@ionic/core 8.8.14-dev.11784037956.17449639 → 8.8.14-dev.11784216165.1ecbf364

package/dist/esm/config-BwKpO3Is.js

@@ -0,0 +1,31 @@
+/*!
+ * (C) Ionic http://ionicframework.com - MIT License
+ */
+const setupConfig = (config) => {
+    const win = window;
+    const Ionic = win.Ionic;
+    // eslint-disable-next-line @typescript-eslint/prefer-optional-chain
+    if (Ionic && Ionic.config && Ionic.config.constructor.name !== 'Object') {
+        return;
+    }
+    win.Ionic = win.Ionic || {};
+    win.Ionic.config = Object.assign(Object.assign({}, win.Ionic.config), config);
+    return win.Ionic.config;
+};
+const getMode = () => {
+    var _a;
+    const win = window;
+    const config = (_a = win === null || win === void 0 ? void 0 : win.Ionic) === null || _a === void 0 ? void 0 : _a.config;
+    if (config) {
+        if (config.mode) {
+            return config.mode;
+        }
+        else {
+            return config.get('mode');
+        }
+    }
+    return 'md';
+};
+const ENABLE_HTML_CONTENT_DEFAULT = false;
+
+export { ENABLE_HTML_CONTENT_DEFAULT as E, getMode as g, setupConfig as s };

package/dist/esm/{index-DV3sJJW8.js → index-AlrZKoWR.js}

@@ -29,4 +29,4 @@ const reorderTwoSharp = "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2
 const searchOutline = "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 512 512' class='ionicon'><path d='M221.09 64a157.09 157.09 0 1 0 157.09 157.09A157.1 157.1 0 0 0 221.09 64Z' stroke-miterlimit='10' class='ionicon-fill-none ionicon-stroke-width'/><path d='M338.29 338.29 448 448' stroke-linecap='round' stroke-miterlimit='10' class='ionicon-fill-none ionicon-stroke-width'/></svg>";
 const searchSharp = "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 512 512' class='ionicon'><path d='M464 428 339.92 303.9a160.48 160.48 0 0 0 30.72-94.58C370.64 120.37 298.27 48 209.32 48S48 120.37 48 209.32s72.37 161.32 161.32 161.32a160.48 160.48 0 0 0 94.58-30.72L428 464ZM209.32 319.69a110.38 110.38 0 1 1 110.37-110.37 110.5 110.5 0 0 1-110.37 110.37'/></svg>";
 
-export { arrowBackSharp as a, closeCircle as b, chevronBack as c, closeSharp as d, searchSharp as e, checkmarkOutline as f, ellipseOutline as g, arrowDown as h, caretBackSharp as i, reorderThreeOutline as j, reorderTwoSharp as k, chevronDown as l, chevronForwardOutline as m, ellipsisHorizontal as n, caretUpSharp as o, chevronForward as p, caretDownSharp as q, removeOutline as r, searchOutline as s, close as t, menuOutline as u, menuSharp as v, chevronExpand as w, eyeOff as x, eye as y };
+export { arrowBackSharp as a, chevronDown as b, chevronBack as c, caretUpSharp as d, chevronForward as e, caretDownSharp as f, closeCircle as g, closeSharp as h, searchSharp as i, checkmarkOutline as j, ellipseOutline as k, arrowDown as l, caretBackSharp as m, reorderThreeOutline as n, reorderTwoSharp as o, chevronForwardOutline as p, ellipsisHorizontal as q, removeOutline as r, searchOutline as s, close as t, menuOutline as u, menuSharp as v, chevronExpand as w, eyeOff as x, eye as y };

package/dist/esm/index-DQSkZyOJ.js

@@ -0,0 +1,424 @@
+/*!
+ * (C) Ionic http://ionicframework.com - MIT License
+ */
+import { j as printIonError } from './index-tcQvqkiX.js';
+
+/**
+ * Sanitize an untrusted HTML string.
+ *
+ * Parses the string into a detached DOM, removes blocked tags, strips
+ * attributes outside the narrow `domStringAllowedAttributes` list (refer
+ * `sanitizeElement`), and scrubs script-scheme URLs. Returns the sanitized
+ * HTML string.
+ *
+ * Use this when you have an HTML string from an unknown source and need to
+ * render it via `innerHTML`. Use `sanitizeDOMTree` instead when you already
+ * have a DOM tree and want to sanitize it in place without a string round
+ * trip. The two apply the same dangerous-vector scrubbing but different
+ * attribute allowlists: this path stays narrow so existing consumers
+ * (toast, loading, alert message, etc.) are unaffected, while
+ * `sanitizeDOMTree` uses the wider rich-content allowlist.
+ *
+ * @param untrustedString - The HTML string to sanitize. Pass an
+ * `IonicSafeString` to bypass sanitization, or `undefined` to short-circuit.
+ * @returns The sanitized HTML string, or `undefined` if the input was
+ * `undefined`. Returns `''` if sanitization fails or the input contains
+ * an inline `onload=` handler.
+ */
+const sanitizeDOMString = (untrustedString) => {
+    try {
+        if (untrustedString instanceof IonicSafeString) {
+            return untrustedString.value;
+        }
+        if (!isSanitizerEnabled() || typeof untrustedString !== 'string' || untrustedString === '') {
+            return untrustedString;
+        }
+        /**
+         * onload is fired when appending to a document
+         * fragment in Chrome. If a string
+         * contains onload then we should not
+         * attempt to add this to the fragment.
+         */
+        if (untrustedString.includes('onload=')) {
+            return '';
+        }
+        /**
+         * Create a document fragment
+         * separate from the main DOM,
+         * create a div to do our work in
+         */
+        const documentFragment = document.createDocumentFragment();
+        const workingDiv = document.createElement('div');
+        documentFragment.appendChild(workingDiv);
+        workingDiv.innerHTML = untrustedString;
+        /**
+         * Remove any elements
+         * that are blocked
+         */
+        blockedTags.forEach((blockedTag) => {
+            const getElementsToRemove = documentFragment.querySelectorAll(blockedTag);
+            for (let elementIndex = getElementsToRemove.length - 1; elementIndex >= 0; elementIndex--) {
+                const element = getElementsToRemove[elementIndex];
+                if (element.parentNode) {
+                    element.parentNode.removeChild(element);
+                }
+                else {
+                    documentFragment.removeChild(element);
+                }
+                /**
+                 * We still need to sanitize
+                 * the children of this element
+                 * as they are left behind
+                 */
+                const childElements = getElementChildren(element);
+                /* eslint-disable-next-line */
+                for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
+                    sanitizeElement(childElements[childIndex], domStringAllowedAttributes);
+                }
+            }
+        });
+        /**
+         * Go through remaining elements and remove
+         * non-allowed attribs
+         */
+        // IE does not support .children on document fragments, only .childNodes
+        const dfChildren = getElementChildren(documentFragment);
+        /* eslint-disable-next-line */
+        for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
+            sanitizeElement(dfChildren[childIndex], domStringAllowedAttributes);
+        }
+        // Append document fragment to div
+        const fragmentDiv = document.createElement('div');
+        fragmentDiv.appendChild(documentFragment);
+        // First child is always the div we did our work in
+        const getInnerDiv = fragmentDiv.querySelector('div');
+        return getInnerDiv !== null ? getInnerDiv.innerHTML : fragmentDiv.innerHTML;
+    }
+    catch (err) {
+        printIonError('sanitizeDOMString', err);
+        return '';
+    }
+};
+/**
+ * Sanitize an entire trusted DOM tree in place.
+ *
+ * Removes blocked tags (`script`, `iframe`, etc.) from the subtree and
+ * then sanitizes attributes on every remaining element using the wider
+ * `richContentAllowedAttributes` allowlist (refer `sanitizeElement`).
+ * Component presentational attributes (`size`, `color`, `shape`, inline
+ * SVG, `aria-*`, `data-*`) are preserved; `style`, event handlers (`on*`),
+ * form/navigation-hijack attributes, script-scheme URLs, and non-image
+ * `data:` URLs are stripped.
+ *
+ * Use this when you have a DOM tree the developer controls (e.g.
+ * cloned slot content from a component) and you need to render it
+ * elsewhere safely.
+ *
+ * @param root - The root element whose subtree will be sanitized in
+ * place. No-op when the sanitizer is disabled via `Ionic.config`.
+ */
+const sanitizeDOMTree = (root) => {
+    if (!isSanitizerEnabled()) {
+        return;
+    }
+    blockedTags.forEach((tag) => {
+        const matches = root.querySelectorAll(tag);
+        for (let i = matches.length - 1; i >= 0; i--) {
+            matches[i].remove();
+        }
+    });
+    sanitizeElement(root, richContentAllowedAttributes, richContentAllowedAttributePrefixes);
+};
+/**
+ * Clean up current element based on allowed attributes
+ * and then recursively dig down into any child elements to
+ * clean those up as well
+ */
+// TODO(FW-2832): type (using Element triggers other type errors as well)
+const sanitizeElement = (element, allowedAttributes, allowedAttributePrefixes = []) => {
+    // IE uses childNodes, so ignore nodes that are not elements
+    if (element.nodeType && element.nodeType !== 1) {
+        return;
+    }
+    /**
+     * If attributes is not a NamedNodeMap
+     * then we should remove the element entirely.
+     * This helps avoid DOM Clobbering attacks where
+     * attributes is overridden.
+     */
+    if (typeof NamedNodeMap !== 'undefined' && !(element.attributes instanceof NamedNodeMap)) {
+        element.remove();
+        return;
+    }
+    /**
+     * Always strip `style` (CSS injection, `background:url()` beaconing, UI
+     * spoofing). It is never on the allowlist, but it is removed explicitly
+     * here because some engines (e.g. jsdom) don't enumerate the CSSOM-backed
+     * `style` attribute in `element.attributes`, which would let the loop
+     * below skip over it.
+     */
+    element.removeAttribute('style');
+    for (let i = element.attributes.length - 1; i >= 0; i--) {
+        const attribute = element.attributes.item(i);
+        const attributeName = attribute.name;
+        const lowerName = attributeName.toLowerCase();
+        /**
+         * Remove any attribute that is not on the allowlist. This drops event
+         * handlers (`on*`), `style`, the form/navigation-hijack attributes
+         * (`formaction`, `action`, `target`), namespaced attributes like
+         * `xlink:href`, and anything else not explicitly known to be safe.
+         */
+        if (!isAttributeAllowed(lowerName, allowedAttributes, allowedAttributePrefixes)) {
+            element.removeAttribute(attributeName);
+            continue;
+        }
+        // clean up any allowed attribs
+        // that attempt to do any JS funny-business
+        const attributeValue = attribute.value;
+        if (attributeValue == null) {
+            continue;
+        }
+        /**
+         * Scrub dangerous schemes from the value. The value is normalized first
+         * (whitespace and ASCII control characters removed) so entity-obfuscated
+         * payloads such as `java&#9;script:`, which the parser decodes to
+         * `java\tscript:`, are still caught. Normalizing the value also covers
+         * namespaced attributes, where the previous `element[attributeName]`
+         * property reflection returned `undefined` and let them slip through.
+         */
+        const normalizedValue = attributeValue.replace(controlCharactersAndWhitespace, '').toLowerCase();
+        // Script schemes are never allowed, on any attribute.
+        if (normalizedValue.includes('javascript:') || normalizedValue.includes('vbscript:')) {
+            element.removeAttribute(attributeName);
+            continue;
+        }
+        /**
+         * For URL-bearing attributes, allow `data:` URIs only for raster
+         * images. Document-bearing types (`text/html`, `image/svg+xml`,
+         * `application/*`, etc.) can carry markup or script when navigated to
+         * or rendered, so they are stripped, while safe image types are kept so
+         * inline images keep working.
+         */
+        if (urlAttributes.includes(lowerName) &&
+            normalizedValue.startsWith('data:') &&
+            !safeDataImageUri.test(normalizedValue)) {
+            element.removeAttribute(attributeName);
+        }
+    }
+    /**
+     * Sanitize any nested children
+     */
+    const childElements = getElementChildren(element);
+    /* eslint-disable-next-line */
+    for (let i = 0; i < childElements.length; i++) {
+        sanitizeElement(childElements[i], allowedAttributes, allowedAttributePrefixes);
+    }
+};
+/**
+ * IE doesn't always support .children
+ * so we revert to .childNodes instead
+ */
+// TODO(FW-2832): type
+const getElementChildren = (el) => {
+    return el.children != null ? el.children : el.childNodes;
+};
+const isSanitizerEnabled = () => {
+    var _a;
+    const win = window;
+    const config = (_a = win === null || win === void 0 ? void 0 : win.Ionic) === null || _a === void 0 ? void 0 : _a.config;
+    if (config) {
+        if (config.get) {
+            return config.get('sanitizerEnabled', true);
+        }
+        else {
+            return config.sanitizerEnabled === true || config.sanitizerEnabled === undefined;
+        }
+    }
+    return true;
+};
+/**
+ * Mirror known custom-element DOM properties onto attributes so they
+ * survive `cloneNode`. Call this on a DOM subtree before cloning it for
+ * rendering elsewhere (e.g. cloning slotted option content into an
+ * overlay).
+ *
+ * Only sets the attribute when the property holds a non-empty string
+ * and the attribute isn't already present, so existing attributes
+ * take precedence.
+ *
+ * @param root - The root element whose subtree (and itself) will be
+ * inspected.
+ */
+const reflectPropertiesToAttributes = (root) => {
+    const candidates = [];
+    if (root.tagName in elementPropsToReflect) {
+        candidates.push(root);
+    }
+    for (const tagName of Object.keys(elementPropsToReflect)) {
+        candidates.push(...Array.from(root.querySelectorAll(tagName.toLowerCase())));
+    }
+    for (const el of candidates) {
+        if (!(el.tagName in elementPropsToReflect)) {
+            continue;
+        }
+        const props = elementPropsToReflect[el.tagName];
+        for (const prop of props) {
+            const value = el[prop];
+            if (typeof value === 'string' && value.length > 0 && !el.hasAttribute(prop)) {
+                el.setAttribute(prop, value);
+            }
+        }
+    }
+};
+/**
+ * Attribute allowlist for `sanitizeDOMString`. Intentionally narrow: this
+ * path sanitizes developer HTML strings rendered via `innerHTML` by
+ * `ion-toast`, `ion-loading`, the `ion-alert` message,
+ * `ion-refresher-content`, and `ion-infinite-scroll-content`, so the list
+ * is kept to the minimum those have always needed. Broadening it here would
+ * change sanitization output for all of those consumers, so the wider
+ * rich-content allowlist below is deliberately scoped to `sanitizeDOMTree`
+ * instead.
+ */
+const domStringAllowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
+/**
+ * Attribute allowlist for `sanitizeDOMTree` (the select rich-content path).
+ * Covers global HTML attributes, the Ionic component presentational props
+ * that cloned rich content (e.g. `ion-select-option` markup) relies on, and
+ * the inert SVG presentation attributes used by inline icons.
+ *
+ * `aria-*` and `data-*` are allowed separately by prefix (refer
+ * `richContentAllowedAttributePrefixes`) since they are inert and not worth
+ * enumerating. URL-bearing names (`href`, `src`) are allowed here, but
+ * their values are still scrubbed for script schemes in `sanitizeElement`.
+ *
+ * Notably absent: `style`, event handlers (`on*`), and the
+ * form/navigation-hijack attributes (`formaction`, `action`, `target`),
+ * which are therefore stripped.
+ */
+const richContentAllowedAttributes = [
+    // Global / structural
+    'class',
+    'id',
+    'slot',
+    'name',
+    'title',
+    'alt',
+    'lang',
+    'dir',
+    'role',
+    'type',
+    'value',
+    'disabled',
+    'width',
+    'height',
+    'href',
+    'src',
+    // Ionic component presentational props
+    'color',
+    'size',
+    'shape',
+    'fill',
+    'expand',
+    'mode',
+    'theme',
+    'icon',
+    'label',
+    'label-placement',
+    'justify',
+    'inset',
+    'lines',
+    'ios',
+    'md',
+    // SVG presentation attributes (compared lowercased, e.g. `viewBox`)
+    'xmlns',
+    'viewbox',
+    'preserveaspectratio',
+    'stroke',
+    'stroke-width',
+    'stroke-linecap',
+    'stroke-linejoin',
+    'stroke-opacity',
+    'stroke-dasharray',
+    'fill-rule',
+    'fill-opacity',
+    'clip-rule',
+    'd',
+    'points',
+    'cx',
+    'cy',
+    'r',
+    'rx',
+    'ry',
+    'x',
+    'y',
+    'x1',
+    'y1',
+    'x2',
+    'y2',
+    'transform',
+    'opacity',
+];
+/**
+ * Attribute-name prefixes that are always safe to keep in the rich-content
+ * path. `aria-*` and `data-*` attributes cannot execute script or load
+ * resources, so they are allowed wholesale rather than enumerated by name.
+ */
+const richContentAllowedAttributePrefixes = ['aria-', 'data-'];
+/**
+ * Whether an attribute name (already lowercased) is safe to keep, by exact
+ * match or by an allowed prefix.
+ */
+const isAttributeAllowed = (lowerName, allowedAttributes, allowedAttributePrefixes) => {
+    if (allowedAttributes.includes(lowerName)) {
+        return true;
+    }
+    return allowedAttributePrefixes.some((prefix) => lowerName.startsWith(prefix));
+};
+/**
+ * Matches ASCII control characters and whitespace (including the
+ * non-breaking space). Used to normalize attribute values before matching
+ * a URL scheme so entity-obfuscated payloads such as `java&#9;script:`
+ * (decoded by the parser to `java\tscript:`) can't smuggle a scheme past
+ * the check.
+ */
+// eslint-disable-next-line no-control-regex -- matching control characters is the point
+const controlCharactersAndWhitespace = /[\u0000-\u0020\u007f-\u00a0]/g;
+/**
+ * Attributes whose values are URLs. Their values are scheme-checked in
+ * `sanitizeElement` (e.g. `data:` filtering) beyond the script-scheme scrub
+ * applied to every attribute.
+ */
+const urlAttributes = ['href', 'src'];
+/**
+ * Matches a `data:` URI for a raster image type that cannot carry script.
+ * `image/svg+xml` is deliberately excluded (SVG can execute script), as are
+ * document types like `text/html` and `application/*`. The value is already
+ * lowercased and whitespace-stripped before this is tested.
+ */
+const safeDataImageUri = /^data:image\/(?:png|jpe?g|gif|webp|bmp|avif|x-icon|vnd\.microsoft\.icon)[;,]/;
+/**
+ * Tags removed entirely (with their subtree) before attribute sanitization.
+ * Exported so tests can assert the set without hardcoding it.
+ */
+const blockedTags = ['script', 'style', 'iframe', 'meta', 'link', 'object', 'embed', 'base'];
+/**
+ * Properties on custom elements that frameworks (Vue, Angular) often
+ * set as DOM properties rather than attributes. `cloneNode` only copies
+ * attributes, so these values are lost when slotted content is cloned
+ * into an overlay. For each known custom element, we mirror the listed
+ * properties onto attributes so the cloned copy still has the data it
+ * needs to render.
+ *
+ * Keyed by uppercased tagName so the lookup matches `Element.tagName`.
+ */
+const elementPropsToReflect = {
+    'ION-ICON': ['icon', 'name', 'src', 'ios', 'md'],
+};
+class IonicSafeString {
+    constructor(value) {
+        this.value = value;
+    }
+}
+
+export { IonicSafeString as I, sanitizeDOMTree as a, reflectPropertiesToAttributes as r, sanitizeDOMString as s };

package/dist/esm/index.js

@@ -10,10 +10,11 @@ export { createGesture } from './index-CfgBF1SE.js';
 export { g as getPlatforms, i as initialize, a as isPlatform } from './ionic-global-Cp_eT4sZ.js';
 export { c as componentOnReady } from './helpers-HEqiOzXb.js';
 export { L as LogLevel } from './index-tcQvqkiX.js';
-export { I as IonicSafeString, g as getMode, s as setupConfig } from './config-DQCONYYp.js';
+export { I as IonicSafeString } from './index-DQSkZyOJ.js';
+export { g as getMode, s as setupConfig } from './config-BwKpO3Is.js';
 export { o as openURL } from './theme-DiVJyqlX.js';
 export { m as menuController } from './index-Q6UPU0Ay.js';
-export { b as actionSheetController, a as alertController, l as loadingController, m as modalController, p as pickerController, c as popoverController, t as toastController } from './overlays-Bmfhux69.js';
+export { b as actionSheetController, a as alertController, l as loadingController, m as modalController, p as popoverController, t as toastController } from './overlays-DLNOHWNc.js';
 import './index-ZjP4CjeZ.js';
 import './gesture-controller-BTEOs1at.js';
 import './hardware-back-button-B93Gru0Y.js';

package/dist/esm/ion-accordion_2.entry.js

@@ -3,7 +3,7 @@
  */
 import { r as registerInstance, e as config, h, d as Host, g as getElement, c as createEvent, f as printIonWarning } from './index-tcQvqkiX.js';
 import { g as getElementRoot, r as raf, f as addEventListener, m as removeEventListener, t as transitionEndAsync } from './helpers-HEqiOzXb.js';
-import { l as chevronDown } from './index-DV3sJJW8.js';
+import { b as chevronDown } from './index-AlrZKoWR.js';
 import { b as getIonMode } from './ionic-global-Cp_eT4sZ.js';
 
 const accordionIosCss = () => `:host{display:block;position:relative;width:100%;background-color:var(--ion-background-color, #ffffff);overflow:hidden;z-index:0}:host(.accordion-expanding) ::slotted(ion-item[slot=header]),:host(.accordion-expanded) ::slotted(ion-item[slot=header]){--border-width:0px}:host(.accordion-animated){-webkit-transition:all 300ms cubic-bezier(0.25, 0.8, 0.5, 1);transition:all 300ms cubic-bezier(0.25, 0.8, 0.5, 1)}:host(.accordion-animated) #content{-webkit-transition:max-height 300ms cubic-bezier(0.25, 0.8, 0.5, 1);transition:max-height 300ms cubic-bezier(0.25, 0.8, 0.5, 1)}#content{overflow:hidden;will-change:max-height}:host(.accordion-collapsing) #content{max-height:0 !important}:host(.accordion-collapsed) #content{display:none}:host(.accordion-expanding) #content{max-height:0}:host(.accordion-expanding) #content-wrapper{overflow:auto}:host(.accordion-disabled) #header,:host(.accordion-readonly) #header,:host(.accordion-disabled) #content,:host(.accordion-readonly) #content{pointer-events:none}:host(.accordion-disabled) #header,:host(.accordion-disabled) #content{opacity:0.4}@media (prefers-reduced-motion: reduce){:host,#content{-webkit-transition:none !important;transition:none !important}}:host(.accordion-next) ::slotted(ion-item[slot=header]){--border-width:0.55px 0px 0.55px 0px}`;