@lwrjs/client-modules 0.15.2 → 0.15.4-alpha.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -230,6 +230,7 @@ const LOCKER_NEAR_MEMBRANE_IS_MASKED_SYMBOL$LWS = SymbolFor$LWS$1('@@lockerNearM
|
|
|
230
230
|
const LOCKER_NEAR_MEMBRANE_SERIALIZED_VALUE_SYMBOL$LWS$1 = SymbolFor$LWS$1('@@lockerNearMembraneSerializedValue');
|
|
231
231
|
const LOCKER_NEAR_MEMBRANE_SYMBOL$LWS$1 = SymbolFor$LWS$1('@@lockerNearMembrane');
|
|
232
232
|
const LOCKER_NEAR_MEMBRANE_UNMASKED_VALUE_SYMBOL$LWS = SymbolFor$LWS$1('@@lockerNearMembraneUnmaskedValue');
|
|
233
|
+
// Legacy symbol used by packages/locker-core-engine/src/LockerFilter.js.
|
|
233
234
|
const SYMBOL_LIVE_OBJECT$LWS = SymbolFor$LWS$1('@@lockerLiveValue');
|
|
234
235
|
// Object brand constants.
|
|
235
236
|
const TO_STRING_BRAND_ARRAY$LWS = '[object Array]';
|
|
@@ -444,7 +445,6 @@ function maskFunction$LWS(func$LWS, maskFunc$LWS, trapInvokers$LWS) {
|
|
|
444
445
|
// `LOCKER_NEAR_MEMBRANE_IS_MASKED_SYMBOL` properties
|
|
445
446
|
// because we know that when the `handshakeProxyMaskedFlag`
|
|
446
447
|
// is ON that there are NO shadowed values.
|
|
447
|
-
// istanbul ignore else: returns immediately
|
|
448
448
|
if (isProxyMaskedSymbol$LWS) {
|
|
449
449
|
return true;
|
|
450
450
|
}
|
|
@@ -605,9 +605,9 @@ const TrustedHTMLProtoToString$LWS = TrustedHTMLCtor$LWS == null || (_TrustedHTM
|
|
|
605
605
|
const TrustedScriptCtor$LWS = typeof TrustedScript === 'function' ? TrustedScript : /* istanbul ignore next: unreachable in test env */undefined;
|
|
606
606
|
// istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
|
|
607
607
|
const TrustedScriptProtoToString$LWS = TrustedScriptCtor$LWS == null || (_TrustedScriptCtor$pr$LWS = TrustedScriptCtor$LWS.prototype) == null ? void 0 : _TrustedScriptCtor$pr$LWS.toString;
|
|
608
|
-
const URLCtor$LWS
|
|
608
|
+
const URLCtor$LWS = typeof URL === 'function' ? URL : /* istanbul ignore next: unreachable in test env */undefined;
|
|
609
609
|
// istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
|
|
610
|
-
const URLProtoToString$LWS = URLCtor$LWS
|
|
610
|
+
const URLProtoToString$LWS = URLCtor$LWS == null || (_URLCtor$prototype$LWS = URLCtor$LWS.prototype) == null ? void 0 : _URLCtor$prototype$LWS.toString;
|
|
611
611
|
// To extract the function body start the match from the beginning of the
|
|
612
612
|
// source code with the character class `[\s\S]` instead of `.` because `[\s\S]`
|
|
613
613
|
// matches everything including newlines where as `.` matches everything except
|
|
@@ -637,11 +637,21 @@ function extractFunctionBodySource$LWS(func$LWS) {
|
|
|
637
637
|
// istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
|
|
638
638
|
return (_ref$LWS = (_match$$LWS = match$LWS == null ? void 0 : match$LWS[1]) != null ? _match$$LWS : match$LWS == null ? void 0 : match$LWS[2]) != null ? _ref$LWS : '';
|
|
639
639
|
}
|
|
640
|
-
|
|
641
|
-
|
|
642
|
-
|
|
643
|
-
//
|
|
644
|
-
|
|
640
|
+
function isConvertibleToString$LWS(value$LWS) {
|
|
641
|
+
if (typeof value$LWS !== 'symbol') {
|
|
642
|
+
try {
|
|
643
|
+
// Attempt to coerce `value` to a string with the ToString operation.
|
|
644
|
+
// Section 7.1.17 ToString ( argument )
|
|
645
|
+
// https://tc39.es/ecma262/#sec-tostring
|
|
646
|
+
return `${value$LWS}` !== undefined;
|
|
647
|
+
// eslint-disable-next-line no-empty
|
|
648
|
+
} catch (_unused2$LWS) {}
|
|
649
|
+
}
|
|
650
|
+
return false;
|
|
651
|
+
}
|
|
652
|
+
// Use `toString()` to coerce values using the default string concatenation
|
|
653
|
+
// operation.
|
|
654
|
+
function toString$LWS(value$LWS) {
|
|
645
655
|
return typeof value$LWS === 'string' ? value$LWS :
|
|
646
656
|
// Attempt to coerce `value` to a string with the ToString operation.
|
|
647
657
|
// Section 7.1.17 ToString ( argument )
|
|
@@ -660,7 +670,6 @@ function toSafeTemplateStringValue$LWS(value$LWS) {
|
|
|
660
670
|
return ReflectApply$LWS$1(FunctionProtoToString$LWS, value$LWS, []);
|
|
661
671
|
}
|
|
662
672
|
if (typeof value$LWS === 'object' && value$LWS !== null) {
|
|
663
|
-
/* istanbul ignore next: unreachable in test env */
|
|
664
673
|
if (TrustedHTMLCtor$LWS && value$LWS instanceof TrustedHTMLCtor$LWS) {
|
|
665
674
|
return ReflectApply$LWS$1(TrustedHTMLProtoToString$LWS, value$LWS, []);
|
|
666
675
|
}
|
|
@@ -668,7 +677,7 @@ function toSafeTemplateStringValue$LWS(value$LWS) {
|
|
|
668
677
|
if (TrustedScriptCtor$LWS && value$LWS instanceof TrustedScriptCtor$LWS) {
|
|
669
678
|
return ReflectApply$LWS$1(TrustedScriptProtoToString$LWS, value$LWS, []);
|
|
670
679
|
}
|
|
671
|
-
if (URLCtor$LWS
|
|
680
|
+
if (URLCtor$LWS && value$LWS instanceof URLCtor$LWS) {
|
|
672
681
|
return ReflectApply$LWS$1(URLProtoToString$LWS, value$LWS, []);
|
|
673
682
|
}
|
|
674
683
|
const result$LWS = ReflectApply$LWS$1(ObjectProtoToString$LWS$1, value$LWS, []);
|
|
@@ -682,7 +691,7 @@ function toSafeTemplateStringValue$LWS(value$LWS) {
|
|
|
682
691
|
// https://tc39.es/ecma262/#sec-string-constructor-string-value
|
|
683
692
|
return StringCtor$LWS$1(value$LWS);
|
|
684
693
|
// eslint-disable-next-line no-empty
|
|
685
|
-
} catch (
|
|
694
|
+
} catch (_unused3$LWS) {}
|
|
686
695
|
return '[object Unknown]';
|
|
687
696
|
}
|
|
688
697
|
const RegExpCtor$LWS$1 = RegExp;
|
|
@@ -815,7 +824,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
815
824
|
return TO_STRING_BRAND_ARRAY_BUFFER$LWS;
|
|
816
825
|
}
|
|
817
826
|
// eslint-disable-next-line no-empty
|
|
818
|
-
} catch (
|
|
827
|
+
} catch (_unused4$LWS) {}
|
|
819
828
|
// Section 21.4.4 Properties of the Date Prototype Object
|
|
820
829
|
// https://tc39.es/ecma262/#thistimevalue
|
|
821
830
|
// Step 1: If Type(value) is Object and value has a [[DateValue]] internal slot, then
|
|
@@ -827,7 +836,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
827
836
|
return TO_STRING_BRAND_DATE$LWS;
|
|
828
837
|
}
|
|
829
838
|
// eslint-disable-next-line no-empty
|
|
830
|
-
} catch (
|
|
839
|
+
} catch (_unused5$LWS) {}
|
|
831
840
|
// Section 24.1.3.10 get Map.prototype.size
|
|
832
841
|
// https://tc39.es/ecma262/#sec-get-map.prototype.size
|
|
833
842
|
// Step 2: Perform ? RequireInternalSlot(M, [[MapData]]).
|
|
@@ -837,7 +846,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
837
846
|
return TO_STRING_BRAND_MAP$LWS;
|
|
838
847
|
}
|
|
839
848
|
// eslint-disable-next-line no-empty
|
|
840
|
-
} catch (
|
|
849
|
+
} catch (_unused6$LWS) {}
|
|
841
850
|
// Section 24.2.3.9 get Set.prototype.size
|
|
842
851
|
// https://tc39.es/ecma262/#sec-get-set.prototype.size
|
|
843
852
|
// Step 2: Perform ? RequireInternalSlot(S, [[SetData]]).
|
|
@@ -847,7 +856,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
847
856
|
return TO_STRING_BRAND_SET$LWS;
|
|
848
857
|
}
|
|
849
858
|
// eslint-disable-next-line no-empty
|
|
850
|
-
} catch (
|
|
859
|
+
} catch (_unused7$LWS) {}
|
|
851
860
|
// Section 24.3.3.4 WeakMap.prototype.has ( key )
|
|
852
861
|
// https://tc39.es/ecma262/#sec-weakmap.prototype.has
|
|
853
862
|
// Step 2: Perform RequireInternalSlot(M, [[WeakMapData]]).
|
|
@@ -857,7 +866,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
857
866
|
return TO_STRING_BRAND_WEAK_MAP$LWS;
|
|
858
867
|
}
|
|
859
868
|
// eslint-disable-next-line no-empty
|
|
860
|
-
} catch (
|
|
869
|
+
} catch (_unused8$LWS) {}
|
|
861
870
|
// Section 24.4.3.4 WeakSet.prototype.has ( value )
|
|
862
871
|
// https://tc39.es/ecma262/#sec-weakset.prototype.has
|
|
863
872
|
// Step 2: 2. Perform RequireInternalSlot(S, [[WeakSetData]]).
|
|
@@ -867,7 +876,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
867
876
|
return TO_STRING_BRAND_WEAK_SET$LWS;
|
|
868
877
|
}
|
|
869
878
|
// eslint-disable-next-line no-empty
|
|
870
|
-
} catch (
|
|
879
|
+
} catch (_unused9$LWS) {}
|
|
871
880
|
// The following checks are for the rare occurrence of object, i.e. boxed,
|
|
872
881
|
// primitive values or those objects without a default @@toStringTag.
|
|
873
882
|
// Section 21.1.3 Properties of the Number Prototype Object
|
|
@@ -881,7 +890,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
881
890
|
return TO_STRING_BRAND_NUMBER$LWS$1;
|
|
882
891
|
}
|
|
883
892
|
// eslint-disable-next-line no-empty
|
|
884
|
-
} catch (
|
|
893
|
+
} catch (_unused10$LWS) {}
|
|
885
894
|
// Section 20.4.3 Properties of the Symbol Prototype Object
|
|
886
895
|
// https://tc39.es/ecma262/#thissymbolvalue
|
|
887
896
|
// Step 2: If Type(value) is Object and value has a [[SymbolData]] internal slot, then
|
|
@@ -893,7 +902,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
893
902
|
return TO_STRING_BRAND_SYMBOL$LWS$1;
|
|
894
903
|
}
|
|
895
904
|
// eslint-disable-next-line no-empty
|
|
896
|
-
} catch (
|
|
905
|
+
} catch (_unused11$LWS) {}
|
|
897
906
|
// Perform heavier checks last.
|
|
898
907
|
// Section 22.2.6.13 get RegExp.prototype.source
|
|
899
908
|
// https://tc39.es/ecma262/#sec-get-regexp.prototype.source
|
|
@@ -906,7 +915,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
906
915
|
return TO_STRING_BRAND_REG_EXP$LWS;
|
|
907
916
|
}
|
|
908
917
|
// eslint-disable-next-line no-empty
|
|
909
|
-
} catch (
|
|
918
|
+
} catch (_unused12$LWS) {}
|
|
910
919
|
// Section 22.1.3 Properties of the String Prototype Object
|
|
911
920
|
// https://tc39.es/ecma262/#thisstringvalue
|
|
912
921
|
// Step 2: If Type(value) is Object and value has a [[StringData]] internal slot, then
|
|
@@ -918,7 +927,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
918
927
|
return TO_STRING_BRAND_STRING$LWS$1;
|
|
919
928
|
}
|
|
920
929
|
// eslint-disable-next-line no-empty
|
|
921
|
-
} catch (
|
|
930
|
+
} catch (_unused13$LWS) {}
|
|
922
931
|
// Section 20.3.3 Properties of the Boolean Prototype Object
|
|
923
932
|
// https://tc39.es/ecma262/#thisbooleanvalue
|
|
924
933
|
// Step 2: If Type(value) is Object and value has a [[BooleanData]] internal slot, then
|
|
@@ -928,7 +937,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
928
937
|
ReflectApply$LWS$1(BooleanProtoValueOf$LWS, value$LWS, []);
|
|
929
938
|
return TO_STRING_BRAND_BOOLEAN$LWS$1;
|
|
930
939
|
// eslint-disable-next-line no-empty
|
|
931
|
-
} catch (
|
|
940
|
+
} catch (_unused14$LWS) {}
|
|
932
941
|
// istanbul ignore else: All platforms that LWS runs tests in support BigInt
|
|
933
942
|
if (SUPPORTS_BIG_INT$LWS) {
|
|
934
943
|
try {
|
|
@@ -939,7 +948,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
|
|
|
939
948
|
ReflectApply$LWS$1(BigIntProtoValueOf$LWS, value$LWS, []);
|
|
940
949
|
return TO_STRING_BRAND_BIG_INT$LWS$1;
|
|
941
950
|
// eslint-disable-next-line no-empty
|
|
942
|
-
} catch (
|
|
951
|
+
} catch (_unused15$LWS) {}
|
|
943
952
|
}
|
|
944
953
|
// Cannot detect brands for Arguments and Error objects.
|
|
945
954
|
return TO_STRING_BRAND_OBJECT$LWS;
|
|
@@ -1320,7 +1329,7 @@ function partialStructuredClone$LWS(value$LWS) {
|
|
|
1320
1329
|
try {
|
|
1321
1330
|
result$LWS = partialStructuredCloneInternal$LWS(value$LWS);
|
|
1322
1331
|
// eslint-disable-next-line no-empty
|
|
1323
|
-
} catch (
|
|
1332
|
+
} catch (_unused16$LWS) {}
|
|
1324
1333
|
SEEN_OBJECTS$LWS.clear();
|
|
1325
1334
|
}
|
|
1326
1335
|
return result$LWS;
|
|
@@ -1348,33 +1357,9 @@ const {
|
|
|
1348
1357
|
function consoleWarn$LWS(...args$LWS) {
|
|
1349
1358
|
ReflectApply$LWS$1(consoleWarnRef$LWS, consoleRef$LWS, args$LWS);
|
|
1350
1359
|
}
|
|
1351
|
-
|
|
1352
|
-
const FEATURE_NAME_PREFIX$LWS = 'com.salesforce.locker.';
|
|
1353
|
-
const fullName$LWS = featureName$LWS => featureName$LWS.startsWith(FEATURE_NAME_PREFIX$LWS) ? featureName$LWS : `${FEATURE_NAME_PREFIX$LWS}${featureName$LWS}`;
|
|
1360
|
+
let gaterEnabledFeatures$LWS = [];
|
|
1354
1361
|
function isGaterEnabledFeature$LWS(featureName$LWS) {
|
|
1355
|
-
return
|
|
1356
|
-
}
|
|
1357
|
-
const ENABLE_MAX_PERF_MODE_GATE$LWS = 'enableMaxPerfMode';
|
|
1358
|
-
const ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS = 'enableSandboxedSameOriginIframe';
|
|
1359
|
-
const omniStudioPredicates$LWS = [key$LWS => key$LWS === 'omnistudio', key$LWS => ReflectApply$LWS$1(StringProtoStartsWith$LWS, key$LWS, ['devopsimpkg'])];
|
|
1360
|
-
const gaterEnabledOverrideRegistry$LWS = {
|
|
1361
|
-
__proto__: null,
|
|
1362
|
-
$lwsBogusFeatureDisabledTrue: [() => true],
|
|
1363
|
-
$lwsBogusFeatureDisabledFalse: [() => false],
|
|
1364
|
-
[ENABLE_MAX_PERF_MODE_GATE$LWS]: omniStudioPredicates$LWS,
|
|
1365
|
-
// Temporarily disable this feature gate
|
|
1366
|
-
// Ref:
|
|
1367
|
-
// "W-17049687: [LWS] Temporarily disable same origin iframe sandbox security fix for OS and devopsimpkg"
|
|
1368
|
-
// https://gus.lightning.force.com/lightning/r/ADM_Work__c/a07EE000023unysYAA/view
|
|
1369
|
-
[ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS]: omniStudioPredicates$LWS
|
|
1370
|
-
};
|
|
1371
|
-
function isAllowedToOverrideGaterEnabledFeature$LWS(sandboxKey$LWS, featureName$LWS) {
|
|
1372
|
-
var _gaterEnabledOverride$LWS;
|
|
1373
|
-
const gaterEnabledOverridePredicates$LWS = toSafeArray$LWS$1((_gaterEnabledOverride$LWS = gaterEnabledOverrideRegistry$LWS[featureName$LWS]) != null ? _gaterEnabledOverride$LWS : []);
|
|
1374
|
-
return gaterEnabledOverridePredicates$LWS.some(predicate$LWS => predicate$LWS(sandboxKey$LWS));
|
|
1375
|
-
}
|
|
1376
|
-
function isNotAllowedToOverrideGaterEnabledFeature$LWS(...args$LWS) {
|
|
1377
|
-
return !isAllowedToOverrideGaterEnabledFeature$LWS(...args$LWS);
|
|
1362
|
+
return ReflectApply$LWS$1(ArrayProtoIncludes$LWS$1, gaterEnabledFeatures$LWS, [`com.salesforce.locker.${featureName$LWS}`]);
|
|
1378
1363
|
}
|
|
1379
1364
|
const trackedLiveTargets$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
|
|
1380
1365
|
function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None */) {
|
|
@@ -1385,7 +1370,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
|
|
|
1385
1370
|
try {
|
|
1386
1371
|
return trackedLiveTargets$LWS.has(target$LWS) || ObjectHasOwn$LWS$1(target$LWS, SYMBOL_LIVE_OBJECT$LWS);
|
|
1387
1372
|
// eslint-disable-next-line no-empty
|
|
1388
|
-
} catch (
|
|
1373
|
+
} catch (_unused17$LWS) {}
|
|
1389
1374
|
return false;
|
|
1390
1375
|
}
|
|
1391
1376
|
if (typeof target$LWS === 'object') {
|
|
@@ -1394,7 +1379,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
|
|
|
1394
1379
|
return true;
|
|
1395
1380
|
}
|
|
1396
1381
|
// eslint-disable-next-line no-empty
|
|
1397
|
-
} catch (
|
|
1382
|
+
} catch (_unused18$LWS) {}
|
|
1398
1383
|
let constructor$LWS;
|
|
1399
1384
|
try {
|
|
1400
1385
|
({
|
|
@@ -1406,7 +1391,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
|
|
|
1406
1391
|
return true;
|
|
1407
1392
|
}
|
|
1408
1393
|
// eslint-disable-next-line no-empty
|
|
1409
|
-
} catch (
|
|
1394
|
+
} catch (_unused19$LWS) {}
|
|
1410
1395
|
try {
|
|
1411
1396
|
if (ReflectGetPrototypeOf$LWS$1(target$LWS) === null && (
|
|
1412
1397
|
// Ensure `target` is not an `Object.prototype` from an iframe.
|
|
@@ -1414,13 +1399,13 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
|
|
|
1414
1399
|
return true;
|
|
1415
1400
|
}
|
|
1416
1401
|
// eslint-disable-next-line no-empty
|
|
1417
|
-
} catch (
|
|
1402
|
+
} catch (_unused20$LWS) {}
|
|
1418
1403
|
if (targetTraits$LWS === 0 /* TargetTraits.None */) {
|
|
1419
1404
|
try {
|
|
1420
1405
|
if (ArrayIsArray$LWS$1(target$LWS)) {
|
|
1421
1406
|
return true;
|
|
1422
1407
|
}
|
|
1423
|
-
} catch (
|
|
1408
|
+
} catch (_unused21$LWS) {
|
|
1424
1409
|
// The target is a revoked proxy.
|
|
1425
1410
|
return false;
|
|
1426
1411
|
}
|
|
@@ -1439,7 +1424,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
|
|
|
1439
1424
|
return true;
|
|
1440
1425
|
}
|
|
1441
1426
|
// eslint-disable-next-line no-empty
|
|
1442
|
-
} catch (
|
|
1427
|
+
} catch (_unused22$LWS) {}
|
|
1443
1428
|
// Section 25.1.5.1 get ArrayBuffer.prototype.byteLength
|
|
1444
1429
|
// https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.bytelength
|
|
1445
1430
|
// Step 2: Perform RequireInternalSlot(O, [[ArrayBufferData]]).
|
|
@@ -1449,7 +1434,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
|
|
|
1449
1434
|
return true;
|
|
1450
1435
|
}
|
|
1451
1436
|
// eslint-disable-next-line no-empty
|
|
1452
|
-
} catch (
|
|
1437
|
+
} catch (_unused23$LWS) {}
|
|
1453
1438
|
}
|
|
1454
1439
|
return false;
|
|
1455
1440
|
}
|
|
@@ -1504,7 +1489,7 @@ const {
|
|
|
1504
1489
|
} = PromiseCtor$LWS.prototype;
|
|
1505
1490
|
const PromiseResolve$LWS = PromiseCtor$LWS.resolve.bind(PromiseCtor$LWS);
|
|
1506
1491
|
const PromiseReject$LWS = PromiseCtor$LWS.reject.bind(PromiseCtor$LWS);
|
|
1507
|
-
/*! version: 0.
|
|
1492
|
+
/*! version: 0.22.5 */
|
|
1508
1493
|
|
|
1509
1494
|
/*!
|
|
1510
1495
|
* Copyright (C) 2019 salesforce.com, inc.
|
|
@@ -1548,7 +1533,6 @@ const {
|
|
|
1548
1533
|
} = DocumentProto$LWS$1;
|
|
1549
1534
|
const {
|
|
1550
1535
|
createComment: DocumentProtoCreateComment$LWS,
|
|
1551
|
-
createDocumentFragment: DocumentProtoCreateDocumentFragment$LWS,
|
|
1552
1536
|
createElement: DocumentProtoCreateElement$LWS$1,
|
|
1553
1537
|
createElementNS: DocumentProtoCreateElementNS$LWS,
|
|
1554
1538
|
getElementById: DocumentProtoGetElementById$LWS
|
|
@@ -1562,10 +1546,6 @@ const DocumentProtoDefaultViewGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentP
|
|
|
1562
1546
|
const DocumentProtoDocumentElementGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentProto$LWS$1, 'documentElement');
|
|
1563
1547
|
const DocumentProtoHeadGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentProto$LWS$1, 'head');
|
|
1564
1548
|
const DocumentProtoImplementationGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentProto$LWS$1, 'implementation');
|
|
1565
|
-
const {
|
|
1566
|
-
append: DocumentFragmentProtoAppend$LWS,
|
|
1567
|
-
getElementById: DocumentFragmentProtoGetElementById$LWS
|
|
1568
|
-
} = DocumentFragment.prototype;
|
|
1569
1549
|
const {
|
|
1570
1550
|
prototype: ElementProto$LWS
|
|
1571
1551
|
} = Element;
|
|
@@ -1618,10 +1598,6 @@ const ElementAriaAttributesToPropertyName$LWS = {
|
|
|
1618
1598
|
'aria-valuenow': 'ariaValueNow',
|
|
1619
1599
|
'aria-valuetext': 'ariaValueText'
|
|
1620
1600
|
};
|
|
1621
|
-
// Used by '@locker/near-membrane-dom'.
|
|
1622
|
-
const {
|
|
1623
|
-
remove: ElementProtoRemove$LWS$1
|
|
1624
|
-
} = ElementProto$LWS;
|
|
1625
1601
|
const {
|
|
1626
1602
|
closest: ElementProtoClosest$LWS,
|
|
1627
1603
|
getAttribute: ElementProtoGetAttribute$LWS,
|
|
@@ -1646,6 +1622,23 @@ const {
|
|
|
1646
1622
|
get: ElementProtoOuterHTMLGetter$LWS
|
|
1647
1623
|
} = ReflectGetOwnPropertyDescriptor$LWS(ElementProto$LWS, 'outerHTML');
|
|
1648
1624
|
const ElementProtoTagNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(ElementProto$LWS, 'tagName');
|
|
1625
|
+
const HTMLTemplateElementProtoContentGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLTemplateElement.prototype, 'content');
|
|
1626
|
+
const {
|
|
1627
|
+
prototype: NodeProto$LWS$1
|
|
1628
|
+
} = Node;
|
|
1629
|
+
const {
|
|
1630
|
+
appendChild: NodeProtoAppendChild$LWS$1,
|
|
1631
|
+
cloneNode: NodeProtoCloneNode$LWS,
|
|
1632
|
+
isEqualNode: NodeProtoIsEqualNode$LWS
|
|
1633
|
+
} = NodeProto$LWS$1;
|
|
1634
|
+
const NodeProtoChildNodesGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'childNodes');
|
|
1635
|
+
const NodeProtoFirstChildGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'firstChild');
|
|
1636
|
+
const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'isConnected');
|
|
1637
|
+
// Used by '@locker/near-membrane-dom'.
|
|
1638
|
+
ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'lastChild');
|
|
1639
|
+
const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'nodeName');
|
|
1640
|
+
const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'ownerDocument');
|
|
1641
|
+
ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS$1, 'textContent');
|
|
1649
1642
|
|
|
1650
1643
|
// Check for the noopener feature being enabled:
|
|
1651
1644
|
// - noopener
|
|
@@ -1751,7 +1744,6 @@ function markForUnsafePropertyBlocking$LWS(childWindow$LWS) {
|
|
|
1751
1744
|
return true;
|
|
1752
1745
|
}
|
|
1753
1746
|
});
|
|
1754
|
-
// istanbul ignore else: currently unreachable via tests
|
|
1755
1747
|
if (typeof childWindow$LWS[blocked$LWS] === 'function') {
|
|
1756
1748
|
descriptor$LWS.value = replacement$LWS;
|
|
1757
1749
|
}
|
|
@@ -1841,41 +1833,7 @@ function normalizeWindowOpenArguments$LWS(args$LWS) {
|
|
|
1841
1833
|
}
|
|
1842
1834
|
return normalizedArgs$LWS;
|
|
1843
1835
|
}
|
|
1844
|
-
|
|
1845
|
-
const {
|
|
1846
|
-
prototype: HTMLElementProto$LWS
|
|
1847
|
-
} = HTMLElement$LWS;
|
|
1848
|
-
const HTMLElementProtoInnerTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLElementProto$LWS, 'innerText');
|
|
1849
|
-
// Used by '@locker/near-membrane-dom'.
|
|
1850
|
-
ObjectLookupOwnGetter$LWS$1(HTMLElementProto$LWS, 'style');
|
|
1851
|
-
const HTMLElementGlobalAttributesToPropertyName$LWS = {
|
|
1852
|
-
__proto__: null,
|
|
1853
|
-
accesskey: 'accessKey',
|
|
1854
|
-
contenteditable: 'contentEditable',
|
|
1855
|
-
enterkeyhint: 'enterKeyHint',
|
|
1856
|
-
inputmode: 'inputMode',
|
|
1857
|
-
tabindex: 'tabIndex'
|
|
1858
|
-
};
|
|
1859
|
-
const HTMLTemplateElementProtoContentGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLTemplateElement.prototype, 'content');
|
|
1860
|
-
const {
|
|
1861
|
-
prototype: NodeProto$LWS$1
|
|
1862
|
-
} = Node;
|
|
1863
|
-
const {
|
|
1864
|
-
appendChild: NodeProtoAppendChild$LWS$1,
|
|
1865
|
-
cloneNode: NodeProtoCloneNode$LWS,
|
|
1866
|
-
isEqualNode: NodeProtoIsEqualNode$LWS
|
|
1867
|
-
} = NodeProto$LWS$1;
|
|
1868
|
-
const NodeProtoChildNodesGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'childNodes');
|
|
1869
|
-
const NodeProtoFirstChildGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'firstChild');
|
|
1870
|
-
const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'isConnected');
|
|
1871
|
-
// Used by '@locker/near-membrane-dom'.
|
|
1872
|
-
ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'lastChild');
|
|
1873
|
-
const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'nodeName');
|
|
1874
|
-
const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'ownerDocument');
|
|
1875
|
-
const NodeProtoParentNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'parentNode');
|
|
1876
|
-
ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS$1, 'textContent');
|
|
1877
|
-
const rootDocumentDetachedFragment$LWS = ReflectApply$LWS$1(DocumentProtoCreateDocumentFragment$LWS, rootDocument$LWS, []);
|
|
1878
|
-
const rootDocumentDetachedContainer$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, rootDocument$LWS, ['div']);
|
|
1836
|
+
|
|
1879
1837
|
/* eslint-disable no-underscore-dangle */
|
|
1880
1838
|
class Validator$LWS {
|
|
1881
1839
|
constructor(document$LWS, {
|
|
@@ -1891,36 +1849,7 @@ class Validator$LWS {
|
|
|
1891
1849
|
};
|
|
1892
1850
|
// There is no reason to ever allow any HTML or XML that contains all three of these substrings.
|
|
1893
1851
|
// eslint-disable-next-line class-methods-use-this
|
|
1894
|
-
this.isInherentlyUnsecure = input$LWS =>
|
|
1895
|
-
const hasIframe$LWS = hasTag$LWS(input$LWS, 'iframe') && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
|
|
1896
|
-
const hasScript$LWS = hasTag$LWS(input$LWS, 'script');
|
|
1897
|
-
// If neither an iframe or a script was detected, then this input is safe.
|
|
1898
|
-
// istanbul ignore else: returns immediately
|
|
1899
|
-
if (!hasIframe$LWS && !hasScript$LWS) {
|
|
1900
|
-
return false;
|
|
1901
|
-
}
|
|
1902
|
-
// If the string contains both the words iframe and srcdoc, it is unsafe
|
|
1903
|
-
// istanbul ignore else: returns immediately
|
|
1904
|
-
if (hasIframe$LWS) {
|
|
1905
|
-
return true;
|
|
1906
|
-
}
|
|
1907
|
-
// If the input contained the word "script", then we need to confirm that the string
|
|
1908
|
-
// that was seen is actually markup.
|
|
1909
|
-
//
|
|
1910
|
-
// IMPORTANT: We CANNOT reuse this.template.left/right for this check. Template elements
|
|
1911
|
-
// do not return innerText or textContent, which makes the following innerHTML/innerText
|
|
1912
|
-
// check useless.
|
|
1913
|
-
ReflectApply$LWS$1(DocumentFragmentProtoAppend$LWS, rootDocumentDetachedFragment$LWS, [rootDocumentDetachedContainer$LWS]);
|
|
1914
|
-
ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, rootDocumentDetachedContainer$LWS, [input$LWS]);
|
|
1915
|
-
// This MUST BE CHECKED AFTER IT IS RENDERED. The nature of these attacks requires
|
|
1916
|
-
// the actual source to be set to the innerHTML to allow the browser to render
|
|
1917
|
-
const innerHTML$LWS = ReflectApply$LWS$1(ElementProtoInnerHTMLGetter$LWS, rootDocumentDetachedContainer$LWS, []);
|
|
1918
|
-
const innerText$LWS = ReflectApply$LWS$1(HTMLElementProtoInnerTextGetter$LWS, rootDocumentDetachedContainer$LWS, []);
|
|
1919
|
-
ReflectApply$LWS$1(ElementProtoRemove$LWS$1, rootDocumentDetachedContainer$LWS, []);
|
|
1920
|
-
// If innerHTML contains "script", but innerText does not, then the string
|
|
1921
|
-
// was hiding a script element through some kind of obfuscation, and is unsecure.
|
|
1922
|
-
return hasTag$LWS(innerHTML$LWS, 'script') && !hasTag$LWS(innerText$LWS, 'script');
|
|
1923
|
-
};
|
|
1852
|
+
this.isInherentlyUnsecure = input$LWS => ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['iframe']) && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['script']) && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
|
|
1924
1853
|
this.isSharedElement = element$LWS => element$LWS === ReflectApply$LWS$1(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS$1(DocumentProtoBodyGetter$LWS$1, this._document, []) || element$LWS === ReflectApply$LWS$1(DocumentProtoDocumentElementGetter$LWS, this._document, []);
|
|
1925
1854
|
this._constructors = {
|
|
1926
1855
|
HTMLLinkElement: HTMLLinkElement$LWS,
|
|
@@ -1953,9 +1882,6 @@ function deepIsEqualNode$LWS(leftRoot$LWS, rightRoot$LWS) {
|
|
|
1953
1882
|
}
|
|
1954
1883
|
return false;
|
|
1955
1884
|
}
|
|
1956
|
-
function hasTag$LWS(input$LWS, tag$LWS) {
|
|
1957
|
-
return ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`<${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`:${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`<${tag$LWS}>`]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`:${tag$LWS}>`]);
|
|
1958
|
-
}
|
|
1959
1885
|
const rootValidator$LWS = new Validator$LWS(rootDocument$LWS, rootWindow$LWS$1);
|
|
1960
1886
|
const documentToValidatorMap$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1([[rootDocument$LWS, rootValidator$LWS]]));
|
|
1961
1887
|
function getValidator$LWS(document$LWS, globalObject$LWS) {
|
|
@@ -2029,6 +1955,9 @@ item$LWS => {
|
|
|
2029
1955
|
const brand$LWS = item$LWS == null ? void 0 : item$LWS.brand;
|
|
2030
1956
|
return typeof brand$LWS === 'string' && ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [brand$LWS]);
|
|
2031
1957
|
}]) !== undefined : ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [getUserAgent$LWS$1()]));
|
|
1958
|
+
const {
|
|
1959
|
+
getElementById: DocumentFragmentProtoGetElementById$LWS
|
|
1960
|
+
} = DocumentFragment.prototype;
|
|
2032
1961
|
|
|
2033
1962
|
// Used by '@locker/near-membrane-shared-dom'.
|
|
2034
1963
|
// The DOMException constructor was exposed in Edge 12 but wasn't invocable
|
|
@@ -2039,17 +1968,7 @@ ObjectLookupOwnGetter$LWS$1(DOMExceptionCtor$LWS$1.prototype, 'code');
|
|
|
2039
1968
|
const {
|
|
2040
1969
|
createDocument: DOMImplementationProtoCreateDocument$LWS
|
|
2041
1970
|
} = DOMImplementation.prototype;
|
|
2042
|
-
const
|
|
2043
|
-
const {
|
|
2044
|
-
prototype: DOMTokenListProto$LWS
|
|
2045
|
-
} = DOMTokenListCtor$LWS;
|
|
2046
|
-
const {
|
|
2047
|
-
add: DOMTokenListProtoAdd$LWS,
|
|
2048
|
-
contains: DOMTokenListProtoContains$LWS,
|
|
2049
|
-
remove: DOMTokenListProtoRemove$LWS
|
|
2050
|
-
} = DOMTokenListProto$LWS;
|
|
2051
|
-
const DOMTokenListProtoLengthGetter$LWS = ObjectLookupOwnGetter$LWS$1(DOMTokenListProto$LWS, 'length');
|
|
2052
|
-
const DOMTokenListProtoValueGetter$LWS = ObjectLookupOwnGetter$LWS$1(DOMTokenListProto$LWS, 'value');
|
|
1971
|
+
const DOMTokenListProtoValueGetter$LWS = ObjectLookupOwnGetter$LWS$1(DOMTokenList.prototype, 'value');
|
|
2053
1972
|
const EventCtor$LWS = Event;
|
|
2054
1973
|
const {
|
|
2055
1974
|
prototype: EventProto$LWS
|
|
@@ -2073,14 +1992,25 @@ const {
|
|
|
2073
1992
|
} = ReflectGetOwnPropertyDescriptor$LWS(HTMLAnchorElementProto$LWS, 'href');
|
|
2074
1993
|
const HTMLAnchorElementProtoPathnameGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLAnchorElementProto$LWS, 'pathname');
|
|
2075
1994
|
const HTMLAnchorElementProtoProtocolGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLAnchorElementProto$LWS, 'protocol');
|
|
1995
|
+
const HTMLElement$LWS = getUnmaskedFunction$LWS(rootWindow$LWS$1.HTMLElement);
|
|
1996
|
+
const {
|
|
1997
|
+
prototype: HTMLElementProto$LWS
|
|
1998
|
+
} = HTMLElement$LWS;
|
|
1999
|
+
// Used by '@locker/near-membrane-dom'.
|
|
2000
|
+
ObjectLookupOwnGetter$LWS$1(HTMLElementProto$LWS, 'style');
|
|
2001
|
+
const HTMLElementGlobalAttributesToPropertyName$LWS = {
|
|
2002
|
+
__proto__: null,
|
|
2003
|
+
accesskey: 'accessKey',
|
|
2004
|
+
contenteditable: 'contentEditable',
|
|
2005
|
+
enterkeyhint: 'enterKeyHint',
|
|
2006
|
+
inputmode: 'inputMode',
|
|
2007
|
+
tabindex: 'tabIndex'
|
|
2008
|
+
};
|
|
2076
2009
|
const {
|
|
2077
2010
|
prototype: HTMLIFrameElementProto$LWS
|
|
2078
2011
|
} = HTMLIFrameElement;
|
|
2079
2012
|
// Used by '@locker/near-membrane-dom'.
|
|
2080
2013
|
ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'contentWindow');
|
|
2081
|
-
const HTMLIFrameElementProtoSandboxGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'sandbox');
|
|
2082
|
-
const HTMLIFrameElementProtoSandboxSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElementProto$LWS, 'sandbox');
|
|
2083
|
-
const HTMLIFrameElementProtoSrcGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'src');
|
|
2084
2014
|
const HTMLIFrameElementProtoSrcSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElementProto$LWS, 'src');
|
|
2085
2015
|
const HTMLScriptElementCtor$LWS = HTMLScriptElement;
|
|
2086
2016
|
const {
|
|
@@ -2103,12 +2033,10 @@ ObjectLookupOwnGetter$LWS$1(ResponseProto$LWS, 'statusText');
|
|
|
2103
2033
|
const {
|
|
2104
2034
|
text: ResponseProtoText$LWS
|
|
2105
2035
|
} = ResponseProto$LWS;
|
|
2106
|
-
const URLCtor$LWS = URL;
|
|
2107
|
-
const URLProtoOriginGetter$LWS = ObjectLookupOwnGetter$LWS$1(URLCtor$LWS.prototype, 'origin');
|
|
2108
2036
|
const {
|
|
2109
2037
|
createObjectURL: URLCreateObjectURL$LWS,
|
|
2110
2038
|
revokeObjectURL: URLRevokeObjectURL$LWS
|
|
2111
|
-
} =
|
|
2039
|
+
} = URL;
|
|
2112
2040
|
const SCRIPT_EVALUATOR_PROPERTY_NAME$LWS = '$evaluator$';
|
|
2113
2041
|
const SCRIPT_HOOK_SOURCE_TEXT$LWS = `document.currentScript.${SCRIPT_EVALUATOR_PROPERTY_NAME$LWS}`;
|
|
2114
2042
|
const evaluatedScriptElements$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
|
|
@@ -2124,7 +2052,6 @@ function defineScriptAccessorProperty$LWS(script$LWS, propKey$LWS, getter$LWS, s
|
|
|
2124
2052
|
});
|
|
2125
2053
|
}
|
|
2126
2054
|
function defineScriptEvaluatorProperty$LWS(script$LWS, callback$LWS) {
|
|
2127
|
-
// istanbul ignore if: require a test to get the evaluator in a bad state. Like code that tried to access it in between. This is mostly a "the universe is not as expected error"
|
|
2128
2055
|
if (!ReflectDefineProperty$LWS$1(script$LWS, SCRIPT_EVALUATOR_PROPERTY_NAME$LWS, {
|
|
2129
2056
|
__proto__: null,
|
|
2130
2057
|
configurable: true,
|
|
@@ -2276,7 +2203,7 @@ const {
|
|
|
2276
2203
|
const XhrProtoResponseTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'responseText');
|
|
2277
2204
|
const XhrProtoStatusGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'status');
|
|
2278
2205
|
ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
|
|
2279
|
-
/*! version: 0.
|
|
2206
|
+
/*! version: 0.22.5 */
|
|
2280
2207
|
|
|
2281
2208
|
/*!
|
|
2282
2209
|
* Copyright (C) 2019 salesforce.com, inc.
|
|
@@ -2297,14 +2224,13 @@ function isMIMETypeAllowed$LWS(mimeType$LWS) {
|
|
|
2297
2224
|
}
|
|
2298
2225
|
return false;
|
|
2299
2226
|
}
|
|
2227
|
+
const DISALLOWED_ENDPOINTS_LIST$LWS = ['/aura', '/webruntime'];
|
|
2300
2228
|
const TRUSTED_DOMAINS_REG_EXP$LWS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/;
|
|
2301
2229
|
const URL_SCHEMES_LIST$LWS = toSafeArray$LWS$1(['about:', 'http:', 'https:']);
|
|
2302
2230
|
const newlinesAndTabsRegExp$LWS = /[\u2028\u2029\n\r\t]/g;
|
|
2303
2231
|
const normalizerAnchor$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, rootDocument$LWS, ['a']);
|
|
2304
2232
|
// @TODO: W-7302311 Make paths and domains configurable.
|
|
2305
2233
|
function isValidURL$LWS(parsedURL$LWS) {
|
|
2306
|
-
// Need to add /services to isValidUrl unit test and locker/scripts/test/disallowed-endpoints.js once we remove the gate.
|
|
2307
|
-
const DISALLOWED_ENDPOINTS_LIST$LWS = isGaterEnabledFeature$LWS('enableBlockServicesEndpoint') ? ['/aura', '/webruntime', '/services'] : ['/aura', '/webruntime'];
|
|
2308
2234
|
const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
|
|
2309
2235
|
for (let i$LWS = 0, {
|
|
2310
2236
|
length: length$LWS
|
|
@@ -2336,9 +2262,9 @@ function sanitizeURLForElement$LWS(url$LWS) {
|
|
|
2336
2262
|
function sanitizeURLString$LWS(urlString$LWS) {
|
|
2337
2263
|
return urlString$LWS === '' ? urlString$LWS : ReflectApply$LWS$1(StringProtoReplace$LWS, urlString$LWS, [newlinesAndTabsRegExp$LWS, '']);
|
|
2338
2264
|
}
|
|
2339
|
-
/*! version: 0.
|
|
2265
|
+
/*! version: 0.22.5 */
|
|
2340
2266
|
|
|
2341
|
-
/*! @license DOMPurify 3.
|
|
2267
|
+
/*! @license DOMPurify 3.0.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.5/LICENSE */
|
|
2342
2268
|
|
|
2343
2269
|
const {
|
|
2344
2270
|
entries,
|
|
@@ -2352,30 +2278,36 @@ let {
|
|
|
2352
2278
|
seal,
|
|
2353
2279
|
create
|
|
2354
2280
|
} = Object; // eslint-disable-line import/no-mutable-exports
|
|
2281
|
+
|
|
2355
2282
|
let {
|
|
2356
2283
|
apply,
|
|
2357
2284
|
construct
|
|
2358
2285
|
} = typeof Reflect !== 'undefined' && Reflect;
|
|
2286
|
+
|
|
2287
|
+
if (!apply) {
|
|
2288
|
+
apply = function apply(fun, thisValue, args) {
|
|
2289
|
+
return fun.apply(thisValue, args);
|
|
2290
|
+
};
|
|
2291
|
+
}
|
|
2292
|
+
|
|
2359
2293
|
if (!freeze) {
|
|
2360
2294
|
freeze = function freeze(x) {
|
|
2361
2295
|
return x;
|
|
2362
2296
|
};
|
|
2363
2297
|
}
|
|
2298
|
+
|
|
2364
2299
|
if (!seal) {
|
|
2365
2300
|
seal = function seal(x) {
|
|
2366
2301
|
return x;
|
|
2367
2302
|
};
|
|
2368
2303
|
}
|
|
2369
|
-
|
|
2370
|
-
apply = function apply(fun, thisValue, args) {
|
|
2371
|
-
return fun.apply(thisValue, args);
|
|
2372
|
-
};
|
|
2373
|
-
}
|
|
2304
|
+
|
|
2374
2305
|
if (!construct) {
|
|
2375
2306
|
construct = function construct(Func, args) {
|
|
2376
2307
|
return new Func(...args);
|
|
2377
2308
|
};
|
|
2378
2309
|
}
|
|
2310
|
+
|
|
2379
2311
|
const arrayForEach = unapply(Array.prototype.forEach);
|
|
2380
2312
|
const arrayPop = unapply(Array.prototype.pop);
|
|
2381
2313
|
const arrayPush = unapply(Array.prototype.push);
|
|
@@ -2385,175 +2317,136 @@ const stringMatch = unapply(String.prototype.match);
|
|
|
2385
2317
|
const stringReplace = unapply(String.prototype.replace);
|
|
2386
2318
|
const stringIndexOf = unapply(String.prototype.indexOf);
|
|
2387
2319
|
const stringTrim = unapply(String.prototype.trim);
|
|
2388
|
-
const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
|
|
2389
2320
|
const regExpTest = unapply(RegExp.prototype.test);
|
|
2390
2321
|
const typeErrorCreate = unconstruct(TypeError);
|
|
2391
|
-
|
|
2392
|
-
/**
|
|
2393
|
-
* Creates a new function that calls the given function with a specified thisArg and arguments.
|
|
2394
|
-
*
|
|
2395
|
-
* @param {Function} func - The function to be wrapped and called.
|
|
2396
|
-
* @returns {Function} A new function that calls the given function with a specified thisArg and arguments.
|
|
2397
|
-
*/
|
|
2398
2322
|
function unapply(func) {
|
|
2399
2323
|
return function (thisArg) {
|
|
2400
2324
|
for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
|
|
2401
2325
|
args[_key - 1] = arguments[_key];
|
|
2402
2326
|
}
|
|
2327
|
+
|
|
2403
2328
|
return apply(func, thisArg, args);
|
|
2404
2329
|
};
|
|
2405
2330
|
}
|
|
2406
|
-
|
|
2407
|
-
/**
|
|
2408
|
-
* Creates a new function that constructs an instance of the given constructor function with the provided arguments.
|
|
2409
|
-
*
|
|
2410
|
-
* @param {Function} func - The constructor function to be wrapped and called.
|
|
2411
|
-
* @returns {Function} A new function that constructs an instance of the given constructor function with the provided arguments.
|
|
2412
|
-
*/
|
|
2413
2331
|
function unconstruct(func) {
|
|
2414
2332
|
return function () {
|
|
2415
2333
|
for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
|
|
2416
2334
|
args[_key2] = arguments[_key2];
|
|
2417
2335
|
}
|
|
2336
|
+
|
|
2418
2337
|
return construct(func, args);
|
|
2419
2338
|
};
|
|
2420
2339
|
}
|
|
2340
|
+
/* Add properties to a lookup table */
|
|
2341
|
+
|
|
2342
|
+
function addToSet(set, array, transformCaseFunc) {
|
|
2343
|
+
var _transformCaseFunc;
|
|
2344
|
+
|
|
2345
|
+
transformCaseFunc = (_transformCaseFunc = transformCaseFunc) !== null && _transformCaseFunc !== void 0 ? _transformCaseFunc : stringToLowerCase;
|
|
2421
2346
|
|
|
2422
|
-
/**
|
|
2423
|
-
* Add properties to a lookup table
|
|
2424
|
-
*
|
|
2425
|
-
* @param {Object} set - The set to which elements will be added.
|
|
2426
|
-
* @param {Array} array - The array containing elements to be added to the set.
|
|
2427
|
-
* @param {Function} transformCaseFunc - An optional function to transform the case of each element before adding to the set.
|
|
2428
|
-
* @returns {Object} The modified set with added elements.
|
|
2429
|
-
*/
|
|
2430
|
-
function addToSet(set, array) {
|
|
2431
|
-
let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
|
|
2432
2347
|
if (setPrototypeOf) {
|
|
2433
2348
|
// Make 'in' and truthy checks like Boolean(set.constructor)
|
|
2434
2349
|
// independent of any properties defined on Object.prototype.
|
|
2435
2350
|
// Prevent prototype setters from intercepting set as a this value.
|
|
2436
2351
|
setPrototypeOf(set, null);
|
|
2437
2352
|
}
|
|
2353
|
+
|
|
2438
2354
|
let l = array.length;
|
|
2355
|
+
|
|
2439
2356
|
while (l--) {
|
|
2440
2357
|
let element = array[l];
|
|
2358
|
+
|
|
2441
2359
|
if (typeof element === 'string') {
|
|
2442
2360
|
const lcElement = transformCaseFunc(element);
|
|
2361
|
+
|
|
2443
2362
|
if (lcElement !== element) {
|
|
2444
2363
|
// Config presets (e.g. tags.js, attrs.js) are immutable.
|
|
2445
2364
|
if (!isFrozen(array)) {
|
|
2446
2365
|
array[l] = lcElement;
|
|
2447
2366
|
}
|
|
2367
|
+
|
|
2448
2368
|
element = lcElement;
|
|
2449
2369
|
}
|
|
2450
2370
|
}
|
|
2371
|
+
|
|
2451
2372
|
set[element] = true;
|
|
2452
2373
|
}
|
|
2453
|
-
return set;
|
|
2454
|
-
}
|
|
2455
2374
|
|
|
2456
|
-
|
|
2457
|
-
* Clean up an array to harden against CSPP
|
|
2458
|
-
*
|
|
2459
|
-
* @param {Array} array - The array to be cleaned.
|
|
2460
|
-
* @returns {Array} The cleaned version of the array
|
|
2461
|
-
*/
|
|
2462
|
-
function cleanArray(array) {
|
|
2463
|
-
for (let index = 0; index < array.length; index++) {
|
|
2464
|
-
const isPropertyExist = objectHasOwnProperty(array, index);
|
|
2465
|
-
if (!isPropertyExist) {
|
|
2466
|
-
array[index] = null;
|
|
2467
|
-
}
|
|
2468
|
-
}
|
|
2469
|
-
return array;
|
|
2375
|
+
return set;
|
|
2470
2376
|
}
|
|
2377
|
+
/* Shallow clone an object */
|
|
2471
2378
|
|
|
2472
|
-
/**
|
|
2473
|
-
* Shallow clone an object
|
|
2474
|
-
*
|
|
2475
|
-
* @param {Object} object - The object to be cloned.
|
|
2476
|
-
* @returns {Object} A new object that copies the original.
|
|
2477
|
-
*/
|
|
2478
2379
|
function clone(object) {
|
|
2479
2380
|
const newObject = create(null);
|
|
2381
|
+
|
|
2480
2382
|
for (const [property, value] of entries(object)) {
|
|
2481
|
-
|
|
2482
|
-
if (isPropertyExist) {
|
|
2483
|
-
if (Array.isArray(value)) {
|
|
2484
|
-
newObject[property] = cleanArray(value);
|
|
2485
|
-
} else if (value && typeof value === 'object' && value.constructor === Object) {
|
|
2486
|
-
newObject[property] = clone(value);
|
|
2487
|
-
} else {
|
|
2488
|
-
newObject[property] = value;
|
|
2489
|
-
}
|
|
2490
|
-
}
|
|
2383
|
+
newObject[property] = value;
|
|
2491
2384
|
}
|
|
2385
|
+
|
|
2492
2386
|
return newObject;
|
|
2493
2387
|
}
|
|
2388
|
+
/* This method automatically checks if the prop is function
|
|
2389
|
+
* or getter and behaves accordingly. */
|
|
2494
2390
|
|
|
2495
|
-
/**
|
|
2496
|
-
* This method automatically checks if the prop is function or getter and behaves accordingly.
|
|
2497
|
-
*
|
|
2498
|
-
* @param {Object} object - The object to look up the getter function in its prototype chain.
|
|
2499
|
-
* @param {String} prop - The property name for which to find the getter function.
|
|
2500
|
-
* @returns {Function} The getter function found in the prototype chain or a fallback function.
|
|
2501
|
-
*/
|
|
2502
2391
|
function lookupGetter(object, prop) {
|
|
2503
2392
|
while (object !== null) {
|
|
2504
2393
|
const desc = getOwnPropertyDescriptor(object, prop);
|
|
2394
|
+
|
|
2505
2395
|
if (desc) {
|
|
2506
2396
|
if (desc.get) {
|
|
2507
2397
|
return unapply(desc.get);
|
|
2508
2398
|
}
|
|
2399
|
+
|
|
2509
2400
|
if (typeof desc.value === 'function') {
|
|
2510
2401
|
return unapply(desc.value);
|
|
2511
2402
|
}
|
|
2512
2403
|
}
|
|
2404
|
+
|
|
2513
2405
|
object = getPrototypeOf(object);
|
|
2514
2406
|
}
|
|
2515
|
-
|
|
2407
|
+
|
|
2408
|
+
function fallbackValue(element) {
|
|
2409
|
+
console.warn('fallback value for', element);
|
|
2516
2410
|
return null;
|
|
2517
2411
|
}
|
|
2412
|
+
|
|
2518
2413
|
return fallbackValue;
|
|
2519
2414
|
}
|
|
2520
2415
|
|
|
2521
|
-
const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
|
|
2416
|
+
const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
|
|
2522
2417
|
|
|
2523
|
-
// SVG
|
|
2524
2418
|
const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
|
|
2525
|
-
const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
|
|
2526
|
-
|
|
2527
|
-
// List of SVG elements that are disallowed by default.
|
|
2419
|
+
const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
|
|
2528
2420
|
// We still need to know them so that we can do namespace
|
|
2529
2421
|
// checks properly in case one wants to add them to
|
|
2530
2422
|
// allow-list.
|
|
2531
|
-
const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
|
|
2532
|
-
const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
|
|
2533
2423
|
|
|
2534
|
-
|
|
2424
|
+
const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
|
|
2425
|
+
const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']); // Similarly to SVG, we want to know all MathML elements,
|
|
2535
2426
|
// even those that we disallow by default.
|
|
2427
|
+
|
|
2536
2428
|
const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
|
|
2537
2429
|
const text = freeze(['#text']);
|
|
2538
2430
|
|
|
2539
|
-
const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', '
|
|
2431
|
+
const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
|
|
2540
2432
|
const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
|
|
2541
2433
|
const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
|
|
2542
2434
|
const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
|
|
2543
2435
|
|
|
2544
|
-
// eslint-disable-next-line unicorn/better-regex
|
|
2545
2436
|
const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
|
|
2437
|
+
|
|
2546
2438
|
const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
2547
2439
|
const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
|
|
2548
2440
|
const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
|
|
2441
|
+
|
|
2549
2442
|
const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
|
|
2443
|
+
|
|
2550
2444
|
const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
|
|
2551
2445
|
);
|
|
2552
2446
|
const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
|
|
2553
2447
|
const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
|
|
2554
2448
|
);
|
|
2555
2449
|
const DOCTYPE_NAME = seal(/^html$/i);
|
|
2556
|
-
const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
|
|
2557
2450
|
|
|
2558
2451
|
var EXPRESSIONS = /*#__PURE__*/Object.freeze({
|
|
2559
2452
|
__proto__: null,
|
|
@@ -2565,61 +2458,47 @@ var EXPRESSIONS = /*#__PURE__*/Object.freeze({
|
|
|
2565
2458
|
IS_ALLOWED_URI: IS_ALLOWED_URI,
|
|
2566
2459
|
IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
|
|
2567
2460
|
ATTR_WHITESPACE: ATTR_WHITESPACE,
|
|
2568
|
-
DOCTYPE_NAME: DOCTYPE_NAME
|
|
2569
|
-
CUSTOM_ELEMENT: CUSTOM_ELEMENT
|
|
2461
|
+
DOCTYPE_NAME: DOCTYPE_NAME
|
|
2570
2462
|
});
|
|
2571
2463
|
|
|
2572
|
-
|
|
2573
|
-
const NODE_TYPE = {
|
|
2574
|
-
element: 1,
|
|
2575
|
-
attribute: 2,
|
|
2576
|
-
text: 3,
|
|
2577
|
-
cdataSection: 4,
|
|
2578
|
-
entityReference: 5,
|
|
2579
|
-
// Deprecated
|
|
2580
|
-
entityNode: 6,
|
|
2581
|
-
// Deprecated
|
|
2582
|
-
progressingInstruction: 7,
|
|
2583
|
-
comment: 8,
|
|
2584
|
-
document: 9,
|
|
2585
|
-
documentType: 10,
|
|
2586
|
-
documentFragment: 11,
|
|
2587
|
-
notation: 12 // Deprecated
|
|
2588
|
-
};
|
|
2589
|
-
const getGlobal = function getGlobal() {
|
|
2590
|
-
return typeof window === 'undefined' ? null : window;
|
|
2591
|
-
};
|
|
2592
|
-
|
|
2464
|
+
const getGlobal = () => typeof window === 'undefined' ? null : window;
|
|
2593
2465
|
/**
|
|
2594
2466
|
* Creates a no-op policy for internal use only.
|
|
2595
2467
|
* Don't export this function outside this module!
|
|
2596
|
-
* @param {TrustedTypePolicyFactory} trustedTypes The policy factory.
|
|
2468
|
+
* @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
|
|
2597
2469
|
* @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
|
|
2598
|
-
* @return {TrustedTypePolicy} The policy created (or null, if Trusted Types
|
|
2470
|
+
* @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
|
|
2599
2471
|
* are not supported or creating the policy failed).
|
|
2600
2472
|
*/
|
|
2473
|
+
|
|
2474
|
+
|
|
2601
2475
|
const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
|
|
2602
2476
|
if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
|
|
2603
2477
|
return null;
|
|
2604
|
-
}
|
|
2605
|
-
|
|
2606
|
-
// Allow the callers to control the unique policy name
|
|
2478
|
+
} // Allow the callers to control the unique policy name
|
|
2607
2479
|
// by adding a data-tt-policy-suffix to the script element with the DOMPurify.
|
|
2608
2480
|
// Policy creation with duplicate names throws in Trusted Types.
|
|
2481
|
+
|
|
2482
|
+
|
|
2609
2483
|
let suffix = null;
|
|
2610
2484
|
const ATTR_NAME = 'data-tt-policy-suffix';
|
|
2485
|
+
|
|
2611
2486
|
if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
|
|
2612
2487
|
suffix = purifyHostElement.getAttribute(ATTR_NAME);
|
|
2613
2488
|
}
|
|
2489
|
+
|
|
2614
2490
|
const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
|
|
2491
|
+
|
|
2615
2492
|
try {
|
|
2616
2493
|
return trustedTypes.createPolicy(policyName, {
|
|
2617
2494
|
createHTML(html) {
|
|
2618
2495
|
return html;
|
|
2619
2496
|
},
|
|
2497
|
+
|
|
2620
2498
|
createScriptURL(scriptUrl) {
|
|
2621
2499
|
return scriptUrl;
|
|
2622
2500
|
}
|
|
2501
|
+
|
|
2623
2502
|
});
|
|
2624
2503
|
} catch (_) {
|
|
2625
2504
|
// Policy creation failed (most likely another DOMPurify script has
|
|
@@ -2629,32 +2508,37 @@ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedType
|
|
|
2629
2508
|
return null;
|
|
2630
2509
|
}
|
|
2631
2510
|
};
|
|
2511
|
+
|
|
2632
2512
|
function createDOMPurify() {
|
|
2633
2513
|
let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
|
|
2634
|
-
const DOMPurify = root => createDOMPurify(root);
|
|
2635
2514
|
|
|
2515
|
+
const DOMPurify = root => createDOMPurify(root);
|
|
2636
2516
|
/**
|
|
2637
2517
|
* Version label, exposed for easier checks
|
|
2638
2518
|
* if DOMPurify is up to date or not
|
|
2639
2519
|
*/
|
|
2640
|
-
DOMPurify.version = '3.1.6';
|
|
2641
2520
|
|
|
2521
|
+
|
|
2522
|
+
DOMPurify.version = '3.0.5';
|
|
2642
2523
|
/**
|
|
2643
2524
|
* Array of elements that DOMPurify removed during sanitation.
|
|
2644
2525
|
* Empty if nothing was removed.
|
|
2645
2526
|
*/
|
|
2527
|
+
|
|
2646
2528
|
DOMPurify.removed = [];
|
|
2647
|
-
|
|
2529
|
+
|
|
2530
|
+
if (!window || !window.document || window.document.nodeType !== 9) {
|
|
2648
2531
|
// Not running in a browser, provide a factory function
|
|
2649
2532
|
// so that you can pass your own Window
|
|
2650
2533
|
DOMPurify.isSupported = false;
|
|
2651
2534
|
return DOMPurify;
|
|
2652
2535
|
}
|
|
2536
|
+
|
|
2537
|
+
const originalDocument = window.document;
|
|
2538
|
+
const currentScript = originalDocument.currentScript;
|
|
2653
2539
|
let {
|
|
2654
2540
|
document
|
|
2655
2541
|
} = window;
|
|
2656
|
-
const originalDocument = document;
|
|
2657
|
-
const currentScript = originalDocument.currentScript;
|
|
2658
2542
|
const {
|
|
2659
2543
|
DocumentFragment,
|
|
2660
2544
|
HTMLTemplateElement,
|
|
@@ -2668,23 +2552,23 @@ function createDOMPurify() {
|
|
|
2668
2552
|
} = window;
|
|
2669
2553
|
const ElementPrototype = Element.prototype;
|
|
2670
2554
|
const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
|
|
2671
|
-
const remove = lookupGetter(ElementPrototype, 'remove');
|
|
2672
2555
|
const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
|
|
2673
2556
|
const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
|
|
2674
|
-
const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
|
|
2675
|
-
|
|
2676
|
-
// As per issue #47, the web-components registry is inherited by a
|
|
2557
|
+
const getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
|
|
2677
2558
|
// new document created via createHTMLDocument. As per the spec
|
|
2678
2559
|
// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
|
|
2679
2560
|
// a new empty registry is used when creating a template contents owner
|
|
2680
2561
|
// document, so we use that as our parent document to ensure nothing
|
|
2681
2562
|
// is inherited.
|
|
2563
|
+
|
|
2682
2564
|
if (typeof HTMLTemplateElement === 'function') {
|
|
2683
2565
|
const template = document.createElement('template');
|
|
2566
|
+
|
|
2684
2567
|
if (template.content && template.content.ownerDocument) {
|
|
2685
2568
|
document = template.content.ownerDocument;
|
|
2686
2569
|
}
|
|
2687
2570
|
}
|
|
2571
|
+
|
|
2688
2572
|
let trustedTypesPolicy;
|
|
2689
2573
|
let emptyHTML = '';
|
|
2690
2574
|
const {
|
|
@@ -2697,10 +2581,10 @@ function createDOMPurify() {
|
|
|
2697
2581
|
importNode
|
|
2698
2582
|
} = originalDocument;
|
|
2699
2583
|
let hooks = {};
|
|
2700
|
-
|
|
2701
2584
|
/**
|
|
2702
2585
|
* Expose whether this browser supports running the full DOMPurify.
|
|
2703
2586
|
*/
|
|
2587
|
+
|
|
2704
2588
|
DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
|
|
2705
2589
|
const {
|
|
2706
2590
|
MUSTACHE_EXPR,
|
|
@@ -2709,33 +2593,32 @@ function createDOMPurify() {
|
|
|
2709
2593
|
DATA_ATTR,
|
|
2710
2594
|
ARIA_ATTR,
|
|
2711
2595
|
IS_SCRIPT_OR_DATA,
|
|
2712
|
-
ATTR_WHITESPACE
|
|
2713
|
-
CUSTOM_ELEMENT
|
|
2596
|
+
ATTR_WHITESPACE
|
|
2714
2597
|
} = EXPRESSIONS;
|
|
2715
2598
|
let {
|
|
2716
2599
|
IS_ALLOWED_URI: IS_ALLOWED_URI$1
|
|
2717
2600
|
} = EXPRESSIONS;
|
|
2718
|
-
|
|
2719
2601
|
/**
|
|
2720
2602
|
* We consider the elements and attributes below to be safe. Ideally
|
|
2721
2603
|
* don't add any new ones but feel free to remove unwanted ones.
|
|
2722
2604
|
*/
|
|
2723
2605
|
|
|
2724
2606
|
/* allowed element names */
|
|
2607
|
+
|
|
2725
2608
|
let ALLOWED_TAGS = null;
|
|
2726
2609
|
const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
|
|
2727
|
-
|
|
2728
2610
|
/* Allowed attribute names */
|
|
2611
|
+
|
|
2729
2612
|
let ALLOWED_ATTR = null;
|
|
2730
2613
|
const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
|
|
2731
|
-
|
|
2732
2614
|
/*
|
|
2733
2615
|
* Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
|
|
2734
2616
|
* @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
|
|
2735
2617
|
* @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
|
|
2736
2618
|
* @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
|
|
2737
2619
|
*/
|
|
2738
|
-
|
|
2620
|
+
|
|
2621
|
+
let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
|
|
2739
2622
|
tagNameCheck: {
|
|
2740
2623
|
writable: true,
|
|
2741
2624
|
configurable: false,
|
|
@@ -2755,65 +2638,59 @@ function createDOMPurify() {
|
|
|
2755
2638
|
value: false
|
|
2756
2639
|
}
|
|
2757
2640
|
}));
|
|
2758
|
-
|
|
2759
2641
|
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
|
|
2760
|
-
let FORBID_TAGS = null;
|
|
2761
2642
|
|
|
2643
|
+
let FORBID_TAGS = null;
|
|
2762
2644
|
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
|
|
2763
|
-
let FORBID_ATTR = null;
|
|
2764
2645
|
|
|
2646
|
+
let FORBID_ATTR = null;
|
|
2765
2647
|
/* Decide if ARIA attributes are okay */
|
|
2766
|
-
let ALLOW_ARIA_ATTR = true;
|
|
2767
2648
|
|
|
2649
|
+
let ALLOW_ARIA_ATTR = true;
|
|
2768
2650
|
/* Decide if custom data attributes are okay */
|
|
2769
|
-
let ALLOW_DATA_ATTR = true;
|
|
2770
2651
|
|
|
2652
|
+
let ALLOW_DATA_ATTR = true;
|
|
2771
2653
|
/* Decide if unknown protocols are okay */
|
|
2772
|
-
let ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
2773
2654
|
|
|
2655
|
+
let ALLOW_UNKNOWN_PROTOCOLS = false;
|
|
2774
2656
|
/* Decide if self-closing tags in attributes are allowed.
|
|
2775
2657
|
* Usually removed due to a mXSS issue in jQuery 3.0 */
|
|
2776
|
-
let ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
2777
2658
|
|
|
2659
|
+
let ALLOW_SELF_CLOSE_IN_ATTR = true;
|
|
2778
2660
|
/* Output should be safe for common template engines.
|
|
2779
2661
|
* This means, DOMPurify removes data attributes, mustaches and ERB
|
|
2780
2662
|
*/
|
|
2781
|
-
let SAFE_FOR_TEMPLATES = false;
|
|
2782
|
-
|
|
2783
|
-
/* Output should be safe even for XML used within HTML and alike.
|
|
2784
|
-
* This means, DOMPurify removes comments when containing risky content.
|
|
2785
|
-
*/
|
|
2786
|
-
let SAFE_FOR_XML = true;
|
|
2787
2663
|
|
|
2664
|
+
let SAFE_FOR_TEMPLATES = false;
|
|
2788
2665
|
/* Decide if document with <html>... should be returned */
|
|
2789
|
-
let WHOLE_DOCUMENT = false;
|
|
2790
2666
|
|
|
2667
|
+
let WHOLE_DOCUMENT = false;
|
|
2791
2668
|
/* Track whether config is already set on this instance of DOMPurify. */
|
|
2792
|
-
let SET_CONFIG = false;
|
|
2793
2669
|
|
|
2670
|
+
let SET_CONFIG = false;
|
|
2794
2671
|
/* Decide if all elements (e.g. style, script) must be children of
|
|
2795
2672
|
* document.body. By default, browsers might move them to document.head */
|
|
2796
|
-
let FORCE_BODY = false;
|
|
2797
2673
|
|
|
2674
|
+
let FORCE_BODY = false;
|
|
2798
2675
|
/* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
|
|
2799
2676
|
* string (or a TrustedHTML object if Trusted Types are supported).
|
|
2800
2677
|
* If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
|
|
2801
2678
|
*/
|
|
2802
|
-
let RETURN_DOM = false;
|
|
2803
2679
|
|
|
2680
|
+
let RETURN_DOM = false;
|
|
2804
2681
|
/* Decide if a DOM `DocumentFragment` should be returned, instead of a html
|
|
2805
2682
|
* string (or a TrustedHTML object if Trusted Types are supported) */
|
|
2806
|
-
let RETURN_DOM_FRAGMENT = false;
|
|
2807
2683
|
|
|
2684
|
+
let RETURN_DOM_FRAGMENT = false;
|
|
2808
2685
|
/* Try to return a Trusted Type object instead of a string, return a string in
|
|
2809
2686
|
* case Trusted Types are not supported */
|
|
2810
|
-
let RETURN_TRUSTED_TYPE = false;
|
|
2811
2687
|
|
|
2688
|
+
let RETURN_TRUSTED_TYPE = false;
|
|
2812
2689
|
/* Output should be free from DOM clobbering attacks?
|
|
2813
2690
|
* This sanitizes markups named with colliding, clobberable built-in DOM APIs.
|
|
2814
2691
|
*/
|
|
2815
|
-
let SANITIZE_DOM = true;
|
|
2816
2692
|
|
|
2693
|
+
let SANITIZE_DOM = true;
|
|
2817
2694
|
/* Achieve full DOM Clobbering protection by isolating the namespace of named
|
|
2818
2695
|
* properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
|
|
2819
2696
|
*
|
|
@@ -2827,309 +2704,352 @@ function createDOMPurify() {
|
|
|
2827
2704
|
* Namespace isolation is implemented by prefixing `id` and `name` attributes
|
|
2828
2705
|
* with a constant string, i.e., `user-content-`
|
|
2829
2706
|
*/
|
|
2707
|
+
|
|
2830
2708
|
let SANITIZE_NAMED_PROPS = false;
|
|
2831
2709
|
const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
|
|
2832
|
-
|
|
2833
2710
|
/* Keep element content when removing element? */
|
|
2834
|
-
let KEEP_CONTENT = true;
|
|
2835
2711
|
|
|
2712
|
+
let KEEP_CONTENT = true;
|
|
2836
2713
|
/* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
|
|
2837
2714
|
* of importing it into a new Document and returning a sanitized copy */
|
|
2838
|
-
let IN_PLACE = false;
|
|
2839
2715
|
|
|
2716
|
+
let IN_PLACE = false;
|
|
2840
2717
|
/* Allow usage of profiles like html, svg and mathMl */
|
|
2841
|
-
let USE_PROFILES = {};
|
|
2842
2718
|
|
|
2719
|
+
let USE_PROFILES = {};
|
|
2843
2720
|
/* Tags to ignore content of when KEEP_CONTENT is true */
|
|
2721
|
+
|
|
2844
2722
|
let FORBID_CONTENTS = null;
|
|
2845
2723
|
const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
|
|
2846
|
-
|
|
2847
2724
|
/* Tags that are safe for data: URIs */
|
|
2725
|
+
|
|
2848
2726
|
let DATA_URI_TAGS = null;
|
|
2849
2727
|
const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
|
|
2850
|
-
|
|
2851
2728
|
/* Attributes safe for values like "javascript:" */
|
|
2729
|
+
|
|
2852
2730
|
let URI_SAFE_ATTRIBUTES = null;
|
|
2853
2731
|
const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
|
|
2854
2732
|
const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
|
|
2855
2733
|
const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
|
|
2856
2734
|
const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
|
|
2857
2735
|
/* Document namespace */
|
|
2736
|
+
|
|
2858
2737
|
let NAMESPACE = HTML_NAMESPACE;
|
|
2859
2738
|
let IS_EMPTY_INPUT = false;
|
|
2860
|
-
|
|
2861
2739
|
/* Allowed XHTML+XML namespaces */
|
|
2740
|
+
|
|
2862
2741
|
let ALLOWED_NAMESPACES = null;
|
|
2863
2742
|
const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
|
|
2864
|
-
|
|
2865
2743
|
/* Parsing of strict XHTML documents */
|
|
2866
|
-
|
|
2744
|
+
|
|
2745
|
+
let PARSER_MEDIA_TYPE;
|
|
2867
2746
|
const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
|
|
2868
2747
|
const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
|
|
2869
|
-
let transformCaseFunc
|
|
2870
|
-
|
|
2748
|
+
let transformCaseFunc;
|
|
2871
2749
|
/* Keep a reference to config to pass to hooks */
|
|
2872
|
-
let CONFIG = null;
|
|
2873
2750
|
|
|
2751
|
+
let CONFIG = null;
|
|
2874
2752
|
/* Ideally, do not touch anything below this line */
|
|
2753
|
+
|
|
2875
2754
|
/* ______________________________________________ */
|
|
2876
2755
|
|
|
2877
2756
|
const formElement = document.createElement('form');
|
|
2757
|
+
|
|
2878
2758
|
const isRegexOrFunction = function isRegexOrFunction(testValue) {
|
|
2879
2759
|
return testValue instanceof RegExp || testValue instanceof Function;
|
|
2880
2760
|
};
|
|
2881
|
-
|
|
2882
2761
|
/**
|
|
2883
2762
|
* _parseConfig
|
|
2884
2763
|
*
|
|
2885
2764
|
* @param {Object} cfg optional config literal
|
|
2886
2765
|
*/
|
|
2887
2766
|
// eslint-disable-next-line complexity
|
|
2888
|
-
|
|
2889
|
-
|
|
2767
|
+
|
|
2768
|
+
|
|
2769
|
+
const _parseConfig = function _parseConfig(cfg) {
|
|
2890
2770
|
if (CONFIG && CONFIG === cfg) {
|
|
2891
2771
|
return;
|
|
2892
2772
|
}
|
|
2893
|
-
|
|
2894
2773
|
/* Shield configuration object from tampering */
|
|
2774
|
+
|
|
2775
|
+
|
|
2895
2776
|
if (!cfg || typeof cfg !== 'object') {
|
|
2896
2777
|
cfg = {};
|
|
2897
2778
|
}
|
|
2898
|
-
|
|
2899
2779
|
/* Shield configuration object from prototype pollution */
|
|
2780
|
+
|
|
2781
|
+
|
|
2900
2782
|
cfg = clone(cfg);
|
|
2901
|
-
PARSER_MEDIA_TYPE =
|
|
2902
|
-
//
|
|
2903
|
-
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
|
|
2783
|
+
PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
|
|
2784
|
+
SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
|
|
2904
2785
|
|
|
2905
|
-
// HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
|
|
2906
2786
|
transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
|
|
2907
|
-
|
|
2908
2787
|
/* Set configuration parameters */
|
|
2909
|
-
|
|
2910
|
-
|
|
2911
|
-
|
|
2912
|
-
|
|
2913
|
-
// eslint-disable-line indent
|
|
2914
|
-
cfg.ADD_URI_SAFE_ATTR,
|
|
2915
|
-
// eslint-disable-line indent
|
|
2788
|
+
|
|
2789
|
+
ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
|
|
2790
|
+
ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
|
|
2791
|
+
ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
|
|
2792
|
+
URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent
|
|
2793
|
+
cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent
|
|
2916
2794
|
transformCaseFunc // eslint-disable-line indent
|
|
2917
2795
|
) // eslint-disable-line indent
|
|
2918
2796
|
: DEFAULT_URI_SAFE_ATTRIBUTES;
|
|
2919
|
-
DATA_URI_TAGS =
|
|
2920
|
-
// eslint-disable-line indent
|
|
2921
|
-
cfg.ADD_DATA_URI_TAGS,
|
|
2922
|
-
// eslint-disable-line indent
|
|
2797
|
+
DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
|
|
2798
|
+
cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
|
|
2923
2799
|
transformCaseFunc // eslint-disable-line indent
|
|
2924
2800
|
) // eslint-disable-line indent
|
|
2925
2801
|
: DEFAULT_DATA_URI_TAGS;
|
|
2926
|
-
FORBID_CONTENTS =
|
|
2927
|
-
FORBID_TAGS =
|
|
2928
|
-
FORBID_ATTR =
|
|
2929
|
-
USE_PROFILES =
|
|
2802
|
+
FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
|
|
2803
|
+
FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
|
|
2804
|
+
FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
|
|
2805
|
+
USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
|
|
2930
2806
|
ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
|
|
2807
|
+
|
|
2931
2808
|
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
|
|
2809
|
+
|
|
2932
2810
|
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
|
|
2811
|
+
|
|
2933
2812
|
ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
|
|
2813
|
+
|
|
2934
2814
|
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
|
|
2935
|
-
|
|
2815
|
+
|
|
2936
2816
|
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
|
|
2817
|
+
|
|
2937
2818
|
RETURN_DOM = cfg.RETURN_DOM || false; // Default false
|
|
2819
|
+
|
|
2938
2820
|
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
|
|
2821
|
+
|
|
2939
2822
|
RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
|
|
2823
|
+
|
|
2940
2824
|
FORCE_BODY = cfg.FORCE_BODY || false; // Default false
|
|
2825
|
+
|
|
2941
2826
|
SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
|
|
2827
|
+
|
|
2942
2828
|
SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
|
|
2829
|
+
|
|
2943
2830
|
KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
|
|
2831
|
+
|
|
2944
2832
|
IN_PLACE = cfg.IN_PLACE || false; // Default false
|
|
2833
|
+
|
|
2945
2834
|
IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
|
|
2946
2835
|
NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
|
|
2947
2836
|
CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
|
|
2837
|
+
|
|
2948
2838
|
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
|
|
2949
2839
|
CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
|
|
2950
2840
|
}
|
|
2841
|
+
|
|
2951
2842
|
if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
|
|
2952
2843
|
CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
|
|
2953
2844
|
}
|
|
2845
|
+
|
|
2954
2846
|
if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
|
|
2955
2847
|
CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
|
|
2956
2848
|
}
|
|
2849
|
+
|
|
2957
2850
|
if (SAFE_FOR_TEMPLATES) {
|
|
2958
2851
|
ALLOW_DATA_ATTR = false;
|
|
2959
2852
|
}
|
|
2853
|
+
|
|
2960
2854
|
if (RETURN_DOM_FRAGMENT) {
|
|
2961
2855
|
RETURN_DOM = true;
|
|
2962
2856
|
}
|
|
2963
|
-
|
|
2964
2857
|
/* Parse profile info */
|
|
2858
|
+
|
|
2859
|
+
|
|
2965
2860
|
if (USE_PROFILES) {
|
|
2966
|
-
ALLOWED_TAGS = addToSet({}, text);
|
|
2861
|
+
ALLOWED_TAGS = addToSet({}, [...text]);
|
|
2967
2862
|
ALLOWED_ATTR = [];
|
|
2863
|
+
|
|
2968
2864
|
if (USE_PROFILES.html === true) {
|
|
2969
2865
|
addToSet(ALLOWED_TAGS, html$1);
|
|
2970
2866
|
addToSet(ALLOWED_ATTR, html);
|
|
2971
2867
|
}
|
|
2868
|
+
|
|
2972
2869
|
if (USE_PROFILES.svg === true) {
|
|
2973
2870
|
addToSet(ALLOWED_TAGS, svg$1);
|
|
2974
2871
|
addToSet(ALLOWED_ATTR, svg);
|
|
2975
2872
|
addToSet(ALLOWED_ATTR, xml);
|
|
2976
2873
|
}
|
|
2874
|
+
|
|
2977
2875
|
if (USE_PROFILES.svgFilters === true) {
|
|
2978
2876
|
addToSet(ALLOWED_TAGS, svgFilters);
|
|
2979
2877
|
addToSet(ALLOWED_ATTR, svg);
|
|
2980
2878
|
addToSet(ALLOWED_ATTR, xml);
|
|
2981
2879
|
}
|
|
2880
|
+
|
|
2982
2881
|
if (USE_PROFILES.mathMl === true) {
|
|
2983
2882
|
addToSet(ALLOWED_TAGS, mathMl$1);
|
|
2984
2883
|
addToSet(ALLOWED_ATTR, mathMl);
|
|
2985
2884
|
addToSet(ALLOWED_ATTR, xml);
|
|
2986
2885
|
}
|
|
2987
2886
|
}
|
|
2988
|
-
|
|
2989
2887
|
/* Merge configuration parameters */
|
|
2888
|
+
|
|
2889
|
+
|
|
2990
2890
|
if (cfg.ADD_TAGS) {
|
|
2991
2891
|
if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
|
|
2992
2892
|
ALLOWED_TAGS = clone(ALLOWED_TAGS);
|
|
2993
2893
|
}
|
|
2894
|
+
|
|
2994
2895
|
addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
|
|
2995
2896
|
}
|
|
2897
|
+
|
|
2996
2898
|
if (cfg.ADD_ATTR) {
|
|
2997
2899
|
if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
|
|
2998
2900
|
ALLOWED_ATTR = clone(ALLOWED_ATTR);
|
|
2999
2901
|
}
|
|
2902
|
+
|
|
3000
2903
|
addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
|
|
3001
2904
|
}
|
|
2905
|
+
|
|
3002
2906
|
if (cfg.ADD_URI_SAFE_ATTR) {
|
|
3003
2907
|
addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
|
|
3004
2908
|
}
|
|
2909
|
+
|
|
3005
2910
|
if (cfg.FORBID_CONTENTS) {
|
|
3006
2911
|
if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
|
|
3007
2912
|
FORBID_CONTENTS = clone(FORBID_CONTENTS);
|
|
3008
2913
|
}
|
|
2914
|
+
|
|
3009
2915
|
addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
|
|
3010
2916
|
}
|
|
3011
|
-
|
|
3012
2917
|
/* Add #text in case KEEP_CONTENT is set to true */
|
|
2918
|
+
|
|
2919
|
+
|
|
3013
2920
|
if (KEEP_CONTENT) {
|
|
3014
2921
|
ALLOWED_TAGS['#text'] = true;
|
|
3015
2922
|
}
|
|
3016
|
-
|
|
3017
2923
|
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
|
|
2924
|
+
|
|
2925
|
+
|
|
3018
2926
|
if (WHOLE_DOCUMENT) {
|
|
3019
2927
|
addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
|
|
3020
2928
|
}
|
|
3021
|
-
|
|
3022
2929
|
/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
|
|
2930
|
+
|
|
2931
|
+
|
|
3023
2932
|
if (ALLOWED_TAGS.table) {
|
|
3024
2933
|
addToSet(ALLOWED_TAGS, ['tbody']);
|
|
3025
2934
|
delete FORBID_TAGS.tbody;
|
|
3026
2935
|
}
|
|
2936
|
+
|
|
3027
2937
|
if (cfg.TRUSTED_TYPES_POLICY) {
|
|
3028
2938
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
|
|
3029
2939
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
|
|
3030
2940
|
}
|
|
2941
|
+
|
|
3031
2942
|
if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
|
|
3032
2943
|
throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
|
|
3033
|
-
}
|
|
2944
|
+
} // Overwrite existing TrustedTypes policy.
|
|
2945
|
+
|
|
3034
2946
|
|
|
3035
|
-
//
|
|
3036
|
-
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
|
|
2947
|
+
trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; // Sign local variables required by `sanitize`.
|
|
3037
2948
|
|
|
3038
|
-
// Sign local variables required by `sanitize`.
|
|
3039
2949
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
3040
2950
|
} else {
|
|
3041
2951
|
// Uninitialized policy, attempt to initialize the internal dompurify policy.
|
|
3042
2952
|
if (trustedTypesPolicy === undefined) {
|
|
3043
2953
|
trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
|
|
3044
|
-
}
|
|
2954
|
+
} // If creating the internal policy succeeded sign internal variables.
|
|
2955
|
+
|
|
3045
2956
|
|
|
3046
|
-
// If creating the internal policy succeeded sign internal variables.
|
|
3047
2957
|
if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
|
|
3048
2958
|
emptyHTML = trustedTypesPolicy.createHTML('');
|
|
3049
2959
|
}
|
|
3050
|
-
}
|
|
3051
|
-
|
|
3052
|
-
// Prevent further manipulation of configuration.
|
|
2960
|
+
} // Prevent further manipulation of configuration.
|
|
3053
2961
|
// Not available in IE8, Safari 5, etc.
|
|
2962
|
+
|
|
2963
|
+
|
|
3054
2964
|
if (freeze) {
|
|
3055
2965
|
freeze(cfg);
|
|
3056
2966
|
}
|
|
2967
|
+
|
|
3057
2968
|
CONFIG = cfg;
|
|
3058
2969
|
};
|
|
3059
|
-
const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
3060
|
-
const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'annotation-xml']);
|
|
3061
2970
|
|
|
3062
|
-
|
|
2971
|
+
const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
|
|
2972
|
+
const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
|
|
3063
2973
|
// namespace. We need to specify them explicitly
|
|
3064
2974
|
// so that they don't get erroneously deleted from
|
|
3065
2975
|
// HTML namespace.
|
|
3066
|
-
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
3067
2976
|
|
|
2977
|
+
const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
|
|
3068
2978
|
/* Keep track of all possible SVG and MathML tags
|
|
3069
2979
|
* so that we can perform the namespace checks
|
|
3070
2980
|
* correctly. */
|
|
3071
|
-
const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
|
|
3072
|
-
const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
|
|
3073
2981
|
|
|
2982
|
+
const ALL_SVG_TAGS = addToSet({}, svg$1);
|
|
2983
|
+
addToSet(ALL_SVG_TAGS, svgFilters);
|
|
2984
|
+
addToSet(ALL_SVG_TAGS, svgDisallowed);
|
|
2985
|
+
const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
|
|
2986
|
+
addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
|
|
3074
2987
|
/**
|
|
2988
|
+
*
|
|
2989
|
+
*
|
|
3075
2990
|
* @param {Element} element a DOM element whose namespace is being checked
|
|
3076
2991
|
* @returns {boolean} Return false if the element has a
|
|
3077
2992
|
* namespace that a spec-compliant parser would never
|
|
3078
2993
|
* return. Return true otherwise.
|
|
3079
2994
|
*/
|
|
3080
|
-
const _checkValidNamespace = function _checkValidNamespace(element) {
|
|
3081
|
-
let parent = getParentNode(element);
|
|
3082
2995
|
|
|
3083
|
-
|
|
2996
|
+
const _checkValidNamespace = function _checkValidNamespace(element) {
|
|
2997
|
+
let parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
|
|
3084
2998
|
// can be null. We just simulate parent in this case.
|
|
2999
|
+
|
|
3085
3000
|
if (!parent || !parent.tagName) {
|
|
3086
3001
|
parent = {
|
|
3087
3002
|
namespaceURI: NAMESPACE,
|
|
3088
3003
|
tagName: 'template'
|
|
3089
3004
|
};
|
|
3090
3005
|
}
|
|
3006
|
+
|
|
3091
3007
|
const tagName = stringToLowerCase(element.tagName);
|
|
3092
3008
|
const parentTagName = stringToLowerCase(parent.tagName);
|
|
3009
|
+
|
|
3093
3010
|
if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
3094
3011
|
return false;
|
|
3095
3012
|
}
|
|
3013
|
+
|
|
3096
3014
|
if (element.namespaceURI === SVG_NAMESPACE) {
|
|
3097
3015
|
// The only way to switch from HTML namespace to SVG
|
|
3098
3016
|
// is via <svg>. If it happens via any other tag, then
|
|
3099
3017
|
// it should be killed.
|
|
3100
3018
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
3101
3019
|
return tagName === 'svg';
|
|
3102
|
-
}
|
|
3103
|
-
|
|
3104
|
-
// The only way to switch from MathML to SVG is via`
|
|
3020
|
+
} // The only way to switch from MathML to SVG is via`
|
|
3105
3021
|
// svg if parent is either <annotation-xml> or MathML
|
|
3106
3022
|
// text integration points.
|
|
3023
|
+
|
|
3024
|
+
|
|
3107
3025
|
if (parent.namespaceURI === MATHML_NAMESPACE) {
|
|
3108
3026
|
return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
|
|
3109
|
-
}
|
|
3110
|
-
|
|
3111
|
-
// We only allow elements that are defined in SVG
|
|
3027
|
+
} // We only allow elements that are defined in SVG
|
|
3112
3028
|
// spec. All others are disallowed in SVG namespace.
|
|
3029
|
+
|
|
3030
|
+
|
|
3113
3031
|
return Boolean(ALL_SVG_TAGS[tagName]);
|
|
3114
3032
|
}
|
|
3033
|
+
|
|
3115
3034
|
if (element.namespaceURI === MATHML_NAMESPACE) {
|
|
3116
3035
|
// The only way to switch from HTML namespace to MathML
|
|
3117
3036
|
// is via <math>. If it happens via any other tag, then
|
|
3118
3037
|
// it should be killed.
|
|
3119
3038
|
if (parent.namespaceURI === HTML_NAMESPACE) {
|
|
3120
3039
|
return tagName === 'math';
|
|
3121
|
-
}
|
|
3122
|
-
|
|
3123
|
-
// The only way to switch from SVG to MathML is via
|
|
3040
|
+
} // The only way to switch from SVG to MathML is via
|
|
3124
3041
|
// <math> and HTML integration points
|
|
3042
|
+
|
|
3043
|
+
|
|
3125
3044
|
if (parent.namespaceURI === SVG_NAMESPACE) {
|
|
3126
3045
|
return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
|
|
3127
|
-
}
|
|
3128
|
-
|
|
3129
|
-
// We only allow elements that are defined in MathML
|
|
3046
|
+
} // We only allow elements that are defined in MathML
|
|
3130
3047
|
// spec. All others are disallowed in MathML namespace.
|
|
3048
|
+
|
|
3049
|
+
|
|
3131
3050
|
return Boolean(ALL_MATHML_TAGS[tagName]);
|
|
3132
3051
|
}
|
|
3052
|
+
|
|
3133
3053
|
if (element.namespaceURI === HTML_NAMESPACE) {
|
|
3134
3054
|
// The only way to switch from SVG to HTML is via
|
|
3135
3055
|
// HTML integration points, and from MathML to HTML
|
|
@@ -3137,50 +3057,54 @@ function createDOMPurify() {
|
|
|
3137
3057
|
if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
|
|
3138
3058
|
return false;
|
|
3139
3059
|
}
|
|
3060
|
+
|
|
3140
3061
|
if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
|
|
3141
3062
|
return false;
|
|
3142
|
-
}
|
|
3143
|
-
|
|
3144
|
-
// We disallow tags that are specific for MathML
|
|
3063
|
+
} // We disallow tags that are specific for MathML
|
|
3145
3064
|
// or SVG and should never appear in HTML namespace
|
|
3065
|
+
|
|
3066
|
+
|
|
3146
3067
|
return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
|
|
3147
|
-
}
|
|
3068
|
+
} // For XHTML and XML documents that support custom namespaces
|
|
3069
|
+
|
|
3148
3070
|
|
|
3149
|
-
// For XHTML and XML documents that support custom namespaces
|
|
3150
3071
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
|
|
3151
3072
|
return true;
|
|
3152
|
-
}
|
|
3153
|
-
|
|
3154
|
-
// The code should never reach this place (this means
|
|
3073
|
+
} // The code should never reach this place (this means
|
|
3155
3074
|
// that the element somehow got namespace that is not
|
|
3156
3075
|
// HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
|
|
3157
3076
|
// Return false just in case.
|
|
3077
|
+
|
|
3078
|
+
|
|
3158
3079
|
return false;
|
|
3159
3080
|
};
|
|
3160
|
-
|
|
3161
3081
|
/**
|
|
3162
3082
|
* _forceRemove
|
|
3163
3083
|
*
|
|
3164
3084
|
* @param {Node} node a DOM node
|
|
3165
3085
|
*/
|
|
3086
|
+
|
|
3087
|
+
|
|
3166
3088
|
const _forceRemove = function _forceRemove(node) {
|
|
3167
3089
|
arrayPush(DOMPurify.removed, {
|
|
3168
3090
|
element: node
|
|
3169
3091
|
});
|
|
3092
|
+
|
|
3170
3093
|
try {
|
|
3171
3094
|
// eslint-disable-next-line unicorn/prefer-dom-node-remove
|
|
3172
|
-
|
|
3095
|
+
node.parentNode.removeChild(node);
|
|
3173
3096
|
} catch (_) {
|
|
3174
|
-
remove(
|
|
3097
|
+
node.remove();
|
|
3175
3098
|
}
|
|
3176
3099
|
};
|
|
3177
|
-
|
|
3178
3100
|
/**
|
|
3179
3101
|
* _removeAttribute
|
|
3180
3102
|
*
|
|
3181
3103
|
* @param {String} name an Attribute name
|
|
3182
3104
|
* @param {Node} node a DOM node
|
|
3183
3105
|
*/
|
|
3106
|
+
|
|
3107
|
+
|
|
3184
3108
|
const _removeAttribute = function _removeAttribute(name, node) {
|
|
3185
3109
|
try {
|
|
3186
3110
|
arrayPush(DOMPurify.removed, {
|
|
@@ -3193,9 +3117,9 @@ function createDOMPurify() {
|
|
|
3193
3117
|
from: node
|
|
3194
3118
|
});
|
|
3195
3119
|
}
|
|
3196
|
-
node.removeAttribute(name);
|
|
3197
3120
|
|
|
3198
|
-
// We void attribute values for unremovable "is"" attributes
|
|
3121
|
+
node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
|
|
3122
|
+
|
|
3199
3123
|
if (name === 'is' && !ALLOWED_ATTR[name]) {
|
|
3200
3124
|
if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
|
|
3201
3125
|
try {
|
|
@@ -3208,17 +3132,19 @@ function createDOMPurify() {
|
|
|
3208
3132
|
}
|
|
3209
3133
|
}
|
|
3210
3134
|
};
|
|
3211
|
-
|
|
3212
3135
|
/**
|
|
3213
3136
|
* _initDocument
|
|
3214
3137
|
*
|
|
3215
3138
|
* @param {String} dirty a string of dirty markup
|
|
3216
3139
|
* @return {Document} a DOM, filled with the dirty markup
|
|
3217
3140
|
*/
|
|
3141
|
+
|
|
3142
|
+
|
|
3218
3143
|
const _initDocument = function _initDocument(dirty) {
|
|
3219
3144
|
/* Create a HTML document */
|
|
3220
|
-
let doc
|
|
3221
|
-
let leadingWhitespace
|
|
3145
|
+
let doc;
|
|
3146
|
+
let leadingWhitespace;
|
|
3147
|
+
|
|
3222
3148
|
if (FORCE_BODY) {
|
|
3223
3149
|
dirty = '<remove></remove>' + dirty;
|
|
3224
3150
|
} else {
|
|
@@ -3226,74 +3152,83 @@ function createDOMPurify() {
|
|
|
3226
3152
|
const matches = stringMatch(dirty, /^[\r\n\t ]+/);
|
|
3227
3153
|
leadingWhitespace = matches && matches[0];
|
|
3228
3154
|
}
|
|
3155
|
+
|
|
3229
3156
|
if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
|
|
3230
3157
|
// Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
|
|
3231
3158
|
dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
|
|
3232
3159
|
}
|
|
3160
|
+
|
|
3233
3161
|
const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
3234
3162
|
/*
|
|
3235
3163
|
* Use the DOMParser API by default, fallback later if needs be
|
|
3236
3164
|
* DOMParser not work for svg when has multiple root element.
|
|
3237
3165
|
*/
|
|
3166
|
+
|
|
3238
3167
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
3239
3168
|
try {
|
|
3240
3169
|
doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
|
|
3241
3170
|
} catch (_) {}
|
|
3242
3171
|
}
|
|
3243
|
-
|
|
3244
3172
|
/* Use createHTMLDocument in case DOMParser is not available */
|
|
3173
|
+
|
|
3174
|
+
|
|
3245
3175
|
if (!doc || !doc.documentElement) {
|
|
3246
3176
|
doc = implementation.createDocument(NAMESPACE, 'template', null);
|
|
3177
|
+
|
|
3247
3178
|
try {
|
|
3248
3179
|
doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
|
|
3249
|
-
} catch (_) {
|
|
3250
|
-
// Syntax error if dirtyPayload is invalid xml
|
|
3180
|
+
} catch (_) {// Syntax error if dirtyPayload is invalid xml
|
|
3251
3181
|
}
|
|
3252
3182
|
}
|
|
3183
|
+
|
|
3253
3184
|
const body = doc.body || doc.documentElement;
|
|
3185
|
+
|
|
3254
3186
|
if (dirty && leadingWhitespace) {
|
|
3255
3187
|
body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
|
|
3256
3188
|
}
|
|
3257
|
-
|
|
3258
3189
|
/* Work on whole document or just its body */
|
|
3190
|
+
|
|
3191
|
+
|
|
3259
3192
|
if (NAMESPACE === HTML_NAMESPACE) {
|
|
3260
3193
|
return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
|
|
3261
3194
|
}
|
|
3195
|
+
|
|
3262
3196
|
return WHOLE_DOCUMENT ? doc.documentElement : body;
|
|
3263
3197
|
};
|
|
3264
|
-
|
|
3265
3198
|
/**
|
|
3266
|
-
*
|
|
3199
|
+
* _createIterator
|
|
3267
3200
|
*
|
|
3268
|
-
* @param {
|
|
3269
|
-
* @return {
|
|
3201
|
+
* @param {Document} root document/fragment to create iterator for
|
|
3202
|
+
* @return {Iterator} iterator instance
|
|
3270
3203
|
*/
|
|
3271
|
-
const _createNodeIterator = function _createNodeIterator(root) {
|
|
3272
|
-
return createNodeIterator.call(root.ownerDocument || root, root,
|
|
3273
|
-
// eslint-disable-next-line no-bitwise
|
|
3274
|
-
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
|
|
3275
|
-
};
|
|
3276
3204
|
|
|
3205
|
+
|
|
3206
|
+
const _createIterator = function _createIterator(root) {
|
|
3207
|
+
return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
|
|
3208
|
+
NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
|
|
3209
|
+
};
|
|
3277
3210
|
/**
|
|
3278
3211
|
* _isClobbered
|
|
3279
3212
|
*
|
|
3280
3213
|
* @param {Node} elm element to check for clobbering attacks
|
|
3281
3214
|
* @return {Boolean} true if clobbered, false if safe
|
|
3282
3215
|
*/
|
|
3216
|
+
|
|
3217
|
+
|
|
3283
3218
|
const _isClobbered = function _isClobbered(elm) {
|
|
3284
3219
|
return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
|
|
3285
3220
|
};
|
|
3286
|
-
|
|
3287
3221
|
/**
|
|
3288
|
-
*
|
|
3222
|
+
* _isNode
|
|
3289
3223
|
*
|
|
3290
|
-
* @param {Node}
|
|
3224
|
+
* @param {Node} obj object to check whether it's a DOM node
|
|
3291
3225
|
* @return {Boolean} true is object is a DOM node
|
|
3292
3226
|
*/
|
|
3227
|
+
|
|
3228
|
+
|
|
3293
3229
|
const _isNode = function _isNode(object) {
|
|
3294
|
-
return typeof Node === '
|
|
3230
|
+
return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
|
|
3295
3231
|
};
|
|
3296
|
-
|
|
3297
3232
|
/**
|
|
3298
3233
|
* _executeHook
|
|
3299
3234
|
* Execute user configurable hooks
|
|
@@ -3302,15 +3237,17 @@ function createDOMPurify() {
|
|
|
3302
3237
|
* @param {Node} currentNode node to work on with the hook
|
|
3303
3238
|
* @param {Object} data additional hook parameters
|
|
3304
3239
|
*/
|
|
3240
|
+
|
|
3241
|
+
|
|
3305
3242
|
const _executeHook = function _executeHook(entryPoint, currentNode, data) {
|
|
3306
3243
|
if (!hooks[entryPoint]) {
|
|
3307
3244
|
return;
|
|
3308
3245
|
}
|
|
3246
|
+
|
|
3309
3247
|
arrayForEach(hooks[entryPoint], hook => {
|
|
3310
3248
|
hook.call(DOMPurify, currentNode, data, CONFIG);
|
|
3311
3249
|
});
|
|
3312
3250
|
};
|
|
3313
|
-
|
|
3314
3251
|
/**
|
|
3315
3252
|
* _sanitizeElements
|
|
3316
3253
|
*
|
|
@@ -3321,93 +3258,94 @@ function createDOMPurify() {
|
|
|
3321
3258
|
* @param {Node} currentNode to check for permission to exist
|
|
3322
3259
|
* @return {Boolean} true if node was killed, false if left alive
|
|
3323
3260
|
*/
|
|
3324
|
-
const _sanitizeElements = function _sanitizeElements(currentNode) {
|
|
3325
|
-
let content = null;
|
|
3326
3261
|
|
|
3262
|
+
|
|
3263
|
+
const _sanitizeElements = function _sanitizeElements(currentNode) {
|
|
3264
|
+
let content;
|
|
3327
3265
|
/* Execute a hook if present */
|
|
3328
|
-
_executeHook('beforeSanitizeElements', currentNode, null);
|
|
3329
3266
|
|
|
3267
|
+
_executeHook('beforeSanitizeElements', currentNode, null);
|
|
3330
3268
|
/* Check if element is clobbered or can clobber */
|
|
3269
|
+
|
|
3270
|
+
|
|
3331
3271
|
if (_isClobbered(currentNode)) {
|
|
3332
3272
|
_forceRemove(currentNode);
|
|
3273
|
+
|
|
3333
3274
|
return true;
|
|
3334
3275
|
}
|
|
3335
|
-
|
|
3336
3276
|
/* Now let's check the element's type and name */
|
|
3337
|
-
const tagName = transformCaseFunc(currentNode.nodeName);
|
|
3338
3277
|
|
|
3278
|
+
|
|
3279
|
+
const tagName = transformCaseFunc(currentNode.nodeName);
|
|
3339
3280
|
/* Execute a hook if present */
|
|
3281
|
+
|
|
3340
3282
|
_executeHook('uponSanitizeElement', currentNode, {
|
|
3341
3283
|
tagName,
|
|
3342
3284
|
allowedTags: ALLOWED_TAGS
|
|
3343
3285
|
});
|
|
3344
|
-
|
|
3345
3286
|
/* Detect mXSS attempts abusing namespace confusion */
|
|
3346
|
-
if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
|
|
3347
|
-
_forceRemove(currentNode);
|
|
3348
|
-
return true;
|
|
3349
|
-
}
|
|
3350
3287
|
|
|
3351
|
-
/* Remove any occurrence of processing instructions */
|
|
3352
|
-
if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
|
|
3353
|
-
_forceRemove(currentNode);
|
|
3354
|
-
return true;
|
|
3355
|
-
}
|
|
3356
3288
|
|
|
3357
|
-
|
|
3358
|
-
if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
|
|
3289
|
+
if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
|
|
3359
3290
|
_forceRemove(currentNode);
|
|
3291
|
+
|
|
3360
3292
|
return true;
|
|
3361
3293
|
}
|
|
3362
|
-
|
|
3363
3294
|
/* Remove element if anything forbids its presence */
|
|
3295
|
+
|
|
3296
|
+
|
|
3364
3297
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
3365
3298
|
/* Check if we have a custom element to handle */
|
|
3366
|
-
if (!FORBID_TAGS[tagName] &&
|
|
3367
|
-
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName))
|
|
3368
|
-
|
|
3369
|
-
}
|
|
3370
|
-
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
|
|
3371
|
-
return false;
|
|
3372
|
-
}
|
|
3299
|
+
if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
|
|
3300
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
|
|
3301
|
+
if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
|
|
3373
3302
|
}
|
|
3374
|
-
|
|
3375
3303
|
/* Keep content except for bad-listed elements */
|
|
3304
|
+
|
|
3305
|
+
|
|
3376
3306
|
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
|
|
3377
3307
|
const parentNode = getParentNode(currentNode) || currentNode.parentNode;
|
|
3378
3308
|
const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
|
|
3309
|
+
|
|
3379
3310
|
if (childNodes && parentNode) {
|
|
3380
3311
|
const childCount = childNodes.length;
|
|
3312
|
+
|
|
3381
3313
|
for (let i = childCount - 1; i >= 0; --i) {
|
|
3382
|
-
|
|
3383
|
-
childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
|
|
3384
|
-
parentNode.insertBefore(childClone, getNextSibling(currentNode));
|
|
3314
|
+
parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
|
|
3385
3315
|
}
|
|
3386
3316
|
}
|
|
3387
3317
|
}
|
|
3318
|
+
|
|
3388
3319
|
_forceRemove(currentNode);
|
|
3320
|
+
|
|
3389
3321
|
return true;
|
|
3390
3322
|
}
|
|
3391
|
-
|
|
3392
3323
|
/* Check whether element has a valid namespace */
|
|
3324
|
+
|
|
3325
|
+
|
|
3393
3326
|
if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
|
|
3394
3327
|
_forceRemove(currentNode);
|
|
3328
|
+
|
|
3395
3329
|
return true;
|
|
3396
3330
|
}
|
|
3397
|
-
|
|
3398
3331
|
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
3332
|
+
|
|
3333
|
+
|
|
3399
3334
|
if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
3400
3335
|
_forceRemove(currentNode);
|
|
3336
|
+
|
|
3401
3337
|
return true;
|
|
3402
3338
|
}
|
|
3403
|
-
|
|
3404
3339
|
/* Sanitize element content to be template-safe */
|
|
3405
|
-
|
|
3340
|
+
|
|
3341
|
+
|
|
3342
|
+
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
|
|
3406
3343
|
/* Get the element's text content */
|
|
3407
3344
|
content = currentNode.textContent;
|
|
3408
|
-
|
|
3409
|
-
|
|
3410
|
-
|
|
3345
|
+
content = stringReplace(content, MUSTACHE_EXPR, ' ');
|
|
3346
|
+
content = stringReplace(content, ERB_EXPR, ' ');
|
|
3347
|
+
content = stringReplace(content, TMPLIT_EXPR, ' ');
|
|
3348
|
+
|
|
3411
3349
|
if (currentNode.textContent !== content) {
|
|
3412
3350
|
arrayPush(DOMPurify.removed, {
|
|
3413
3351
|
element: currentNode.cloneNode()
|
|
@@ -3415,12 +3353,13 @@ function createDOMPurify() {
|
|
|
3415
3353
|
currentNode.textContent = content;
|
|
3416
3354
|
}
|
|
3417
3355
|
}
|
|
3418
|
-
|
|
3419
3356
|
/* Execute a hook if present */
|
|
3357
|
+
|
|
3358
|
+
|
|
3420
3359
|
_executeHook('afterSanitizeElements', currentNode, null);
|
|
3360
|
+
|
|
3421
3361
|
return false;
|
|
3422
3362
|
};
|
|
3423
|
-
|
|
3424
3363
|
/**
|
|
3425
3364
|
* _isValidAttribute
|
|
3426
3365
|
*
|
|
@@ -3430,46 +3369,47 @@ function createDOMPurify() {
|
|
|
3430
3369
|
* @return {Boolean} Returns true if `value` is valid, otherwise false.
|
|
3431
3370
|
*/
|
|
3432
3371
|
// eslint-disable-next-line complexity
|
|
3372
|
+
|
|
3373
|
+
|
|
3433
3374
|
const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
|
|
3434
3375
|
/* Make sure attribute cannot clobber */
|
|
3435
3376
|
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
|
|
3436
3377
|
return false;
|
|
3437
3378
|
}
|
|
3438
|
-
|
|
3439
3379
|
/* Allow valid data-* attributes: At least one character after "-"
|
|
3440
3380
|
(https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
|
|
3441
3381
|
XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
|
|
3442
3382
|
We don't need to check the value; it's always URI safe. */
|
|
3383
|
+
|
|
3384
|
+
|
|
3443
3385
|
if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
|
|
3444
|
-
if (
|
|
3445
|
-
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
3386
|
+
if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
3446
3387
|
// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
3447
3388
|
// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
|
|
3448
|
-
|
|
3449
|
-
// Alternative, second condition checks if it's an `is`-attribute, AND
|
|
3389
|
+
_basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
|
|
3450
3390
|
// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
3451
3391
|
lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
|
|
3452
3392
|
return false;
|
|
3453
3393
|
}
|
|
3454
3394
|
/* Check value is safe. First, is attr inert? If so, is safe */
|
|
3395
|
+
|
|
3455
3396
|
} else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
|
|
3456
3397
|
return false;
|
|
3457
3398
|
} else ;
|
|
3399
|
+
|
|
3458
3400
|
return true;
|
|
3459
3401
|
};
|
|
3460
|
-
|
|
3461
3402
|
/**
|
|
3462
|
-
*
|
|
3403
|
+
* _basicCustomElementCheck
|
|
3463
3404
|
* checks if at least one dash is included in tagName, and it's not the first char
|
|
3464
3405
|
* for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
|
|
3465
|
-
*
|
|
3466
3406
|
* @param {string} tagName name of the tag of the node to sanitize
|
|
3467
|
-
* @returns {boolean} Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
|
|
3468
3407
|
*/
|
|
3469
|
-
const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
|
|
3470
|
-
return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
|
|
3471
|
-
};
|
|
3472
3408
|
|
|
3409
|
+
|
|
3410
|
+
const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
|
|
3411
|
+
return tagName.indexOf('-') > 0;
|
|
3412
|
+
};
|
|
3473
3413
|
/**
|
|
3474
3414
|
* _sanitizeAttributes
|
|
3475
3415
|
*
|
|
@@ -3480,94 +3420,107 @@ function createDOMPurify() {
|
|
|
3480
3420
|
*
|
|
3481
3421
|
* @param {Node} currentNode to sanitize
|
|
3482
3422
|
*/
|
|
3423
|
+
|
|
3424
|
+
|
|
3483
3425
|
const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
|
|
3426
|
+
let attr;
|
|
3427
|
+
let value;
|
|
3428
|
+
let lcName;
|
|
3429
|
+
let l;
|
|
3484
3430
|
/* Execute a hook if present */
|
|
3431
|
+
|
|
3485
3432
|
_executeHook('beforeSanitizeAttributes', currentNode, null);
|
|
3433
|
+
|
|
3486
3434
|
const {
|
|
3487
3435
|
attributes
|
|
3488
3436
|
} = currentNode;
|
|
3489
|
-
|
|
3490
3437
|
/* Check if we have attributes; if not we might have a text node */
|
|
3438
|
+
|
|
3491
3439
|
if (!attributes) {
|
|
3492
3440
|
return;
|
|
3493
3441
|
}
|
|
3442
|
+
|
|
3494
3443
|
const hookEvent = {
|
|
3495
3444
|
attrName: '',
|
|
3496
3445
|
attrValue: '',
|
|
3497
3446
|
keepAttr: true,
|
|
3498
3447
|
allowedAttributes: ALLOWED_ATTR
|
|
3499
3448
|
};
|
|
3500
|
-
|
|
3501
|
-
|
|
3449
|
+
l = attributes.length;
|
|
3502
3450
|
/* Go backwards over all attributes; safely remove bad ones */
|
|
3451
|
+
|
|
3503
3452
|
while (l--) {
|
|
3504
|
-
|
|
3453
|
+
attr = attributes[l];
|
|
3505
3454
|
const {
|
|
3506
3455
|
name,
|
|
3507
|
-
namespaceURI
|
|
3508
|
-
value: attrValue
|
|
3456
|
+
namespaceURI
|
|
3509
3457
|
} = attr;
|
|
3510
|
-
|
|
3511
|
-
|
|
3512
|
-
|
|
3458
|
+
value = name === 'value' ? attr.value : stringTrim(attr.value);
|
|
3459
|
+
lcName = transformCaseFunc(name);
|
|
3513
3460
|
/* Execute a hook if present */
|
|
3461
|
+
|
|
3514
3462
|
hookEvent.attrName = lcName;
|
|
3515
3463
|
hookEvent.attrValue = value;
|
|
3516
3464
|
hookEvent.keepAttr = true;
|
|
3517
3465
|
hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
|
|
3518
|
-
_executeHook('uponSanitizeAttribute', currentNode, hookEvent);
|
|
3519
|
-
value = hookEvent.attrValue;
|
|
3520
3466
|
|
|
3521
|
-
|
|
3522
|
-
if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
|
|
3523
|
-
_removeAttribute(name, currentNode);
|
|
3524
|
-
continue;
|
|
3525
|
-
}
|
|
3467
|
+
_executeHook('uponSanitizeAttribute', currentNode, hookEvent);
|
|
3526
3468
|
|
|
3469
|
+
value = hookEvent.attrValue;
|
|
3527
3470
|
/* Did the hooks approve of the attribute? */
|
|
3471
|
+
|
|
3528
3472
|
if (hookEvent.forceKeepAttr) {
|
|
3529
3473
|
continue;
|
|
3530
3474
|
}
|
|
3531
|
-
|
|
3532
3475
|
/* Remove attribute */
|
|
3533
|
-
_removeAttribute(name, currentNode);
|
|
3534
3476
|
|
|
3477
|
+
|
|
3478
|
+
_removeAttribute(name, currentNode);
|
|
3535
3479
|
/* Did the hooks approve of the attribute? */
|
|
3480
|
+
|
|
3481
|
+
|
|
3536
3482
|
if (!hookEvent.keepAttr) {
|
|
3537
3483
|
continue;
|
|
3538
3484
|
}
|
|
3539
|
-
|
|
3540
3485
|
/* Work around a security issue in jQuery 3.0 */
|
|
3486
|
+
|
|
3487
|
+
|
|
3541
3488
|
if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
|
|
3542
3489
|
_removeAttribute(name, currentNode);
|
|
3490
|
+
|
|
3543
3491
|
continue;
|
|
3544
3492
|
}
|
|
3545
|
-
|
|
3546
3493
|
/* Sanitize attribute content to be template-safe */
|
|
3494
|
+
|
|
3495
|
+
|
|
3547
3496
|
if (SAFE_FOR_TEMPLATES) {
|
|
3548
|
-
|
|
3549
|
-
|
|
3550
|
-
|
|
3497
|
+
value = stringReplace(value, MUSTACHE_EXPR, ' ');
|
|
3498
|
+
value = stringReplace(value, ERB_EXPR, ' ');
|
|
3499
|
+
value = stringReplace(value, TMPLIT_EXPR, ' ');
|
|
3551
3500
|
}
|
|
3552
|
-
|
|
3553
3501
|
/* Is `value` valid for this attribute? */
|
|
3502
|
+
|
|
3503
|
+
|
|
3554
3504
|
const lcTag = transformCaseFunc(currentNode.nodeName);
|
|
3505
|
+
|
|
3555
3506
|
if (!_isValidAttribute(lcTag, lcName, value)) {
|
|
3556
3507
|
continue;
|
|
3557
3508
|
}
|
|
3558
|
-
|
|
3559
3509
|
/* Full DOM Clobbering protection via namespace isolation,
|
|
3560
3510
|
* Prefix id and name attributes with `user-content-`
|
|
3561
3511
|
*/
|
|
3512
|
+
|
|
3513
|
+
|
|
3562
3514
|
if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
|
|
3563
3515
|
// Remove the attribute with this value
|
|
3564
|
-
_removeAttribute(name, currentNode);
|
|
3516
|
+
_removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
|
|
3517
|
+
|
|
3565
3518
|
|
|
3566
|
-
// Prefix the value and later re-create the attribute with the sanitized value
|
|
3567
3519
|
value = SANITIZE_NAMED_PROPS_PREFIX + value;
|
|
3568
3520
|
}
|
|
3569
|
-
|
|
3570
3521
|
/* Handle attributes that require Trusted Types */
|
|
3522
|
+
|
|
3523
|
+
|
|
3571
3524
|
if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
|
|
3572
3525
|
if (namespaceURI) ; else {
|
|
3573
3526
|
switch (trustedTypes.getAttributeType(lcTag, lcName)) {
|
|
@@ -3576,6 +3529,7 @@ function createDOMPurify() {
|
|
|
3576
3529
|
value = trustedTypesPolicy.createHTML(value);
|
|
3577
3530
|
break;
|
|
3578
3531
|
}
|
|
3532
|
+
|
|
3579
3533
|
case 'TrustedScriptURL':
|
|
3580
3534
|
{
|
|
3581
3535
|
value = trustedTypesPolicy.createScriptURL(value);
|
|
@@ -3584,8 +3538,9 @@ function createDOMPurify() {
|
|
|
3584
3538
|
}
|
|
3585
3539
|
}
|
|
3586
3540
|
}
|
|
3587
|
-
|
|
3588
3541
|
/* Handle invalid data-* attribute set by try-catching it */
|
|
3542
|
+
|
|
3543
|
+
|
|
3589
3544
|
try {
|
|
3590
3545
|
if (namespaceURI) {
|
|
3591
3546
|
currentNode.setAttributeNS(namespaceURI, name, value);
|
|
@@ -3593,77 +3548,88 @@ function createDOMPurify() {
|
|
|
3593
3548
|
/* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
|
|
3594
3549
|
currentNode.setAttribute(name, value);
|
|
3595
3550
|
}
|
|
3596
|
-
|
|
3597
|
-
|
|
3598
|
-
} else {
|
|
3599
|
-
arrayPop(DOMPurify.removed);
|
|
3600
|
-
}
|
|
3551
|
+
|
|
3552
|
+
arrayPop(DOMPurify.removed);
|
|
3601
3553
|
} catch (_) {}
|
|
3602
3554
|
}
|
|
3603
|
-
|
|
3604
3555
|
/* Execute a hook if present */
|
|
3556
|
+
|
|
3557
|
+
|
|
3605
3558
|
_executeHook('afterSanitizeAttributes', currentNode, null);
|
|
3606
3559
|
};
|
|
3607
|
-
|
|
3608
3560
|
/**
|
|
3609
3561
|
* _sanitizeShadowDOM
|
|
3610
3562
|
*
|
|
3611
3563
|
* @param {DocumentFragment} fragment to iterate over recursively
|
|
3612
3564
|
*/
|
|
3565
|
+
|
|
3566
|
+
|
|
3613
3567
|
const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
|
|
3614
|
-
let shadowNode
|
|
3615
|
-
const shadowIterator = _createNodeIterator(fragment);
|
|
3568
|
+
let shadowNode;
|
|
3616
3569
|
|
|
3570
|
+
const shadowIterator = _createIterator(fragment);
|
|
3617
3571
|
/* Execute a hook if present */
|
|
3572
|
+
|
|
3573
|
+
|
|
3618
3574
|
_executeHook('beforeSanitizeShadowDOM', fragment, null);
|
|
3575
|
+
|
|
3619
3576
|
while (shadowNode = shadowIterator.nextNode()) {
|
|
3620
3577
|
/* Execute a hook if present */
|
|
3621
3578
|
_executeHook('uponSanitizeShadowNode', shadowNode, null);
|
|
3622
|
-
|
|
3623
3579
|
/* Sanitize tags and elements */
|
|
3580
|
+
|
|
3581
|
+
|
|
3624
3582
|
if (_sanitizeElements(shadowNode)) {
|
|
3625
3583
|
continue;
|
|
3626
3584
|
}
|
|
3627
|
-
|
|
3628
3585
|
/* Deep shadow DOM detected */
|
|
3586
|
+
|
|
3587
|
+
|
|
3629
3588
|
if (shadowNode.content instanceof DocumentFragment) {
|
|
3630
3589
|
_sanitizeShadowDOM(shadowNode.content);
|
|
3631
3590
|
}
|
|
3632
|
-
|
|
3633
3591
|
/* Check attributes, sanitize if necessary */
|
|
3592
|
+
|
|
3593
|
+
|
|
3634
3594
|
_sanitizeAttributes(shadowNode);
|
|
3635
3595
|
}
|
|
3636
|
-
|
|
3637
3596
|
/* Execute a hook if present */
|
|
3597
|
+
|
|
3598
|
+
|
|
3638
3599
|
_executeHook('afterSanitizeShadowDOM', fragment, null);
|
|
3639
3600
|
};
|
|
3640
|
-
|
|
3641
3601
|
/**
|
|
3642
3602
|
* Sanitize
|
|
3643
3603
|
* Public method providing core sanitation functionality
|
|
3644
3604
|
*
|
|
3645
3605
|
* @param {String|Node} dirty string or DOM node
|
|
3646
|
-
* @param {Object}
|
|
3606
|
+
* @param {Object} configuration object
|
|
3647
3607
|
*/
|
|
3648
3608
|
// eslint-disable-next-line complexity
|
|
3609
|
+
|
|
3610
|
+
|
|
3649
3611
|
DOMPurify.sanitize = function (dirty) {
|
|
3650
3612
|
let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
|
|
3651
|
-
let body
|
|
3652
|
-
let importedNode
|
|
3653
|
-
let currentNode
|
|
3654
|
-
let returnNode
|
|
3613
|
+
let body;
|
|
3614
|
+
let importedNode;
|
|
3615
|
+
let currentNode;
|
|
3616
|
+
let returnNode;
|
|
3655
3617
|
/* Make sure we have a string to sanitize.
|
|
3656
3618
|
DO NOT return early, as this will return the wrong type if
|
|
3657
3619
|
the user has requested a DOM object rather than a string */
|
|
3620
|
+
|
|
3658
3621
|
IS_EMPTY_INPUT = !dirty;
|
|
3622
|
+
|
|
3659
3623
|
if (IS_EMPTY_INPUT) {
|
|
3660
3624
|
dirty = '<!-->';
|
|
3661
3625
|
}
|
|
3662
|
-
|
|
3663
3626
|
/* Stringify, in case dirty is an object */
|
|
3627
|
+
|
|
3628
|
+
|
|
3664
3629
|
if (typeof dirty !== 'string' && !_isNode(dirty)) {
|
|
3665
3630
|
if (typeof dirty.toString === 'function') {
|
|
3666
3631
|
dirty = dirty.toString();
|
|
3632
|
+
|
|
3667
3633
|
if (typeof dirty !== 'string') {
|
|
3668
3634
|
throw typeErrorCreate('dirty is not a string, aborting');
|
|
3669
3635
|
}
|
|
@@ -3671,28 +3637,33 @@ function createDOMPurify() {
|
|
|
3671
3637
|
throw typeErrorCreate('toString is not a function');
|
|
3672
3638
|
}
|
|
3673
3639
|
}
|
|
3674
|
-
|
|
3675
3640
|
/* Return dirty HTML if DOMPurify cannot run */
|
|
3641
|
+
|
|
3642
|
+
|
|
3676
3643
|
if (!DOMPurify.isSupported) {
|
|
3677
3644
|
return dirty;
|
|
3678
3645
|
}
|
|
3679
|
-
|
|
3680
3646
|
/* Assign config vars */
|
|
3647
|
+
|
|
3648
|
+
|
|
3681
3649
|
if (!SET_CONFIG) {
|
|
3682
3650
|
_parseConfig(cfg);
|
|
3683
3651
|
}
|
|
3684
|
-
|
|
3685
3652
|
/* Clean up removed elements */
|
|
3686
|
-
DOMPurify.removed = [];
|
|
3687
3653
|
|
|
3654
|
+
|
|
3655
|
+
DOMPurify.removed = [];
|
|
3688
3656
|
/* Check if dirty is correctly typed for IN_PLACE */
|
|
3657
|
+
|
|
3689
3658
|
if (typeof dirty === 'string') {
|
|
3690
3659
|
IN_PLACE = false;
|
|
3691
3660
|
}
|
|
3661
|
+
|
|
3692
3662
|
if (IN_PLACE) {
|
|
3693
3663
|
/* Do some early pre-sanitization to avoid unsafe root nodes */
|
|
3694
3664
|
if (dirty.nodeName) {
|
|
3695
3665
|
const tagName = transformCaseFunc(dirty.nodeName);
|
|
3666
|
+
|
|
3696
3667
|
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
|
3697
3668
|
throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
|
|
3698
3669
|
}
|
|
@@ -3702,7 +3673,8 @@ function createDOMPurify() {
|
|
|
3702
3673
|
elements being stripped by the parser */
|
|
3703
3674
|
body = _initDocument('<!---->');
|
|
3704
3675
|
importedNode = body.ownerDocument.importNode(dirty, true);
|
|
3705
|
-
|
|
3676
|
+
|
|
3677
|
+
if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
|
|
3706
3678
|
/* Node is already a body, use as is */
|
|
3707
3679
|
body = importedNode;
|
|
3708
3680
|
} else if (importedNode.nodeName === 'HTML') {
|
|
@@ -3713,54 +3685,62 @@ function createDOMPurify() {
|
|
|
3713
3685
|
}
|
|
3714
3686
|
} else {
|
|
3715
3687
|
/* Exit directly if we have nothing to do */
|
|
3716
|
-
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
|
|
3717
|
-
// eslint-disable-next-line unicorn/prefer-includes
|
|
3688
|
+
if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
|
|
3718
3689
|
dirty.indexOf('<') === -1) {
|
|
3719
3690
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
|
|
3720
3691
|
}
|
|
3721
|
-
|
|
3722
3692
|
/* Initialize the document to work on */
|
|
3723
|
-
body = _initDocument(dirty);
|
|
3724
3693
|
|
|
3694
|
+
|
|
3695
|
+
body = _initDocument(dirty);
|
|
3725
3696
|
/* Check we have a DOM node from the data */
|
|
3697
|
+
|
|
3726
3698
|
if (!body) {
|
|
3727
3699
|
return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
|
|
3728
3700
|
}
|
|
3729
3701
|
}
|
|
3730
|
-
|
|
3731
3702
|
/* Remove first element node (ours) if FORCE_BODY is set */
|
|
3703
|
+
|
|
3704
|
+
|
|
3732
3705
|
if (body && FORCE_BODY) {
|
|
3733
3706
|
_forceRemove(body.firstChild);
|
|
3734
3707
|
}
|
|
3735
|
-
|
|
3736
3708
|
/* Get node iterator */
|
|
3737
|
-
const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
|
|
3738
3709
|
|
|
3710
|
+
|
|
3711
|
+
const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
|
|
3739
3712
|
/* Now start iterating over the created document */
|
|
3713
|
+
|
|
3714
|
+
|
|
3740
3715
|
while (currentNode = nodeIterator.nextNode()) {
|
|
3741
3716
|
/* Sanitize tags and elements */
|
|
3742
3717
|
if (_sanitizeElements(currentNode)) {
|
|
3743
3718
|
continue;
|
|
3744
3719
|
}
|
|
3745
|
-
|
|
3746
3720
|
/* Shadow DOM detected, sanitize it */
|
|
3721
|
+
|
|
3722
|
+
|
|
3747
3723
|
if (currentNode.content instanceof DocumentFragment) {
|
|
3748
3724
|
_sanitizeShadowDOM(currentNode.content);
|
|
3749
3725
|
}
|
|
3750
|
-
|
|
3751
3726
|
/* Check attributes, sanitize if necessary */
|
|
3727
|
+
|
|
3728
|
+
|
|
3752
3729
|
_sanitizeAttributes(currentNode);
|
|
3753
3730
|
}
|
|
3754
|
-
|
|
3755
3731
|
/* If we sanitized `dirty` in-place, return it. */
|
|
3732
|
+
|
|
3733
|
+
|
|
3756
3734
|
if (IN_PLACE) {
|
|
3757
3735
|
return dirty;
|
|
3758
3736
|
}
|
|
3759
|
-
|
|
3760
3737
|
/* Return sanitized string or DOM */
|
|
3738
|
+
|
|
3739
|
+
|
|
3761
3740
|
if (RETURN_DOM) {
|
|
3762
3741
|
if (RETURN_DOM_FRAGMENT) {
|
|
3763
3742
|
returnNode = createDocumentFragment.call(body.ownerDocument);
|
|
3743
|
+
|
|
3764
3744
|
while (body.firstChild) {
|
|
3765
3745
|
// eslint-disable-next-line unicorn/prefer-dom-node-append
|
|
3766
3746
|
returnNode.appendChild(body.firstChild);
|
|
@@ -3768,6 +3748,7 @@ function createDOMPurify() {
|
|
|
3768
3748
|
} else {
|
|
3769
3749
|
returnNode = body;
|
|
3770
3750
|
}
|
|
3751
|
+
|
|
3771
3752
|
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
3772
3753
|
/*
|
|
3773
3754
|
AdoptNode() is not used because internal state is not reset
|
|
@@ -3778,66 +3759,73 @@ function createDOMPurify() {
|
|
|
3778
3759
|
*/
|
|
3779
3760
|
returnNode = importNode.call(originalDocument, returnNode, true);
|
|
3780
3761
|
}
|
|
3762
|
+
|
|
3781
3763
|
return returnNode;
|
|
3782
3764
|
}
|
|
3783
|
-
let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
|
3784
3765
|
|
|
3766
|
+
let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
|
3785
3767
|
/* Serialize doctype if allowed */
|
|
3768
|
+
|
|
3786
3769
|
if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
|
|
3787
3770
|
serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
|
|
3788
3771
|
}
|
|
3789
|
-
|
|
3790
3772
|
/* Sanitize final string template-safe */
|
|
3773
|
+
|
|
3774
|
+
|
|
3791
3775
|
if (SAFE_FOR_TEMPLATES) {
|
|
3792
|
-
|
|
3793
|
-
|
|
3794
|
-
|
|
3776
|
+
serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');
|
|
3777
|
+
serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');
|
|
3778
|
+
serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');
|
|
3795
3779
|
}
|
|
3780
|
+
|
|
3796
3781
|
return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
|
|
3797
3782
|
};
|
|
3798
|
-
|
|
3799
3783
|
/**
|
|
3800
3784
|
* Public method to set the configuration once
|
|
3801
3785
|
* setConfig
|
|
3802
3786
|
*
|
|
3803
3787
|
* @param {Object} cfg configuration object
|
|
3804
3788
|
*/
|
|
3805
|
-
|
|
3806
|
-
|
|
3789
|
+
|
|
3790
|
+
|
|
3791
|
+
DOMPurify.setConfig = function (cfg) {
|
|
3807
3792
|
_parseConfig(cfg);
|
|
3793
|
+
|
|
3808
3794
|
SET_CONFIG = true;
|
|
3809
3795
|
};
|
|
3810
|
-
|
|
3811
3796
|
/**
|
|
3812
3797
|
* Public method to remove the configuration
|
|
3813
3798
|
* clearConfig
|
|
3814
3799
|
*
|
|
3815
3800
|
*/
|
|
3801
|
+
|
|
3802
|
+
|
|
3816
3803
|
DOMPurify.clearConfig = function () {
|
|
3817
3804
|
CONFIG = null;
|
|
3818
3805
|
SET_CONFIG = false;
|
|
3819
3806
|
};
|
|
3820
|
-
|
|
3821
3807
|
/**
|
|
3822
3808
|
* Public method to check if an attribute value is valid.
|
|
3823
3809
|
* Uses last set config, if any. Otherwise, uses config defaults.
|
|
3824
3810
|
* isValidAttribute
|
|
3825
3811
|
*
|
|
3826
|
-
* @param {
|
|
3827
|
-
* @param {
|
|
3828
|
-
* @param {
|
|
3812
|
+
* @param {string} tag Tag name of containing element.
|
|
3813
|
+
* @param {string} attr Attribute name.
|
|
3814
|
+
* @param {string} value Attribute value.
|
|
3829
3815
|
* @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
|
|
3830
3816
|
*/
|
|
3817
|
+
|
|
3818
|
+
|
|
3831
3819
|
DOMPurify.isValidAttribute = function (tag, attr, value) {
|
|
3832
3820
|
/* Initialize shared config vars if necessary. */
|
|
3833
3821
|
if (!CONFIG) {
|
|
3834
3822
|
_parseConfig({});
|
|
3835
3823
|
}
|
|
3824
|
+
|
|
3836
3825
|
const lcTag = transformCaseFunc(tag);
|
|
3837
3826
|
const lcName = transformCaseFunc(attr);
|
|
3838
3827
|
return _isValidAttribute(lcTag, lcName, value);
|
|
3839
3828
|
};
|
|
3840
|
-
|
|
3841
3829
|
/**
|
|
3842
3830
|
* AddHook
|
|
3843
3831
|
* Public method to add DOMPurify hooks
|
|
@@ -3845,14 +3833,16 @@ function createDOMPurify() {
|
|
|
3845
3833
|
* @param {String} entryPoint entry point for the hook to add
|
|
3846
3834
|
* @param {Function} hookFunction function to execute
|
|
3847
3835
|
*/
|
|
3836
|
+
|
|
3837
|
+
|
|
3848
3838
|
DOMPurify.addHook = function (entryPoint, hookFunction) {
|
|
3849
3839
|
if (typeof hookFunction !== 'function') {
|
|
3850
3840
|
return;
|
|
3851
3841
|
}
|
|
3842
|
+
|
|
3852
3843
|
hooks[entryPoint] = hooks[entryPoint] || [];
|
|
3853
3844
|
arrayPush(hooks[entryPoint], hookFunction);
|
|
3854
3845
|
};
|
|
3855
|
-
|
|
3856
3846
|
/**
|
|
3857
3847
|
* RemoveHook
|
|
3858
3848
|
* Public method to remove a DOMPurify hook at a given entryPoint
|
|
@@ -3861,33 +3851,40 @@ function createDOMPurify() {
|
|
|
3861
3851
|
* @param {String} entryPoint entry point for the hook to remove
|
|
3862
3852
|
* @return {Function} removed(popped) hook
|
|
3863
3853
|
*/
|
|
3854
|
+
|
|
3855
|
+
|
|
3864
3856
|
DOMPurify.removeHook = function (entryPoint) {
|
|
3865
3857
|
if (hooks[entryPoint]) {
|
|
3866
3858
|
return arrayPop(hooks[entryPoint]);
|
|
3867
3859
|
}
|
|
3868
3860
|
};
|
|
3869
|
-
|
|
3870
3861
|
/**
|
|
3871
3862
|
* RemoveHooks
|
|
3872
3863
|
* Public method to remove all DOMPurify hooks at a given entryPoint
|
|
3873
3864
|
*
|
|
3874
3865
|
* @param {String} entryPoint entry point for the hooks to remove
|
|
3875
3866
|
*/
|
|
3867
|
+
|
|
3868
|
+
|
|
3876
3869
|
DOMPurify.removeHooks = function (entryPoint) {
|
|
3877
3870
|
if (hooks[entryPoint]) {
|
|
3878
3871
|
hooks[entryPoint] = [];
|
|
3879
3872
|
}
|
|
3880
3873
|
};
|
|
3881
|
-
|
|
3882
3874
|
/**
|
|
3883
3875
|
* RemoveAllHooks
|
|
3884
3876
|
* Public method to remove all DOMPurify hooks
|
|
3877
|
+
*
|
|
3885
3878
|
*/
|
|
3879
|
+
|
|
3880
|
+
|
|
3886
3881
|
DOMPurify.removeAllHooks = function () {
|
|
3887
3882
|
hooks = {};
|
|
3888
3883
|
};
|
|
3884
|
+
|
|
3889
3885
|
return DOMPurify;
|
|
3890
3886
|
}
|
|
3887
|
+
|
|
3891
3888
|
var purify = createDOMPurify();
|
|
3892
3889
|
|
|
3893
3890
|
/*!
|
|
@@ -3951,7 +3948,7 @@ try {
|
|
|
3951
3948
|
// swallow
|
|
3952
3949
|
}
|
|
3953
3950
|
const trusted = createPolicy('trusted', policyOptions);
|
|
3954
|
-
/*! version: 0.
|
|
3951
|
+
/*! version: 0.22.5 */
|
|
3955
3952
|
|
|
3956
3953
|
/*!
|
|
3957
3954
|
* Copyright (C) 2019 salesforce.com, inc.
|
|
@@ -4082,7 +4079,7 @@ function sanitizeSvgTextReturnDOM$LWS(dirty$LWS) {
|
|
|
4082
4079
|
return svgSanitizer$LWS.sanitize(dirty$LWS);
|
|
4083
4080
|
}
|
|
4084
4081
|
function sanitizeSvgHref$LWS(url$LWS) {
|
|
4085
|
-
const urlAsString$LWS =
|
|
4082
|
+
const urlAsString$LWS = toString$LWS(url$LWS);
|
|
4086
4083
|
if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, urlAsString$LWS, ['#'])) {
|
|
4087
4084
|
return url$LWS;
|
|
4088
4085
|
}
|
|
@@ -4212,7 +4209,7 @@ function blobSanitizer$LWS(sandboxKey$LWS) {
|
|
|
4212
4209
|
}
|
|
4213
4210
|
return getSanitizerForConfig$LWS(sandboxKey$LWS, 'STRING_BLOB_HTML');
|
|
4214
4211
|
}
|
|
4215
|
-
/*! version: 0.
|
|
4212
|
+
/*! version: 0.22.5 */
|
|
4216
4213
|
|
|
4217
4214
|
/*!
|
|
4218
4215
|
* Copyright (C) 2023 salesforce.com, inc.
|
|
@@ -4410,7 +4407,7 @@ function encloseSrcSetter$LWS(targetElement$LWS) {
|
|
|
4410
4407
|
ReflectApply$LWS$1(ElementProtoSetAttributeNS$LWS, targetElement$LWS, [attributeNamespaceURI$LWS, attributeName$LWS, src$LWS]);
|
|
4411
4408
|
};
|
|
4412
4409
|
}
|
|
4413
|
-
/*! version: 0.
|
|
4410
|
+
/*! version: 0.22.5 */
|
|
4414
4411
|
|
|
4415
4412
|
/*!
|
|
4416
4413
|
* Copyright (C) 2019 salesforce.com, inc.
|
|
@@ -4947,7 +4944,7 @@ function patchAttributes$LWS(instance$LWS, originalDefinition$LWS, definition$LW
|
|
|
4947
4944
|
}, ElementProtoRemoveAttribute$LWS);
|
|
4948
4945
|
instance$LWS.setAttribute = maskFunction$LWS(function setAttribute$LWS(attrName$LWS, value$LWS) {
|
|
4949
4946
|
const args$LWS = [attrName$LWS];
|
|
4950
|
-
const stringifiedValue$LWS =
|
|
4947
|
+
const stringifiedValue$LWS = toString$LWS(value$LWS);
|
|
4951
4948
|
const setAttributeArgs$LWS = [attrName$LWS, stringifiedValue$LWS];
|
|
4952
4949
|
// `observedAttributesDifference` is a safe Set.
|
|
4953
4950
|
if (observedAttributesDifference$LWS.has(attrName$LWS)) {
|
|
@@ -5156,64 +5153,6 @@ function setCustomElementsRegistry$LWS(document$LWS, key$LWS) {
|
|
|
5156
5153
|
currentRegistry$LWS = getSandboxCustomElementRegistry$LWS(document$LWS, key$LWS);
|
|
5157
5154
|
}
|
|
5158
5155
|
const DataTransferBlockedProperties$LWS = ['mozCursor', 'mozSourceNode', 'mozUserCancelled'];
|
|
5159
|
-
const elementShadowRootBySandboxKeyRegistry$LWS = {
|
|
5160
|
-
__proto__: null
|
|
5161
|
-
};
|
|
5162
|
-
function registerShadowRootInSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
|
|
5163
|
-
const {
|
|
5164
|
-
[sandboxKey$LWS]: elementShadowRootRegistry$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
|
|
5165
|
-
} = elementShadowRootBySandboxKeyRegistry$LWS;
|
|
5166
|
-
elementShadowRootRegistry$LWS.add(shadowRoot$LWS);
|
|
5167
|
-
if (!elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS]) {
|
|
5168
|
-
elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS] = elementShadowRootRegistry$LWS;
|
|
5169
|
-
}
|
|
5170
|
-
}
|
|
5171
|
-
function isShadowRootAccessibleInThisSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
|
|
5172
|
-
const elementShadowRootRegistry$LWS = elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS];
|
|
5173
|
-
if (!elementShadowRootRegistry$LWS) {
|
|
5174
|
-
return false;
|
|
5175
|
-
}
|
|
5176
|
-
return elementShadowRootRegistry$LWS.has(shadowRoot$LWS);
|
|
5177
|
-
}
|
|
5178
|
-
function isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, container$LWS) {
|
|
5179
|
-
let parentNode$LWS = container$LWS;
|
|
5180
|
-
do {
|
|
5181
|
-
if (isShadowRootAccessibleInThisSandbox$LWS(key$LWS, parentNode$LWS)) {
|
|
5182
|
-
return true;
|
|
5183
|
-
}
|
|
5184
|
-
} while (parentNode$LWS = ReflectApply$LWS$1(NodeProtoParentNodeGetter$LWS, parentNode$LWS, []));
|
|
5185
|
-
return false;
|
|
5186
|
-
}
|
|
5187
|
-
function initDistortionAbstractRangeEndContainerGetter$LWS({
|
|
5188
|
-
globalObject: {
|
|
5189
|
-
AbstractRange: AbstractRange$LWS
|
|
5190
|
-
}
|
|
5191
|
-
}) {
|
|
5192
|
-
const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRange$LWS.prototype, 'endContainer');
|
|
5193
|
-
return function distortionEndContainerGetter$LWS({
|
|
5194
|
-
key: key$LWS
|
|
5195
|
-
}) {
|
|
5196
|
-
return [originalEndContainerGetter$LWS, function endContainer$LWS() {
|
|
5197
|
-
const realEndContainer$LWS = ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []);
|
|
5198
|
-
return isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, realEndContainer$LWS) ? realEndContainer$LWS : null;
|
|
5199
|
-
}];
|
|
5200
|
-
};
|
|
5201
|
-
}
|
|
5202
|
-
function initDistortionAbstractRangeStartContainerGetter$LWS({
|
|
5203
|
-
globalObject: {
|
|
5204
|
-
AbstractRange: AbstractRange$LWS
|
|
5205
|
-
}
|
|
5206
|
-
}) {
|
|
5207
|
-
const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRange$LWS.prototype, 'startContainer');
|
|
5208
|
-
return function distortionStartContainerGetter$LWS({
|
|
5209
|
-
key: key$LWS
|
|
5210
|
-
}) {
|
|
5211
|
-
return [originalStartContainerGetter$LWS, function startContainer$LWS() {
|
|
5212
|
-
const realStartContainer$LWS = ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, []);
|
|
5213
|
-
return isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, realStartContainer$LWS) ? realStartContainer$LWS : null;
|
|
5214
|
-
}];
|
|
5215
|
-
};
|
|
5216
|
-
}
|
|
5217
5156
|
const attributeDistortionFactoriesCache$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1());
|
|
5218
5157
|
const sandboxAttributeDistortionRegistryCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
|
|
5219
5158
|
function finalizeAttributeDistortions$LWS(record$LWS) {
|
|
@@ -5422,10 +5361,11 @@ function initDistortionCacheStorageDelete$LWS({
|
|
|
5422
5361
|
return [originalDelete$LWS, function patchedDelete$LWS(...args$LWS) {
|
|
5423
5362
|
if (args$LWS.length) {
|
|
5424
5363
|
const {
|
|
5425
|
-
0:
|
|
5364
|
+
0: cacheName$LWS
|
|
5426
5365
|
} = args$LWS;
|
|
5427
|
-
|
|
5428
|
-
|
|
5366
|
+
if (isConvertibleToString$LWS(cacheName$LWS)) {
|
|
5367
|
+
args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
|
|
5368
|
+
}
|
|
5429
5369
|
}
|
|
5430
5370
|
return ReflectApply$LWS$1(originalDelete$LWS, this, args$LWS);
|
|
5431
5371
|
}];
|
|
@@ -5450,10 +5390,11 @@ function initDistortionCacheStorageHas$LWS({
|
|
|
5450
5390
|
return [originalHas$LWS, function has$LWS(...args$LWS) {
|
|
5451
5391
|
if (args$LWS.length) {
|
|
5452
5392
|
const {
|
|
5453
|
-
0:
|
|
5393
|
+
0: cacheName$LWS
|
|
5454
5394
|
} = args$LWS;
|
|
5455
|
-
|
|
5456
|
-
|
|
5395
|
+
if (isConvertibleToString$LWS(cacheName$LWS)) {
|
|
5396
|
+
args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
|
|
5397
|
+
}
|
|
5457
5398
|
}
|
|
5458
5399
|
return ReflectApply$LWS$1(originalHas$LWS, this, args$LWS);
|
|
5459
5400
|
}];
|
|
@@ -5523,13 +5464,14 @@ function initDistortionCacheStorageMatch$LWS({
|
|
|
5523
5464
|
// also be safely convertible to a string.
|
|
5524
5465
|
if (isObjectLike$LWS(matchOptions$LWS) && 'cacheName' in matchOptions$LWS) {
|
|
5525
5466
|
const {
|
|
5526
|
-
cacheName:
|
|
5467
|
+
cacheName: cacheName$LWS
|
|
5527
5468
|
} = matchOptions$LWS;
|
|
5528
|
-
|
|
5529
|
-
|
|
5530
|
-
|
|
5531
|
-
|
|
5532
|
-
|
|
5469
|
+
if (isConvertibleToString$LWS(cacheName$LWS)) {
|
|
5470
|
+
const clonedOptions$LWS = shallowCloneOptions$LWS(matchOptions$LWS);
|
|
5471
|
+
clonedOptions$LWS.cacheName = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
|
|
5472
|
+
args$LWS[1] = clonedOptions$LWS;
|
|
5473
|
+
return ReflectApply$LWS$1(originalMatch$LWS, this, args$LWS);
|
|
5474
|
+
}
|
|
5533
5475
|
}
|
|
5534
5476
|
return PromiseReject$LWS(new LockerSecurityError$LWS("caches.match() expects 'options.cacheName' to be present."));
|
|
5535
5477
|
}];
|
|
@@ -5554,10 +5496,11 @@ function initDistortionCacheStorageOpen$LWS({
|
|
|
5554
5496
|
return [originalOpen$LWS, function open$LWS(...args$LWS) {
|
|
5555
5497
|
if (args$LWS.length) {
|
|
5556
5498
|
const {
|
|
5557
|
-
0:
|
|
5499
|
+
0: cacheName$LWS
|
|
5558
5500
|
} = args$LWS;
|
|
5559
|
-
|
|
5560
|
-
|
|
5501
|
+
if (isConvertibleToString$LWS(cacheName$LWS)) {
|
|
5502
|
+
args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
|
|
5503
|
+
}
|
|
5561
5504
|
}
|
|
5562
5505
|
return ReflectApply$LWS$1(originalOpen$LWS, this, args$LWS);
|
|
5563
5506
|
}];
|
|
@@ -5703,26 +5646,11 @@ function isEventTargetRestricted$LWS(record$LWS, eventTarget$LWS, eventName$LWS)
|
|
|
5703
5646
|
if (restrictedEventTargetRegistry$LWS === undefined || restrictedEventTargetRegistry$LWS[eventName$LWS] === undefined) {
|
|
5704
5647
|
return false;
|
|
5705
5648
|
}
|
|
5706
|
-
|
|
5707
|
-
// Walk UP the proto chain to check if super classes have a restriction on this event.
|
|
5708
|
-
// This can happen in cases where HTMLElement is the event target constructor, but
|
|
5709
|
-
// the event listener is being added to HTMLDivElement. Since we obviously want to
|
|
5710
|
-
// block all listeners for an event being blocked at HTMLElement level, we need to
|
|
5711
|
-
// walk up from the HTMLDivElement until we find the constructor for which we
|
|
5712
|
-
// registered a restriction.
|
|
5713
|
-
while (possiblyRestrictedConstructor$LWS !== null) {
|
|
5714
|
-
if (restrictedEventTargetRegistry$LWS[eventName$LWS].has(possiblyRestrictedConstructor$LWS)) {
|
|
5715
|
-
return true;
|
|
5716
|
-
}
|
|
5717
|
-
// eslint-disable-next-line no-proto
|
|
5718
|
-
possiblyRestrictedConstructor$LWS = possiblyRestrictedConstructor$LWS.__proto__;
|
|
5719
|
-
}
|
|
5720
|
-
return false;
|
|
5649
|
+
return restrictedEventTargetRegistry$LWS[eventName$LWS].has(eventTarget$LWS.constructor);
|
|
5721
5650
|
}
|
|
5722
5651
|
function registerEventTargetRestriction$LWS(record$LWS, EventTargetCtor$LWS, eventName$LWS) {
|
|
5723
|
-
const unmaskedEventTargetCtor$LWS = getUnmaskedFunction$LWS(EventTargetCtor$LWS);
|
|
5724
5652
|
// istanbul ignore if: this is a safety precaution that is unreachable via tests
|
|
5725
|
-
if (isEventTargetRestricted$LWS(record$LWS,
|
|
5653
|
+
if (isEventTargetRestricted$LWS(record$LWS, EventTargetCtor$LWS.prototype, eventName$LWS)) {
|
|
5726
5654
|
return;
|
|
5727
5655
|
}
|
|
5728
5656
|
const {
|
|
@@ -5736,7 +5664,7 @@ function registerEventTargetRestriction$LWS(record$LWS, EventTargetCtor$LWS, eve
|
|
|
5736
5664
|
const {
|
|
5737
5665
|
[eventName$LWS]: restrictedEventTargetCtors$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
|
|
5738
5666
|
} = restrictedEventTargetRegistry$LWS;
|
|
5739
|
-
restrictedEventTargetCtors$LWS.add(
|
|
5667
|
+
restrictedEventTargetCtors$LWS.add(EventTargetCtor$LWS);
|
|
5740
5668
|
restrictedEventTargetRegistry$LWS[eventName$LWS] = restrictedEventTargetCtors$LWS;
|
|
5741
5669
|
restrictedEventTargetRegistryBySandboxKeyRegistry$LWS[key$LWS] = restrictedEventTargetRegistry$LWS;
|
|
5742
5670
|
}
|
|
@@ -6091,7 +6019,7 @@ function initDistortionDocumentDomainSetter$LWS({
|
|
|
6091
6019
|
};
|
|
6092
6020
|
}
|
|
6093
6021
|
const {
|
|
6094
|
-
isSharedElement: isSharedElement$
|
|
6022
|
+
isSharedElement: isSharedElement$r$LWS
|
|
6095
6023
|
} = rootValidator$LWS;
|
|
6096
6024
|
function throwLockerSecurityError$LWS(command$LWS, target$LWS) {
|
|
6097
6025
|
throw new LockerSecurityError$LWS(`Cannot execute command '${command$LWS}' on ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, target$LWS, [])}.`);
|
|
@@ -6118,7 +6046,7 @@ function initDistortionDocumentExecCommand$LWS({
|
|
|
6118
6046
|
length: length$LWS
|
|
6119
6047
|
} = args$LWS;
|
|
6120
6048
|
if (length$LWS >= 1) {
|
|
6121
|
-
const command$LWS =
|
|
6049
|
+
const command$LWS = toString$LWS(args$LWS[0]);
|
|
6122
6050
|
const loweredCommand$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, command$LWS, []);
|
|
6123
6051
|
if (loweredCommand$LWS === 'selectall' && this === rootDocument$LWS) {
|
|
6124
6052
|
throwLockerSecurityError$LWS(command$LWS, this);
|
|
@@ -6137,7 +6065,7 @@ function initDistortionDocumentExecCommand$LWS({
|
|
|
6137
6065
|
// istanbul ignore else: external is the default sandbox type for coverage runs
|
|
6138
6066
|
if (type$LWS === 0 /* SandboxType.External */) {
|
|
6139
6067
|
const activeElement$LWS = ReflectApply$LWS$1(originalActiveElement$LWS, this, []);
|
|
6140
|
-
if (isSharedElement$
|
|
6068
|
+
if (isSharedElement$r$LWS(activeElement$LWS) && ReflectApply$LWS$1(originalIsContentEditable$LWS, activeElement$LWS, [])) {
|
|
6141
6069
|
throwLockerSecurityError$LWS(command$LWS, activeElement$LWS);
|
|
6142
6070
|
}
|
|
6143
6071
|
}
|
|
@@ -6252,8 +6180,8 @@ function initDistortionDOMParserParseFromString$LWS({
|
|
|
6252
6180
|
if (args$LWS.length >= 2) {
|
|
6253
6181
|
// Override the value of the first argument with a sanitized version
|
|
6254
6182
|
// of that argument.
|
|
6255
|
-
const string$LWS =
|
|
6256
|
-
const mimeType$LWS =
|
|
6183
|
+
const string$LWS = toString$LWS(args$LWS[0]);
|
|
6184
|
+
const mimeType$LWS = toString$LWS(args$LWS[1]);
|
|
6257
6185
|
let contentType$LWS;
|
|
6258
6186
|
switch (mimeType$LWS) {
|
|
6259
6187
|
case 'application/xhtml+xml':
|
|
@@ -6284,7 +6212,7 @@ function initDistortionDOMParserParseFromString$LWS({
|
|
|
6284
6212
|
};
|
|
6285
6213
|
}
|
|
6286
6214
|
const {
|
|
6287
|
-
isSharedElement: isSharedElement$
|
|
6215
|
+
isSharedElement: isSharedElement$q$LWS,
|
|
6288
6216
|
isAllowedSharedElementChild: isAllowedSharedElementChild$6$LWS
|
|
6289
6217
|
} = rootValidator$LWS;
|
|
6290
6218
|
function initDistortionElementAfter$LWS({
|
|
@@ -6299,13 +6227,13 @@ function initDistortionElementAfter$LWS({
|
|
|
6299
6227
|
}) {
|
|
6300
6228
|
const distortionEntry$LWS = [originalAfter$LWS, function after$LWS(...args$LWS) {
|
|
6301
6229
|
// istanbul ignore else: needs default platform behavior test
|
|
6302
|
-
if (isSharedElement$
|
|
6230
|
+
if (isSharedElement$q$LWS(this)) {
|
|
6303
6231
|
for (let i$LWS = 0, {
|
|
6304
6232
|
length: length$LWS
|
|
6305
6233
|
} = args$LWS; i$LWS < length$LWS; i$LWS += 1) {
|
|
6306
6234
|
const argValue$LWS = args$LWS[i$LWS];
|
|
6307
6235
|
if (!isAllowedSharedElementChild$6$LWS(argValue$LWS)) {
|
|
6308
|
-
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */
|
|
6236
|
+
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
|
|
6309
6237
|
throw new LockerSecurityError$LWS(`Cannot insert ${nodeNameOrString$LWS} after ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6310
6238
|
}
|
|
6311
6239
|
}
|
|
@@ -6317,7 +6245,7 @@ function initDistortionElementAfter$LWS({
|
|
|
6317
6245
|
};
|
|
6318
6246
|
}
|
|
6319
6247
|
const {
|
|
6320
|
-
isSharedElement: isSharedElement$
|
|
6248
|
+
isSharedElement: isSharedElement$p$LWS,
|
|
6321
6249
|
isAllowedSharedElementChild: isAllowedSharedElementChild$5$LWS
|
|
6322
6250
|
} = rootValidator$LWS;
|
|
6323
6251
|
function initDistortionElementAppend$LWS({
|
|
@@ -6332,7 +6260,7 @@ function initDistortionElementAppend$LWS({
|
|
|
6332
6260
|
}) {
|
|
6333
6261
|
const distortionEntry$LWS = [originalAppend$LWS, function append$LWS(...args$LWS) {
|
|
6334
6262
|
// istanbul ignore else: needs default platform behavior test
|
|
6335
|
-
if (isSharedElement$
|
|
6263
|
+
if (isSharedElement$p$LWS(this)) {
|
|
6336
6264
|
// Element.prototype.append(...args) accepts an arbitrary number
|
|
6337
6265
|
// of arguments which can be comprised of Nodes and DOMStrings.
|
|
6338
6266
|
for (let i$LWS = 0, {
|
|
@@ -6343,7 +6271,7 @@ function initDistortionElementAppend$LWS({
|
|
|
6343
6271
|
// element child which is limited to script and link, an
|
|
6344
6272
|
// exception is thrown.
|
|
6345
6273
|
if (!isAllowedSharedElementChild$5$LWS(argValue$LWS)) {
|
|
6346
|
-
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */
|
|
6274
|
+
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
|
|
6347
6275
|
throw new LockerSecurityError$LWS(`Cannot append ${nodeNameOrString$LWS} to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6348
6276
|
}
|
|
6349
6277
|
}
|
|
@@ -6354,6 +6282,25 @@ function initDistortionElementAppend$LWS({
|
|
|
6354
6282
|
return distortionEntry$LWS;
|
|
6355
6283
|
};
|
|
6356
6284
|
}
|
|
6285
|
+
const elementShadowRootBySandboxKeyRegistry$LWS = {
|
|
6286
|
+
__proto__: null
|
|
6287
|
+
};
|
|
6288
|
+
function registerShadowRootInSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
|
|
6289
|
+
const {
|
|
6290
|
+
[sandboxKey$LWS]: elementShadowRootRegistry$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
|
|
6291
|
+
} = elementShadowRootBySandboxKeyRegistry$LWS;
|
|
6292
|
+
elementShadowRootRegistry$LWS.add(shadowRoot$LWS);
|
|
6293
|
+
if (!elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS]) {
|
|
6294
|
+
elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS] = elementShadowRootRegistry$LWS;
|
|
6295
|
+
}
|
|
6296
|
+
}
|
|
6297
|
+
function isShadowRootAccessibleInThisSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
|
|
6298
|
+
const elementShadowRootRegistry$LWS = elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS];
|
|
6299
|
+
if (!elementShadowRootRegistry$LWS) {
|
|
6300
|
+
return false;
|
|
6301
|
+
}
|
|
6302
|
+
return elementShadowRootRegistry$LWS.has(shadowRoot$LWS);
|
|
6303
|
+
}
|
|
6357
6304
|
function initDistortionElementAttachShadow$LWS({
|
|
6358
6305
|
globalObject: {
|
|
6359
6306
|
Element: {
|
|
@@ -6410,7 +6357,7 @@ function initDistortionElementAttributesGetter$LWS({
|
|
|
6410
6357
|
};
|
|
6411
6358
|
}
|
|
6412
6359
|
const {
|
|
6413
|
-
isSharedElement: isSharedElement$
|
|
6360
|
+
isSharedElement: isSharedElement$o$LWS,
|
|
6414
6361
|
isAllowedSharedElementChild: isAllowedSharedElementChild$4$LWS
|
|
6415
6362
|
} = rootValidator$LWS;
|
|
6416
6363
|
function initDistortionElementBefore$LWS({
|
|
@@ -6425,14 +6372,14 @@ function initDistortionElementBefore$LWS({
|
|
|
6425
6372
|
}) {
|
|
6426
6373
|
const distortionEntry$LWS = [originalBefore$LWS, function before$LWS(...args$LWS) {
|
|
6427
6374
|
// istanbul ignore else: needs default platform behavior test
|
|
6428
|
-
if (isSharedElement$
|
|
6375
|
+
if (isSharedElement$o$LWS(this)) {
|
|
6429
6376
|
for (let i$LWS = 0, {
|
|
6430
6377
|
length: length$LWS
|
|
6431
6378
|
} = args$LWS; i$LWS < length$LWS; i$LWS += 1) {
|
|
6432
6379
|
const argValue$LWS = args$LWS[i$LWS];
|
|
6433
6380
|
// istanbul ignore else: needs default platform behavior test
|
|
6434
6381
|
if (!isAllowedSharedElementChild$4$LWS(argValue$LWS)) {
|
|
6435
|
-
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */
|
|
6382
|
+
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
|
|
6436
6383
|
throw new LockerSecurityError$LWS(`Cannot insert ${nodeNameOrString$LWS} before ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6437
6384
|
}
|
|
6438
6385
|
}
|
|
@@ -6486,7 +6433,7 @@ function initDistortionElementGetInnerHTML$LWS({
|
|
|
6486
6433
|
};
|
|
6487
6434
|
}
|
|
6488
6435
|
function scriptPropertySetters$LWS(incomingThis$LWS, property$LWS, valueAsTrustedString$LWS, originalScriptPropertyGetter$LWS, originalScriptPropertySetter$LWS, distortions$LWS, sandboxEvaluator$LWS, signedScriptHookSourceText$LWS) {
|
|
6489
|
-
const valueAsString$LWS =
|
|
6436
|
+
const valueAsString$LWS = toString$LWS(valueAsTrustedString$LWS);
|
|
6490
6437
|
if (!isScriptPropertyEvaluatorHookDefined$LWS(incomingThis$LWS)) {
|
|
6491
6438
|
const distortedScriptPropertyGetter$LWS = distortions$LWS.get(originalScriptPropertyGetter$LWS);
|
|
6492
6439
|
defineScriptAccessorProperty$LWS(incomingThis$LWS, property$LWS, distortedScriptPropertyGetter$LWS, originalScriptPropertySetter$LWS);
|
|
@@ -6516,8 +6463,8 @@ function scriptPropertySetters$LWS(incomingThis$LWS, property$LWS, valueAsTruste
|
|
|
6516
6463
|
return false;
|
|
6517
6464
|
}
|
|
6518
6465
|
const {
|
|
6519
|
-
isInherentlyUnsecure: isInherentlyUnsecure$
|
|
6520
|
-
isSharedElement: isSharedElement$
|
|
6466
|
+
isInherentlyUnsecure: isInherentlyUnsecure$3$LWS,
|
|
6467
|
+
isSharedElement: isSharedElement$n$LWS
|
|
6521
6468
|
} = rootValidator$LWS;
|
|
6522
6469
|
function initDistortionElementInnerHTMLSetter$LWS({
|
|
6523
6470
|
document: document$LWS,
|
|
@@ -6543,7 +6490,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
|
|
|
6543
6490
|
const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
|
|
6544
6491
|
if (!isOwnerXMLDocument$LWS) {
|
|
6545
6492
|
// istanbul ignore else: needs default platform behavior test
|
|
6546
|
-
if (isSharedElement$
|
|
6493
|
+
if (isSharedElement$n$LWS(this)) {
|
|
6547
6494
|
throw new LockerSecurityError$LWS(`Cannot set innerHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6548
6495
|
}
|
|
6549
6496
|
if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement) {
|
|
@@ -6560,7 +6507,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
|
|
|
6560
6507
|
const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
|
|
6561
6508
|
value$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
|
|
6562
6509
|
}
|
|
6563
|
-
if (isInherentlyUnsecure$
|
|
6510
|
+
if (isInherentlyUnsecure$3$LWS(value$LWS)) {
|
|
6564
6511
|
throw new LockerSecurityError$LWS(`Cannot set 'innerHTML' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
|
|
6565
6512
|
}
|
|
6566
6513
|
ReflectApply$LWS$1(originalInnerHTMLSetter$LWS, this, [value$LWS]);
|
|
@@ -6568,7 +6515,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
|
|
|
6568
6515
|
};
|
|
6569
6516
|
}
|
|
6570
6517
|
const {
|
|
6571
|
-
isSharedElement: isSharedElement$
|
|
6518
|
+
isSharedElement: isSharedElement$m$LWS,
|
|
6572
6519
|
isAllowedSharedElementChild: isAllowedSharedElementChild$3$LWS
|
|
6573
6520
|
} = rootValidator$LWS;
|
|
6574
6521
|
function initDistortionElementInsertAdjacentElement$LWS({
|
|
@@ -6587,7 +6534,7 @@ function initDistortionElementInsertAdjacentElement$LWS({
|
|
|
6587
6534
|
1: element$LWS
|
|
6588
6535
|
} = args$LWS;
|
|
6589
6536
|
// istanbul ignore else: needs default platform behavior test
|
|
6590
|
-
if (isSharedElement$
|
|
6537
|
+
if (isSharedElement$m$LWS(this) && !isAllowedSharedElementChild$3$LWS(element$LWS)) {
|
|
6591
6538
|
throw new LockerSecurityError$LWS(`Cannot insert ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, element$LWS, [])} adjacent to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6592
6539
|
}
|
|
6593
6540
|
}
|
|
@@ -6598,7 +6545,8 @@ function initDistortionElementInsertAdjacentElement$LWS({
|
|
|
6598
6545
|
};
|
|
6599
6546
|
}
|
|
6600
6547
|
const {
|
|
6601
|
-
|
|
6548
|
+
isInherentlyUnsecure: isInherentlyUnsecure$2$LWS,
|
|
6549
|
+
isSharedElement: isSharedElement$l$LWS
|
|
6602
6550
|
} = rootValidator$LWS;
|
|
6603
6551
|
const allowedElementHTMLRegExp$LWS = /^\s*<(link|script|style)/i;
|
|
6604
6552
|
function initDistortionElementInsertAdjacentHTML$LWS({
|
|
@@ -6618,7 +6566,7 @@ function initDistortionElementInsertAdjacentHTML$LWS({
|
|
|
6618
6566
|
// istanbul ignore else: needs default platform behavior test
|
|
6619
6567
|
if (args$LWS.length > 1) {
|
|
6620
6568
|
const match$LWS = ReflectApply$LWS$1(StringProtoMatch$LWS, args$LWS[1], [allowedElementHTMLRegExp$LWS]);
|
|
6621
|
-
if (isSharedElement$
|
|
6569
|
+
if (isSharedElement$l$LWS(this) && match$LWS === null) {
|
|
6622
6570
|
throw new LockerSecurityError$LWS(`Cannot insert adjacent HTML to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}`);
|
|
6623
6571
|
}
|
|
6624
6572
|
// This must be called to signal to the virtual
|
|
@@ -6628,13 +6576,17 @@ function initDistortionElementInsertAdjacentHTML$LWS({
|
|
|
6628
6576
|
setCustomElementsRegistry$LWS(document$LWS, key$LWS);
|
|
6629
6577
|
const contentType$LWS = this instanceof SVGElement ? ContentType$LWS.SVG : ContentType$LWS.HTML;
|
|
6630
6578
|
args$LWS[1] = lwsInternalPolicy$LWS.createHTML(args$LWS[1], key$LWS, contentType$LWS);
|
|
6579
|
+
if (isInherentlyUnsecure$2$LWS(args$LWS[1])) {
|
|
6580
|
+
throw new LockerSecurityError$LWS(`Cannot 'insertAdjacentHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[1])}.`);
|
|
6581
|
+
}
|
|
6631
6582
|
}
|
|
6632
6583
|
ReflectApply$LWS$1(originalInsertAdjacentHTML$LWS, this, args$LWS);
|
|
6633
6584
|
}];
|
|
6634
6585
|
};
|
|
6635
6586
|
}
|
|
6636
6587
|
const {
|
|
6637
|
-
|
|
6588
|
+
isInherentlyUnsecure: isInherentlyUnsecure$1$LWS,
|
|
6589
|
+
isSharedElement: isSharedElement$k$LWS
|
|
6638
6590
|
} = rootValidator$LWS;
|
|
6639
6591
|
function initDistortionElementOuterHTMLSetter$LWS({
|
|
6640
6592
|
document: document$LWS,
|
|
@@ -6648,7 +6600,7 @@ function initDistortionElementOuterHTMLSetter$LWS({
|
|
|
6648
6600
|
}) {
|
|
6649
6601
|
return [originalOuterHTMLSetter$LWS, function outerHTML$LWS(value$LWS) {
|
|
6650
6602
|
// istanbul ignore else: needs default platform behavior test
|
|
6651
|
-
if (isSharedElement$
|
|
6603
|
+
if (isSharedElement$k$LWS(this)) {
|
|
6652
6604
|
throw new LockerSecurityError$LWS(`Cannot set outerHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6653
6605
|
}
|
|
6654
6606
|
// This must be called to signal to the virtual
|
|
@@ -6657,12 +6609,15 @@ function initDistortionElementOuterHTMLSetter$LWS({
|
|
|
6657
6609
|
// association to this sandbox.
|
|
6658
6610
|
setCustomElementsRegistry$LWS(document$LWS, key$LWS);
|
|
6659
6611
|
const html$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, ContentType$LWS.HTML);
|
|
6612
|
+
if (isInherentlyUnsecure$1$LWS(html$LWS)) {
|
|
6613
|
+
throw new LockerSecurityError$LWS(`Cannot set 'outerHTML' using an unsecure ${toSafeTemplateStringValue$LWS(html$LWS)}.`);
|
|
6614
|
+
}
|
|
6660
6615
|
ReflectApply$LWS$1(originalOuterHTMLSetter$LWS, this, [html$LWS]);
|
|
6661
6616
|
}];
|
|
6662
6617
|
};
|
|
6663
6618
|
}
|
|
6664
6619
|
const {
|
|
6665
|
-
isSharedElement: isSharedElement$
|
|
6620
|
+
isSharedElement: isSharedElement$j$LWS,
|
|
6666
6621
|
isAllowedSharedElementChild: isAllowedSharedElementChild$2$LWS
|
|
6667
6622
|
} = rootValidator$LWS;
|
|
6668
6623
|
function initDistortionElementPrepend$LWS({
|
|
@@ -6677,7 +6632,7 @@ function initDistortionElementPrepend$LWS({
|
|
|
6677
6632
|
}) {
|
|
6678
6633
|
const distortionEntry$LWS = [originalPrepend$LWS, function prepend$LWS(...args$LWS) {
|
|
6679
6634
|
// istanbul ignore else: needs default platform behavior test
|
|
6680
|
-
if (isSharedElement$
|
|
6635
|
+
if (isSharedElement$j$LWS(this)) {
|
|
6681
6636
|
// Element.prototype.prepend(...args) accepts an arbitrary
|
|
6682
6637
|
// number of arguments which can be comprised of Nodes and
|
|
6683
6638
|
// DOMStrings.
|
|
@@ -6689,7 +6644,7 @@ function initDistortionElementPrepend$LWS({
|
|
|
6689
6644
|
// element child, which is limited to script and link, an
|
|
6690
6645
|
// exception is thrown.
|
|
6691
6646
|
if (!isAllowedSharedElementChild$2$LWS(argValue$LWS)) {
|
|
6692
|
-
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */
|
|
6647
|
+
const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
|
|
6693
6648
|
throw new LockerSecurityError$LWS(`Cannot prepend ${nodeNameOrString$LWS} to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6694
6649
|
}
|
|
6695
6650
|
}
|
|
@@ -6701,7 +6656,7 @@ function initDistortionElementPrepend$LWS({
|
|
|
6701
6656
|
};
|
|
6702
6657
|
}
|
|
6703
6658
|
const {
|
|
6704
|
-
isSharedElement: isSharedElement$
|
|
6659
|
+
isSharedElement: isSharedElement$i$LWS
|
|
6705
6660
|
} = rootValidator$LWS;
|
|
6706
6661
|
function initDistortionElementRemove$LWS({
|
|
6707
6662
|
globalObject: {
|
|
@@ -6714,7 +6669,7 @@ function initDistortionElementRemove$LWS({
|
|
|
6714
6669
|
}) {
|
|
6715
6670
|
const distortionEntry$LWS = [originalRemove$LWS, function remove$LWS() {
|
|
6716
6671
|
// istanbul ignore else: needs default platform behavior test
|
|
6717
|
-
if (isSharedElement$
|
|
6672
|
+
if (isSharedElement$i$LWS(this)) {
|
|
6718
6673
|
throw new LockerSecurityError$LWS(`Cannot remove ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6719
6674
|
}
|
|
6720
6675
|
ReflectApply$LWS$1(originalRemove$LWS, this, []);
|
|
@@ -6724,7 +6679,7 @@ function initDistortionElementRemove$LWS({
|
|
|
6724
6679
|
};
|
|
6725
6680
|
}
|
|
6726
6681
|
const {
|
|
6727
|
-
isSharedElement: isSharedElement$
|
|
6682
|
+
isSharedElement: isSharedElement$h$LWS
|
|
6728
6683
|
} = rootValidator$LWS;
|
|
6729
6684
|
function initDistortionElementReplaceChildren$LWS({
|
|
6730
6685
|
globalObject: {
|
|
@@ -6737,7 +6692,7 @@ function initDistortionElementReplaceChildren$LWS({
|
|
|
6737
6692
|
}) {
|
|
6738
6693
|
const distortionEntry$LWS = [originalReplaceChildren$LWS, function replaceChildren$LWS(...args$LWS) {
|
|
6739
6694
|
// istanbul ignore else: needs default platform behavior test
|
|
6740
|
-
if (isSharedElement$
|
|
6695
|
+
if (isSharedElement$h$LWS(this)) {
|
|
6741
6696
|
throw new LockerSecurityError$LWS(`Cannot replace children of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6742
6697
|
}
|
|
6743
6698
|
return ReflectApply$LWS$1(originalReplaceChildren$LWS, this, args$LWS);
|
|
@@ -6747,7 +6702,7 @@ function initDistortionElementReplaceChildren$LWS({
|
|
|
6747
6702
|
};
|
|
6748
6703
|
}
|
|
6749
6704
|
const {
|
|
6750
|
-
isSharedElement: isSharedElement$
|
|
6705
|
+
isSharedElement: isSharedElement$g$LWS
|
|
6751
6706
|
} = rootValidator$LWS;
|
|
6752
6707
|
function initDistortionElementReplaceWith$LWS({
|
|
6753
6708
|
globalObject: {
|
|
@@ -6760,7 +6715,7 @@ function initDistortionElementReplaceWith$LWS({
|
|
|
6760
6715
|
}) {
|
|
6761
6716
|
const distortionEntry$LWS = [originalReplaceWith$LWS, function replaceWith$LWS(...args$LWS) {
|
|
6762
6717
|
// istanbul ignore else: needs default platform behavior test
|
|
6763
|
-
if (isSharedElement$
|
|
6718
|
+
if (isSharedElement$g$LWS(this)) {
|
|
6764
6719
|
throw new LockerSecurityError$LWS(`Cannot replace ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6765
6720
|
}
|
|
6766
6721
|
return ReflectApply$LWS$1(originalReplaceWith$LWS, this, args$LWS);
|
|
@@ -6781,8 +6736,8 @@ function initDistortionElementSetAttribute$LWS({
|
|
|
6781
6736
|
return function distortionElementSetAttribute$LWS(record$LWS) {
|
|
6782
6737
|
return [originalSetAttribute$LWS, function setAttribute$LWS(...args$LWS) {
|
|
6783
6738
|
if (args$LWS.length > 1) {
|
|
6784
|
-
const attrName$LWS = normalizeNamespacedAttributeName$LWS(
|
|
6785
|
-
const attrValue$LWS =
|
|
6739
|
+
const attrName$LWS = normalizeNamespacedAttributeName$LWS(toString$LWS(args$LWS[0]));
|
|
6740
|
+
const attrValue$LWS = toString$LWS(args$LWS[1]);
|
|
6786
6741
|
const distortion$LWS = getAttributeDistortion$LWS(record$LWS, this, attrName$LWS);
|
|
6787
6742
|
if (distortion$LWS) {
|
|
6788
6743
|
ReflectApply$LWS$1(distortion$LWS, this, [attrValue$LWS]);
|
|
@@ -6935,10 +6890,10 @@ function initDistortionElementSetAttributeNS$LWS({
|
|
|
6935
6890
|
0: attrNamespace$LWS
|
|
6936
6891
|
} = args$LWS;
|
|
6937
6892
|
if (attrNamespace$LWS !== null && attrNamespace$LWS !== undefined) {
|
|
6938
|
-
attrNamespace$LWS =
|
|
6893
|
+
attrNamespace$LWS = toString$LWS(attrNamespace$LWS);
|
|
6939
6894
|
}
|
|
6940
|
-
const attrName$LWS = normalizeNamespacedAttributeName$LWS(
|
|
6941
|
-
const attrValue$LWS =
|
|
6895
|
+
const attrName$LWS = normalizeNamespacedAttributeName$LWS(toString$LWS(args$LWS[1]));
|
|
6896
|
+
const attrValue$LWS = toString$LWS(args$LWS[2]);
|
|
6942
6897
|
const normalizedNamespace$LWS = normalizeNamespace$LWS(attrNamespace$LWS);
|
|
6943
6898
|
const distortion$LWS = getAttributeDistortion$LWS(record$LWS, this, attrName$LWS, normalizedNamespace$LWS);
|
|
6944
6899
|
// istanbul ignore else: needs default platform behavior test
|
|
@@ -6966,8 +6921,8 @@ function initDistortionElementSetAttributeNS$LWS({
|
|
|
6966
6921
|
};
|
|
6967
6922
|
}
|
|
6968
6923
|
const {
|
|
6969
|
-
isInherentlyUnsecure: isInherentlyUnsecure$
|
|
6970
|
-
isSharedElement: isSharedElement$
|
|
6924
|
+
isInherentlyUnsecure: isInherentlyUnsecure$LWS,
|
|
6925
|
+
isSharedElement: isSharedElement$f$LWS
|
|
6971
6926
|
} = rootValidator$LWS;
|
|
6972
6927
|
function initDistortionElementSetHTML$LWS({
|
|
6973
6928
|
document: document$LWS,
|
|
@@ -6993,7 +6948,7 @@ function initDistortionElementSetHTML$LWS({
|
|
|
6993
6948
|
const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
|
|
6994
6949
|
if (!isOwnerXMLDocument$LWS) {
|
|
6995
6950
|
// istanbul ignore else: needs default platform behavior test
|
|
6996
|
-
if (isSharedElement$
|
|
6951
|
+
if (isSharedElement$f$LWS(this)) {
|
|
6997
6952
|
throw new LockerSecurityError$LWS(`Cannot setHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
6998
6953
|
}
|
|
6999
6954
|
// This must be called to signal to the virtual
|
|
@@ -7006,7 +6961,7 @@ function initDistortionElementSetHTML$LWS({
|
|
|
7006
6961
|
const value$LWS = args$LWS[0];
|
|
7007
6962
|
const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
|
|
7008
6963
|
args$LWS[0] = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
|
|
7009
|
-
if (isInherentlyUnsecure$
|
|
6964
|
+
if (isInherentlyUnsecure$LWS(args$LWS[0])) {
|
|
7010
6965
|
throw new LockerSecurityError$LWS(`Cannot 'setHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[0])}.`);
|
|
7011
6966
|
}
|
|
7012
6967
|
}
|
|
@@ -7014,68 +6969,6 @@ function initDistortionElementSetHTML$LWS({
|
|
|
7014
6969
|
}];
|
|
7015
6970
|
};
|
|
7016
6971
|
}
|
|
7017
|
-
const {
|
|
7018
|
-
isInherentlyUnsecure: isInherentlyUnsecure$LWS,
|
|
7019
|
-
isSharedElement: isSharedElement$f$LWS
|
|
7020
|
-
} = rootValidator$LWS;
|
|
7021
|
-
function initDistortionElementSetHTMLUnsafe$LWS({
|
|
7022
|
-
document: document$LWS,
|
|
7023
|
-
globalObject: {
|
|
7024
|
-
Element: Element$LWS,
|
|
7025
|
-
Element: {
|
|
7026
|
-
prototype: {
|
|
7027
|
-
setHTMLUnsafe: originalSetHTMLUnsafe$LWS
|
|
7028
|
-
}
|
|
7029
|
-
},
|
|
7030
|
-
HTMLScriptElement: HTMLScriptElement$LWS,
|
|
7031
|
-
SVGElement: SVGElement$LWS,
|
|
7032
|
-
XMLDocument: XMLDocument$LWS
|
|
7033
|
-
},
|
|
7034
|
-
root: {
|
|
7035
|
-
distortions: distortions$LWS
|
|
7036
|
-
}
|
|
7037
|
-
}) {
|
|
7038
|
-
// istanbul ignore if: currently unreachable via tests
|
|
7039
|
-
if (typeof originalSetHTMLUnsafe$LWS !== 'function') {
|
|
7040
|
-
return noop$LWS$1;
|
|
7041
|
-
}
|
|
7042
|
-
return function distortionElementSetHTMLUnsafe$LWS({
|
|
7043
|
-
key: key$LWS,
|
|
7044
|
-
sandboxEvaluator: sandboxEvaluator$LWS
|
|
7045
|
-
}) {
|
|
7046
|
-
const {
|
|
7047
|
-
get: originalInnerHTMLGetter$LWS,
|
|
7048
|
-
set: originalInnerHTMLSetter$LWS
|
|
7049
|
-
} = ReflectGetOwnPropertyDescriptor$LWS(Element$LWS.prototype, 'innerHTML');
|
|
7050
|
-
return [originalSetHTMLUnsafe$LWS, function innerHTML$LWS(value$LWS) {
|
|
7051
|
-
const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
|
|
7052
|
-
if (!isOwnerXMLDocument$LWS) {
|
|
7053
|
-
// istanbul ignore else: needs default platform behavior test
|
|
7054
|
-
if (isSharedElement$f$LWS(this)) {
|
|
7055
|
-
throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
|
|
7056
|
-
}
|
|
7057
|
-
// This is necessary to support script.setHTMLUnsafe(...)
|
|
7058
|
-
if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement) {
|
|
7059
|
-
const scriptWasNotEvaluatedInScriptPropertySetter$LWS = scriptPropertySetters$LWS(this, 'innerHTML', trusted.createScript(value$LWS), originalInnerHTMLGetter$LWS, originalInnerHTMLSetter$LWS, distortions$LWS, sandboxEvaluator$LWS, trusted.createScript(SCRIPT_HOOK_SOURCE_TEXT$LWS));
|
|
7060
|
-
if (scriptWasNotEvaluatedInScriptPropertySetter$LWS) {
|
|
7061
|
-
return;
|
|
7062
|
-
}
|
|
7063
|
-
}
|
|
7064
|
-
// This must be called to signal to the virtual
|
|
7065
|
-
// CustomElementRegistry that the next thing created
|
|
7066
|
-
// MAY CONTAIN a custom element, which must be marked for
|
|
7067
|
-
// association to this sandbox.
|
|
7068
|
-
setCustomElementsRegistry$LWS(document$LWS, key$LWS);
|
|
7069
|
-
const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
|
|
7070
|
-
value$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
|
|
7071
|
-
}
|
|
7072
|
-
if (isInherentlyUnsecure$LWS(value$LWS)) {
|
|
7073
|
-
throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
|
|
7074
|
-
}
|
|
7075
|
-
ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [value$LWS]);
|
|
7076
|
-
}];
|
|
7077
|
-
};
|
|
7078
|
-
}
|
|
7079
6972
|
function initDistortionElementShadowRootGetter$LWS({
|
|
7080
6973
|
globalObject: {
|
|
7081
6974
|
Element: Element$LWS
|
|
@@ -7111,7 +7004,7 @@ function initDistortionElementToggleAttribute$LWS({
|
|
|
7111
7004
|
} = args$LWS;
|
|
7112
7005
|
// istanbul ignore else: needs default platform behavior test
|
|
7113
7006
|
if (length$LWS > 0) {
|
|
7114
|
-
const attrName$LWS =
|
|
7007
|
+
const attrName$LWS = toString$LWS(args$LWS[0]);
|
|
7115
7008
|
const distortion$LWS = getAttributeDistortion$LWS(record$LWS, this, attrName$LWS);
|
|
7116
7009
|
// istanbul ignore else: needs default platform behavior test
|
|
7117
7010
|
if (distortion$LWS) {
|
|
@@ -7148,7 +7041,7 @@ function initDistortionEval$LWS({
|
|
|
7148
7041
|
}) {
|
|
7149
7042
|
return [originalEval$LWS, function (sourceText$LWS) {
|
|
7150
7043
|
throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'eval');
|
|
7151
|
-
return sandboxEvaluator$LWS(transformSourceText$LWS(
|
|
7044
|
+
return sandboxEvaluator$LWS(transformSourceText$LWS(toString$LWS(sourceText$LWS)), UNCOMPILED_CONTEXT$LWS);
|
|
7152
7045
|
}];
|
|
7153
7046
|
};
|
|
7154
7047
|
}
|
|
@@ -7232,7 +7125,7 @@ function initDistortionEventTargetAddEventListener$LWS({
|
|
|
7232
7125
|
// should fail if less than 2 arguments are provided.
|
|
7233
7126
|
// istanbul ignore else: needs default platform behavior test
|
|
7234
7127
|
if (length$LWS > 1) {
|
|
7235
|
-
const eventName$LWS =
|
|
7128
|
+
const eventName$LWS = toString$LWS(args$LWS[0]);
|
|
7236
7129
|
if (isEventTargetRestricted$LWS(record$LWS, this, eventName$LWS)) {
|
|
7237
7130
|
throw new LockerSecurityError$LWS(createEventListenerExceptionMessage$LWS(this, eventName$LWS));
|
|
7238
7131
|
}
|
|
@@ -7267,7 +7160,7 @@ function initDistortionFunction$LWS({
|
|
|
7267
7160
|
return ReflectApply$LWS$1(sandboxFuncCtor$LWS, this, []);
|
|
7268
7161
|
}
|
|
7269
7162
|
const lastIndex$LWS = length$LWS - 1;
|
|
7270
|
-
const funcBody$LWS =
|
|
7163
|
+
const funcBody$LWS = toString$LWS(args$LWS[lastIndex$LWS]);
|
|
7271
7164
|
// Validate parsing the function body.
|
|
7272
7165
|
ReflectApply$LWS$1(sandboxFuncCtor$LWS, this, [funcBody$LWS]);
|
|
7273
7166
|
// Make function body empty to create the wire-frame.
|
|
@@ -7423,16 +7316,6 @@ function initDistortionHTMLElementInnerTextSetter$LWS({
|
|
|
7423
7316
|
return distortionEntry$LWS;
|
|
7424
7317
|
};
|
|
7425
7318
|
}
|
|
7426
|
-
function initDistortionHTMLElementOnsecuritypolicyviolation$LWS({
|
|
7427
|
-
globalObject: {
|
|
7428
|
-
HTMLElement: {
|
|
7429
|
-
prototype: HTMLElementProto$LWS
|
|
7430
|
-
},
|
|
7431
|
-
HTMLElement: HTMLElement$LWS
|
|
7432
|
-
}
|
|
7433
|
-
}) {
|
|
7434
|
-
return createEventDistortionFactory$LWS(HTMLElementProto$LWS, HTMLElement$LWS, 'securitypolicyviolation');
|
|
7435
|
-
}
|
|
7436
7319
|
const {
|
|
7437
7320
|
isSharedElement: isSharedElement$d$LWS
|
|
7438
7321
|
} = rootValidator$LWS;
|
|
@@ -7522,77 +7405,12 @@ function initDistortionIFrameElementContentWindowGetter$LWS({
|
|
|
7522
7405
|
return distortionEntry$LWS;
|
|
7523
7406
|
};
|
|
7524
7407
|
}
|
|
7525
|
-
function
|
|
7526
|
-
|
|
7527
|
-
|
|
7528
|
-
|
|
7529
|
-
}) {
|
|
7530
|
-
const originalSandboxGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElement$LWS.prototype, 'sandbox');
|
|
7531
|
-
return function distortionHTMLIFrameElementSandboxGetter$LWS({
|
|
7532
|
-
key: key$LWS
|
|
7533
|
-
}) {
|
|
7534
|
-
return [originalSandboxGetter$LWS, function sandbox$LWS() {
|
|
7535
|
-
const sandboxTokenList$LWS = ReflectApply$LWS$1(HTMLIFrameElementProtoSandboxGetter$LWS, this, []);
|
|
7536
|
-
if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(key$LWS, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
|
|
7537
|
-
// By returning a "copy" of the real "sandbox" DOMTokenList as an array of strings, LWS ensures
|
|
7538
|
-
// that the real "sandbox" DOMTokenList is not accessible from code within the LWS sandbox.
|
|
7539
|
-
return [...sandboxTokenList$LWS];
|
|
7540
|
-
}
|
|
7541
|
-
// istanbul ignore next: this line is untested because tests are run with all gates enabled.
|
|
7542
|
-
return sandboxTokenList$LWS;
|
|
7543
|
-
}];
|
|
7544
|
-
};
|
|
7545
|
-
}
|
|
7546
|
-
const ABOUT_BLANK_TOKEN$LWS = 'about:blank';
|
|
7547
|
-
const ALLOW_SAME_ORIGIN_TOKEN$LWS = 'allow-same-origin';
|
|
7548
|
-
const ALLOW_SCRIPTS_TOKEN$LWS = 'allow-scripts';
|
|
7549
|
-
const sameOriginSandboxedByLWS$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
|
|
7550
|
-
function enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(iframe$LWS) {
|
|
7551
|
-
const sandboxTokenList$LWS = ReflectApply$LWS$1(HTMLIFrameElementProtoSandboxGetter$LWS, iframe$LWS, []);
|
|
7552
|
-
const srcValue$LWS = ReflectApply$LWS$1(HTMLIFrameElementProtoSrcGetter$LWS, iframe$LWS, []);
|
|
7553
|
-
// Before adding "allow-scripts", check that "allow-same-origin" isn't present. If it is,
|
|
7554
|
-
// throw an exception because LWS cannot allow an iframe created by component code to
|
|
7555
|
-
// have sandbox="allow-same-origin allow-scripts", because that would enable access to
|
|
7556
|
-
// the top level global object.
|
|
7557
|
-
if (ReflectApply$LWS$1(DOMTokenListProtoContains$LWS, sandboxTokenList$LWS, [ALLOW_SAME_ORIGIN_TOKEN$LWS])) {
|
|
7558
|
-
// Remove the 'allow-same-origin' sandbox token and throw an exception. This prevents
|
|
7559
|
-
// component code from wrapping the operation in a try catch and then exploiting
|
|
7560
|
-
// the iframe that may now have "allow-scripts allow-same-origin".
|
|
7561
|
-
ReflectApply$LWS$1(DOMTokenListProtoRemove$LWS, sandboxTokenList$LWS, [ALLOW_SAME_ORIGIN_TOKEN$LWS]);
|
|
7562
|
-
throw new LockerSecurityError$LWS('HTMLIFrameElement.sandbox cannot be set to "allow-same-origin"');
|
|
7563
|
-
}
|
|
7564
|
-
if (srcValue$LWS !== '' && srcValue$LWS !== ABOUT_BLANK_TOKEN$LWS) {
|
|
7565
|
-
// If there is a valid src value and it is not "about:blank", parse it and
|
|
7566
|
-
// compare it to the top level window's location.origin. We don't want to
|
|
7567
|
-
// impose the sandbox="allow-scripts" on cross-origin iframes.
|
|
7568
|
-
try {
|
|
7569
|
-
const srcUrlOrigin$LWS = ReflectApply$LWS$1(URLProtoOriginGetter$LWS, new URLCtor$LWS(srcValue$LWS), []);
|
|
7570
|
-
// If this iframe.src is cross-origin, let the browser take care of security.
|
|
7571
|
-
if (srcUrlOrigin$LWS && srcUrlOrigin$LWS !== rootWindow$LWS$1.location.origin) {
|
|
7572
|
-
return;
|
|
7573
|
-
}
|
|
7574
|
-
} catch (_unused2$LWS) {
|
|
7575
|
-
/* empty */
|
|
7576
|
-
}
|
|
7577
|
-
if (!ReflectApply$LWS$1(DOMTokenListProtoContains$LWS, sandboxTokenList$LWS, [ALLOW_SCRIPTS_TOKEN$LWS])) {
|
|
7578
|
-
// Track that LWS added this token
|
|
7579
|
-
sameOriginSandboxedByLWS$LWS.add(iframe$LWS);
|
|
7580
|
-
ReflectApply$LWS$1(DOMTokenListProtoAdd$LWS, sandboxTokenList$LWS, [ALLOW_SCRIPTS_TOKEN$LWS]);
|
|
7581
|
-
}
|
|
7582
|
-
} else {
|
|
7583
|
-
if (srcValue$LWS === ABOUT_BLANK_TOKEN$LWS && sameOriginSandboxedByLWS$LWS.has(iframe$LWS)) {
|
|
7584
|
-
// If the sandboxed code is navigated away from a same origin url,
|
|
7585
|
-
// to "about:blank", and the only token is the one we created,
|
|
7586
|
-
// then we can remove the sandbox attribute entirely.
|
|
7587
|
-
sameOriginSandboxedByLWS$LWS.delete(iframe$LWS);
|
|
7588
|
-
ReflectApply$LWS$1(DOMTokenListProtoRemove$LWS, sandboxTokenList$LWS, [ALLOW_SCRIPTS_TOKEN$LWS]);
|
|
7589
|
-
// If after removing ALLOW_SCRIPTS_TOKEN, the sandbox attribute is empty,
|
|
7590
|
-
// we can remove it entirely.
|
|
7591
|
-
if (ReflectApply$LWS$1(DOMTokenListProtoLengthGetter$LWS, sandboxTokenList$LWS, []) === 0) {
|
|
7592
|
-
ReflectApply$LWS$1(ElementProtoRemoveAttribute$LWS, iframe$LWS, ['sandbox']);
|
|
7593
|
-
}
|
|
7594
|
-
}
|
|
7408
|
+
function src$LWS(value$LWS) {
|
|
7409
|
+
const urlString$LWS = sanitizeURLForElement$LWS(value$LWS);
|
|
7410
|
+
if (!isValidURLScheme$LWS(urlString$LWS)) {
|
|
7411
|
+
throw new LockerSecurityError$LWS('HTMLIFrameElement.src supports http://, https:// schemes, relative urls and about:blank.');
|
|
7595
7412
|
}
|
|
7413
|
+
ReflectApply$LWS$1(HTMLIFrameElementProtoSrcSetter$LWS, this, [urlString$LWS]);
|
|
7596
7414
|
}
|
|
7597
7415
|
function initDistortionHTMLIFrameElementSrcSetter$LWS({
|
|
7598
7416
|
globalObject: {
|
|
@@ -7600,40 +7418,10 @@ function initDistortionHTMLIFrameElementSrcSetter$LWS({
|
|
|
7600
7418
|
}
|
|
7601
7419
|
}) {
|
|
7602
7420
|
const originalSrcSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElement$LWS.prototype, 'src');
|
|
7421
|
+
const distortionMapEntry$LWS = [originalSrcSetter$LWS, src$LWS];
|
|
7603
7422
|
return function distortionHTMLIFrameElementSrcSetter$LWS(record$LWS) {
|
|
7604
|
-
function src$LWS(value$LWS) {
|
|
7605
|
-
const normalizedSrcValue$LWS = toSafeStringValue$LWS(value$LWS);
|
|
7606
|
-
// If the string being set to iframe.src is not an empty string, sanitize it for assignment
|
|
7607
|
-
// to iframe.src. If it is an empty string, let it be and proceed.
|
|
7608
|
-
// Otherwise, take no action.
|
|
7609
|
-
const urlString$LWS = normalizedSrcValue$LWS !== '' ? sanitizeURLForElement$LWS(normalizedSrcValue$LWS) : '';
|
|
7610
|
-
if (urlString$LWS && !isValidURLScheme$LWS(urlString$LWS)) {
|
|
7611
|
-
throw new LockerSecurityError$LWS('HTMLIFrameElement.src supports http://, https:// schemes, relative urls and about:blank.');
|
|
7612
|
-
}
|
|
7613
|
-
ReflectApply$LWS$1(HTMLIFrameElementProtoSrcSetter$LWS, this, [urlString$LWS]);
|
|
7614
|
-
if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(record$LWS.key, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
|
|
7615
|
-
enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(this);
|
|
7616
|
-
}
|
|
7617
|
-
}
|
|
7618
7423
|
registerAttributeDistortion$LWS(record$LWS, HTMLIFrameElement$LWS, 'src', NAMESPACE_DEFAULT$LWS, src$LWS);
|
|
7619
|
-
return
|
|
7620
|
-
};
|
|
7621
|
-
}
|
|
7622
|
-
function initDistortionHTMLIFrameElementSandboxSetter$LWS({
|
|
7623
|
-
globalObject: {
|
|
7624
|
-
HTMLIFrameElement: HTMLIFrameElement$LWS
|
|
7625
|
-
}
|
|
7626
|
-
}) {
|
|
7627
|
-
const originalSandboxSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElement$LWS.prototype, 'sandbox');
|
|
7628
|
-
return function distortionHTMLIFrameElementSandboxSetter$LWS(record$LWS) {
|
|
7629
|
-
function sandbox$LWS(value$LWS) {
|
|
7630
|
-
ReflectApply$LWS$1(HTMLIFrameElementProtoSandboxSetter$LWS, this, [value$LWS]);
|
|
7631
|
-
if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(record$LWS.key, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
|
|
7632
|
-
enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(this);
|
|
7633
|
-
}
|
|
7634
|
-
}
|
|
7635
|
-
registerAttributeDistortion$LWS(record$LWS, HTMLIFrameElement$LWS, 'sandbox', NAMESPACE_DEFAULT$LWS, sandbox$LWS);
|
|
7636
|
-
return [originalSandboxSetter$LWS, sandbox$LWS];
|
|
7424
|
+
return distortionMapEntry$LWS;
|
|
7637
7425
|
};
|
|
7638
7426
|
}
|
|
7639
7427
|
const importRegExp$LWS = /import/i;
|
|
@@ -7648,7 +7436,7 @@ function initDistortionHTMLLinkElementRelSetter$LWS({
|
|
|
7648
7436
|
}) {
|
|
7649
7437
|
const originalRelSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLLinkElement$LWS.prototype, 'rel');
|
|
7650
7438
|
function rel$LWS(value$LWS) {
|
|
7651
|
-
const valueAsString$LWS =
|
|
7439
|
+
const valueAsString$LWS = toString$LWS(value$LWS);
|
|
7652
7440
|
if (isValidRelValue$LWS(valueAsString$LWS)) {
|
|
7653
7441
|
ReflectApply$LWS$1(originalRelSetter$LWS, this, [valueAsString$LWS]);
|
|
7654
7442
|
return;
|
|
@@ -7669,7 +7457,7 @@ function initDistortionHTMLLinkElementRelListSetter$LWS({
|
|
|
7669
7457
|
}) {
|
|
7670
7458
|
const originalRelListSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLLinkElement$LWS.prototype, 'relList');
|
|
7671
7459
|
const distortionEntry$LWS = [originalRelListSetter$LWS, function relList$LWS(relListValue$LWS) {
|
|
7672
|
-
const string$LWS = relList$LWS instanceof DOMTokenList$LWS ? /* istanbul ignore next: needs default platform behavior test */ReflectApply$LWS$1(DOMTokenListProtoValueGetter$LWS, relListValue$LWS, []) :
|
|
7460
|
+
const string$LWS = relList$LWS instanceof DOMTokenList$LWS ? /* istanbul ignore next: needs default platform behavior test */ReflectApply$LWS$1(DOMTokenListProtoValueGetter$LWS, relListValue$LWS, []) : toString$LWS(relListValue$LWS);
|
|
7673
7461
|
if (isValidRelValue$LWS(string$LWS)) {
|
|
7674
7462
|
ReflectApply$LWS$1(originalRelListSetter$LWS, this, [string$LWS]);
|
|
7675
7463
|
return;
|
|
@@ -7989,16 +7777,6 @@ function initDistortionIDBObjectStorePut$LWS({
|
|
|
7989
7777
|
return distortionEntry$LWS;
|
|
7990
7778
|
};
|
|
7991
7779
|
}
|
|
7992
|
-
function initDistortionMathMLElementOnsecuritypolicyviolation$LWS({
|
|
7993
|
-
globalObject: {
|
|
7994
|
-
MathMLElement: {
|
|
7995
|
-
prototype: MathMLElementProto$LWS
|
|
7996
|
-
},
|
|
7997
|
-
MathMLElement: MathMLElement$LWS
|
|
7998
|
-
}
|
|
7999
|
-
}) {
|
|
8000
|
-
return createEventDistortionFactory$LWS(MathMLElementProto$LWS, MathMLElement$LWS, 'securitypolicyviolation');
|
|
8001
|
-
}
|
|
8002
7780
|
function initDistortionMessagePortPostMessage$LWS({
|
|
8003
7781
|
globalObject: {
|
|
8004
7782
|
DOMException: DOMException$LWS,
|
|
@@ -8090,7 +7868,7 @@ function initDistortionNavigatorSendBeacon$LWS({
|
|
|
8090
7868
|
}) {
|
|
8091
7869
|
const distortionEntry$LWS = [originalSendBeacon$LWS, function sendBeacon$LWS(...args$LWS) {
|
|
8092
7870
|
if (args$LWS.length) {
|
|
8093
|
-
const parsedURL$LWS = parseURL$LWS(
|
|
7871
|
+
const parsedURL$LWS = parseURL$LWS(toString$LWS(args$LWS[0]));
|
|
8094
7872
|
if (!isValidURL$LWS(parsedURL$LWS)) {
|
|
8095
7873
|
throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
|
|
8096
7874
|
}
|
|
@@ -8611,7 +8389,7 @@ const {
|
|
|
8611
8389
|
isSharedElement: isSharedElement$5$LWS
|
|
8612
8390
|
} = rootValidator$LWS;
|
|
8613
8391
|
function createRangeProtoMethodDistortionFactoryInitializer$LWS(methodName$LWS) {
|
|
8614
|
-
return function
|
|
8392
|
+
return function initDistortionContentWindowGetter$LWS({
|
|
8615
8393
|
globalObject: {
|
|
8616
8394
|
Range: {
|
|
8617
8395
|
// @ts-ignore: Prevent index type error.
|
|
@@ -8641,7 +8419,7 @@ function createRangeProtoMethodDistortionFactoryInitializer$LWS(methodName$LWS)
|
|
|
8641
8419
|
}
|
|
8642
8420
|
};
|
|
8643
8421
|
const distortionEntry$LWS = [originalMethod$LWS, distortion$LWS];
|
|
8644
|
-
return function
|
|
8422
|
+
return function distortionContentWindowGetter$LWS() {
|
|
8645
8423
|
return distortionEntry$LWS;
|
|
8646
8424
|
};
|
|
8647
8425
|
};
|
|
@@ -8835,33 +8613,6 @@ function initDistortionShadowRootInnerHTMLSetter$LWS({
|
|
|
8835
8613
|
}];
|
|
8836
8614
|
};
|
|
8837
8615
|
}
|
|
8838
|
-
function initDistortionShadowRootSetHTMLUnsafe$LWS({
|
|
8839
|
-
document: document$LWS,
|
|
8840
|
-
globalObject: {
|
|
8841
|
-
ShadowRoot: {
|
|
8842
|
-
prototype: {
|
|
8843
|
-
setHTMLUnsafe: originalSetHTMLUnsafe$LWS
|
|
8844
|
-
}
|
|
8845
|
-
}
|
|
8846
|
-
}
|
|
8847
|
-
}) {
|
|
8848
|
-
// istanbul ignore if: currently unreachable via tests
|
|
8849
|
-
if (typeof originalSetHTMLUnsafe$LWS !== 'function') {
|
|
8850
|
-
return noop$LWS$1;
|
|
8851
|
-
}
|
|
8852
|
-
return function distortionShadowRootSetHTMLUnsafe$LWS({
|
|
8853
|
-
key: key$LWS
|
|
8854
|
-
}) {
|
|
8855
|
-
return [originalSetHTMLUnsafe$LWS, function setHTMLUnsafe$LWS(value$LWS) {
|
|
8856
|
-
// This must be called to signal to the virtual
|
|
8857
|
-
// CustomElementRegistry that the next thing created
|
|
8858
|
-
// MAY CONTAIN a custom element, which must be marked for
|
|
8859
|
-
// association to this sandbox.
|
|
8860
|
-
setCustomElementsRegistry$LWS(document$LWS, key$LWS);
|
|
8861
|
-
ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, ContentType$LWS.HTML)]);
|
|
8862
|
-
}];
|
|
8863
|
-
};
|
|
8864
|
-
}
|
|
8865
8616
|
function SharedWorker$LWS(scriptURL$LWS) {
|
|
8866
8617
|
throw new LockerSecurityError$LWS(`Cannot create SharedWorker with ${toSafeTemplateStringValue$LWS(scriptURL$LWS)}.`);
|
|
8867
8618
|
}
|
|
@@ -9073,7 +8824,7 @@ class PatchedStorage$LWS {
|
|
|
9073
8824
|
storage: storage$LWS
|
|
9074
8825
|
} = getStorageMetaOrThrowInvalidInvocation$LWS(this);
|
|
9075
8826
|
if (args$LWS.length) {
|
|
9076
|
-
args$LWS[0] = prependStorageNamespaceMarker$LWS(
|
|
8827
|
+
args$LWS[0] = prependStorageNamespaceMarker$LWS(toString$LWS(args$LWS[0]), namespace$LWS);
|
|
9077
8828
|
}
|
|
9078
8829
|
return ReflectApply$LWS$1(StorageProtoGetItem$LWS, storage$LWS, args$LWS);
|
|
9079
8830
|
}
|
|
@@ -9083,8 +8834,8 @@ class PatchedStorage$LWS {
|
|
|
9083
8834
|
storage: storage$LWS
|
|
9084
8835
|
} = getStorageMetaOrThrowInvalidInvocation$LWS(this);
|
|
9085
8836
|
if (args$LWS.length > 1) {
|
|
9086
|
-
args$LWS[0] = prependStorageNamespaceMarker$LWS(
|
|
9087
|
-
args$LWS[1] =
|
|
8837
|
+
args$LWS[0] = prependStorageNamespaceMarker$LWS(toString$LWS(args$LWS[0]), namespace$LWS);
|
|
8838
|
+
args$LWS[1] = toString$LWS(args$LWS[1]);
|
|
9088
8839
|
}
|
|
9089
8840
|
ReflectApply$LWS$1(StorageProtoSetItem$LWS, storage$LWS, args$LWS);
|
|
9090
8841
|
}
|
|
@@ -9094,7 +8845,7 @@ class PatchedStorage$LWS {
|
|
|
9094
8845
|
storage: storage$LWS
|
|
9095
8846
|
} = getStorageMetaOrThrowInvalidInvocation$LWS(this);
|
|
9096
8847
|
if (args$LWS.length) {
|
|
9097
|
-
args$LWS[0] = prependStorageNamespaceMarker$LWS(
|
|
8848
|
+
args$LWS[0] = prependStorageNamespaceMarker$LWS(toString$LWS(args$LWS[0]), namespace$LWS);
|
|
9098
8849
|
}
|
|
9099
8850
|
ReflectApply$LWS$1(StorageProtoRemoveItem$LWS, storage$LWS, args$LWS);
|
|
9100
8851
|
}
|
|
@@ -9144,7 +8895,7 @@ function createDistortionStorageFactoryInitializer$LWS(storageName$LWS) {
|
|
|
9144
8895
|
try {
|
|
9145
8896
|
originalStorageObject$LWS = globalObject$LWS[storageName$LWS];
|
|
9146
8897
|
// eslint-disable-next-line no-empty
|
|
9147
|
-
} catch (
|
|
8898
|
+
} catch (_unused2$LWS) {}
|
|
9148
8899
|
// istanbul ignore if: currently unreachable via tests
|
|
9149
8900
|
if (!isObject$LWS$1(originalStorageObject$LWS)) {
|
|
9150
8901
|
return noop$LWS$1;
|
|
@@ -9364,16 +9115,6 @@ function initDistortionSVGElementDatasetGetter$LWS({
|
|
|
9364
9115
|
return distortionEntry$LWS;
|
|
9365
9116
|
};
|
|
9366
9117
|
}
|
|
9367
|
-
function initDistortionSVGElementOnsecuritypolicyviolation$LWS({
|
|
9368
|
-
globalObject: {
|
|
9369
|
-
SVGElement: {
|
|
9370
|
-
prototype: SVGElementProto$LWS
|
|
9371
|
-
},
|
|
9372
|
-
SVGElement: SVGElement$LWS
|
|
9373
|
-
}
|
|
9374
|
-
}) {
|
|
9375
|
-
return createEventDistortionFactory$LWS(SVGElementProto$LWS, SVGElement$LWS, 'securitypolicyviolation');
|
|
9376
|
-
}
|
|
9377
9118
|
function initDistortionSVGElementStyleGetter$LWS({
|
|
9378
9119
|
globalObject: {
|
|
9379
9120
|
SVGElement: SVGElement$LWS
|
|
@@ -9533,7 +9274,7 @@ function initDistortionTrustedTypePolicyFactoryCreatePolicy$LWS({
|
|
|
9533
9274
|
try {
|
|
9534
9275
|
// istanbul ignore next: needs default platform behavior test
|
|
9535
9276
|
return ReflectApply$LWS$1(originalCreatePolicy$LWS, this, args$LWS);
|
|
9536
|
-
} catch (
|
|
9277
|
+
} catch (_unused3$LWS) {
|
|
9537
9278
|
// istanbul ignore next: this is tested, but currently cannot be tested in the coverage environment
|
|
9538
9279
|
consoleWarn$LWS(`${createTrustedTypesExceptionMessage$LWS(name$LWS)} Substituting with Lightning Web Security policy.`);
|
|
9539
9280
|
}
|
|
@@ -9604,12 +9345,16 @@ function initDistortionURLCreateObjectURL$LWS({
|
|
|
9604
9345
|
ReflectApply$LWS$1(XhrProtoOpen$LWS, xhr$LWS, ['GET', outURL$LWS, false]);
|
|
9605
9346
|
try {
|
|
9606
9347
|
ReflectApply$LWS$1(XhrProtoSend$LWS, xhr$LWS, []);
|
|
9607
|
-
} catch (
|
|
9348
|
+
} catch (_unused4$LWS) {
|
|
9608
9349
|
throw new LockerSecurityError$LWS(`Unable to verify ${toSafeTemplateStringValue$LWS(blobObject$LWS)} is secure.`);
|
|
9609
9350
|
}
|
|
9610
9351
|
const responseText$LWS = ReflectApply$LWS$1(XhrProtoResponseTextGetter$LWS, xhr$LWS, []);
|
|
9352
|
+
// W-15987833
|
|
9353
|
+
if (isInherentlyUnsecure$LWS(responseText$LWS)) {
|
|
9354
|
+
throw new LockerSecurityError$LWS(createInsecureBlobErrorMessage$LWS(blobObject$LWS));
|
|
9355
|
+
}
|
|
9611
9356
|
const sanitized$LWS = sanitizer$LWS.sanitize(responseText$LWS);
|
|
9612
|
-
if (!isEqualDomString$LWS(trusted.createHTML(responseText$LWS), trusted.createHTML(sanitized$LWS))
|
|
9357
|
+
if (!isEqualDomString$LWS(trusted.createHTML(responseText$LWS), trusted.createHTML(sanitized$LWS))) {
|
|
9613
9358
|
URLRevokeObjectURL$LWS(outURL$LWS);
|
|
9614
9359
|
throw new LockerSecurityError$LWS(createInsecureBlobErrorMessage$LWS(blobObject$LWS));
|
|
9615
9360
|
}
|
|
@@ -9640,7 +9385,7 @@ function initDistortionWindowFetch$LWS({
|
|
|
9640
9385
|
// similar to link element's href.
|
|
9641
9386
|
parsedURL$LWS = parseURL$LWS(ReflectApply$LWS$1(RequestProtoURLGetter$LWS, url$LWS, []));
|
|
9642
9387
|
} else {
|
|
9643
|
-
parsedURL$LWS = parseURL$LWS(
|
|
9388
|
+
parsedURL$LWS = parseURL$LWS(toString$LWS(url$LWS));
|
|
9644
9389
|
url$LWS = parsedURL$LWS.normalizedURL;
|
|
9645
9390
|
args$LWS[0] = url$LWS;
|
|
9646
9391
|
}
|
|
@@ -10007,7 +9752,7 @@ function initDistortionWindowSetInterval$LWS({
|
|
|
10007
9752
|
} = args$LWS;
|
|
10008
9753
|
if (callback$LWS !== null && callback$LWS !== undefined && typeof callback$LWS !== 'function') {
|
|
10009
9754
|
// Snapshot callback source to prevent shapeshifting.
|
|
10010
|
-
const sourceText$LWS =
|
|
9755
|
+
const sourceText$LWS = toString$LWS(callback$LWS);
|
|
10011
9756
|
// Defer transforming source text asynchronously.
|
|
10012
9757
|
let transformedSourceText$LWS;
|
|
10013
9758
|
// Replace callback parameter.
|
|
@@ -10042,7 +9787,7 @@ function initDistortionWindowSetTimeout$LWS({
|
|
|
10042
9787
|
} = args$LWS;
|
|
10043
9788
|
if (callback$LWS !== null && callback$LWS !== undefined && typeof callback$LWS !== 'function') {
|
|
10044
9789
|
// Snapshot callback source to prevent shapeshifting.
|
|
10045
|
-
const sourceText$LWS =
|
|
9790
|
+
const sourceText$LWS = toString$LWS(callback$LWS);
|
|
10046
9791
|
// Replace callback parameter.
|
|
10047
9792
|
args$LWS[0] = () => {
|
|
10048
9793
|
// Defer transforming source text asynchronously.
|
|
@@ -10141,7 +9886,7 @@ function initDistortionXMLHttpRequestOpen$LWS({
|
|
|
10141
9886
|
// Let the native method handle missing parameters error or null/undefined URL case.
|
|
10142
9887
|
const url$LWS = args$LWS.length > 1 ? args$LWS[1] : undefined;
|
|
10143
9888
|
if (url$LWS !== null && url$LWS !== undefined) {
|
|
10144
|
-
const parsedURL$LWS = parseURL$LWS(
|
|
9889
|
+
const parsedURL$LWS = parseURL$LWS(toString$LWS(url$LWS));
|
|
10145
9890
|
if (!isValidURL$LWS(parsedURL$LWS)) {
|
|
10146
9891
|
throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
|
|
10147
9892
|
}
|
|
@@ -10235,7 +9980,7 @@ initDistortionHistoryPushState$LWS, initDistortionHistoryReplaceState$LWS,
|
|
|
10235
9980
|
// HTMLElement
|
|
10236
9981
|
initDistortionHTMLElementDatasetGetter$LWS, initDistortionHTMLElementInnerTextSetter$LWS, initDistortionHTMLElementOuterTextSetter$LWS, initDistortionHTMLElementStyleGetter$LWS,
|
|
10237
9982
|
// HTMLIFrameElement
|
|
10238
|
-
initDistortionIFrameElementContentDocumentGetter$LWS, initDistortionIFrameElementContentWindowGetter$LWS,
|
|
9983
|
+
initDistortionIFrameElementContentDocumentGetter$LWS, initDistortionIFrameElementContentWindowGetter$LWS, initDistortionHTMLIFrameElementSrcSetter$LWS,
|
|
10239
9984
|
// HTMLLinkElement
|
|
10240
9985
|
initDistortionHTMLLinkElementRelSetter$LWS, initDistortionHTMLLinkElementRelListSetter$LWS,
|
|
10241
9986
|
// HTMLObjectElement
|
|
@@ -10283,8 +10028,6 @@ initDistortionWorkerCtor$LWS, initDistortionWorkerProto$LWS,
|
|
|
10283
10028
|
// XHR
|
|
10284
10029
|
initDistortionXMLHttpRequestOpen$LWS];
|
|
10285
10030
|
const internalKeyedDistortionFactoryInitializers$LWS = [
|
|
10286
|
-
// AbstractRange
|
|
10287
|
-
initDistortionAbstractRangeEndContainerGetter$LWS, initDistortionAbstractRangeStartContainerGetter$LWS,
|
|
10288
10031
|
// Attr
|
|
10289
10032
|
initDistortionAttrValueSetter$LWS,
|
|
10290
10033
|
// Aura
|
|
@@ -10300,7 +10043,7 @@ initDistortionDocumentCookieGetter$LWS, initDistortionDocumentCookieSetter$LWS,
|
|
|
10300
10043
|
// DOMParser
|
|
10301
10044
|
initDistortionDOMParserParseFromString$LWS,
|
|
10302
10045
|
// Element
|
|
10303
|
-
initDistortionElementAttachShadow$LWS, initDistortionElementInnerHTMLSetter$LWS, initDistortionElementInsertAdjacentHTML$LWS, initDistortionElementOuterHTMLSetter$LWS, initDistortionElementSetAttribute$LWS, initDistortionElementSetAttributeNode$LWS, initDistortionElementSetAttributeNodeNS$LWS, initDistortionElementSetAttributeNS$LWS, initDistortionElementSetHTML$LWS,
|
|
10046
|
+
initDistortionElementAttachShadow$LWS, initDistortionElementInnerHTMLSetter$LWS, initDistortionElementInsertAdjacentHTML$LWS, initDistortionElementOuterHTMLSetter$LWS, initDistortionElementSetAttribute$LWS, initDistortionElementSetAttributeNode$LWS, initDistortionElementSetAttributeNodeNS$LWS, initDistortionElementSetAttributeNS$LWS, initDistortionElementSetHTML$LWS, initDistortionElementShadowRootGetter$LWS, initDistortionElementToggleAttribute$LWS,
|
|
10304
10047
|
// Eval
|
|
10305
10048
|
initDistortionEval$LWS,
|
|
10306
10049
|
// Event
|
|
@@ -10310,13 +10053,11 @@ initDistortionEventTargetAddEventListener$LWS,
|
|
|
10310
10053
|
// HTMLBodyElement
|
|
10311
10054
|
initDistortionHTMLBodyElementOnrejectionhandled$LWS, initDistortionHTMLBodyElementOnstorage$LWS, initDistortionHTMLBodyElementOnunhandledrejection$LWS,
|
|
10312
10055
|
// HTMLElement
|
|
10313
|
-
initDistortionHTMLElementCtor$LWS,
|
|
10056
|
+
initDistortionHTMLElementCtor$LWS,
|
|
10314
10057
|
// HTMLFrameSetElement
|
|
10315
10058
|
initDistortionHTMLFrameSetElementOnrejectionhandled$LWS, initDistortionHTMLFrameSetElementOnstorage$LWS, initDistortionHTMLFrameSetElementOnunhandledrejection$LWS,
|
|
10316
10059
|
// HTMLScriptElement,
|
|
10317
10060
|
initDistortionHTMLScriptElementSrcSetter$LWS, initDistortionHTMLScriptElementTextSetter$LWS,
|
|
10318
|
-
// MathMLElement
|
|
10319
|
-
initDistortionMathMLElementOnsecuritypolicyviolation$LWS,
|
|
10320
10061
|
// NamedNodeMap
|
|
10321
10062
|
initDistortionNamedNodeMapSetNamedItem$LWS, initDistortionNamedNodeMapSetNamedItemNS$LWS,
|
|
10322
10063
|
// Node
|
|
@@ -10324,7 +10065,7 @@ initDistortionNodeValueSetter$LWS, initDistortionNodeTextContentGetter$LWS, init
|
|
|
10324
10065
|
// Range
|
|
10325
10066
|
initDistortionRangeCreateContextualFragment$LWS,
|
|
10326
10067
|
// ShadowRoot
|
|
10327
|
-
initDistortionShadowRootInnerHTMLSetter$LWS,
|
|
10068
|
+
initDistortionShadowRootInnerHTMLSetter$LWS,
|
|
10328
10069
|
// Storage
|
|
10329
10070
|
initDistortionLocalStorage$LWS, initDistortionSessionStorage$LWS,
|
|
10330
10071
|
// SVGAnimationElement
|
|
@@ -10332,7 +10073,7 @@ initDistortionSVGAnimateElementAttributeNameAttribute$LWS,
|
|
|
10332
10073
|
// SVGScriptElement
|
|
10333
10074
|
initDistortionSVGScriptElementHrefGetter$LWS, initDistortionSVGScriptElementHrefSetter$LWS,
|
|
10334
10075
|
// SVGSetElement
|
|
10335
|
-
initDistortionSVGSetElementAttributeNameAttribute$LWS,
|
|
10076
|
+
initDistortionSVGSetElementAttributeNameAttribute$LWS,
|
|
10336
10077
|
// URL
|
|
10337
10078
|
initDistortionURLCreateObjectURL$LWS,
|
|
10338
10079
|
// Window
|
|
@@ -10349,8 +10090,8 @@ initDistortionElementAfter$LWS, initDistortionElementAppend$LWS, initDistortionE
|
|
|
10349
10090
|
initDistortionNodeInsertBefore$LWS]);
|
|
10350
10091
|
const externalKeyedDistortionFactoryInitializers$LWS = internalKeyedDistortionFactoryInitializers$LWS;
|
|
10351
10092
|
const distortionFactoryInitializerToggleSwitches$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1([[initDistortionCacheStorageDelete$LWS, 'caches'], [initDistortionCacheStorageHas$LWS, 'caches'], [initDistortionCacheStorageKeys$LWS, 'caches'], [initDistortionCacheStorageMatch$LWS, 'caches'], [initDistortionCacheStorageOpen$LWS, 'caches'], [initDistortionCookieStoreDelete$LWS, 'cookieStore'], [initDistortionCookieStoreGet$LWS, 'cookieStore'], [initDistortionCookieStoreGetAll$LWS, 'cookieStore'], [initDistortionCookieStoreOnChange$LWS, 'cookieStore'], [initDistortionCookieStoreSet$LWS, 'cookieStore'], [initDistortionCSSStyleRuleStyleGetter$LWS, 'style'], [initDistortionCustomElementRegistryDefine$LWS, 'customElements'], [initDistortionCustomElementRegistryGet$LWS, 'customElements'], [initDistortionCustomElementRegistryUpgrade$LWS, 'customElements'], [initDistortionCustomElementRegistryWhenDefined$LWS, 'customElements'], [initDistortionDocumentCookieGetter$LWS, 'documentCookie'], [initDistortionDocumentCookieSetter$LWS, 'documentCookie'], [initDistortionDocumentDomainSetter$LWS, 'documentDomain'], [initDistortionDocumentExecCommand$LWS, 'documentExecCommand'], [initDistortionDOMParserParseFromString$LWS, 'domParserParseFromString'], [initDistortionElementAfter$LWS, 'element'], [initDistortionElementAppend$LWS, 'element'], [initDistortionElementAttributesGetter$LWS, 'attributes'], [initDistortionElementBefore$LWS, 'element'], [initDistortionElementGetInnerHTML$LWS, 'innerHTML'], [initDistortionElementInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionElementInsertAdjacentElement$LWS, 'element'], [initDistortionElementInsertAdjacentHTML$LWS, 'element'], [initDistortionElementOuterHTMLSetter$LWS, 'element'], [initDistortionElementPrepend$LWS, 'element'], [initDistortionElementRemove$LWS, 'element'], [initDistortionElementReplaceChildren$LWS, 'element'], [initDistortionElementReplaceWith$LWS, 'element'], [initDistortionElementSetAttribute$LWS, 'attributes'], [initDistortionElementSetAttributeNode$LWS, 'attributes'], [initDistortionElementSetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementSetAttributeNS$LWS, 'attributes'], [initDistortionElementSetHTML$LWS, 'element'], [initDistortionElementToggleAttribute$LWS, 'attributes'], [initDistortionHistoryPushState$LWS, 'history'], [initDistortionHistoryReplaceState$LWS, 'history'], [initDistortionHTMLElementDatasetGetter$LWS, 'dataset'], [initDistortionHTMLElementStyleGetter$LWS, 'style'], [initDistortionHTMLScriptElementSrcGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcSetter$LWS, 'script'], [initDistortionHTMLScriptElementTextSetter$LWS, 'script'], [initDistortionIDBObjectStoreAdd$LWS, 'indexedDB'], [initDistortionIDBObjectStorePut$LWS, 'indexedDB'], [initDistortionLocalStorage$LWS, 'storage'], [initDistortionMessagePortPostMessage$LWS, 'postMessage'], [initDistortionNamedNodeMapSetNamedItem$LWS, 'attributes'], [initDistortionNamedNodeMapSetNamedItemNS$LWS, 'attributes'], [initDistortionNavigatorSendBeacon$LWS, 'navigatorSendBeacon'], [initDistortionNodeInsertBefore$LWS, 'node'], [initDistortionNodeRemoveChild$LWS, 'node'], [initDistortionNodeReplaceChild$LWS, 'node'], [initDistortionNodeTextContentGetter$LWS, 'node'], [initDistortionNodeTextContentSetter$LWS, 'node'], [initDistortionNodeValueSetter$LWS, 'node'], [initDistortionNotificationCtor$LWS, 'notification'], [initDistortionPerformanceMark$LWS, 'performance'], [initDistortionPerformanceMarkCtor$LWS, 'performance'], [initDistortionPerformanceMeasure$LWS, 'performance'], [initDistortionRangeCreateContextualFragment$LWS, 'range'], [initDistortionRangeDeleteContents$LWS, 'range'], [initDistortionRangeExtractContents$LWS, 'range'], [initDistortionRangeInsertNode$LWS, 'range'], [initDistortionRangeSelectNode$LWS, 'range'], [initDistortionRangeSelectNodeContents$LWS, 'range'], [initDistortionRangeSetEnd$LWS, 'range'], [initDistortionRangeSetEndAfter$LWS, 'range'], [initDistortionRangeSetEndBefore$LWS, 'range'], [initDistortionRangeSetStart$LWS, 'range'], [initDistortionRangeSetStartAfter$LWS, 'range'], [initDistortionRangeSetStartBefore$LWS, 'range'], [initDistortionRangeSurroundContents$LWS, 'range'], [initDistortionSelectionCollapse$LWS, 'selection'], [initDistortionSelectionExtend$LWS, 'selection'], [initDistortionSelectionSelectAllChildren$LWS, 'selection'], [initDistortionSelectionSetBaseAndExtent$LWS, 'selection'], [initDistortionSelectionSetPosition$LWS, 'selection'], [initDistortionSessionStorage$LWS, 'storage'], [initDistortionShadowRootInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionStorage$LWS, 'storage'], [initDistortionStorageClear$LWS, 'storage'], [initDistortionStorageGetItem$LWS, 'storage'], [initDistortionStorageKey$LWS, 'storage'], [initDistortionStorageLength$LWS, 'storage'], [initDistortionStorageRemoveItem$LWS, 'storage'], [initDistortionStorageSetItem$LWS, 'storage'], [initDistortionSVGElementDatasetGetter$LWS, 'dataset'], [initDistortionSVGElementStyleGetter$LWS, 'style'], [initDistortionSVGScriptElementHrefGetter$LWS, 'script'], [initDistortionSVGScriptElementHrefSetter$LWS, 'script'], [initDistortionWindowFetch$LWS, 'windowFetch'], [initDistortionWindowFramesGetter$LWS, 'windowFrames'], [initDistortionWindowGetComputedStyle$LWS, 'style'], [initDistortionWindowLengthGetter$LWS, 'windowFrames'], [initDistortionWindowPostMessage$LWS, 'postMessage'], [initDistortionWindowSetInterval$LWS, 'setInterval'], [initDistortionWindowSetTimeout$LWS, 'setTimeout'], [initDistortionXMLHttpRequestResponseGetter$LWS, 'xhr'], [initDistortionXMLHttpRequestResponseXMLGetter$LWS, 'xhr']]));
|
|
10352
|
-
const DocumentBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', '
|
|
10353
|
-
const ElementBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
|
|
10093
|
+
const DocumentBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
|
|
10094
|
+
const ElementBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'setHTMLUnsafe', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
|
|
10354
10095
|
const EventBlockedProperties$LWS = ['originalTarget', 'explicitOriginalTarget'];
|
|
10355
10096
|
const HTMLElementBlockedAttributes$LWS = ['nonce'];
|
|
10356
10097
|
const HTMLElementBlockedProperties$LWS = ['nonce', 'onrejectionhandled', 'onunhandledrejection'];
|
|
@@ -10367,7 +10108,7 @@ const SVGElementBlockedProperties$LWS = ['nonce'];
|
|
|
10367
10108
|
const UIEventBlockedProperties$LWS = ['rangeParent'];
|
|
10368
10109
|
const WindowBlockedProperties$LWS = ['find', 'requestFileSystem', 'webkitRequestFileSystem'];
|
|
10369
10110
|
const XSLTProcessorBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
|
|
10370
|
-
/*! version: 0.
|
|
10111
|
+
/*! version: 0.22.5 */
|
|
10371
10112
|
|
|
10372
10113
|
/*!
|
|
10373
10114
|
* Copyright (C) 2019 salesforce.com, inc.
|
|
@@ -15027,7 +14768,7 @@ class VirtualEnvironment$LWS {
|
|
|
15027
14768
|
* problematic, and requires a lot more work to guarantee that objects from both sides
|
|
15028
14769
|
* can be considered equivalents (without identity discontinuity).
|
|
15029
14770
|
*/
|
|
15030
|
-
function getESGlobalKeys$LWS(
|
|
14771
|
+
function getESGlobalKeys$LWS(remapTypedArrays$LWS = true) {
|
|
15031
14772
|
const ESGlobalKeys$LWS = [
|
|
15032
14773
|
// *** 19.1 Value Properties of the Global Object
|
|
15033
14774
|
'globalThis', 'Infinity', 'NaN', 'undefined',
|
|
@@ -15043,7 +14784,8 @@ function getESGlobalKeys$LWS(maxPerfMode$LWS) {
|
|
|
15043
14784
|
// 'EvalError', // Reflective
|
|
15044
14785
|
'FinalizationRegistry',
|
|
15045
14786
|
// 'Function', // dangerous & Reflective
|
|
15046
|
-
'Map',
|
|
14787
|
+
// 'Map', // Remapped
|
|
14788
|
+
'Number',
|
|
15047
14789
|
// 'Object', // Reflective
|
|
15048
14790
|
// Allow blue `Promise` constructor to overwrite the Red one so that promises
|
|
15049
14791
|
// created by the `Promise` constructor or APIs like `fetch` will work.
|
|
@@ -15051,11 +14793,15 @@ function getESGlobalKeys$LWS(maxPerfMode$LWS) {
|
|
|
15051
14793
|
// 'Proxy', // Reflective
|
|
15052
14794
|
// 'RangeError', // Reflective
|
|
15053
14795
|
// 'ReferenceError', // Reflective
|
|
15054
|
-
'RegExp',
|
|
14796
|
+
'RegExp',
|
|
14797
|
+
// 'Set', // Remapped
|
|
14798
|
+
'String', 'Symbol',
|
|
15055
14799
|
// 'SyntaxError', // Reflective
|
|
15056
14800
|
// 'TypeError', // Reflective
|
|
15057
14801
|
// 'URIError', // Reflective
|
|
15058
|
-
'WeakMap',
|
|
14802
|
+
// 'WeakMap', // Remapped
|
|
14803
|
+
// 'WeakSet', // Remapped
|
|
14804
|
+
'WeakRef',
|
|
15059
14805
|
// *** 18.4 Other Properties of the Global Object
|
|
15060
14806
|
// 'Atomics', // Remapped
|
|
15061
14807
|
'JSON', 'Math', 'Reflect',
|
|
@@ -15064,22 +14810,16 @@ function getESGlobalKeys$LWS(maxPerfMode$LWS) {
|
|
|
15064
14810
|
// *** ECMA-402
|
|
15065
14811
|
// 'Intl', // Remapped
|
|
15066
14812
|
];
|
|
15067
|
-
|
|
15068
|
-
|
|
15069
|
-
intrinsics: ['ArrayBuffer', 'Atomics', 'BigInt64Array', 'BigUint64Array', 'DataView', 'Float32Array', 'Float64Array', 'Int16Array', 'Int32Array', 'Int8Array', 'SharedArrayBuffer', 'Uint16Array', 'Uint32Array', 'Uint8Array', 'Uint8ClampedArray'],
|
|
15070
|
-
// Ideally these should come from browser-realm, that's a code reorg improvement for later
|
|
15071
|
-
browser: ['Blob', 'crypto', 'Crypto', 'File', 'FileReader', 'SubtleCrypto', 'URL']
|
|
15072
|
-
};
|
|
15073
|
-
if (maxPerfMode$LWS) {
|
|
15074
|
-
ESGlobalKeys$LWS.push(...maxPerfModeKeys$LWS.intrinsics, ...maxPerfModeKeys$LWS.browser);
|
|
14813
|
+
if (remapTypedArrays$LWS === false) {
|
|
14814
|
+
ESGlobalKeys$LWS.push('ArrayBuffer', 'BigInt64Array', 'BigUint64Array', 'DataView', 'Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int32Array', 'SharedArrayBuffer', 'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array');
|
|
15075
14815
|
}
|
|
15076
14816
|
return ESGlobalKeys$LWS;
|
|
15077
14817
|
}
|
|
15078
14818
|
// These are foundational things that should never be wrapped but are equivalent
|
|
15079
14819
|
// @TODO: Revisit this list.
|
|
15080
14820
|
const ReflectiveIntrinsicObjectNames$LWS = ['AggregateError', 'Array', 'Error', 'EvalError', 'Function', 'Object', 'Proxy', 'RangeError', 'ReferenceError', 'SyntaxError', 'TypeError', 'URIError', 'eval', 'globalThis'];
|
|
15081
|
-
function getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(
|
|
15082
|
-
const ESGlobalKeys$LWS = getESGlobalKeys$LWS(
|
|
14821
|
+
function getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(remapTypedArrays$LWS = true) {
|
|
14822
|
+
const ESGlobalKeys$LWS = getESGlobalKeys$LWS(remapTypedArrays$LWS);
|
|
15083
14823
|
return toSafeArray$LWS([...ESGlobalKeys$LWS, ...ReflectiveIntrinsicObjectNames$LWS]);
|
|
15084
14824
|
}
|
|
15085
14825
|
function getGlobalObjectOwnKeys$LWS(source$LWS) {
|
|
@@ -15092,9 +14832,9 @@ function getGlobalObjectOwnKeys$LWS(source$LWS) {
|
|
|
15092
14832
|
}
|
|
15093
14833
|
return ownKeys$LWS;
|
|
15094
14834
|
}
|
|
15095
|
-
function assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(descs$LWS, source$LWS,
|
|
14835
|
+
function assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(descs$LWS, source$LWS, includeTypedArrays$LWS) {
|
|
15096
14836
|
const ownKeys$LWS = getGlobalObjectOwnKeys$LWS(source$LWS);
|
|
15097
|
-
const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(
|
|
14837
|
+
const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(includeTypedArrays$LWS);
|
|
15098
14838
|
for (let i$LWS = 0, {
|
|
15099
14839
|
length: length$LWS
|
|
15100
14840
|
} = ownKeys$LWS; i$LWS < length$LWS; i$LWS += 1) {
|
|
@@ -15117,11 +14857,11 @@ function assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(descs$LWS,
|
|
|
15117
14857
|
}
|
|
15118
14858
|
return descs$LWS;
|
|
15119
14859
|
}
|
|
15120
|
-
function getFilteredGlobalOwnKeys$LWS(source$LWS,
|
|
14860
|
+
function getFilteredGlobalOwnKeys$LWS(source$LWS, includeTypedArrays$LWS) {
|
|
15121
14861
|
const result$LWS = [];
|
|
15122
14862
|
let resultOffset$LWS = 0;
|
|
15123
14863
|
const ownKeys$LWS = getGlobalObjectOwnKeys$LWS(source$LWS);
|
|
15124
|
-
const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(
|
|
14864
|
+
const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(includeTypedArrays$LWS);
|
|
15125
14865
|
for (let i$LWS = 0, {
|
|
15126
14866
|
length: length$LWS
|
|
15127
14867
|
} = ownKeys$LWS; i$LWS < length$LWS; i$LWS += 1) {
|
|
@@ -15195,8 +14935,18 @@ function getCachedGlobalObjectReferences$LWS(globalObject$LWS) {
|
|
|
15195
14935
|
blueDocumentToRecordMap$LWS.set(document$LWS, record$LWS);
|
|
15196
14936
|
return record$LWS;
|
|
15197
14937
|
}
|
|
15198
|
-
function filterWindowKeys$LWS(keys$LWS) {
|
|
14938
|
+
function filterWindowKeys$LWS(keys$LWS, remapTypedArrays$LWS) {
|
|
15199
14939
|
const excludedKeys$LWS = new SetCtor$LWS(['document', 'location', 'top', 'window']);
|
|
14940
|
+
// Crypto and typed arrays must be from the same global object
|
|
14941
|
+
if (remapTypedArrays$LWS === false) {
|
|
14942
|
+
excludedKeys$LWS.add('crypto');
|
|
14943
|
+
excludedKeys$LWS.add('Crypto');
|
|
14944
|
+
excludedKeys$LWS.add('SubtleCrypto');
|
|
14945
|
+
excludedKeys$LWS.add('Blob');
|
|
14946
|
+
excludedKeys$LWS.add('File');
|
|
14947
|
+
excludedKeys$LWS.add('FileReader');
|
|
14948
|
+
excludedKeys$LWS.add('URL');
|
|
14949
|
+
}
|
|
15200
14950
|
const result$LWS = [];
|
|
15201
14951
|
let resultOffset$LWS = 0;
|
|
15202
14952
|
for (let i$LWS = 0, {
|
|
@@ -15237,7 +14987,7 @@ function filterWindowKeys$LWS(keys$LWS) {
|
|
|
15237
14987
|
* that will be installed (via the membrane) as global descriptors in
|
|
15238
14988
|
* the red realm.
|
|
15239
14989
|
*/
|
|
15240
|
-
function removeWindowDescriptors$LWS(unsafeDescs$LWS) {
|
|
14990
|
+
function removeWindowDescriptors$LWS(unsafeDescs$LWS, remapTypedArrays$LWS) {
|
|
15241
14991
|
// Remove unforgeable descriptors that cannot be installed.
|
|
15242
14992
|
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'document');
|
|
15243
14993
|
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'location');
|
|
@@ -15245,6 +14995,16 @@ function removeWindowDescriptors$LWS(unsafeDescs$LWS) {
|
|
|
15245
14995
|
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'window');
|
|
15246
14996
|
// Remove other browser specific unforgeables.
|
|
15247
14997
|
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'chrome');
|
|
14998
|
+
// Crypto and typed arrays must be from the same global object
|
|
14999
|
+
if (remapTypedArrays$LWS === false) {
|
|
15000
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'crypto');
|
|
15001
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'Crypto');
|
|
15002
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'SubtleCrypto');
|
|
15003
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'Blob');
|
|
15004
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'File');
|
|
15005
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'FileReader');
|
|
15006
|
+
ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'URL');
|
|
15007
|
+
}
|
|
15248
15008
|
return unsafeDescs$LWS;
|
|
15249
15009
|
}
|
|
15250
15010
|
/**
|
|
@@ -15285,7 +15045,7 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
|
|
|
15285
15045
|
instrumentation: instrumentation$LWS,
|
|
15286
15046
|
keepAlive: keepAlive$LWS = true,
|
|
15287
15047
|
liveTargetCallback: liveTargetCallback$LWS,
|
|
15288
|
-
|
|
15048
|
+
remapTypedArrays: remapTypedArrays$LWS = true,
|
|
15289
15049
|
signSourceCallback: signSourceCallback$LWS
|
|
15290
15050
|
// eslint-disable-next-line prefer-object-spread
|
|
15291
15051
|
} = ObjectAssign$LWS({
|
|
@@ -15294,7 +15054,7 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
|
|
|
15294
15054
|
const iframe$LWS = createDetachableIframe$LWS(blueRefs$LWS.document);
|
|
15295
15055
|
const redWindow$LWS = ReflectApply$LWS(HTMLIFrameElementProtoContentWindowGetter$LWS, iframe$LWS, []);
|
|
15296
15056
|
const shouldUseDefaultGlobalOwnKeys$LWS = typeof globalObjectShape$LWS !== 'object' || globalObjectShape$LWS === null;
|
|
15297
|
-
const defaultGlobalOwnKeys$LWS = filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(redWindow$LWS,
|
|
15057
|
+
const defaultGlobalOwnKeys$LWS = filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(redWindow$LWS, remapTypedArrays$LWS), remapTypedArrays$LWS);
|
|
15298
15058
|
let blueConnector$LWS = blueCreateHooksCallbackCache$LWS.get(blueRefs$LWS.document);
|
|
15299
15059
|
if (blueConnector$LWS === undefined) {
|
|
15300
15060
|
blueConnector$LWS = createBlueConnector$LWS(globalObject$LWS);
|
|
@@ -15335,7 +15095,7 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
|
|
|
15335
15095
|
// window.__proto__.__proto__.__proto__ (aka EventTarget.prototype)
|
|
15336
15096
|
env$LWS.link('__proto__', '__proto__', '__proto__');
|
|
15337
15097
|
env$LWS.remapProto(blueRefs$LWS.document, blueRefs$LWS.DocumentProto);
|
|
15338
|
-
env$LWS.lazyRemapProperties(blueRefs$LWS.window, shouldUseDefaultGlobalOwnKeys$LWS ? defaultGlobalOwnKeys$LWS : filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(globalObjectShape$LWS,
|
|
15098
|
+
env$LWS.lazyRemapProperties(blueRefs$LWS.window, shouldUseDefaultGlobalOwnKeys$LWS ? defaultGlobalOwnKeys$LWS : filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(globalObjectShape$LWS), remapTypedArrays$LWS),
|
|
15339
15099
|
// Chromium based browsers have a bug that nulls the result of `window`
|
|
15340
15100
|
// getters in detached iframes when the property descriptor of `window.window`
|
|
15341
15101
|
// is retrieved.
|
|
@@ -15343,8 +15103,8 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
|
|
|
15343
15103
|
keepAlive$LWS ? undefined : unforgeablePoisonedWindowKeys$LWS);
|
|
15344
15104
|
if (endowments$LWS) {
|
|
15345
15105
|
const filteredEndowments$LWS = {};
|
|
15346
|
-
assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(filteredEndowments$LWS, endowments$LWS,
|
|
15347
|
-
removeWindowDescriptors$LWS(filteredEndowments$LWS);
|
|
15106
|
+
assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(filteredEndowments$LWS, endowments$LWS, remapTypedArrays$LWS);
|
|
15107
|
+
removeWindowDescriptors$LWS(filteredEndowments$LWS, remapTypedArrays$LWS);
|
|
15348
15108
|
env$LWS.remapProperties(blueRefs$LWS.window, filteredEndowments$LWS);
|
|
15349
15109
|
}
|
|
15350
15110
|
// We intentionally skip remapping Window.prototype because there is nothing
|
|
@@ -15631,7 +15391,7 @@ function createEvalHelpersFactoryArgs$LWS(record$LWS) {
|
|
|
15631
15391
|
// DOM per url per sandbox.
|
|
15632
15392
|
// istanbul ignore next: currently unreachable via tests, platformResourceLoader testing is exclusively done in AMD format mode
|
|
15633
15393
|
function loadScript$LWS(_thisArg$LWS, url$LWS) {
|
|
15634
|
-
const urlResolved$LWS = resolveURL$LWS(
|
|
15394
|
+
const urlResolved$LWS = resolveURL$LWS(toString$LWS(url$LWS));
|
|
15635
15395
|
const scripts$LWS = ReflectApply$LWS$1(ElementProtoQuerySelectorAll$LWS, head$LWS, ['script']);
|
|
15636
15396
|
for (let i$LWS = 0, {
|
|
15637
15397
|
length: length$LWS
|
|
@@ -15671,7 +15431,7 @@ function createEvalHelpersFactoryArgs$LWS(record$LWS) {
|
|
|
15671
15431
|
// per url for all the sandboxes.
|
|
15672
15432
|
// istanbul ignore next: currently unreachable via tests, platformResourceLoader testing is exclusively done in AMD format mode
|
|
15673
15433
|
function loadStyle$LWS(_thisArg$LWS, url$LWS) {
|
|
15674
|
-
const urlResolved$LWS = resolveURL$LWS(
|
|
15434
|
+
const urlResolved$LWS = resolveURL$LWS(toString$LWS(url$LWS));
|
|
15675
15435
|
let link$LWS = ReflectApply$LWS$1(ElementProtoQuerySelector$LWS, head$LWS, [`link[href=${enquote$LWS(urlResolved$LWS)}]`]);
|
|
15676
15436
|
if (link$LWS) {
|
|
15677
15437
|
var _resourceStatusCache$2$LWS;
|
|
@@ -15694,7 +15454,7 @@ function createEvalHelpersFactoryArgs$LWS(record$LWS) {
|
|
|
15694
15454
|
}];
|
|
15695
15455
|
}
|
|
15696
15456
|
function toSourceText$LWS(value$LWS, sourceType$LWS) {
|
|
15697
|
-
let sourceText$LWS = typeof value$LWS === 'function' ? extractFunctionBodySource$LWS(value$LWS) :
|
|
15457
|
+
let sourceText$LWS = typeof value$LWS === 'function' ? extractFunctionBodySource$LWS(value$LWS) : toString$LWS(value$LWS);
|
|
15698
15458
|
// We workaround bundlers, like Rollup, aggressively stripping inline source
|
|
15699
15459
|
// maps by compiling them with the name "sandboxMappingURL". At runtime the
|
|
15700
15460
|
// name is changed so the inline source map is registered.
|
|
@@ -15703,7 +15463,7 @@ function toSourceText$LWS(value$LWS, sourceType$LWS) {
|
|
|
15703
15463
|
// tools from mistaking the regexp or the replacement string for an
|
|
15704
15464
|
// actual source mapping URL.
|
|
15705
15465
|
/\/\/# sandbox(?=MappingURL=.*?\s*$)/, '//# source']);
|
|
15706
|
-
sourceText$LWS = `\n//# LWS Version = "0.
|
|
15466
|
+
sourceText$LWS = `\n//# LWS Version = "0.22.5"\n${sourceText$LWS}`;
|
|
15707
15467
|
return sourceType$LWS === 1 /* SourceType.Module */ && indexOfPragma$LWS(sourceText$LWS, 'use strict') === -1 ?
|
|
15708
15468
|
// Append "'use strict'" to the extracted function body so it is
|
|
15709
15469
|
// evaluated in strict mode.
|
|
@@ -15796,9 +15556,13 @@ function createVirtualEnvironment$LWS(record$LWS) {
|
|
|
15796
15556
|
},
|
|
15797
15557
|
type: type$LWS
|
|
15798
15558
|
} = record$LWS;
|
|
15799
|
-
|
|
15800
|
-
|
|
15801
|
-
|
|
15559
|
+
// only Omnistudio test namespaces 'devopsimpkg*' or exact 'omnistudio' name
|
|
15560
|
+
let remapTypedArrays$LWS = true;
|
|
15561
|
+
if (key$LWS === 'omnistudio') {
|
|
15562
|
+
remapTypedArrays$LWS = false;
|
|
15563
|
+
} else if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, key$LWS, ['devopsimpkg'])) {
|
|
15564
|
+
remapTypedArrays$LWS = false;
|
|
15565
|
+
}
|
|
15802
15566
|
return createIframeVirtualEnvironment$LWS(globalObject$LWS, {
|
|
15803
15567
|
defaultPolicy: {
|
|
15804
15568
|
createScript:
|
|
@@ -15888,10 +15652,10 @@ function createVirtualEnvironment$LWS(record$LWS) {
|
|
|
15888
15652
|
// accessible from inside the sandbox.
|
|
15889
15653
|
ObjectAssign$LWS$1({}, DEFAULT_ENDOWMENTS_DESCRIPTOR_MAP$LWS, ObjectGetOwnPropertyDescriptors$LWS(endowments$LWS)) : DEFAULT_ENDOWMENTS_DESCRIPTOR_MAP$LWS,
|
|
15890
15654
|
instrumentation: instrumentation$LWS,
|
|
15891
|
-
|
|
15655
|
+
remapTypedArrays: remapTypedArrays$LWS,
|
|
15892
15656
|
keepAlive:
|
|
15893
15657
|
// istanbul ignore next: cannot test isLockerFeatureEnabled
|
|
15894
|
-
|
|
15658
|
+
!remapTypedArrays$LWS && isLockerFeatureEnabled$LWS('isLockerNextForOmnistudioEnabled') || IFRAME_KEEP_ALIVE_FLAG$LWS,
|
|
15895
15659
|
liveTargetCallback: isTargetLive$LWS,
|
|
15896
15660
|
signSourceCallback: sourceText$LWS => trusted.createScript(sourceText$LWS)
|
|
15897
15661
|
});
|
|
@@ -15917,7 +15681,6 @@ function createRootWindowSandboxRecord$LWS({
|
|
|
15917
15681
|
if (record$LWS) {
|
|
15918
15682
|
return record$LWS;
|
|
15919
15683
|
}
|
|
15920
|
-
// istanbul ignore next: instrumentation is not tested
|
|
15921
15684
|
const LOCKER_INSTRUMENTATION_FLAG$LWS =
|
|
15922
15685
|
// In the future we can preface the LOCKER_INSTRUMENTATION_FLAG
|
|
15923
15686
|
// definition with a LOCKER_UNMINIFIED_FLAG check to have instrumentation
|
|
@@ -16224,30 +15987,24 @@ function internalEvaluateInSandbox$LWS(evaluateOptions$LWS) {
|
|
|
16224
15987
|
}
|
|
16225
15988
|
let result$LWS;
|
|
16226
15989
|
const sourceText$LWS = toSourceText$LWS(source$LWS, sourceType$LWS);
|
|
16227
|
-
// istanbul ignore next: instrumentation is not tested
|
|
16228
15990
|
const activity$LWS = LOCKER_INSTRUMENTATION_FLAG$LWS ? instrumentation$LWS == null ? void 0 : instrumentation$LWS.startActivity('lws.evaluate') : undefined;
|
|
16229
15991
|
try {
|
|
16230
15992
|
// Protecting against errors during evaluation can guarantee the state
|
|
16231
15993
|
// of the EvalContext to avoid leaking context values
|
|
16232
15994
|
result$LWS = virtualEnvironmentEvaluator$LWS(sourceText$LWS);
|
|
16233
|
-
// istanbul ignore next: instrumentation is not tested
|
|
16234
15995
|
instrumentation$LWS == null || instrumentation$LWS.incrementCounter == null || instrumentation$LWS.incrementCounter('lws.evaluate', 1, false);
|
|
16235
15996
|
} catch (error) {
|
|
16236
|
-
// istanbul ignore next: instrumentation is not tested
|
|
16237
15997
|
instrumentation$LWS == null || instrumentation$LWS.incrementCounter == null || instrumentation$LWS.incrementCounter('lws.evaluate', 1, true);
|
|
16238
|
-
// istanbul ignore next: instrumentation is not tested
|
|
16239
15998
|
activity$LWS == null || activity$LWS.error({
|
|
16240
15999
|
sandboxKey: key$LWS,
|
|
16241
16000
|
error
|
|
16242
16001
|
});
|
|
16243
|
-
// istanbul ignore next: instrumentation is not tested
|
|
16244
16002
|
activity$LWS == null || activity$LWS.stop();
|
|
16245
16003
|
throw error;
|
|
16246
16004
|
} finally {
|
|
16247
16005
|
clearEvalContext$LWS();
|
|
16248
16006
|
clearEvalHelpers$LWS();
|
|
16249
16007
|
}
|
|
16250
|
-
// istanbul ignore next: instrumentation is not tested
|
|
16251
16008
|
activity$LWS == null || activity$LWS.stop();
|
|
16252
16009
|
return result$LWS;
|
|
16253
16010
|
}
|
|
@@ -16390,7 +16147,7 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
|
|
|
16390
16147
|
depRegistry$LWS.set(dep$LWS, secureDep$LWS);
|
|
16391
16148
|
return secureDep$LWS;
|
|
16392
16149
|
}
|
|
16393
|
-
/*! version: 0.
|
|
16150
|
+
/*! version: 0.22.5 */
|
|
16394
16151
|
|
|
16395
16152
|
const loaderDefine = globalThis.LWR.define;
|
|
16396
16153
|
|