {
     const Tag = useSpan ? 'span' : 'div';
     const keyPrefix = `${className}-${id}`;
+    /**
+     * Do not remove. This is the only sanitization pass for callers that pass
+     * an `HTMLElement` straight to `renderOptionLabel` (e.g. vanilla JS)
+     * without going through `getOptionContent`, which sanitizes upstream.
+     * `cloneToVNode` does pure structural conversion and no security
+     * filtering, so dropping this call would reopen an XSS hole on the
+     * direct `HTMLElement` path.
+     */
     sanitizeDOMTree(content);
     return (hAsync(Tag, { class: className, key: keyPrefix }, Array.from(content.childNodes).map((child, i) => cloneToVNode(child, keyPrefix, i))));
 };
@@ -38301,12 +38324,12 @@ class SelectOption {
         registerInstance(this, hostRef);
         this.inputId = `ion-selopt-${selectOptionIds++}`;
         /**
-         * If `true`, the user cannot interact with the select option. This property does not apply when `interface="action-sheet"` as `ion-action-sheet` does not allow for disabled buttons.
+         * If `true`, the user cannot interact with the select option.
          */
         this.disabled = false;
     }
     render() {
-        return hAsync(Host, { key: '4f284411b91b98eda59aadc401bc4d8e423caae9', role: "option", id: this.inputId, class: getIonMode$1(this) });
+        return hAsync(Host, { key: '8b8bef0f5a55f18048708c34d3ea3ff0ff2f1d47', role: "option", id: this.inputId, class: getIonMode$1(this) });
     }
     get el() { return getElement(this); }
     static get style() { return selectOptionCss(); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionic/core",
-  "version": "8.8.12-dev.11782342444.186b6e9c",
+  "version": "8.8.12-dev.11782931922.18ba507c",
   "description": "Base components for Ionic",
   "engines": {
     "node": ">= 16"

package/components/p-CMpqV7Co.js

@@ -1,4 +0,0 @@
-/*!
- * (C) Ionic http://ionicframework.com - MIT License
- */
-import{j as t}from"./p-CHqRYvYm.js";const o=o=>{try{if(o instanceof y)return o.value;if(!r()||"string"!=typeof o||""===o)return o;if(o.includes("onload="))return"";const t=document.createDocumentFragment(),e=document.createElement("div");t.appendChild(e),e.innerHTML=o,p.forEach((o=>{const e=t.querySelectorAll(o);for(let o=e.length-1;o>=0;o--){const r=e[o];r.parentNode?r.parentNode.removeChild(r):t.removeChild(r);const s=i(r);for(let t=0;t<s.length;t++)n(s[t])}}));const s=i(t);for(let t=0;t<s.length;t++)n(s[t]);const a=document.createElement("div");a.appendChild(t);const c=a.querySelector("div");return null!==c?c.innerHTML:a.innerHTML}catch(o){return t("sanitizeDOMString",o),""}},e=t=>{r()&&(p.forEach((o=>{const e=t.querySelectorAll(o);for(let t=e.length-1;t>=0;t--)e[t].remove()})),n(t))},n=t=>{if(t.nodeType&&1!==t.nodeType)return;if("undefined"!=typeof NamedNodeMap&&!(t.attributes instanceof NamedNodeMap))return void t.remove();t.removeAttribute("style");for(let o=t.attributes.length-1;o>=0;o--){const e=t.attributes.item(o),n=e.name,i=n.toLowerCase();if(!l(i)){t.removeAttribute(n);continue}const r=e.value;if(null==r)continue;const s=r.replace(f,"").toLowerCase();(s.includes("javascript:")||s.includes("vbscript:")||d.includes(i)&&s.startsWith("data:")&&!u.test(s))&&t.removeAttribute(n)}const o=i(t);for(let t=0;t<o.length;t++)n(o[t])},i=t=>null!=t.children?t.children:t.childNodes,r=()=>{var t;const o=window,e=null===(t=null==o?void 0:o.Ionic)||void 0===t?void 0:t.config;return!e||(e.get?e.get("sanitizerEnabled",!0):!0===e.sanitizerEnabled||void 0===e.sanitizerEnabled)},s=t=>{const o=[];t.tagName in m&&o.push(t);for(const e of Object.keys(m))o.push(...Array.from(t.querySelectorAll(e.toLowerCase())));for(const t of o){if(!(t.tagName in m))continue;const o=m[t.tagName];for(const e of o){const o=t[e];"string"==typeof o&&o.length>0&&!t.hasAttribute(e)&&t.setAttribute(e,o)}}},a=["class","id","slot","name","title","alt","lang","dir","role","type","value","disabled","width","height","href","src","color","size","shape","fill","expand","mode","theme","icon","label","label-placement","justify","inset","lines","ios","md","xmlns","viewbox","preserveaspectratio","stroke","stroke-width","stroke-linecap","stroke-linejoin","stroke-opacity","stroke-dasharray","fill-rule","fill-opacity","clip-rule","d","points","cx","cy","r","rx","ry","x","y","x1","y1","x2","y2","transform","opacity"],c=["aria-","data-"],l=t=>!!a.includes(t)||c.some((o=>t.startsWith(o))),f=/[\u0000-\u0020\u007f-\u00a0]/g,d=["href","src"],u=/^data:image\/(?:png|jpe?g|gif|webp|bmp|avif|x-icon|vnd\.microsoft\.icon)[;,]/,p=["script","style","iframe","meta","link","object","embed","base"],m={"ION-ICON":["icon","name","src","ios","md"]};class y{constructor(t){this.value=t}}export{y as I,o as a,s as r,e as s}

package/dist/ionic/p-5x6vmGTf.js

@@ -1,4 +0,0 @@
-/*!
- * (C) Ionic http://ionicframework.com - MIT License
- */
-import{j as t}from"./p-tcQvqkiX.js";const o=o=>{try{if(o instanceof y)return o.value;if(!r()||"string"!=typeof o||""===o)return o;if(o.includes("onload="))return"";const t=document.createDocumentFragment(),e=document.createElement("div");t.appendChild(e),e.innerHTML=o,p.forEach((o=>{const e=t.querySelectorAll(o);for(let o=e.length-1;o>=0;o--){const r=e[o];r.parentNode?r.parentNode.removeChild(r):t.removeChild(r);const s=i(r);for(let t=0;t<s.length;t++)n(s[t])}}));const s=i(t);for(let t=0;t<s.length;t++)n(s[t]);const a=document.createElement("div");a.appendChild(t);const c=a.querySelector("div");return null!==c?c.innerHTML:a.innerHTML}catch(o){return t("sanitizeDOMString",o),""}},e=t=>{r()&&(p.forEach((o=>{const e=t.querySelectorAll(o);for(let t=e.length-1;t>=0;t--)e[t].remove()})),n(t))},n=t=>{if(t.nodeType&&1!==t.nodeType)return;if("undefined"!=typeof NamedNodeMap&&!(t.attributes instanceof NamedNodeMap))return void t.remove();t.removeAttribute("style");for(let o=t.attributes.length-1;o>=0;o--){const e=t.attributes.item(o),n=e.name,i=n.toLowerCase();if(!l(i)){t.removeAttribute(n);continue}const r=e.value;if(null==r)continue;const s=r.replace(f,"").toLowerCase();(s.includes("javascript:")||s.includes("vbscript:")||d.includes(i)&&s.startsWith("data:")&&!u.test(s))&&t.removeAttribute(n)}const o=i(t);for(let t=0;t<o.length;t++)n(o[t])},i=t=>null!=t.children?t.children:t.childNodes,r=()=>{var t;const o=window,e=null===(t=null==o?void 0:o.Ionic)||void 0===t?void 0:t.config;return!e||(e.get?e.get("sanitizerEnabled",!0):!0===e.sanitizerEnabled||void 0===e.sanitizerEnabled)},s=t=>{const o=[];t.tagName in m&&o.push(t);for(const e of Object.keys(m))o.push(...Array.from(t.querySelectorAll(e.toLowerCase())));for(const t of o){if(!(t.tagName in m))continue;const o=m[t.tagName];for(const e of o){const o=t[e];"string"==typeof o&&o.length>0&&!t.hasAttribute(e)&&t.setAttribute(e,o)}}},a=["class","id","slot","name","title","alt","lang","dir","role","type","value","disabled","width","height","href","src","color","size","shape","fill","expand","mode","theme","icon","label","label-placement","justify","inset","lines","ios","md","xmlns","viewbox","preserveaspectratio","stroke","stroke-width","stroke-linecap","stroke-linejoin","stroke-opacity","stroke-dasharray","fill-rule","fill-opacity","clip-rule","d","points","cx","cy","r","rx","ry","x","y","x1","y1","x2","y2","transform","opacity"],c=["aria-","data-"],l=t=>!!a.includes(t)||c.some((o=>t.startsWith(o))),f=/[\u0000-\u0020\u007f-\u00a0]/g,d=["href","src"],u=/^data:image\/(?:png|jpe?g|gif|webp|bmp|avif|x-icon|vnd\.microsoft\.icon)[;,]/,p=["script","style","iframe","meta","link","object","embed","base"],m={"ION-ICON":["icon","name","src","ios","md"]};class y{constructor(t){this.value=t}}export{y as I,e as a,s as r,o as s}