@lwrjs/client-modules 0.15.2 → 0.15.4-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -230,6 +230,7 @@ const LOCKER_NEAR_MEMBRANE_IS_MASKED_SYMBOL$LWS = SymbolFor$LWS$1('@@lockerNearM
230
230
  const LOCKER_NEAR_MEMBRANE_SERIALIZED_VALUE_SYMBOL$LWS$1 = SymbolFor$LWS$1('@@lockerNearMembraneSerializedValue');
231
231
  const LOCKER_NEAR_MEMBRANE_SYMBOL$LWS$1 = SymbolFor$LWS$1('@@lockerNearMembrane');
232
232
  const LOCKER_NEAR_MEMBRANE_UNMASKED_VALUE_SYMBOL$LWS = SymbolFor$LWS$1('@@lockerNearMembraneUnmaskedValue');
233
+ // Legacy symbol used by packages/locker-core-engine/src/LockerFilter.js.
233
234
  const SYMBOL_LIVE_OBJECT$LWS = SymbolFor$LWS$1('@@lockerLiveValue');
234
235
  // Object brand constants.
235
236
  const TO_STRING_BRAND_ARRAY$LWS = '[object Array]';
@@ -444,7 +445,6 @@ function maskFunction$LWS(func$LWS, maskFunc$LWS, trapInvokers$LWS) {
444
445
  // `LOCKER_NEAR_MEMBRANE_IS_MASKED_SYMBOL` properties
445
446
  // because we know that when the `handshakeProxyMaskedFlag`
446
447
  // is ON that there are NO shadowed values.
447
- // istanbul ignore else: returns immediately
448
448
  if (isProxyMaskedSymbol$LWS) {
449
449
  return true;
450
450
  }
@@ -605,9 +605,9 @@ const TrustedHTMLProtoToString$LWS = TrustedHTMLCtor$LWS == null || (_TrustedHTM
605
605
  const TrustedScriptCtor$LWS = typeof TrustedScript === 'function' ? TrustedScript : /* istanbul ignore next: unreachable in test env */undefined;
606
606
  // istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
607
607
  const TrustedScriptProtoToString$LWS = TrustedScriptCtor$LWS == null || (_TrustedScriptCtor$pr$LWS = TrustedScriptCtor$LWS.prototype) == null ? void 0 : _TrustedScriptCtor$pr$LWS.toString;
608
- const URLCtor$LWS$1 = typeof URL === 'function' ? URL : /* istanbul ignore next: unreachable in test env */undefined;
608
+ const URLCtor$LWS = typeof URL === 'function' ? URL : /* istanbul ignore next: unreachable in test env */undefined;
609
609
  // istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
610
- const URLProtoToString$LWS = URLCtor$LWS$1 == null || (_URLCtor$prototype$LWS = URLCtor$LWS$1.prototype) == null ? void 0 : _URLCtor$prototype$LWS.toString;
610
+ const URLProtoToString$LWS = URLCtor$LWS == null || (_URLCtor$prototype$LWS = URLCtor$LWS.prototype) == null ? void 0 : _URLCtor$prototype$LWS.toString;
611
611
  // To extract the function body start the match from the beginning of the
612
612
  // source code with the character class `[\s\S]` instead of `.` because `[\s\S]`
613
613
  // matches everything including newlines where as `.` matches everything except
@@ -637,11 +637,21 @@ function extractFunctionBodySource$LWS(func$LWS) {
637
637
  // istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
638
638
  return (_ref$LWS = (_match$$LWS = match$LWS == null ? void 0 : match$LWS[1]) != null ? _match$$LWS : match$LWS == null ? void 0 : match$LWS[2]) != null ? _ref$LWS : '';
639
639
  }
640
- // Use `toSafeStringValue()` to coerce values using the default string concatenation
641
- // operation. This must be done ONLY once on incoming values to avoid creating
642
- // shape-shifting exploits, ie. passing { toString() {...} } where a string
643
- // is otherwise expected.
644
- function toSafeStringValue$LWS(value$LWS) {
640
+ function isConvertibleToString$LWS(value$LWS) {
641
+ if (typeof value$LWS !== 'symbol') {
642
+ try {
643
+ // Attempt to coerce `value` to a string with the ToString operation.
644
+ // Section 7.1.17 ToString ( argument )
645
+ // https://tc39.es/ecma262/#sec-tostring
646
+ return `${value$LWS}` !== undefined;
647
+ // eslint-disable-next-line no-empty
648
+ } catch (_unused2$LWS) {}
649
+ }
650
+ return false;
651
+ }
652
+ // Use `toString()` to coerce values using the default string concatenation
653
+ // operation.
654
+ function toString$LWS(value$LWS) {
645
655
  return typeof value$LWS === 'string' ? value$LWS :
646
656
  // Attempt to coerce `value` to a string with the ToString operation.
647
657
  // Section 7.1.17 ToString ( argument )
@@ -660,7 +670,6 @@ function toSafeTemplateStringValue$LWS(value$LWS) {
660
670
  return ReflectApply$LWS$1(FunctionProtoToString$LWS, value$LWS, []);
661
671
  }
662
672
  if (typeof value$LWS === 'object' && value$LWS !== null) {
663
- /* istanbul ignore next: unreachable in test env */
664
673
  if (TrustedHTMLCtor$LWS && value$LWS instanceof TrustedHTMLCtor$LWS) {
665
674
  return ReflectApply$LWS$1(TrustedHTMLProtoToString$LWS, value$LWS, []);
666
675
  }
@@ -668,7 +677,7 @@ function toSafeTemplateStringValue$LWS(value$LWS) {
668
677
  if (TrustedScriptCtor$LWS && value$LWS instanceof TrustedScriptCtor$LWS) {
669
678
  return ReflectApply$LWS$1(TrustedScriptProtoToString$LWS, value$LWS, []);
670
679
  }
671
- if (URLCtor$LWS$1 && value$LWS instanceof URLCtor$LWS$1) {
680
+ if (URLCtor$LWS && value$LWS instanceof URLCtor$LWS) {
672
681
  return ReflectApply$LWS$1(URLProtoToString$LWS, value$LWS, []);
673
682
  }
674
683
  const result$LWS = ReflectApply$LWS$1(ObjectProtoToString$LWS$1, value$LWS, []);
@@ -682,7 +691,7 @@ function toSafeTemplateStringValue$LWS(value$LWS) {
682
691
  // https://tc39.es/ecma262/#sec-string-constructor-string-value
683
692
  return StringCtor$LWS$1(value$LWS);
684
693
  // eslint-disable-next-line no-empty
685
- } catch (_unused2$LWS) {}
694
+ } catch (_unused3$LWS) {}
686
695
  return '[object Unknown]';
687
696
  }
688
697
  const RegExpCtor$LWS$1 = RegExp;
@@ -815,7 +824,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
815
824
  return TO_STRING_BRAND_ARRAY_BUFFER$LWS;
816
825
  }
817
826
  // eslint-disable-next-line no-empty
818
- } catch (_unused3$LWS) {}
827
+ } catch (_unused4$LWS) {}
819
828
  // Section 21.4.4 Properties of the Date Prototype Object
820
829
  // https://tc39.es/ecma262/#thistimevalue
821
830
  // Step 1: If Type(value) is Object and value has a [[DateValue]] internal slot, then
@@ -827,7 +836,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
827
836
  return TO_STRING_BRAND_DATE$LWS;
828
837
  }
829
838
  // eslint-disable-next-line no-empty
830
- } catch (_unused4$LWS) {}
839
+ } catch (_unused5$LWS) {}
831
840
  // Section 24.1.3.10 get Map.prototype.size
832
841
  // https://tc39.es/ecma262/#sec-get-map.prototype.size
833
842
  // Step 2: Perform ? RequireInternalSlot(M, [[MapData]]).
@@ -837,7 +846,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
837
846
  return TO_STRING_BRAND_MAP$LWS;
838
847
  }
839
848
  // eslint-disable-next-line no-empty
840
- } catch (_unused5$LWS) {}
849
+ } catch (_unused6$LWS) {}
841
850
  // Section 24.2.3.9 get Set.prototype.size
842
851
  // https://tc39.es/ecma262/#sec-get-set.prototype.size
843
852
  // Step 2: Perform ? RequireInternalSlot(S, [[SetData]]).
@@ -847,7 +856,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
847
856
  return TO_STRING_BRAND_SET$LWS;
848
857
  }
849
858
  // eslint-disable-next-line no-empty
850
- } catch (_unused6$LWS) {}
859
+ } catch (_unused7$LWS) {}
851
860
  // Section 24.3.3.4 WeakMap.prototype.has ( key )
852
861
  // https://tc39.es/ecma262/#sec-weakmap.prototype.has
853
862
  // Step 2: Perform RequireInternalSlot(M, [[WeakMapData]]).
@@ -857,7 +866,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
857
866
  return TO_STRING_BRAND_WEAK_MAP$LWS;
858
867
  }
859
868
  // eslint-disable-next-line no-empty
860
- } catch (_unused7$LWS) {}
869
+ } catch (_unused8$LWS) {}
861
870
  // Section 24.4.3.4 WeakSet.prototype.has ( value )
862
871
  // https://tc39.es/ecma262/#sec-weakset.prototype.has
863
872
  // Step 2: 2. Perform RequireInternalSlot(S, [[WeakSetData]]).
@@ -867,7 +876,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
867
876
  return TO_STRING_BRAND_WEAK_SET$LWS;
868
877
  }
869
878
  // eslint-disable-next-line no-empty
870
- } catch (_unused8$LWS) {}
879
+ } catch (_unused9$LWS) {}
871
880
  // The following checks are for the rare occurrence of object, i.e. boxed,
872
881
  // primitive values or those objects without a default @@toStringTag.
873
882
  // Section 21.1.3 Properties of the Number Prototype Object
@@ -881,7 +890,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
881
890
  return TO_STRING_BRAND_NUMBER$LWS$1;
882
891
  }
883
892
  // eslint-disable-next-line no-empty
884
- } catch (_unused9$LWS) {}
893
+ } catch (_unused10$LWS) {}
885
894
  // Section 20.4.3 Properties of the Symbol Prototype Object
886
895
  // https://tc39.es/ecma262/#thissymbolvalue
887
896
  // Step 2: If Type(value) is Object and value has a [[SymbolData]] internal slot, then
@@ -893,7 +902,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
893
902
  return TO_STRING_BRAND_SYMBOL$LWS$1;
894
903
  }
895
904
  // eslint-disable-next-line no-empty
896
- } catch (_unused10$LWS) {}
905
+ } catch (_unused11$LWS) {}
897
906
  // Perform heavier checks last.
898
907
  // Section 22.2.6.13 get RegExp.prototype.source
899
908
  // https://tc39.es/ecma262/#sec-get-regexp.prototype.source
@@ -906,7 +915,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
906
915
  return TO_STRING_BRAND_REG_EXP$LWS;
907
916
  }
908
917
  // eslint-disable-next-line no-empty
909
- } catch (_unused11$LWS) {}
918
+ } catch (_unused12$LWS) {}
910
919
  // Section 22.1.3 Properties of the String Prototype Object
911
920
  // https://tc39.es/ecma262/#thisstringvalue
912
921
  // Step 2: If Type(value) is Object and value has a [[StringData]] internal slot, then
@@ -918,7 +927,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
918
927
  return TO_STRING_BRAND_STRING$LWS$1;
919
928
  }
920
929
  // eslint-disable-next-line no-empty
921
- } catch (_unused12$LWS) {}
930
+ } catch (_unused13$LWS) {}
922
931
  // Section 20.3.3 Properties of the Boolean Prototype Object
923
932
  // https://tc39.es/ecma262/#thisbooleanvalue
924
933
  // Step 2: If Type(value) is Object and value has a [[BooleanData]] internal slot, then
@@ -928,7 +937,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
928
937
  ReflectApply$LWS$1(BooleanProtoValueOf$LWS, value$LWS, []);
929
938
  return TO_STRING_BRAND_BOOLEAN$LWS$1;
930
939
  // eslint-disable-next-line no-empty
931
- } catch (_unused13$LWS) {}
940
+ } catch (_unused14$LWS) {}
932
941
  // istanbul ignore else: All platforms that LWS runs tests in support BigInt
933
942
  if (SUPPORTS_BIG_INT$LWS) {
934
943
  try {
@@ -939,7 +948,7 @@ function getBrandByTrialAndError$LWS(value$LWS) {
939
948
  ReflectApply$LWS$1(BigIntProtoValueOf$LWS, value$LWS, []);
940
949
  return TO_STRING_BRAND_BIG_INT$LWS$1;
941
950
  // eslint-disable-next-line no-empty
942
- } catch (_unused14$LWS) {}
951
+ } catch (_unused15$LWS) {}
943
952
  }
944
953
  // Cannot detect brands for Arguments and Error objects.
945
954
  return TO_STRING_BRAND_OBJECT$LWS;
@@ -1320,7 +1329,7 @@ function partialStructuredClone$LWS(value$LWS) {
1320
1329
  try {
1321
1330
  result$LWS = partialStructuredCloneInternal$LWS(value$LWS);
1322
1331
  // eslint-disable-next-line no-empty
1323
- } catch (_unused15$LWS) {}
1332
+ } catch (_unused16$LWS) {}
1324
1333
  SEEN_OBJECTS$LWS.clear();
1325
1334
  }
1326
1335
  return result$LWS;
@@ -1348,33 +1357,9 @@ const {
1348
1357
  function consoleWarn$LWS(...args$LWS) {
1349
1358
  ReflectApply$LWS$1(consoleWarnRef$LWS, consoleRef$LWS, args$LWS);
1350
1359
  }
1351
- const gaterEnabledFeatures$LWS = toSafeSet$LWS(new SetCtor$LWS$1());
1352
- const FEATURE_NAME_PREFIX$LWS = 'com.salesforce.locker.';
1353
- const fullName$LWS = featureName$LWS => featureName$LWS.startsWith(FEATURE_NAME_PREFIX$LWS) ? featureName$LWS : `${FEATURE_NAME_PREFIX$LWS}${featureName$LWS}`;
1360
+ let gaterEnabledFeatures$LWS = [];
1354
1361
  function isGaterEnabledFeature$LWS(featureName$LWS) {
1355
- return gaterEnabledFeatures$LWS.has(fullName$LWS(featureName$LWS));
1356
- }
1357
- const ENABLE_MAX_PERF_MODE_GATE$LWS = 'enableMaxPerfMode';
1358
- const ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS = 'enableSandboxedSameOriginIframe';
1359
- const omniStudioPredicates$LWS = [key$LWS => key$LWS === 'omnistudio', key$LWS => ReflectApply$LWS$1(StringProtoStartsWith$LWS, key$LWS, ['devopsimpkg'])];
1360
- const gaterEnabledOverrideRegistry$LWS = {
1361
- __proto__: null,
1362
- $lwsBogusFeatureDisabledTrue: [() => true],
1363
- $lwsBogusFeatureDisabledFalse: [() => false],
1364
- [ENABLE_MAX_PERF_MODE_GATE$LWS]: omniStudioPredicates$LWS,
1365
- // Temporarily disable this feature gate
1366
- // Ref:
1367
- // "W-17049687: [LWS] Temporarily disable same origin iframe sandbox security fix for OS and devopsimpkg"
1368
- // https://gus.lightning.force.com/lightning/r/ADM_Work__c/a07EE000023unysYAA/view
1369
- [ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS]: omniStudioPredicates$LWS
1370
- };
1371
- function isAllowedToOverrideGaterEnabledFeature$LWS(sandboxKey$LWS, featureName$LWS) {
1372
- var _gaterEnabledOverride$LWS;
1373
- const gaterEnabledOverridePredicates$LWS = toSafeArray$LWS$1((_gaterEnabledOverride$LWS = gaterEnabledOverrideRegistry$LWS[featureName$LWS]) != null ? _gaterEnabledOverride$LWS : []);
1374
- return gaterEnabledOverridePredicates$LWS.some(predicate$LWS => predicate$LWS(sandboxKey$LWS));
1375
- }
1376
- function isNotAllowedToOverrideGaterEnabledFeature$LWS(...args$LWS) {
1377
- return !isAllowedToOverrideGaterEnabledFeature$LWS(...args$LWS);
1362
+ return ReflectApply$LWS$1(ArrayProtoIncludes$LWS$1, gaterEnabledFeatures$LWS, [`com.salesforce.locker.${featureName$LWS}`]);
1378
1363
  }
1379
1364
  const trackedLiveTargets$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
1380
1365
  function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None */) {
@@ -1385,7 +1370,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
1385
1370
  try {
1386
1371
  return trackedLiveTargets$LWS.has(target$LWS) || ObjectHasOwn$LWS$1(target$LWS, SYMBOL_LIVE_OBJECT$LWS);
1387
1372
  // eslint-disable-next-line no-empty
1388
- } catch (_unused16$LWS) {}
1373
+ } catch (_unused17$LWS) {}
1389
1374
  return false;
1390
1375
  }
1391
1376
  if (typeof target$LWS === 'object') {
@@ -1394,7 +1379,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
1394
1379
  return true;
1395
1380
  }
1396
1381
  // eslint-disable-next-line no-empty
1397
- } catch (_unused17$LWS) {}
1382
+ } catch (_unused18$LWS) {}
1398
1383
  let constructor$LWS;
1399
1384
  try {
1400
1385
  ({
@@ -1406,7 +1391,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
1406
1391
  return true;
1407
1392
  }
1408
1393
  // eslint-disable-next-line no-empty
1409
- } catch (_unused18$LWS) {}
1394
+ } catch (_unused19$LWS) {}
1410
1395
  try {
1411
1396
  if (ReflectGetPrototypeOf$LWS$1(target$LWS) === null && (
1412
1397
  // Ensure `target` is not an `Object.prototype` from an iframe.
@@ -1414,13 +1399,13 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
1414
1399
  return true;
1415
1400
  }
1416
1401
  // eslint-disable-next-line no-empty
1417
- } catch (_unused19$LWS) {}
1402
+ } catch (_unused20$LWS) {}
1418
1403
  if (targetTraits$LWS === 0 /* TargetTraits.None */) {
1419
1404
  try {
1420
1405
  if (ArrayIsArray$LWS$1(target$LWS)) {
1421
1406
  return true;
1422
1407
  }
1423
- } catch (_unused20$LWS) {
1408
+ } catch (_unused21$LWS) {
1424
1409
  // The target is a revoked proxy.
1425
1410
  return false;
1426
1411
  }
@@ -1439,7 +1424,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
1439
1424
  return true;
1440
1425
  }
1441
1426
  // eslint-disable-next-line no-empty
1442
- } catch (_unused21$LWS) {}
1427
+ } catch (_unused22$LWS) {}
1443
1428
  // Section 25.1.5.1 get ArrayBuffer.prototype.byteLength
1444
1429
  // https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.bytelength
1445
1430
  // Step 2: Perform RequireInternalSlot(O, [[ArrayBufferData]]).
@@ -1449,7 +1434,7 @@ function isTargetLive$LWS(target$LWS, targetTraits$LWS = 0 /* TargetTraits.None
1449
1434
  return true;
1450
1435
  }
1451
1436
  // eslint-disable-next-line no-empty
1452
- } catch (_unused22$LWS) {}
1437
+ } catch (_unused23$LWS) {}
1453
1438
  }
1454
1439
  return false;
1455
1440
  }
@@ -1504,7 +1489,7 @@ const {
1504
1489
  } = PromiseCtor$LWS.prototype;
1505
1490
  const PromiseResolve$LWS = PromiseCtor$LWS.resolve.bind(PromiseCtor$LWS);
1506
1491
  const PromiseReject$LWS = PromiseCtor$LWS.reject.bind(PromiseCtor$LWS);
1507
- /*! version: 0.23.6 */
1492
+ /*! version: 0.22.5 */
1508
1493
 
1509
1494
  /*!
1510
1495
  * Copyright (C) 2019 salesforce.com, inc.
@@ -1548,7 +1533,6 @@ const {
1548
1533
  } = DocumentProto$LWS$1;
1549
1534
  const {
1550
1535
  createComment: DocumentProtoCreateComment$LWS,
1551
- createDocumentFragment: DocumentProtoCreateDocumentFragment$LWS,
1552
1536
  createElement: DocumentProtoCreateElement$LWS$1,
1553
1537
  createElementNS: DocumentProtoCreateElementNS$LWS,
1554
1538
  getElementById: DocumentProtoGetElementById$LWS
@@ -1562,10 +1546,6 @@ const DocumentProtoDefaultViewGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentP
1562
1546
  const DocumentProtoDocumentElementGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentProto$LWS$1, 'documentElement');
1563
1547
  const DocumentProtoHeadGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentProto$LWS$1, 'head');
1564
1548
  const DocumentProtoImplementationGetter$LWS = ObjectLookupOwnGetter$LWS$1(DocumentProto$LWS$1, 'implementation');
1565
- const {
1566
- append: DocumentFragmentProtoAppend$LWS,
1567
- getElementById: DocumentFragmentProtoGetElementById$LWS
1568
- } = DocumentFragment.prototype;
1569
1549
  const {
1570
1550
  prototype: ElementProto$LWS
1571
1551
  } = Element;
@@ -1618,10 +1598,6 @@ const ElementAriaAttributesToPropertyName$LWS = {
1618
1598
  'aria-valuenow': 'ariaValueNow',
1619
1599
  'aria-valuetext': 'ariaValueText'
1620
1600
  };
1621
- // Used by '@locker/near-membrane-dom'.
1622
- const {
1623
- remove: ElementProtoRemove$LWS$1
1624
- } = ElementProto$LWS;
1625
1601
  const {
1626
1602
  closest: ElementProtoClosest$LWS,
1627
1603
  getAttribute: ElementProtoGetAttribute$LWS,
@@ -1646,6 +1622,23 @@ const {
1646
1622
  get: ElementProtoOuterHTMLGetter$LWS
1647
1623
  } = ReflectGetOwnPropertyDescriptor$LWS(ElementProto$LWS, 'outerHTML');
1648
1624
  const ElementProtoTagNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(ElementProto$LWS, 'tagName');
1625
+ const HTMLTemplateElementProtoContentGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLTemplateElement.prototype, 'content');
1626
+ const {
1627
+ prototype: NodeProto$LWS$1
1628
+ } = Node;
1629
+ const {
1630
+ appendChild: NodeProtoAppendChild$LWS$1,
1631
+ cloneNode: NodeProtoCloneNode$LWS,
1632
+ isEqualNode: NodeProtoIsEqualNode$LWS
1633
+ } = NodeProto$LWS$1;
1634
+ const NodeProtoChildNodesGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'childNodes');
1635
+ const NodeProtoFirstChildGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'firstChild');
1636
+ const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'isConnected');
1637
+ // Used by '@locker/near-membrane-dom'.
1638
+ ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'lastChild');
1639
+ const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'nodeName');
1640
+ const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'ownerDocument');
1641
+ ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS$1, 'textContent');
1649
1642
 
1650
1643
  // Check for the noopener feature being enabled:
1651
1644
  // - noopener
@@ -1751,7 +1744,6 @@ function markForUnsafePropertyBlocking$LWS(childWindow$LWS) {
1751
1744
  return true;
1752
1745
  }
1753
1746
  });
1754
- // istanbul ignore else: currently unreachable via tests
1755
1747
  if (typeof childWindow$LWS[blocked$LWS] === 'function') {
1756
1748
  descriptor$LWS.value = replacement$LWS;
1757
1749
  }
@@ -1841,41 +1833,7 @@ function normalizeWindowOpenArguments$LWS(args$LWS) {
1841
1833
  }
1842
1834
  return normalizedArgs$LWS;
1843
1835
  }
1844
- const HTMLElement$LWS = getUnmaskedFunction$LWS(rootWindow$LWS$1.HTMLElement);
1845
- const {
1846
- prototype: HTMLElementProto$LWS
1847
- } = HTMLElement$LWS;
1848
- const HTMLElementProtoInnerTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLElementProto$LWS, 'innerText');
1849
- // Used by '@locker/near-membrane-dom'.
1850
- ObjectLookupOwnGetter$LWS$1(HTMLElementProto$LWS, 'style');
1851
- const HTMLElementGlobalAttributesToPropertyName$LWS = {
1852
- __proto__: null,
1853
- accesskey: 'accessKey',
1854
- contenteditable: 'contentEditable',
1855
- enterkeyhint: 'enterKeyHint',
1856
- inputmode: 'inputMode',
1857
- tabindex: 'tabIndex'
1858
- };
1859
- const HTMLTemplateElementProtoContentGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLTemplateElement.prototype, 'content');
1860
- const {
1861
- prototype: NodeProto$LWS$1
1862
- } = Node;
1863
- const {
1864
- appendChild: NodeProtoAppendChild$LWS$1,
1865
- cloneNode: NodeProtoCloneNode$LWS,
1866
- isEqualNode: NodeProtoIsEqualNode$LWS
1867
- } = NodeProto$LWS$1;
1868
- const NodeProtoChildNodesGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'childNodes');
1869
- const NodeProtoFirstChildGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'firstChild');
1870
- const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'isConnected');
1871
- // Used by '@locker/near-membrane-dom'.
1872
- ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'lastChild');
1873
- const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'nodeName');
1874
- const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'ownerDocument');
1875
- const NodeProtoParentNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'parentNode');
1876
- ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS$1, 'textContent');
1877
- const rootDocumentDetachedFragment$LWS = ReflectApply$LWS$1(DocumentProtoCreateDocumentFragment$LWS, rootDocument$LWS, []);
1878
- const rootDocumentDetachedContainer$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, rootDocument$LWS, ['div']);
1836
+
1879
1837
  /* eslint-disable no-underscore-dangle */
1880
1838
  class Validator$LWS {
1881
1839
  constructor(document$LWS, {
@@ -1891,36 +1849,7 @@ class Validator$LWS {
1891
1849
  };
1892
1850
  // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
1893
1851
  // eslint-disable-next-line class-methods-use-this
1894
- this.isInherentlyUnsecure = input$LWS => {
1895
- const hasIframe$LWS = hasTag$LWS(input$LWS, 'iframe') && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
1896
- const hasScript$LWS = hasTag$LWS(input$LWS, 'script');
1897
- // If neither an iframe or a script was detected, then this input is safe.
1898
- // istanbul ignore else: returns immediately
1899
- if (!hasIframe$LWS && !hasScript$LWS) {
1900
- return false;
1901
- }
1902
- // If the string contains both the words iframe and srcdoc, it is unsafe
1903
- // istanbul ignore else: returns immediately
1904
- if (hasIframe$LWS) {
1905
- return true;
1906
- }
1907
- // If the input contained the word "script", then we need to confirm that the string
1908
- // that was seen is actually markup.
1909
- //
1910
- // IMPORTANT: We CANNOT reuse this.template.left/right for this check. Template elements
1911
- // do not return innerText or textContent, which makes the following innerHTML/innerText
1912
- // check useless.
1913
- ReflectApply$LWS$1(DocumentFragmentProtoAppend$LWS, rootDocumentDetachedFragment$LWS, [rootDocumentDetachedContainer$LWS]);
1914
- ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, rootDocumentDetachedContainer$LWS, [input$LWS]);
1915
- // This MUST BE CHECKED AFTER IT IS RENDERED. The nature of these attacks requires
1916
- // the actual source to be set to the innerHTML to allow the browser to render
1917
- const innerHTML$LWS = ReflectApply$LWS$1(ElementProtoInnerHTMLGetter$LWS, rootDocumentDetachedContainer$LWS, []);
1918
- const innerText$LWS = ReflectApply$LWS$1(HTMLElementProtoInnerTextGetter$LWS, rootDocumentDetachedContainer$LWS, []);
1919
- ReflectApply$LWS$1(ElementProtoRemove$LWS$1, rootDocumentDetachedContainer$LWS, []);
1920
- // If innerHTML contains "script", but innerText does not, then the string
1921
- // was hiding a script element through some kind of obfuscation, and is unsecure.
1922
- return hasTag$LWS(innerHTML$LWS, 'script') && !hasTag$LWS(innerText$LWS, 'script');
1923
- };
1852
+ this.isInherentlyUnsecure = input$LWS => ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['iframe']) && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['script']) && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
1924
1853
  this.isSharedElement = element$LWS => element$LWS === ReflectApply$LWS$1(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS$1(DocumentProtoBodyGetter$LWS$1, this._document, []) || element$LWS === ReflectApply$LWS$1(DocumentProtoDocumentElementGetter$LWS, this._document, []);
1925
1854
  this._constructors = {
1926
1855
  HTMLLinkElement: HTMLLinkElement$LWS,
@@ -1953,9 +1882,6 @@ function deepIsEqualNode$LWS(leftRoot$LWS, rightRoot$LWS) {
1953
1882
  }
1954
1883
  return false;
1955
1884
  }
1956
- function hasTag$LWS(input$LWS, tag$LWS) {
1957
- return ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`<${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`:${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`<${tag$LWS}>`]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`:${tag$LWS}>`]);
1958
- }
1959
1885
  const rootValidator$LWS = new Validator$LWS(rootDocument$LWS, rootWindow$LWS$1);
1960
1886
  const documentToValidatorMap$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1([[rootDocument$LWS, rootValidator$LWS]]));
1961
1887
  function getValidator$LWS(document$LWS, globalObject$LWS) {
@@ -2029,6 +1955,9 @@ item$LWS => {
2029
1955
  const brand$LWS = item$LWS == null ? void 0 : item$LWS.brand;
2030
1956
  return typeof brand$LWS === 'string' && ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [brand$LWS]);
2031
1957
  }]) !== undefined : ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [getUserAgent$LWS$1()]));
1958
+ const {
1959
+ getElementById: DocumentFragmentProtoGetElementById$LWS
1960
+ } = DocumentFragment.prototype;
2032
1961
 
2033
1962
  // Used by '@locker/near-membrane-shared-dom'.
2034
1963
  // The DOMException constructor was exposed in Edge 12 but wasn't invocable
@@ -2039,17 +1968,7 @@ ObjectLookupOwnGetter$LWS$1(DOMExceptionCtor$LWS$1.prototype, 'code');
2039
1968
  const {
2040
1969
  createDocument: DOMImplementationProtoCreateDocument$LWS
2041
1970
  } = DOMImplementation.prototype;
2042
- const DOMTokenListCtor$LWS = DOMTokenList;
2043
- const {
2044
- prototype: DOMTokenListProto$LWS
2045
- } = DOMTokenListCtor$LWS;
2046
- const {
2047
- add: DOMTokenListProtoAdd$LWS,
2048
- contains: DOMTokenListProtoContains$LWS,
2049
- remove: DOMTokenListProtoRemove$LWS
2050
- } = DOMTokenListProto$LWS;
2051
- const DOMTokenListProtoLengthGetter$LWS = ObjectLookupOwnGetter$LWS$1(DOMTokenListProto$LWS, 'length');
2052
- const DOMTokenListProtoValueGetter$LWS = ObjectLookupOwnGetter$LWS$1(DOMTokenListProto$LWS, 'value');
1971
+ const DOMTokenListProtoValueGetter$LWS = ObjectLookupOwnGetter$LWS$1(DOMTokenList.prototype, 'value');
2053
1972
  const EventCtor$LWS = Event;
2054
1973
  const {
2055
1974
  prototype: EventProto$LWS
@@ -2073,14 +1992,25 @@ const {
2073
1992
  } = ReflectGetOwnPropertyDescriptor$LWS(HTMLAnchorElementProto$LWS, 'href');
2074
1993
  const HTMLAnchorElementProtoPathnameGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLAnchorElementProto$LWS, 'pathname');
2075
1994
  const HTMLAnchorElementProtoProtocolGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLAnchorElementProto$LWS, 'protocol');
1995
+ const HTMLElement$LWS = getUnmaskedFunction$LWS(rootWindow$LWS$1.HTMLElement);
1996
+ const {
1997
+ prototype: HTMLElementProto$LWS
1998
+ } = HTMLElement$LWS;
1999
+ // Used by '@locker/near-membrane-dom'.
2000
+ ObjectLookupOwnGetter$LWS$1(HTMLElementProto$LWS, 'style');
2001
+ const HTMLElementGlobalAttributesToPropertyName$LWS = {
2002
+ __proto__: null,
2003
+ accesskey: 'accessKey',
2004
+ contenteditable: 'contentEditable',
2005
+ enterkeyhint: 'enterKeyHint',
2006
+ inputmode: 'inputMode',
2007
+ tabindex: 'tabIndex'
2008
+ };
2076
2009
  const {
2077
2010
  prototype: HTMLIFrameElementProto$LWS
2078
2011
  } = HTMLIFrameElement;
2079
2012
  // Used by '@locker/near-membrane-dom'.
2080
2013
  ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'contentWindow');
2081
- const HTMLIFrameElementProtoSandboxGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'sandbox');
2082
- const HTMLIFrameElementProtoSandboxSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElementProto$LWS, 'sandbox');
2083
- const HTMLIFrameElementProtoSrcGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'src');
2084
2014
  const HTMLIFrameElementProtoSrcSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElementProto$LWS, 'src');
2085
2015
  const HTMLScriptElementCtor$LWS = HTMLScriptElement;
2086
2016
  const {
@@ -2103,12 +2033,10 @@ ObjectLookupOwnGetter$LWS$1(ResponseProto$LWS, 'statusText');
2103
2033
  const {
2104
2034
  text: ResponseProtoText$LWS
2105
2035
  } = ResponseProto$LWS;
2106
- const URLCtor$LWS = URL;
2107
- const URLProtoOriginGetter$LWS = ObjectLookupOwnGetter$LWS$1(URLCtor$LWS.prototype, 'origin');
2108
2036
  const {
2109
2037
  createObjectURL: URLCreateObjectURL$LWS,
2110
2038
  revokeObjectURL: URLRevokeObjectURL$LWS
2111
- } = URLCtor$LWS;
2039
+ } = URL;
2112
2040
  const SCRIPT_EVALUATOR_PROPERTY_NAME$LWS = '$evaluator$';
2113
2041
  const SCRIPT_HOOK_SOURCE_TEXT$LWS = `document.currentScript.${SCRIPT_EVALUATOR_PROPERTY_NAME$LWS}`;
2114
2042
  const evaluatedScriptElements$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
@@ -2124,7 +2052,6 @@ function defineScriptAccessorProperty$LWS(script$LWS, propKey$LWS, getter$LWS, s
2124
2052
  });
2125
2053
  }
2126
2054
  function defineScriptEvaluatorProperty$LWS(script$LWS, callback$LWS) {
2127
- // istanbul ignore if: require a test to get the evaluator in a bad state. Like code that tried to access it in between. This is mostly a "the universe is not as expected error"
2128
2055
  if (!ReflectDefineProperty$LWS$1(script$LWS, SCRIPT_EVALUATOR_PROPERTY_NAME$LWS, {
2129
2056
  __proto__: null,
2130
2057
  configurable: true,
@@ -2276,7 +2203,7 @@ const {
2276
2203
  const XhrProtoResponseTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'responseText');
2277
2204
  const XhrProtoStatusGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'status');
2278
2205
  ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
2279
- /*! version: 0.23.6 */
2206
+ /*! version: 0.22.5 */
2280
2207
 
2281
2208
  /*!
2282
2209
  * Copyright (C) 2019 salesforce.com, inc.
@@ -2297,14 +2224,13 @@ function isMIMETypeAllowed$LWS(mimeType$LWS) {
2297
2224
  }
2298
2225
  return false;
2299
2226
  }
2227
+ const DISALLOWED_ENDPOINTS_LIST$LWS = ['/aura', '/webruntime'];
2300
2228
  const TRUSTED_DOMAINS_REG_EXP$LWS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/;
2301
2229
  const URL_SCHEMES_LIST$LWS = toSafeArray$LWS$1(['about:', 'http:', 'https:']);
2302
2230
  const newlinesAndTabsRegExp$LWS = /[\u2028\u2029\n\r\t]/g;
2303
2231
  const normalizerAnchor$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, rootDocument$LWS, ['a']);
2304
2232
  // @TODO: W-7302311 Make paths and domains configurable.
2305
2233
  function isValidURL$LWS(parsedURL$LWS) {
2306
- // Need to add /services to isValidUrl unit test and locker/scripts/test/disallowed-endpoints.js once we remove the gate.
2307
- const DISALLOWED_ENDPOINTS_LIST$LWS = isGaterEnabledFeature$LWS('enableBlockServicesEndpoint') ? ['/aura', '/webruntime', '/services'] : ['/aura', '/webruntime'];
2308
2234
  const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
2309
2235
  for (let i$LWS = 0, {
2310
2236
  length: length$LWS
@@ -2336,9 +2262,9 @@ function sanitizeURLForElement$LWS(url$LWS) {
2336
2262
  function sanitizeURLString$LWS(urlString$LWS) {
2337
2263
  return urlString$LWS === '' ? urlString$LWS : ReflectApply$LWS$1(StringProtoReplace$LWS, urlString$LWS, [newlinesAndTabsRegExp$LWS, '']);
2338
2264
  }
2339
- /*! version: 0.23.6 */
2265
+ /*! version: 0.22.5 */
2340
2266
 
2341
- /*! @license DOMPurify 3.1.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.1.6/LICENSE */
2267
+ /*! @license DOMPurify 3.0.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.5/LICENSE */
2342
2268
 
2343
2269
  const {
2344
2270
  entries,
@@ -2352,30 +2278,36 @@ let {
2352
2278
  seal,
2353
2279
  create
2354
2280
  } = Object; // eslint-disable-line import/no-mutable-exports
2281
+
2355
2282
  let {
2356
2283
  apply,
2357
2284
  construct
2358
2285
  } = typeof Reflect !== 'undefined' && Reflect;
2286
+
2287
+ if (!apply) {
2288
+ apply = function apply(fun, thisValue, args) {
2289
+ return fun.apply(thisValue, args);
2290
+ };
2291
+ }
2292
+
2359
2293
  if (!freeze) {
2360
2294
  freeze = function freeze(x) {
2361
2295
  return x;
2362
2296
  };
2363
2297
  }
2298
+
2364
2299
  if (!seal) {
2365
2300
  seal = function seal(x) {
2366
2301
  return x;
2367
2302
  };
2368
2303
  }
2369
- if (!apply) {
2370
- apply = function apply(fun, thisValue, args) {
2371
- return fun.apply(thisValue, args);
2372
- };
2373
- }
2304
+
2374
2305
  if (!construct) {
2375
2306
  construct = function construct(Func, args) {
2376
2307
  return new Func(...args);
2377
2308
  };
2378
2309
  }
2310
+
2379
2311
  const arrayForEach = unapply(Array.prototype.forEach);
2380
2312
  const arrayPop = unapply(Array.prototype.pop);
2381
2313
  const arrayPush = unapply(Array.prototype.push);
@@ -2385,175 +2317,136 @@ const stringMatch = unapply(String.prototype.match);
2385
2317
  const stringReplace = unapply(String.prototype.replace);
2386
2318
  const stringIndexOf = unapply(String.prototype.indexOf);
2387
2319
  const stringTrim = unapply(String.prototype.trim);
2388
- const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
2389
2320
  const regExpTest = unapply(RegExp.prototype.test);
2390
2321
  const typeErrorCreate = unconstruct(TypeError);
2391
-
2392
- /**
2393
- * Creates a new function that calls the given function with a specified thisArg and arguments.
2394
- *
2395
- * @param {Function} func - The function to be wrapped and called.
2396
- * @returns {Function} A new function that calls the given function with a specified thisArg and arguments.
2397
- */
2398
2322
  function unapply(func) {
2399
2323
  return function (thisArg) {
2400
2324
  for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
2401
2325
  args[_key - 1] = arguments[_key];
2402
2326
  }
2327
+
2403
2328
  return apply(func, thisArg, args);
2404
2329
  };
2405
2330
  }
2406
-
2407
- /**
2408
- * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
2409
- *
2410
- * @param {Function} func - The constructor function to be wrapped and called.
2411
- * @returns {Function} A new function that constructs an instance of the given constructor function with the provided arguments.
2412
- */
2413
2331
  function unconstruct(func) {
2414
2332
  return function () {
2415
2333
  for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
2416
2334
  args[_key2] = arguments[_key2];
2417
2335
  }
2336
+
2418
2337
  return construct(func, args);
2419
2338
  };
2420
2339
  }
2340
+ /* Add properties to a lookup table */
2341
+
2342
+ function addToSet(set, array, transformCaseFunc) {
2343
+ var _transformCaseFunc;
2344
+
2345
+ transformCaseFunc = (_transformCaseFunc = transformCaseFunc) !== null && _transformCaseFunc !== void 0 ? _transformCaseFunc : stringToLowerCase;
2421
2346
 
2422
- /**
2423
- * Add properties to a lookup table
2424
- *
2425
- * @param {Object} set - The set to which elements will be added.
2426
- * @param {Array} array - The array containing elements to be added to the set.
2427
- * @param {Function} transformCaseFunc - An optional function to transform the case of each element before adding to the set.
2428
- * @returns {Object} The modified set with added elements.
2429
- */
2430
- function addToSet(set, array) {
2431
- let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
2432
2347
  if (setPrototypeOf) {
2433
2348
  // Make 'in' and truthy checks like Boolean(set.constructor)
2434
2349
  // independent of any properties defined on Object.prototype.
2435
2350
  // Prevent prototype setters from intercepting set as a this value.
2436
2351
  setPrototypeOf(set, null);
2437
2352
  }
2353
+
2438
2354
  let l = array.length;
2355
+
2439
2356
  while (l--) {
2440
2357
  let element = array[l];
2358
+
2441
2359
  if (typeof element === 'string') {
2442
2360
  const lcElement = transformCaseFunc(element);
2361
+
2443
2362
  if (lcElement !== element) {
2444
2363
  // Config presets (e.g. tags.js, attrs.js) are immutable.
2445
2364
  if (!isFrozen(array)) {
2446
2365
  array[l] = lcElement;
2447
2366
  }
2367
+
2448
2368
  element = lcElement;
2449
2369
  }
2450
2370
  }
2371
+
2451
2372
  set[element] = true;
2452
2373
  }
2453
- return set;
2454
- }
2455
2374
 
2456
- /**
2457
- * Clean up an array to harden against CSPP
2458
- *
2459
- * @param {Array} array - The array to be cleaned.
2460
- * @returns {Array} The cleaned version of the array
2461
- */
2462
- function cleanArray(array) {
2463
- for (let index = 0; index < array.length; index++) {
2464
- const isPropertyExist = objectHasOwnProperty(array, index);
2465
- if (!isPropertyExist) {
2466
- array[index] = null;
2467
- }
2468
- }
2469
- return array;
2375
+ return set;
2470
2376
  }
2377
+ /* Shallow clone an object */
2471
2378
 
2472
- /**
2473
- * Shallow clone an object
2474
- *
2475
- * @param {Object} object - The object to be cloned.
2476
- * @returns {Object} A new object that copies the original.
2477
- */
2478
2379
  function clone(object) {
2479
2380
  const newObject = create(null);
2381
+
2480
2382
  for (const [property, value] of entries(object)) {
2481
- const isPropertyExist = objectHasOwnProperty(object, property);
2482
- if (isPropertyExist) {
2483
- if (Array.isArray(value)) {
2484
- newObject[property] = cleanArray(value);
2485
- } else if (value && typeof value === 'object' && value.constructor === Object) {
2486
- newObject[property] = clone(value);
2487
- } else {
2488
- newObject[property] = value;
2489
- }
2490
- }
2383
+ newObject[property] = value;
2491
2384
  }
2385
+
2492
2386
  return newObject;
2493
2387
  }
2388
+ /* This method automatically checks if the prop is function
2389
+ * or getter and behaves accordingly. */
2494
2390
 
2495
- /**
2496
- * This method automatically checks if the prop is function or getter and behaves accordingly.
2497
- *
2498
- * @param {Object} object - The object to look up the getter function in its prototype chain.
2499
- * @param {String} prop - The property name for which to find the getter function.
2500
- * @returns {Function} The getter function found in the prototype chain or a fallback function.
2501
- */
2502
2391
  function lookupGetter(object, prop) {
2503
2392
  while (object !== null) {
2504
2393
  const desc = getOwnPropertyDescriptor(object, prop);
2394
+
2505
2395
  if (desc) {
2506
2396
  if (desc.get) {
2507
2397
  return unapply(desc.get);
2508
2398
  }
2399
+
2509
2400
  if (typeof desc.value === 'function') {
2510
2401
  return unapply(desc.value);
2511
2402
  }
2512
2403
  }
2404
+
2513
2405
  object = getPrototypeOf(object);
2514
2406
  }
2515
- function fallbackValue() {
2407
+
2408
+ function fallbackValue(element) {
2409
+ console.warn('fallback value for', element);
2516
2410
  return null;
2517
2411
  }
2412
+
2518
2413
  return fallbackValue;
2519
2414
  }
2520
2415
 
2521
- const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
2416
+ const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
2522
2417
 
2523
- // SVG
2524
2418
  const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
2525
- const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
2526
-
2527
- // List of SVG elements that are disallowed by default.
2419
+ const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
2528
2420
  // We still need to know them so that we can do namespace
2529
2421
  // checks properly in case one wants to add them to
2530
2422
  // allow-list.
2531
- const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
2532
- const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
2533
2423
 
2534
- // Similarly to SVG, we want to know all MathML elements,
2424
+ const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
2425
+ const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']); // Similarly to SVG, we want to know all MathML elements,
2535
2426
  // even those that we disallow by default.
2427
+
2536
2428
  const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
2537
2429
  const text = freeze(['#text']);
2538
2430
 
2539
- const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
2431
+ const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
2540
2432
  const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
2541
2433
  const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
2542
2434
  const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
2543
2435
 
2544
- // eslint-disable-next-line unicorn/better-regex
2545
2436
  const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
2437
+
2546
2438
  const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
2547
2439
  const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
2548
2440
  const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
2441
+
2549
2442
  const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
2443
+
2550
2444
  const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
2551
2445
  );
2552
2446
  const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
2553
2447
  const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
2554
2448
  );
2555
2449
  const DOCTYPE_NAME = seal(/^html$/i);
2556
- const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
2557
2450
 
2558
2451
  var EXPRESSIONS = /*#__PURE__*/Object.freeze({
2559
2452
  __proto__: null,
@@ -2565,61 +2458,47 @@ var EXPRESSIONS = /*#__PURE__*/Object.freeze({
2565
2458
  IS_ALLOWED_URI: IS_ALLOWED_URI,
2566
2459
  IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
2567
2460
  ATTR_WHITESPACE: ATTR_WHITESPACE,
2568
- DOCTYPE_NAME: DOCTYPE_NAME,
2569
- CUSTOM_ELEMENT: CUSTOM_ELEMENT
2461
+ DOCTYPE_NAME: DOCTYPE_NAME
2570
2462
  });
2571
2463
 
2572
- // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
2573
- const NODE_TYPE = {
2574
- element: 1,
2575
- attribute: 2,
2576
- text: 3,
2577
- cdataSection: 4,
2578
- entityReference: 5,
2579
- // Deprecated
2580
- entityNode: 6,
2581
- // Deprecated
2582
- progressingInstruction: 7,
2583
- comment: 8,
2584
- document: 9,
2585
- documentType: 10,
2586
- documentFragment: 11,
2587
- notation: 12 // Deprecated
2588
- };
2589
- const getGlobal = function getGlobal() {
2590
- return typeof window === 'undefined' ? null : window;
2591
- };
2592
-
2464
+ const getGlobal = () => typeof window === 'undefined' ? null : window;
2593
2465
  /**
2594
2466
  * Creates a no-op policy for internal use only.
2595
2467
  * Don't export this function outside this module!
2596
- * @param {TrustedTypePolicyFactory} trustedTypes The policy factory.
2468
+ * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
2597
2469
  * @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
2598
- * @return {TrustedTypePolicy} The policy created (or null, if Trusted Types
2470
+ * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
2599
2471
  * are not supported or creating the policy failed).
2600
2472
  */
2473
+
2474
+
2601
2475
  const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
2602
2476
  if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
2603
2477
  return null;
2604
- }
2605
-
2606
- // Allow the callers to control the unique policy name
2478
+ } // Allow the callers to control the unique policy name
2607
2479
  // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
2608
2480
  // Policy creation with duplicate names throws in Trusted Types.
2481
+
2482
+
2609
2483
  let suffix = null;
2610
2484
  const ATTR_NAME = 'data-tt-policy-suffix';
2485
+
2611
2486
  if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
2612
2487
  suffix = purifyHostElement.getAttribute(ATTR_NAME);
2613
2488
  }
2489
+
2614
2490
  const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
2491
+
2615
2492
  try {
2616
2493
  return trustedTypes.createPolicy(policyName, {
2617
2494
  createHTML(html) {
2618
2495
  return html;
2619
2496
  },
2497
+
2620
2498
  createScriptURL(scriptUrl) {
2621
2499
  return scriptUrl;
2622
2500
  }
2501
+
2623
2502
  });
2624
2503
  } catch (_) {
2625
2504
  // Policy creation failed (most likely another DOMPurify script has
@@ -2629,32 +2508,37 @@ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedType
2629
2508
  return null;
2630
2509
  }
2631
2510
  };
2511
+
2632
2512
  function createDOMPurify() {
2633
2513
  let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
2634
- const DOMPurify = root => createDOMPurify(root);
2635
2514
 
2515
+ const DOMPurify = root => createDOMPurify(root);
2636
2516
  /**
2637
2517
  * Version label, exposed for easier checks
2638
2518
  * if DOMPurify is up to date or not
2639
2519
  */
2640
- DOMPurify.version = '3.1.6';
2641
2520
 
2521
+
2522
+ DOMPurify.version = '3.0.5';
2642
2523
  /**
2643
2524
  * Array of elements that DOMPurify removed during sanitation.
2644
2525
  * Empty if nothing was removed.
2645
2526
  */
2527
+
2646
2528
  DOMPurify.removed = [];
2647
- if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document) {
2529
+
2530
+ if (!window || !window.document || window.document.nodeType !== 9) {
2648
2531
  // Not running in a browser, provide a factory function
2649
2532
  // so that you can pass your own Window
2650
2533
  DOMPurify.isSupported = false;
2651
2534
  return DOMPurify;
2652
2535
  }
2536
+
2537
+ const originalDocument = window.document;
2538
+ const currentScript = originalDocument.currentScript;
2653
2539
  let {
2654
2540
  document
2655
2541
  } = window;
2656
- const originalDocument = document;
2657
- const currentScript = originalDocument.currentScript;
2658
2542
  const {
2659
2543
  DocumentFragment,
2660
2544
  HTMLTemplateElement,
@@ -2668,23 +2552,23 @@ function createDOMPurify() {
2668
2552
  } = window;
2669
2553
  const ElementPrototype = Element.prototype;
2670
2554
  const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
2671
- const remove = lookupGetter(ElementPrototype, 'remove');
2672
2555
  const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
2673
2556
  const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
2674
- const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
2675
-
2676
- // As per issue #47, the web-components registry is inherited by a
2557
+ const getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
2677
2558
  // new document created via createHTMLDocument. As per the spec
2678
2559
  // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
2679
2560
  // a new empty registry is used when creating a template contents owner
2680
2561
  // document, so we use that as our parent document to ensure nothing
2681
2562
  // is inherited.
2563
+
2682
2564
  if (typeof HTMLTemplateElement === 'function') {
2683
2565
  const template = document.createElement('template');
2566
+
2684
2567
  if (template.content && template.content.ownerDocument) {
2685
2568
  document = template.content.ownerDocument;
2686
2569
  }
2687
2570
  }
2571
+
2688
2572
  let trustedTypesPolicy;
2689
2573
  let emptyHTML = '';
2690
2574
  const {
@@ -2697,10 +2581,10 @@ function createDOMPurify() {
2697
2581
  importNode
2698
2582
  } = originalDocument;
2699
2583
  let hooks = {};
2700
-
2701
2584
  /**
2702
2585
  * Expose whether this browser supports running the full DOMPurify.
2703
2586
  */
2587
+
2704
2588
  DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
2705
2589
  const {
2706
2590
  MUSTACHE_EXPR,
@@ -2709,33 +2593,32 @@ function createDOMPurify() {
2709
2593
  DATA_ATTR,
2710
2594
  ARIA_ATTR,
2711
2595
  IS_SCRIPT_OR_DATA,
2712
- ATTR_WHITESPACE,
2713
- CUSTOM_ELEMENT
2596
+ ATTR_WHITESPACE
2714
2597
  } = EXPRESSIONS;
2715
2598
  let {
2716
2599
  IS_ALLOWED_URI: IS_ALLOWED_URI$1
2717
2600
  } = EXPRESSIONS;
2718
-
2719
2601
  /**
2720
2602
  * We consider the elements and attributes below to be safe. Ideally
2721
2603
  * don't add any new ones but feel free to remove unwanted ones.
2722
2604
  */
2723
2605
 
2724
2606
  /* allowed element names */
2607
+
2725
2608
  let ALLOWED_TAGS = null;
2726
2609
  const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
2727
-
2728
2610
  /* Allowed attribute names */
2611
+
2729
2612
  let ALLOWED_ATTR = null;
2730
2613
  const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
2731
-
2732
2614
  /*
2733
2615
  * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
2734
2616
  * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
2735
2617
  * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
2736
2618
  * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
2737
2619
  */
2738
- let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
2620
+
2621
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
2739
2622
  tagNameCheck: {
2740
2623
  writable: true,
2741
2624
  configurable: false,
@@ -2755,65 +2638,59 @@ function createDOMPurify() {
2755
2638
  value: false
2756
2639
  }
2757
2640
  }));
2758
-
2759
2641
  /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
2760
- let FORBID_TAGS = null;
2761
2642
 
2643
+ let FORBID_TAGS = null;
2762
2644
  /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
2763
- let FORBID_ATTR = null;
2764
2645
 
2646
+ let FORBID_ATTR = null;
2765
2647
  /* Decide if ARIA attributes are okay */
2766
- let ALLOW_ARIA_ATTR = true;
2767
2648
 
2649
+ let ALLOW_ARIA_ATTR = true;
2768
2650
  /* Decide if custom data attributes are okay */
2769
- let ALLOW_DATA_ATTR = true;
2770
2651
 
2652
+ let ALLOW_DATA_ATTR = true;
2771
2653
  /* Decide if unknown protocols are okay */
2772
- let ALLOW_UNKNOWN_PROTOCOLS = false;
2773
2654
 
2655
+ let ALLOW_UNKNOWN_PROTOCOLS = false;
2774
2656
  /* Decide if self-closing tags in attributes are allowed.
2775
2657
  * Usually removed due to a mXSS issue in jQuery 3.0 */
2776
- let ALLOW_SELF_CLOSE_IN_ATTR = true;
2777
2658
 
2659
+ let ALLOW_SELF_CLOSE_IN_ATTR = true;
2778
2660
  /* Output should be safe for common template engines.
2779
2661
  * This means, DOMPurify removes data attributes, mustaches and ERB
2780
2662
  */
2781
- let SAFE_FOR_TEMPLATES = false;
2782
-
2783
- /* Output should be safe even for XML used within HTML and alike.
2784
- * This means, DOMPurify removes comments when containing risky content.
2785
- */
2786
- let SAFE_FOR_XML = true;
2787
2663
 
2664
+ let SAFE_FOR_TEMPLATES = false;
2788
2665
  /* Decide if document with <html>... should be returned */
2789
- let WHOLE_DOCUMENT = false;
2790
2666
 
2667
+ let WHOLE_DOCUMENT = false;
2791
2668
  /* Track whether config is already set on this instance of DOMPurify. */
2792
- let SET_CONFIG = false;
2793
2669
 
2670
+ let SET_CONFIG = false;
2794
2671
  /* Decide if all elements (e.g. style, script) must be children of
2795
2672
  * document.body. By default, browsers might move them to document.head */
2796
- let FORCE_BODY = false;
2797
2673
 
2674
+ let FORCE_BODY = false;
2798
2675
  /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
2799
2676
  * string (or a TrustedHTML object if Trusted Types are supported).
2800
2677
  * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
2801
2678
  */
2802
- let RETURN_DOM = false;
2803
2679
 
2680
+ let RETURN_DOM = false;
2804
2681
  /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
2805
2682
  * string (or a TrustedHTML object if Trusted Types are supported) */
2806
- let RETURN_DOM_FRAGMENT = false;
2807
2683
 
2684
+ let RETURN_DOM_FRAGMENT = false;
2808
2685
  /* Try to return a Trusted Type object instead of a string, return a string in
2809
2686
  * case Trusted Types are not supported */
2810
- let RETURN_TRUSTED_TYPE = false;
2811
2687
 
2688
+ let RETURN_TRUSTED_TYPE = false;
2812
2689
  /* Output should be free from DOM clobbering attacks?
2813
2690
  * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
2814
2691
  */
2815
- let SANITIZE_DOM = true;
2816
2692
 
2693
+ let SANITIZE_DOM = true;
2817
2694
  /* Achieve full DOM Clobbering protection by isolating the namespace of named
2818
2695
  * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
2819
2696
  *
@@ -2827,309 +2704,352 @@ function createDOMPurify() {
2827
2704
  * Namespace isolation is implemented by prefixing `id` and `name` attributes
2828
2705
  * with a constant string, i.e., `user-content-`
2829
2706
  */
2707
+
2830
2708
  let SANITIZE_NAMED_PROPS = false;
2831
2709
  const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
2832
-
2833
2710
  /* Keep element content when removing element? */
2834
- let KEEP_CONTENT = true;
2835
2711
 
2712
+ let KEEP_CONTENT = true;
2836
2713
  /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
2837
2714
  * of importing it into a new Document and returning a sanitized copy */
2838
- let IN_PLACE = false;
2839
2715
 
2716
+ let IN_PLACE = false;
2840
2717
  /* Allow usage of profiles like html, svg and mathMl */
2841
- let USE_PROFILES = {};
2842
2718
 
2719
+ let USE_PROFILES = {};
2843
2720
  /* Tags to ignore content of when KEEP_CONTENT is true */
2721
+
2844
2722
  let FORBID_CONTENTS = null;
2845
2723
  const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
2846
-
2847
2724
  /* Tags that are safe for data: URIs */
2725
+
2848
2726
  let DATA_URI_TAGS = null;
2849
2727
  const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
2850
-
2851
2728
  /* Attributes safe for values like "javascript:" */
2729
+
2852
2730
  let URI_SAFE_ATTRIBUTES = null;
2853
2731
  const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
2854
2732
  const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
2855
2733
  const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
2856
2734
  const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
2857
2735
  /* Document namespace */
2736
+
2858
2737
  let NAMESPACE = HTML_NAMESPACE;
2859
2738
  let IS_EMPTY_INPUT = false;
2860
-
2861
2739
  /* Allowed XHTML+XML namespaces */
2740
+
2862
2741
  let ALLOWED_NAMESPACES = null;
2863
2742
  const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
2864
-
2865
2743
  /* Parsing of strict XHTML documents */
2866
- let PARSER_MEDIA_TYPE = null;
2744
+
2745
+ let PARSER_MEDIA_TYPE;
2867
2746
  const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
2868
2747
  const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
2869
- let transformCaseFunc = null;
2870
-
2748
+ let transformCaseFunc;
2871
2749
  /* Keep a reference to config to pass to hooks */
2872
- let CONFIG = null;
2873
2750
 
2751
+ let CONFIG = null;
2874
2752
  /* Ideally, do not touch anything below this line */
2753
+
2875
2754
  /* ______________________________________________ */
2876
2755
 
2877
2756
  const formElement = document.createElement('form');
2757
+
2878
2758
  const isRegexOrFunction = function isRegexOrFunction(testValue) {
2879
2759
  return testValue instanceof RegExp || testValue instanceof Function;
2880
2760
  };
2881
-
2882
2761
  /**
2883
2762
  * _parseConfig
2884
2763
  *
2885
2764
  * @param {Object} cfg optional config literal
2886
2765
  */
2887
2766
  // eslint-disable-next-line complexity
2888
- const _parseConfig = function _parseConfig() {
2889
- let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
2767
+
2768
+
2769
+ const _parseConfig = function _parseConfig(cfg) {
2890
2770
  if (CONFIG && CONFIG === cfg) {
2891
2771
  return;
2892
2772
  }
2893
-
2894
2773
  /* Shield configuration object from tampering */
2774
+
2775
+
2895
2776
  if (!cfg || typeof cfg !== 'object') {
2896
2777
  cfg = {};
2897
2778
  }
2898
-
2899
2779
  /* Shield configuration object from prototype pollution */
2780
+
2781
+
2900
2782
  cfg = clone(cfg);
2901
- PARSER_MEDIA_TYPE =
2902
- // eslint-disable-next-line unicorn/prefer-includes
2903
- SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
2783
+ PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
2784
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
2904
2785
 
2905
- // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
2906
2786
  transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
2907
-
2908
2787
  /* Set configuration parameters */
2909
- ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
2910
- ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
2911
- ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
2912
- URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES),
2913
- // eslint-disable-line indent
2914
- cfg.ADD_URI_SAFE_ATTR,
2915
- // eslint-disable-line indent
2788
+
2789
+ ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
2790
+ ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
2791
+ ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
2792
+ URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent
2793
+ cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent
2916
2794
  transformCaseFunc // eslint-disable-line indent
2917
2795
  ) // eslint-disable-line indent
2918
2796
  : DEFAULT_URI_SAFE_ATTRIBUTES;
2919
- DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS),
2920
- // eslint-disable-line indent
2921
- cfg.ADD_DATA_URI_TAGS,
2922
- // eslint-disable-line indent
2797
+ DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
2798
+ cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
2923
2799
  transformCaseFunc // eslint-disable-line indent
2924
2800
  ) // eslint-disable-line indent
2925
2801
  : DEFAULT_DATA_URI_TAGS;
2926
- FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
2927
- FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
2928
- FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
2929
- USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
2802
+ FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
2803
+ FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
2804
+ FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
2805
+ USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
2930
2806
  ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
2807
+
2931
2808
  ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
2809
+
2932
2810
  ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
2811
+
2933
2812
  ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
2813
+
2934
2814
  SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
2935
- SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
2815
+
2936
2816
  WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
2817
+
2937
2818
  RETURN_DOM = cfg.RETURN_DOM || false; // Default false
2819
+
2938
2820
  RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
2821
+
2939
2822
  RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
2823
+
2940
2824
  FORCE_BODY = cfg.FORCE_BODY || false; // Default false
2825
+
2941
2826
  SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
2827
+
2942
2828
  SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
2829
+
2943
2830
  KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
2831
+
2944
2832
  IN_PLACE = cfg.IN_PLACE || false; // Default false
2833
+
2945
2834
  IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
2946
2835
  NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
2947
2836
  CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
2837
+
2948
2838
  if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
2949
2839
  CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
2950
2840
  }
2841
+
2951
2842
  if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
2952
2843
  CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
2953
2844
  }
2845
+
2954
2846
  if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
2955
2847
  CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
2956
2848
  }
2849
+
2957
2850
  if (SAFE_FOR_TEMPLATES) {
2958
2851
  ALLOW_DATA_ATTR = false;
2959
2852
  }
2853
+
2960
2854
  if (RETURN_DOM_FRAGMENT) {
2961
2855
  RETURN_DOM = true;
2962
2856
  }
2963
-
2964
2857
  /* Parse profile info */
2858
+
2859
+
2965
2860
  if (USE_PROFILES) {
2966
- ALLOWED_TAGS = addToSet({}, text);
2861
+ ALLOWED_TAGS = addToSet({}, [...text]);
2967
2862
  ALLOWED_ATTR = [];
2863
+
2968
2864
  if (USE_PROFILES.html === true) {
2969
2865
  addToSet(ALLOWED_TAGS, html$1);
2970
2866
  addToSet(ALLOWED_ATTR, html);
2971
2867
  }
2868
+
2972
2869
  if (USE_PROFILES.svg === true) {
2973
2870
  addToSet(ALLOWED_TAGS, svg$1);
2974
2871
  addToSet(ALLOWED_ATTR, svg);
2975
2872
  addToSet(ALLOWED_ATTR, xml);
2976
2873
  }
2874
+
2977
2875
  if (USE_PROFILES.svgFilters === true) {
2978
2876
  addToSet(ALLOWED_TAGS, svgFilters);
2979
2877
  addToSet(ALLOWED_ATTR, svg);
2980
2878
  addToSet(ALLOWED_ATTR, xml);
2981
2879
  }
2880
+
2982
2881
  if (USE_PROFILES.mathMl === true) {
2983
2882
  addToSet(ALLOWED_TAGS, mathMl$1);
2984
2883
  addToSet(ALLOWED_ATTR, mathMl);
2985
2884
  addToSet(ALLOWED_ATTR, xml);
2986
2885
  }
2987
2886
  }
2988
-
2989
2887
  /* Merge configuration parameters */
2888
+
2889
+
2990
2890
  if (cfg.ADD_TAGS) {
2991
2891
  if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
2992
2892
  ALLOWED_TAGS = clone(ALLOWED_TAGS);
2993
2893
  }
2894
+
2994
2895
  addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
2995
2896
  }
2897
+
2996
2898
  if (cfg.ADD_ATTR) {
2997
2899
  if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
2998
2900
  ALLOWED_ATTR = clone(ALLOWED_ATTR);
2999
2901
  }
2902
+
3000
2903
  addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
3001
2904
  }
2905
+
3002
2906
  if (cfg.ADD_URI_SAFE_ATTR) {
3003
2907
  addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
3004
2908
  }
2909
+
3005
2910
  if (cfg.FORBID_CONTENTS) {
3006
2911
  if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
3007
2912
  FORBID_CONTENTS = clone(FORBID_CONTENTS);
3008
2913
  }
2914
+
3009
2915
  addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
3010
2916
  }
3011
-
3012
2917
  /* Add #text in case KEEP_CONTENT is set to true */
2918
+
2919
+
3013
2920
  if (KEEP_CONTENT) {
3014
2921
  ALLOWED_TAGS['#text'] = true;
3015
2922
  }
3016
-
3017
2923
  /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
2924
+
2925
+
3018
2926
  if (WHOLE_DOCUMENT) {
3019
2927
  addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
3020
2928
  }
3021
-
3022
2929
  /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
2930
+
2931
+
3023
2932
  if (ALLOWED_TAGS.table) {
3024
2933
  addToSet(ALLOWED_TAGS, ['tbody']);
3025
2934
  delete FORBID_TAGS.tbody;
3026
2935
  }
2936
+
3027
2937
  if (cfg.TRUSTED_TYPES_POLICY) {
3028
2938
  if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
3029
2939
  throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
3030
2940
  }
2941
+
3031
2942
  if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
3032
2943
  throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
3033
- }
2944
+ } // Overwrite existing TrustedTypes policy.
2945
+
3034
2946
 
3035
- // Overwrite existing TrustedTypes policy.
3036
- trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
2947
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; // Sign local variables required by `sanitize`.
3037
2948
 
3038
- // Sign local variables required by `sanitize`.
3039
2949
  emptyHTML = trustedTypesPolicy.createHTML('');
3040
2950
  } else {
3041
2951
  // Uninitialized policy, attempt to initialize the internal dompurify policy.
3042
2952
  if (trustedTypesPolicy === undefined) {
3043
2953
  trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
3044
- }
2954
+ } // If creating the internal policy succeeded sign internal variables.
2955
+
3045
2956
 
3046
- // If creating the internal policy succeeded sign internal variables.
3047
2957
  if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
3048
2958
  emptyHTML = trustedTypesPolicy.createHTML('');
3049
2959
  }
3050
- }
3051
-
3052
- // Prevent further manipulation of configuration.
2960
+ } // Prevent further manipulation of configuration.
3053
2961
  // Not available in IE8, Safari 5, etc.
2962
+
2963
+
3054
2964
  if (freeze) {
3055
2965
  freeze(cfg);
3056
2966
  }
2967
+
3057
2968
  CONFIG = cfg;
3058
2969
  };
3059
- const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
3060
- const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'annotation-xml']);
3061
2970
 
3062
- // Certain elements are allowed in both SVG and HTML
2971
+ const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
2972
+ const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
3063
2973
  // namespace. We need to specify them explicitly
3064
2974
  // so that they don't get erroneously deleted from
3065
2975
  // HTML namespace.
3066
- const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
3067
2976
 
2977
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
3068
2978
  /* Keep track of all possible SVG and MathML tags
3069
2979
  * so that we can perform the namespace checks
3070
2980
  * correctly. */
3071
- const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
3072
- const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
3073
2981
 
2982
+ const ALL_SVG_TAGS = addToSet({}, svg$1);
2983
+ addToSet(ALL_SVG_TAGS, svgFilters);
2984
+ addToSet(ALL_SVG_TAGS, svgDisallowed);
2985
+ const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
2986
+ addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
3074
2987
  /**
2988
+ *
2989
+ *
3075
2990
  * @param {Element} element a DOM element whose namespace is being checked
3076
2991
  * @returns {boolean} Return false if the element has a
3077
2992
  * namespace that a spec-compliant parser would never
3078
2993
  * return. Return true otherwise.
3079
2994
  */
3080
- const _checkValidNamespace = function _checkValidNamespace(element) {
3081
- let parent = getParentNode(element);
3082
2995
 
3083
- // In JSDOM, if we're inside shadow DOM, then parentNode
2996
+ const _checkValidNamespace = function _checkValidNamespace(element) {
2997
+ let parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
3084
2998
  // can be null. We just simulate parent in this case.
2999
+
3085
3000
  if (!parent || !parent.tagName) {
3086
3001
  parent = {
3087
3002
  namespaceURI: NAMESPACE,
3088
3003
  tagName: 'template'
3089
3004
  };
3090
3005
  }
3006
+
3091
3007
  const tagName = stringToLowerCase(element.tagName);
3092
3008
  const parentTagName = stringToLowerCase(parent.tagName);
3009
+
3093
3010
  if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
3094
3011
  return false;
3095
3012
  }
3013
+
3096
3014
  if (element.namespaceURI === SVG_NAMESPACE) {
3097
3015
  // The only way to switch from HTML namespace to SVG
3098
3016
  // is via <svg>. If it happens via any other tag, then
3099
3017
  // it should be killed.
3100
3018
  if (parent.namespaceURI === HTML_NAMESPACE) {
3101
3019
  return tagName === 'svg';
3102
- }
3103
-
3104
- // The only way to switch from MathML to SVG is via`
3020
+ } // The only way to switch from MathML to SVG is via`
3105
3021
  // svg if parent is either <annotation-xml> or MathML
3106
3022
  // text integration points.
3023
+
3024
+
3107
3025
  if (parent.namespaceURI === MATHML_NAMESPACE) {
3108
3026
  return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
3109
- }
3110
-
3111
- // We only allow elements that are defined in SVG
3027
+ } // We only allow elements that are defined in SVG
3112
3028
  // spec. All others are disallowed in SVG namespace.
3029
+
3030
+
3113
3031
  return Boolean(ALL_SVG_TAGS[tagName]);
3114
3032
  }
3033
+
3115
3034
  if (element.namespaceURI === MATHML_NAMESPACE) {
3116
3035
  // The only way to switch from HTML namespace to MathML
3117
3036
  // is via <math>. If it happens via any other tag, then
3118
3037
  // it should be killed.
3119
3038
  if (parent.namespaceURI === HTML_NAMESPACE) {
3120
3039
  return tagName === 'math';
3121
- }
3122
-
3123
- // The only way to switch from SVG to MathML is via
3040
+ } // The only way to switch from SVG to MathML is via
3124
3041
  // <math> and HTML integration points
3042
+
3043
+
3125
3044
  if (parent.namespaceURI === SVG_NAMESPACE) {
3126
3045
  return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
3127
- }
3128
-
3129
- // We only allow elements that are defined in MathML
3046
+ } // We only allow elements that are defined in MathML
3130
3047
  // spec. All others are disallowed in MathML namespace.
3048
+
3049
+
3131
3050
  return Boolean(ALL_MATHML_TAGS[tagName]);
3132
3051
  }
3052
+
3133
3053
  if (element.namespaceURI === HTML_NAMESPACE) {
3134
3054
  // The only way to switch from SVG to HTML is via
3135
3055
  // HTML integration points, and from MathML to HTML
@@ -3137,50 +3057,54 @@ function createDOMPurify() {
3137
3057
  if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
3138
3058
  return false;
3139
3059
  }
3060
+
3140
3061
  if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
3141
3062
  return false;
3142
- }
3143
-
3144
- // We disallow tags that are specific for MathML
3063
+ } // We disallow tags that are specific for MathML
3145
3064
  // or SVG and should never appear in HTML namespace
3065
+
3066
+
3146
3067
  return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
3147
- }
3068
+ } // For XHTML and XML documents that support custom namespaces
3069
+
3148
3070
 
3149
- // For XHTML and XML documents that support custom namespaces
3150
3071
  if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
3151
3072
  return true;
3152
- }
3153
-
3154
- // The code should never reach this place (this means
3073
+ } // The code should never reach this place (this means
3155
3074
  // that the element somehow got namespace that is not
3156
3075
  // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
3157
3076
  // Return false just in case.
3077
+
3078
+
3158
3079
  return false;
3159
3080
  };
3160
-
3161
3081
  /**
3162
3082
  * _forceRemove
3163
3083
  *
3164
3084
  * @param {Node} node a DOM node
3165
3085
  */
3086
+
3087
+
3166
3088
  const _forceRemove = function _forceRemove(node) {
3167
3089
  arrayPush(DOMPurify.removed, {
3168
3090
  element: node
3169
3091
  });
3092
+
3170
3093
  try {
3171
3094
  // eslint-disable-next-line unicorn/prefer-dom-node-remove
3172
- getParentNode(node).removeChild(node);
3095
+ node.parentNode.removeChild(node);
3173
3096
  } catch (_) {
3174
- remove(node);
3097
+ node.remove();
3175
3098
  }
3176
3099
  };
3177
-
3178
3100
  /**
3179
3101
  * _removeAttribute
3180
3102
  *
3181
3103
  * @param {String} name an Attribute name
3182
3104
  * @param {Node} node a DOM node
3183
3105
  */
3106
+
3107
+
3184
3108
  const _removeAttribute = function _removeAttribute(name, node) {
3185
3109
  try {
3186
3110
  arrayPush(DOMPurify.removed, {
@@ -3193,9 +3117,9 @@ function createDOMPurify() {
3193
3117
  from: node
3194
3118
  });
3195
3119
  }
3196
- node.removeAttribute(name);
3197
3120
 
3198
- // We void attribute values for unremovable "is"" attributes
3121
+ node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
3122
+
3199
3123
  if (name === 'is' && !ALLOWED_ATTR[name]) {
3200
3124
  if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
3201
3125
  try {
@@ -3208,17 +3132,19 @@ function createDOMPurify() {
3208
3132
  }
3209
3133
  }
3210
3134
  };
3211
-
3212
3135
  /**
3213
3136
  * _initDocument
3214
3137
  *
3215
3138
  * @param {String} dirty a string of dirty markup
3216
3139
  * @return {Document} a DOM, filled with the dirty markup
3217
3140
  */
3141
+
3142
+
3218
3143
  const _initDocument = function _initDocument(dirty) {
3219
3144
  /* Create a HTML document */
3220
- let doc = null;
3221
- let leadingWhitespace = null;
3145
+ let doc;
3146
+ let leadingWhitespace;
3147
+
3222
3148
  if (FORCE_BODY) {
3223
3149
  dirty = '<remove></remove>' + dirty;
3224
3150
  } else {
@@ -3226,74 +3152,83 @@ function createDOMPurify() {
3226
3152
  const matches = stringMatch(dirty, /^[\r\n\t ]+/);
3227
3153
  leadingWhitespace = matches && matches[0];
3228
3154
  }
3155
+
3229
3156
  if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
3230
3157
  // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
3231
3158
  dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
3232
3159
  }
3160
+
3233
3161
  const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
3234
3162
  /*
3235
3163
  * Use the DOMParser API by default, fallback later if needs be
3236
3164
  * DOMParser not work for svg when has multiple root element.
3237
3165
  */
3166
+
3238
3167
  if (NAMESPACE === HTML_NAMESPACE) {
3239
3168
  try {
3240
3169
  doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
3241
3170
  } catch (_) {}
3242
3171
  }
3243
-
3244
3172
  /* Use createHTMLDocument in case DOMParser is not available */
3173
+
3174
+
3245
3175
  if (!doc || !doc.documentElement) {
3246
3176
  doc = implementation.createDocument(NAMESPACE, 'template', null);
3177
+
3247
3178
  try {
3248
3179
  doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
3249
- } catch (_) {
3250
- // Syntax error if dirtyPayload is invalid xml
3180
+ } catch (_) {// Syntax error if dirtyPayload is invalid xml
3251
3181
  }
3252
3182
  }
3183
+
3253
3184
  const body = doc.body || doc.documentElement;
3185
+
3254
3186
  if (dirty && leadingWhitespace) {
3255
3187
  body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
3256
3188
  }
3257
-
3258
3189
  /* Work on whole document or just its body */
3190
+
3191
+
3259
3192
  if (NAMESPACE === HTML_NAMESPACE) {
3260
3193
  return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
3261
3194
  }
3195
+
3262
3196
  return WHOLE_DOCUMENT ? doc.documentElement : body;
3263
3197
  };
3264
-
3265
3198
  /**
3266
- * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
3199
+ * _createIterator
3267
3200
  *
3268
- * @param {Node} root The root element or node to start traversing on.
3269
- * @return {NodeIterator} The created NodeIterator
3201
+ * @param {Document} root document/fragment to create iterator for
3202
+ * @return {Iterator} iterator instance
3270
3203
  */
3271
- const _createNodeIterator = function _createNodeIterator(root) {
3272
- return createNodeIterator.call(root.ownerDocument || root, root,
3273
- // eslint-disable-next-line no-bitwise
3274
- NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
3275
- };
3276
3204
 
3205
+
3206
+ const _createIterator = function _createIterator(root) {
3207
+ return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
3208
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
3209
+ };
3277
3210
  /**
3278
3211
  * _isClobbered
3279
3212
  *
3280
3213
  * @param {Node} elm element to check for clobbering attacks
3281
3214
  * @return {Boolean} true if clobbered, false if safe
3282
3215
  */
3216
+
3217
+
3283
3218
  const _isClobbered = function _isClobbered(elm) {
3284
3219
  return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
3285
3220
  };
3286
-
3287
3221
  /**
3288
- * Checks whether the given object is a DOM node.
3222
+ * _isNode
3289
3223
  *
3290
- * @param {Node} object object to check whether it's a DOM node
3224
+ * @param {Node} obj object to check whether it's a DOM node
3291
3225
  * @return {Boolean} true is object is a DOM node
3292
3226
  */
3227
+
3228
+
3293
3229
  const _isNode = function _isNode(object) {
3294
- return typeof Node === 'function' && object instanceof Node;
3230
+ return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
3295
3231
  };
3296
-
3297
3232
  /**
3298
3233
  * _executeHook
3299
3234
  * Execute user configurable hooks
@@ -3302,15 +3237,17 @@ function createDOMPurify() {
3302
3237
  * @param {Node} currentNode node to work on with the hook
3303
3238
  * @param {Object} data additional hook parameters
3304
3239
  */
3240
+
3241
+
3305
3242
  const _executeHook = function _executeHook(entryPoint, currentNode, data) {
3306
3243
  if (!hooks[entryPoint]) {
3307
3244
  return;
3308
3245
  }
3246
+
3309
3247
  arrayForEach(hooks[entryPoint], hook => {
3310
3248
  hook.call(DOMPurify, currentNode, data, CONFIG);
3311
3249
  });
3312
3250
  };
3313
-
3314
3251
  /**
3315
3252
  * _sanitizeElements
3316
3253
  *
@@ -3321,93 +3258,94 @@ function createDOMPurify() {
3321
3258
  * @param {Node} currentNode to check for permission to exist
3322
3259
  * @return {Boolean} true if node was killed, false if left alive
3323
3260
  */
3324
- const _sanitizeElements = function _sanitizeElements(currentNode) {
3325
- let content = null;
3326
3261
 
3262
+
3263
+ const _sanitizeElements = function _sanitizeElements(currentNode) {
3264
+ let content;
3327
3265
  /* Execute a hook if present */
3328
- _executeHook('beforeSanitizeElements', currentNode, null);
3329
3266
 
3267
+ _executeHook('beforeSanitizeElements', currentNode, null);
3330
3268
  /* Check if element is clobbered or can clobber */
3269
+
3270
+
3331
3271
  if (_isClobbered(currentNode)) {
3332
3272
  _forceRemove(currentNode);
3273
+
3333
3274
  return true;
3334
3275
  }
3335
-
3336
3276
  /* Now let's check the element's type and name */
3337
- const tagName = transformCaseFunc(currentNode.nodeName);
3338
3277
 
3278
+
3279
+ const tagName = transformCaseFunc(currentNode.nodeName);
3339
3280
  /* Execute a hook if present */
3281
+
3340
3282
  _executeHook('uponSanitizeElement', currentNode, {
3341
3283
  tagName,
3342
3284
  allowedTags: ALLOWED_TAGS
3343
3285
  });
3344
-
3345
3286
  /* Detect mXSS attempts abusing namespace confusion */
3346
- if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
3347
- _forceRemove(currentNode);
3348
- return true;
3349
- }
3350
3287
 
3351
- /* Remove any occurrence of processing instructions */
3352
- if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
3353
- _forceRemove(currentNode);
3354
- return true;
3355
- }
3356
3288
 
3357
- /* Remove any kind of possibly harmful comments */
3358
- if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
3289
+ if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
3359
3290
  _forceRemove(currentNode);
3291
+
3360
3292
  return true;
3361
3293
  }
3362
-
3363
3294
  /* Remove element if anything forbids its presence */
3295
+
3296
+
3364
3297
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
3365
3298
  /* Check if we have a custom element to handle */
3366
- if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
3367
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
3368
- return false;
3369
- }
3370
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
3371
- return false;
3372
- }
3299
+ if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
3300
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
3301
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
3373
3302
  }
3374
-
3375
3303
  /* Keep content except for bad-listed elements */
3304
+
3305
+
3376
3306
  if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
3377
3307
  const parentNode = getParentNode(currentNode) || currentNode.parentNode;
3378
3308
  const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
3309
+
3379
3310
  if (childNodes && parentNode) {
3380
3311
  const childCount = childNodes.length;
3312
+
3381
3313
  for (let i = childCount - 1; i >= 0; --i) {
3382
- const childClone = cloneNode(childNodes[i], true);
3383
- childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
3384
- parentNode.insertBefore(childClone, getNextSibling(currentNode));
3314
+ parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
3385
3315
  }
3386
3316
  }
3387
3317
  }
3318
+
3388
3319
  _forceRemove(currentNode);
3320
+
3389
3321
  return true;
3390
3322
  }
3391
-
3392
3323
  /* Check whether element has a valid namespace */
3324
+
3325
+
3393
3326
  if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
3394
3327
  _forceRemove(currentNode);
3328
+
3395
3329
  return true;
3396
3330
  }
3397
-
3398
3331
  /* Make sure that older browsers don't get fallback-tag mXSS */
3332
+
3333
+
3399
3334
  if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
3400
3335
  _forceRemove(currentNode);
3336
+
3401
3337
  return true;
3402
3338
  }
3403
-
3404
3339
  /* Sanitize element content to be template-safe */
3405
- if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
3340
+
3341
+
3342
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
3406
3343
  /* Get the element's text content */
3407
3344
  content = currentNode.textContent;
3408
- arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
3409
- content = stringReplace(content, expr, ' ');
3410
- });
3345
+ content = stringReplace(content, MUSTACHE_EXPR, ' ');
3346
+ content = stringReplace(content, ERB_EXPR, ' ');
3347
+ content = stringReplace(content, TMPLIT_EXPR, ' ');
3348
+
3411
3349
  if (currentNode.textContent !== content) {
3412
3350
  arrayPush(DOMPurify.removed, {
3413
3351
  element: currentNode.cloneNode()
@@ -3415,12 +3353,13 @@ function createDOMPurify() {
3415
3353
  currentNode.textContent = content;
3416
3354
  }
3417
3355
  }
3418
-
3419
3356
  /* Execute a hook if present */
3357
+
3358
+
3420
3359
  _executeHook('afterSanitizeElements', currentNode, null);
3360
+
3421
3361
  return false;
3422
3362
  };
3423
-
3424
3363
  /**
3425
3364
  * _isValidAttribute
3426
3365
  *
@@ -3430,46 +3369,47 @@ function createDOMPurify() {
3430
3369
  * @return {Boolean} Returns true if `value` is valid, otherwise false.
3431
3370
  */
3432
3371
  // eslint-disable-next-line complexity
3372
+
3373
+
3433
3374
  const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
3434
3375
  /* Make sure attribute cannot clobber */
3435
3376
  if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
3436
3377
  return false;
3437
3378
  }
3438
-
3439
3379
  /* Allow valid data-* attributes: At least one character after "-"
3440
3380
  (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
3441
3381
  XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
3442
3382
  We don't need to check the value; it's always URI safe. */
3383
+
3384
+
3443
3385
  if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
3444
- if (
3445
- // First condition does a very basic check if a) it's basically a valid custom element tagname AND
3386
+ if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
3446
3387
  // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
3447
3388
  // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
3448
- _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
3449
- // Alternative, second condition checks if it's an `is`-attribute, AND
3389
+ _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
3450
3390
  // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
3451
3391
  lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
3452
3392
  return false;
3453
3393
  }
3454
3394
  /* Check value is safe. First, is attr inert? If so, is safe */
3395
+
3455
3396
  } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
3456
3397
  return false;
3457
3398
  } else ;
3399
+
3458
3400
  return true;
3459
3401
  };
3460
-
3461
3402
  /**
3462
- * _isBasicCustomElement
3403
+ * _basicCustomElementCheck
3463
3404
  * checks if at least one dash is included in tagName, and it's not the first char
3464
3405
  * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
3465
- *
3466
3406
  * @param {string} tagName name of the tag of the node to sanitize
3467
- * @returns {boolean} Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
3468
3407
  */
3469
- const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
3470
- return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
3471
- };
3472
3408
 
3409
+
3410
+ const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
3411
+ return tagName.indexOf('-') > 0;
3412
+ };
3473
3413
  /**
3474
3414
  * _sanitizeAttributes
3475
3415
  *
@@ -3480,94 +3420,107 @@ function createDOMPurify() {
3480
3420
  *
3481
3421
  * @param {Node} currentNode to sanitize
3482
3422
  */
3423
+
3424
+
3483
3425
  const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
3426
+ let attr;
3427
+ let value;
3428
+ let lcName;
3429
+ let l;
3484
3430
  /* Execute a hook if present */
3431
+
3485
3432
  _executeHook('beforeSanitizeAttributes', currentNode, null);
3433
+
3486
3434
  const {
3487
3435
  attributes
3488
3436
  } = currentNode;
3489
-
3490
3437
  /* Check if we have attributes; if not we might have a text node */
3438
+
3491
3439
  if (!attributes) {
3492
3440
  return;
3493
3441
  }
3442
+
3494
3443
  const hookEvent = {
3495
3444
  attrName: '',
3496
3445
  attrValue: '',
3497
3446
  keepAttr: true,
3498
3447
  allowedAttributes: ALLOWED_ATTR
3499
3448
  };
3500
- let l = attributes.length;
3501
-
3449
+ l = attributes.length;
3502
3450
  /* Go backwards over all attributes; safely remove bad ones */
3451
+
3503
3452
  while (l--) {
3504
- const attr = attributes[l];
3453
+ attr = attributes[l];
3505
3454
  const {
3506
3455
  name,
3507
- namespaceURI,
3508
- value: attrValue
3456
+ namespaceURI
3509
3457
  } = attr;
3510
- const lcName = transformCaseFunc(name);
3511
- let value = name === 'value' ? attrValue : stringTrim(attrValue);
3512
-
3458
+ value = name === 'value' ? attr.value : stringTrim(attr.value);
3459
+ lcName = transformCaseFunc(name);
3513
3460
  /* Execute a hook if present */
3461
+
3514
3462
  hookEvent.attrName = lcName;
3515
3463
  hookEvent.attrValue = value;
3516
3464
  hookEvent.keepAttr = true;
3517
3465
  hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
3518
- _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
3519
- value = hookEvent.attrValue;
3520
3466
 
3521
- /* Work around a security issue with comments inside attributes */
3522
- if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
3523
- _removeAttribute(name, currentNode);
3524
- continue;
3525
- }
3467
+ _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
3526
3468
 
3469
+ value = hookEvent.attrValue;
3527
3470
  /* Did the hooks approve of the attribute? */
3471
+
3528
3472
  if (hookEvent.forceKeepAttr) {
3529
3473
  continue;
3530
3474
  }
3531
-
3532
3475
  /* Remove attribute */
3533
- _removeAttribute(name, currentNode);
3534
3476
 
3477
+
3478
+ _removeAttribute(name, currentNode);
3535
3479
  /* Did the hooks approve of the attribute? */
3480
+
3481
+
3536
3482
  if (!hookEvent.keepAttr) {
3537
3483
  continue;
3538
3484
  }
3539
-
3540
3485
  /* Work around a security issue in jQuery 3.0 */
3486
+
3487
+
3541
3488
  if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
3542
3489
  _removeAttribute(name, currentNode);
3490
+
3543
3491
  continue;
3544
3492
  }
3545
-
3546
3493
  /* Sanitize attribute content to be template-safe */
3494
+
3495
+
3547
3496
  if (SAFE_FOR_TEMPLATES) {
3548
- arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
3549
- value = stringReplace(value, expr, ' ');
3550
- });
3497
+ value = stringReplace(value, MUSTACHE_EXPR, ' ');
3498
+ value = stringReplace(value, ERB_EXPR, ' ');
3499
+ value = stringReplace(value, TMPLIT_EXPR, ' ');
3551
3500
  }
3552
-
3553
3501
  /* Is `value` valid for this attribute? */
3502
+
3503
+
3554
3504
  const lcTag = transformCaseFunc(currentNode.nodeName);
3505
+
3555
3506
  if (!_isValidAttribute(lcTag, lcName, value)) {
3556
3507
  continue;
3557
3508
  }
3558
-
3559
3509
  /* Full DOM Clobbering protection via namespace isolation,
3560
3510
  * Prefix id and name attributes with `user-content-`
3561
3511
  */
3512
+
3513
+
3562
3514
  if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
3563
3515
  // Remove the attribute with this value
3564
- _removeAttribute(name, currentNode);
3516
+ _removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
3517
+
3565
3518
 
3566
- // Prefix the value and later re-create the attribute with the sanitized value
3567
3519
  value = SANITIZE_NAMED_PROPS_PREFIX + value;
3568
3520
  }
3569
-
3570
3521
  /* Handle attributes that require Trusted Types */
3522
+
3523
+
3571
3524
  if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
3572
3525
  if (namespaceURI) ; else {
3573
3526
  switch (trustedTypes.getAttributeType(lcTag, lcName)) {
@@ -3576,6 +3529,7 @@ function createDOMPurify() {
3576
3529
  value = trustedTypesPolicy.createHTML(value);
3577
3530
  break;
3578
3531
  }
3532
+
3579
3533
  case 'TrustedScriptURL':
3580
3534
  {
3581
3535
  value = trustedTypesPolicy.createScriptURL(value);
@@ -3584,8 +3538,9 @@ function createDOMPurify() {
3584
3538
  }
3585
3539
  }
3586
3540
  }
3587
-
3588
3541
  /* Handle invalid data-* attribute set by try-catching it */
3542
+
3543
+
3589
3544
  try {
3590
3545
  if (namespaceURI) {
3591
3546
  currentNode.setAttributeNS(namespaceURI, name, value);
@@ -3593,77 +3548,88 @@ function createDOMPurify() {
3593
3548
  /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
3594
3549
  currentNode.setAttribute(name, value);
3595
3550
  }
3596
- if (_isClobbered(currentNode)) {
3597
- _forceRemove(currentNode);
3598
- } else {
3599
- arrayPop(DOMPurify.removed);
3600
- }
3551
+
3552
+ arrayPop(DOMPurify.removed);
3601
3553
  } catch (_) {}
3602
3554
  }
3603
-
3604
3555
  /* Execute a hook if present */
3556
+
3557
+
3605
3558
  _executeHook('afterSanitizeAttributes', currentNode, null);
3606
3559
  };
3607
-
3608
3560
  /**
3609
3561
  * _sanitizeShadowDOM
3610
3562
  *
3611
3563
  * @param {DocumentFragment} fragment to iterate over recursively
3612
3564
  */
3565
+
3566
+
3613
3567
  const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
3614
- let shadowNode = null;
3615
- const shadowIterator = _createNodeIterator(fragment);
3568
+ let shadowNode;
3616
3569
 
3570
+ const shadowIterator = _createIterator(fragment);
3617
3571
  /* Execute a hook if present */
3572
+
3573
+
3618
3574
  _executeHook('beforeSanitizeShadowDOM', fragment, null);
3575
+
3619
3576
  while (shadowNode = shadowIterator.nextNode()) {
3620
3577
  /* Execute a hook if present */
3621
3578
  _executeHook('uponSanitizeShadowNode', shadowNode, null);
3622
-
3623
3579
  /* Sanitize tags and elements */
3580
+
3581
+
3624
3582
  if (_sanitizeElements(shadowNode)) {
3625
3583
  continue;
3626
3584
  }
3627
-
3628
3585
  /* Deep shadow DOM detected */
3586
+
3587
+
3629
3588
  if (shadowNode.content instanceof DocumentFragment) {
3630
3589
  _sanitizeShadowDOM(shadowNode.content);
3631
3590
  }
3632
-
3633
3591
  /* Check attributes, sanitize if necessary */
3592
+
3593
+
3634
3594
  _sanitizeAttributes(shadowNode);
3635
3595
  }
3636
-
3637
3596
  /* Execute a hook if present */
3597
+
3598
+
3638
3599
  _executeHook('afterSanitizeShadowDOM', fragment, null);
3639
3600
  };
3640
-
3641
3601
  /**
3642
3602
  * Sanitize
3643
3603
  * Public method providing core sanitation functionality
3644
3604
  *
3645
3605
  * @param {String|Node} dirty string or DOM node
3646
- * @param {Object} cfg object
3606
+ * @param {Object} configuration object
3647
3607
  */
3648
3608
  // eslint-disable-next-line complexity
3609
+
3610
+
3649
3611
  DOMPurify.sanitize = function (dirty) {
3650
3612
  let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
3651
- let body = null;
3652
- let importedNode = null;
3653
- let currentNode = null;
3654
- let returnNode = null;
3613
+ let body;
3614
+ let importedNode;
3615
+ let currentNode;
3616
+ let returnNode;
3655
3617
  /* Make sure we have a string to sanitize.
3656
3618
  DO NOT return early, as this will return the wrong type if
3657
3619
  the user has requested a DOM object rather than a string */
3620
+
3658
3621
  IS_EMPTY_INPUT = !dirty;
3622
+
3659
3623
  if (IS_EMPTY_INPUT) {
3660
3624
  dirty = '<!-->';
3661
3625
  }
3662
-
3663
3626
  /* Stringify, in case dirty is an object */
3627
+
3628
+
3664
3629
  if (typeof dirty !== 'string' && !_isNode(dirty)) {
3665
3630
  if (typeof dirty.toString === 'function') {
3666
3631
  dirty = dirty.toString();
3632
+
3667
3633
  if (typeof dirty !== 'string') {
3668
3634
  throw typeErrorCreate('dirty is not a string, aborting');
3669
3635
  }
@@ -3671,28 +3637,33 @@ function createDOMPurify() {
3671
3637
  throw typeErrorCreate('toString is not a function');
3672
3638
  }
3673
3639
  }
3674
-
3675
3640
  /* Return dirty HTML if DOMPurify cannot run */
3641
+
3642
+
3676
3643
  if (!DOMPurify.isSupported) {
3677
3644
  return dirty;
3678
3645
  }
3679
-
3680
3646
  /* Assign config vars */
3647
+
3648
+
3681
3649
  if (!SET_CONFIG) {
3682
3650
  _parseConfig(cfg);
3683
3651
  }
3684
-
3685
3652
  /* Clean up removed elements */
3686
- DOMPurify.removed = [];
3687
3653
 
3654
+
3655
+ DOMPurify.removed = [];
3688
3656
  /* Check if dirty is correctly typed for IN_PLACE */
3657
+
3689
3658
  if (typeof dirty === 'string') {
3690
3659
  IN_PLACE = false;
3691
3660
  }
3661
+
3692
3662
  if (IN_PLACE) {
3693
3663
  /* Do some early pre-sanitization to avoid unsafe root nodes */
3694
3664
  if (dirty.nodeName) {
3695
3665
  const tagName = transformCaseFunc(dirty.nodeName);
3666
+
3696
3667
  if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
3697
3668
  throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
3698
3669
  }
@@ -3702,7 +3673,8 @@ function createDOMPurify() {
3702
3673
  elements being stripped by the parser */
3703
3674
  body = _initDocument('<!---->');
3704
3675
  importedNode = body.ownerDocument.importNode(dirty, true);
3705
- if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
3676
+
3677
+ if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
3706
3678
  /* Node is already a body, use as is */
3707
3679
  body = importedNode;
3708
3680
  } else if (importedNode.nodeName === 'HTML') {
@@ -3713,54 +3685,62 @@ function createDOMPurify() {
3713
3685
  }
3714
3686
  } else {
3715
3687
  /* Exit directly if we have nothing to do */
3716
- if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
3717
- // eslint-disable-next-line unicorn/prefer-includes
3688
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
3718
3689
  dirty.indexOf('<') === -1) {
3719
3690
  return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
3720
3691
  }
3721
-
3722
3692
  /* Initialize the document to work on */
3723
- body = _initDocument(dirty);
3724
3693
 
3694
+
3695
+ body = _initDocument(dirty);
3725
3696
  /* Check we have a DOM node from the data */
3697
+
3726
3698
  if (!body) {
3727
3699
  return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
3728
3700
  }
3729
3701
  }
3730
-
3731
3702
  /* Remove first element node (ours) if FORCE_BODY is set */
3703
+
3704
+
3732
3705
  if (body && FORCE_BODY) {
3733
3706
  _forceRemove(body.firstChild);
3734
3707
  }
3735
-
3736
3708
  /* Get node iterator */
3737
- const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
3738
3709
 
3710
+
3711
+ const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
3739
3712
  /* Now start iterating over the created document */
3713
+
3714
+
3740
3715
  while (currentNode = nodeIterator.nextNode()) {
3741
3716
  /* Sanitize tags and elements */
3742
3717
  if (_sanitizeElements(currentNode)) {
3743
3718
  continue;
3744
3719
  }
3745
-
3746
3720
  /* Shadow DOM detected, sanitize it */
3721
+
3722
+
3747
3723
  if (currentNode.content instanceof DocumentFragment) {
3748
3724
  _sanitizeShadowDOM(currentNode.content);
3749
3725
  }
3750
-
3751
3726
  /* Check attributes, sanitize if necessary */
3727
+
3728
+
3752
3729
  _sanitizeAttributes(currentNode);
3753
3730
  }
3754
-
3755
3731
  /* If we sanitized `dirty` in-place, return it. */
3732
+
3733
+
3756
3734
  if (IN_PLACE) {
3757
3735
  return dirty;
3758
3736
  }
3759
-
3760
3737
  /* Return sanitized string or DOM */
3738
+
3739
+
3761
3740
  if (RETURN_DOM) {
3762
3741
  if (RETURN_DOM_FRAGMENT) {
3763
3742
  returnNode = createDocumentFragment.call(body.ownerDocument);
3743
+
3764
3744
  while (body.firstChild) {
3765
3745
  // eslint-disable-next-line unicorn/prefer-dom-node-append
3766
3746
  returnNode.appendChild(body.firstChild);
@@ -3768,6 +3748,7 @@ function createDOMPurify() {
3768
3748
  } else {
3769
3749
  returnNode = body;
3770
3750
  }
3751
+
3771
3752
  if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
3772
3753
  /*
3773
3754
  AdoptNode() is not used because internal state is not reset
@@ -3778,66 +3759,73 @@ function createDOMPurify() {
3778
3759
  */
3779
3760
  returnNode = importNode.call(originalDocument, returnNode, true);
3780
3761
  }
3762
+
3781
3763
  return returnNode;
3782
3764
  }
3783
- let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
3784
3765
 
3766
+ let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
3785
3767
  /* Serialize doctype if allowed */
3768
+
3786
3769
  if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
3787
3770
  serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
3788
3771
  }
3789
-
3790
3772
  /* Sanitize final string template-safe */
3773
+
3774
+
3791
3775
  if (SAFE_FOR_TEMPLATES) {
3792
- arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
3793
- serializedHTML = stringReplace(serializedHTML, expr, ' ');
3794
- });
3776
+ serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');
3777
+ serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');
3778
+ serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');
3795
3779
  }
3780
+
3796
3781
  return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
3797
3782
  };
3798
-
3799
3783
  /**
3800
3784
  * Public method to set the configuration once
3801
3785
  * setConfig
3802
3786
  *
3803
3787
  * @param {Object} cfg configuration object
3804
3788
  */
3805
- DOMPurify.setConfig = function () {
3806
- let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
3789
+
3790
+
3791
+ DOMPurify.setConfig = function (cfg) {
3807
3792
  _parseConfig(cfg);
3793
+
3808
3794
  SET_CONFIG = true;
3809
3795
  };
3810
-
3811
3796
  /**
3812
3797
  * Public method to remove the configuration
3813
3798
  * clearConfig
3814
3799
  *
3815
3800
  */
3801
+
3802
+
3816
3803
  DOMPurify.clearConfig = function () {
3817
3804
  CONFIG = null;
3818
3805
  SET_CONFIG = false;
3819
3806
  };
3820
-
3821
3807
  /**
3822
3808
  * Public method to check if an attribute value is valid.
3823
3809
  * Uses last set config, if any. Otherwise, uses config defaults.
3824
3810
  * isValidAttribute
3825
3811
  *
3826
- * @param {String} tag Tag name of containing element.
3827
- * @param {String} attr Attribute name.
3828
- * @param {String} value Attribute value.
3812
+ * @param {string} tag Tag name of containing element.
3813
+ * @param {string} attr Attribute name.
3814
+ * @param {string} value Attribute value.
3829
3815
  * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
3830
3816
  */
3817
+
3818
+
3831
3819
  DOMPurify.isValidAttribute = function (tag, attr, value) {
3832
3820
  /* Initialize shared config vars if necessary. */
3833
3821
  if (!CONFIG) {
3834
3822
  _parseConfig({});
3835
3823
  }
3824
+
3836
3825
  const lcTag = transformCaseFunc(tag);
3837
3826
  const lcName = transformCaseFunc(attr);
3838
3827
  return _isValidAttribute(lcTag, lcName, value);
3839
3828
  };
3840
-
3841
3829
  /**
3842
3830
  * AddHook
3843
3831
  * Public method to add DOMPurify hooks
@@ -3845,14 +3833,16 @@ function createDOMPurify() {
3845
3833
  * @param {String} entryPoint entry point for the hook to add
3846
3834
  * @param {Function} hookFunction function to execute
3847
3835
  */
3836
+
3837
+
3848
3838
  DOMPurify.addHook = function (entryPoint, hookFunction) {
3849
3839
  if (typeof hookFunction !== 'function') {
3850
3840
  return;
3851
3841
  }
3842
+
3852
3843
  hooks[entryPoint] = hooks[entryPoint] || [];
3853
3844
  arrayPush(hooks[entryPoint], hookFunction);
3854
3845
  };
3855
-
3856
3846
  /**
3857
3847
  * RemoveHook
3858
3848
  * Public method to remove a DOMPurify hook at a given entryPoint
@@ -3861,33 +3851,40 @@ function createDOMPurify() {
3861
3851
  * @param {String} entryPoint entry point for the hook to remove
3862
3852
  * @return {Function} removed(popped) hook
3863
3853
  */
3854
+
3855
+
3864
3856
  DOMPurify.removeHook = function (entryPoint) {
3865
3857
  if (hooks[entryPoint]) {
3866
3858
  return arrayPop(hooks[entryPoint]);
3867
3859
  }
3868
3860
  };
3869
-
3870
3861
  /**
3871
3862
  * RemoveHooks
3872
3863
  * Public method to remove all DOMPurify hooks at a given entryPoint
3873
3864
  *
3874
3865
  * @param {String} entryPoint entry point for the hooks to remove
3875
3866
  */
3867
+
3868
+
3876
3869
  DOMPurify.removeHooks = function (entryPoint) {
3877
3870
  if (hooks[entryPoint]) {
3878
3871
  hooks[entryPoint] = [];
3879
3872
  }
3880
3873
  };
3881
-
3882
3874
  /**
3883
3875
  * RemoveAllHooks
3884
3876
  * Public method to remove all DOMPurify hooks
3877
+ *
3885
3878
  */
3879
+
3880
+
3886
3881
  DOMPurify.removeAllHooks = function () {
3887
3882
  hooks = {};
3888
3883
  };
3884
+
3889
3885
  return DOMPurify;
3890
3886
  }
3887
+
3891
3888
  var purify = createDOMPurify();
3892
3889
 
3893
3890
  /*!
@@ -3951,7 +3948,7 @@ try {
3951
3948
  // swallow
3952
3949
  }
3953
3950
  const trusted = createPolicy('trusted', policyOptions);
3954
- /*! version: 0.23.6 */
3951
+ /*! version: 0.22.5 */
3955
3952
 
3956
3953
  /*!
3957
3954
  * Copyright (C) 2019 salesforce.com, inc.
@@ -4082,7 +4079,7 @@ function sanitizeSvgTextReturnDOM$LWS(dirty$LWS) {
4082
4079
  return svgSanitizer$LWS.sanitize(dirty$LWS);
4083
4080
  }
4084
4081
  function sanitizeSvgHref$LWS(url$LWS) {
4085
- const urlAsString$LWS = toSafeStringValue$LWS(url$LWS);
4082
+ const urlAsString$LWS = toString$LWS(url$LWS);
4086
4083
  if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, urlAsString$LWS, ['#'])) {
4087
4084
  return url$LWS;
4088
4085
  }
@@ -4212,7 +4209,7 @@ function blobSanitizer$LWS(sandboxKey$LWS) {
4212
4209
  }
4213
4210
  return getSanitizerForConfig$LWS(sandboxKey$LWS, 'STRING_BLOB_HTML');
4214
4211
  }
4215
- /*! version: 0.23.6 */
4212
+ /*! version: 0.22.5 */
4216
4213
 
4217
4214
  /*!
4218
4215
  * Copyright (C) 2023 salesforce.com, inc.
@@ -4410,7 +4407,7 @@ function encloseSrcSetter$LWS(targetElement$LWS) {
4410
4407
  ReflectApply$LWS$1(ElementProtoSetAttributeNS$LWS, targetElement$LWS, [attributeNamespaceURI$LWS, attributeName$LWS, src$LWS]);
4411
4408
  };
4412
4409
  }
4413
- /*! version: 0.23.6 */
4410
+ /*! version: 0.22.5 */
4414
4411
 
4415
4412
  /*!
4416
4413
  * Copyright (C) 2019 salesforce.com, inc.
@@ -4947,7 +4944,7 @@ function patchAttributes$LWS(instance$LWS, originalDefinition$LWS, definition$LW
4947
4944
  }, ElementProtoRemoveAttribute$LWS);
4948
4945
  instance$LWS.setAttribute = maskFunction$LWS(function setAttribute$LWS(attrName$LWS, value$LWS) {
4949
4946
  const args$LWS = [attrName$LWS];
4950
- const stringifiedValue$LWS = toSafeStringValue$LWS(value$LWS);
4947
+ const stringifiedValue$LWS = toString$LWS(value$LWS);
4951
4948
  const setAttributeArgs$LWS = [attrName$LWS, stringifiedValue$LWS];
4952
4949
  // `observedAttributesDifference` is a safe Set.
4953
4950
  if (observedAttributesDifference$LWS.has(attrName$LWS)) {
@@ -5156,64 +5153,6 @@ function setCustomElementsRegistry$LWS(document$LWS, key$LWS) {
5156
5153
  currentRegistry$LWS = getSandboxCustomElementRegistry$LWS(document$LWS, key$LWS);
5157
5154
  }
5158
5155
  const DataTransferBlockedProperties$LWS = ['mozCursor', 'mozSourceNode', 'mozUserCancelled'];
5159
- const elementShadowRootBySandboxKeyRegistry$LWS = {
5160
- __proto__: null
5161
- };
5162
- function registerShadowRootInSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
5163
- const {
5164
- [sandboxKey$LWS]: elementShadowRootRegistry$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
5165
- } = elementShadowRootBySandboxKeyRegistry$LWS;
5166
- elementShadowRootRegistry$LWS.add(shadowRoot$LWS);
5167
- if (!elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS]) {
5168
- elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS] = elementShadowRootRegistry$LWS;
5169
- }
5170
- }
5171
- function isShadowRootAccessibleInThisSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
5172
- const elementShadowRootRegistry$LWS = elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS];
5173
- if (!elementShadowRootRegistry$LWS) {
5174
- return false;
5175
- }
5176
- return elementShadowRootRegistry$LWS.has(shadowRoot$LWS);
5177
- }
5178
- function isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, container$LWS) {
5179
- let parentNode$LWS = container$LWS;
5180
- do {
5181
- if (isShadowRootAccessibleInThisSandbox$LWS(key$LWS, parentNode$LWS)) {
5182
- return true;
5183
- }
5184
- } while (parentNode$LWS = ReflectApply$LWS$1(NodeProtoParentNodeGetter$LWS, parentNode$LWS, []));
5185
- return false;
5186
- }
5187
- function initDistortionAbstractRangeEndContainerGetter$LWS({
5188
- globalObject: {
5189
- AbstractRange: AbstractRange$LWS
5190
- }
5191
- }) {
5192
- const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRange$LWS.prototype, 'endContainer');
5193
- return function distortionEndContainerGetter$LWS({
5194
- key: key$LWS
5195
- }) {
5196
- return [originalEndContainerGetter$LWS, function endContainer$LWS() {
5197
- const realEndContainer$LWS = ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []);
5198
- return isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, realEndContainer$LWS) ? realEndContainer$LWS : null;
5199
- }];
5200
- };
5201
- }
5202
- function initDistortionAbstractRangeStartContainerGetter$LWS({
5203
- globalObject: {
5204
- AbstractRange: AbstractRange$LWS
5205
- }
5206
- }) {
5207
- const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRange$LWS.prototype, 'startContainer');
5208
- return function distortionStartContainerGetter$LWS({
5209
- key: key$LWS
5210
- }) {
5211
- return [originalStartContainerGetter$LWS, function startContainer$LWS() {
5212
- const realStartContainer$LWS = ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, []);
5213
- return isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, realStartContainer$LWS) ? realStartContainer$LWS : null;
5214
- }];
5215
- };
5216
- }
5217
5156
  const attributeDistortionFactoriesCache$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1());
5218
5157
  const sandboxAttributeDistortionRegistryCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
5219
5158
  function finalizeAttributeDistortions$LWS(record$LWS) {
@@ -5422,10 +5361,11 @@ function initDistortionCacheStorageDelete$LWS({
5422
5361
  return [originalDelete$LWS, function patchedDelete$LWS(...args$LWS) {
5423
5362
  if (args$LWS.length) {
5424
5363
  const {
5425
- 0: rawCacheName$LWS
5364
+ 0: cacheName$LWS
5426
5365
  } = args$LWS;
5427
- const cacheName$LWS = toSafeStringValue$LWS(rawCacheName$LWS);
5428
- args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5366
+ if (isConvertibleToString$LWS(cacheName$LWS)) {
5367
+ args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5368
+ }
5429
5369
  }
5430
5370
  return ReflectApply$LWS$1(originalDelete$LWS, this, args$LWS);
5431
5371
  }];
@@ -5450,10 +5390,11 @@ function initDistortionCacheStorageHas$LWS({
5450
5390
  return [originalHas$LWS, function has$LWS(...args$LWS) {
5451
5391
  if (args$LWS.length) {
5452
5392
  const {
5453
- 0: rawCacheName$LWS
5393
+ 0: cacheName$LWS
5454
5394
  } = args$LWS;
5455
- const cacheName$LWS = toSafeStringValue$LWS(rawCacheName$LWS);
5456
- args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5395
+ if (isConvertibleToString$LWS(cacheName$LWS)) {
5396
+ args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5397
+ }
5457
5398
  }
5458
5399
  return ReflectApply$LWS$1(originalHas$LWS, this, args$LWS);
5459
5400
  }];
@@ -5523,13 +5464,14 @@ function initDistortionCacheStorageMatch$LWS({
5523
5464
  // also be safely convertible to a string.
5524
5465
  if (isObjectLike$LWS(matchOptions$LWS) && 'cacheName' in matchOptions$LWS) {
5525
5466
  const {
5526
- cacheName: rawCacheName$LWS
5467
+ cacheName: cacheName$LWS
5527
5468
  } = matchOptions$LWS;
5528
- const cacheName$LWS = toSafeStringValue$LWS(rawCacheName$LWS);
5529
- const clonedOptions$LWS = shallowCloneOptions$LWS(matchOptions$LWS);
5530
- clonedOptions$LWS.cacheName = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5531
- args$LWS[1] = clonedOptions$LWS;
5532
- return ReflectApply$LWS$1(originalMatch$LWS, this, args$LWS);
5469
+ if (isConvertibleToString$LWS(cacheName$LWS)) {
5470
+ const clonedOptions$LWS = shallowCloneOptions$LWS(matchOptions$LWS);
5471
+ clonedOptions$LWS.cacheName = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5472
+ args$LWS[1] = clonedOptions$LWS;
5473
+ return ReflectApply$LWS$1(originalMatch$LWS, this, args$LWS);
5474
+ }
5533
5475
  }
5534
5476
  return PromiseReject$LWS(new LockerSecurityError$LWS("caches.match() expects 'options.cacheName' to be present."));
5535
5477
  }];
@@ -5554,10 +5496,11 @@ function initDistortionCacheStorageOpen$LWS({
5554
5496
  return [originalOpen$LWS, function open$LWS(...args$LWS) {
5555
5497
  if (args$LWS.length) {
5556
5498
  const {
5557
- 0: rawCacheName$LWS
5499
+ 0: cacheName$LWS
5558
5500
  } = args$LWS;
5559
- const cacheName$LWS = toSafeStringValue$LWS(rawCacheName$LWS);
5560
- args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5501
+ if (isConvertibleToString$LWS(cacheName$LWS)) {
5502
+ args$LWS[0] = prependNamespaceMarker$LWS(cacheName$LWS, key$LWS);
5503
+ }
5561
5504
  }
5562
5505
  return ReflectApply$LWS$1(originalOpen$LWS, this, args$LWS);
5563
5506
  }];
@@ -5703,26 +5646,11 @@ function isEventTargetRestricted$LWS(record$LWS, eventTarget$LWS, eventName$LWS)
5703
5646
  if (restrictedEventTargetRegistry$LWS === undefined || restrictedEventTargetRegistry$LWS[eventName$LWS] === undefined) {
5704
5647
  return false;
5705
5648
  }
5706
- let possiblyRestrictedConstructor$LWS = getUnmaskedFunction$LWS(eventTarget$LWS.constructor);
5707
- // Walk UP the proto chain to check if super classes have a restriction on this event.
5708
- // This can happen in cases where HTMLElement is the event target constructor, but
5709
- // the event listener is being added to HTMLDivElement. Since we obviously want to
5710
- // block all listeners for an event being blocked at HTMLElement level, we need to
5711
- // walk up from the HTMLDivElement until we find the constructor for which we
5712
- // registered a restriction.
5713
- while (possiblyRestrictedConstructor$LWS !== null) {
5714
- if (restrictedEventTargetRegistry$LWS[eventName$LWS].has(possiblyRestrictedConstructor$LWS)) {
5715
- return true;
5716
- }
5717
- // eslint-disable-next-line no-proto
5718
- possiblyRestrictedConstructor$LWS = possiblyRestrictedConstructor$LWS.__proto__;
5719
- }
5720
- return false;
5649
+ return restrictedEventTargetRegistry$LWS[eventName$LWS].has(eventTarget$LWS.constructor);
5721
5650
  }
5722
5651
  function registerEventTargetRestriction$LWS(record$LWS, EventTargetCtor$LWS, eventName$LWS) {
5723
- const unmaskedEventTargetCtor$LWS = getUnmaskedFunction$LWS(EventTargetCtor$LWS);
5724
5652
  // istanbul ignore if: this is a safety precaution that is unreachable via tests
5725
- if (isEventTargetRestricted$LWS(record$LWS, unmaskedEventTargetCtor$LWS.prototype, eventName$LWS)) {
5653
+ if (isEventTargetRestricted$LWS(record$LWS, EventTargetCtor$LWS.prototype, eventName$LWS)) {
5726
5654
  return;
5727
5655
  }
5728
5656
  const {
@@ -5736,7 +5664,7 @@ function registerEventTargetRestriction$LWS(record$LWS, EventTargetCtor$LWS, eve
5736
5664
  const {
5737
5665
  [eventName$LWS]: restrictedEventTargetCtors$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
5738
5666
  } = restrictedEventTargetRegistry$LWS;
5739
- restrictedEventTargetCtors$LWS.add(unmaskedEventTargetCtor$LWS);
5667
+ restrictedEventTargetCtors$LWS.add(EventTargetCtor$LWS);
5740
5668
  restrictedEventTargetRegistry$LWS[eventName$LWS] = restrictedEventTargetCtors$LWS;
5741
5669
  restrictedEventTargetRegistryBySandboxKeyRegistry$LWS[key$LWS] = restrictedEventTargetRegistry$LWS;
5742
5670
  }
@@ -6091,7 +6019,7 @@ function initDistortionDocumentDomainSetter$LWS({
6091
6019
  };
6092
6020
  }
6093
6021
  const {
6094
- isSharedElement: isSharedElement$s$LWS
6022
+ isSharedElement: isSharedElement$r$LWS
6095
6023
  } = rootValidator$LWS;
6096
6024
  function throwLockerSecurityError$LWS(command$LWS, target$LWS) {
6097
6025
  throw new LockerSecurityError$LWS(`Cannot execute command '${command$LWS}' on ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, target$LWS, [])}.`);
@@ -6118,7 +6046,7 @@ function initDistortionDocumentExecCommand$LWS({
6118
6046
  length: length$LWS
6119
6047
  } = args$LWS;
6120
6048
  if (length$LWS >= 1) {
6121
- const command$LWS = toSafeStringValue$LWS(args$LWS[0]);
6049
+ const command$LWS = toString$LWS(args$LWS[0]);
6122
6050
  const loweredCommand$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, command$LWS, []);
6123
6051
  if (loweredCommand$LWS === 'selectall' && this === rootDocument$LWS) {
6124
6052
  throwLockerSecurityError$LWS(command$LWS, this);
@@ -6137,7 +6065,7 @@ function initDistortionDocumentExecCommand$LWS({
6137
6065
  // istanbul ignore else: external is the default sandbox type for coverage runs
6138
6066
  if (type$LWS === 0 /* SandboxType.External */) {
6139
6067
  const activeElement$LWS = ReflectApply$LWS$1(originalActiveElement$LWS, this, []);
6140
- if (isSharedElement$s$LWS(activeElement$LWS) && ReflectApply$LWS$1(originalIsContentEditable$LWS, activeElement$LWS, [])) {
6068
+ if (isSharedElement$r$LWS(activeElement$LWS) && ReflectApply$LWS$1(originalIsContentEditable$LWS, activeElement$LWS, [])) {
6141
6069
  throwLockerSecurityError$LWS(command$LWS, activeElement$LWS);
6142
6070
  }
6143
6071
  }
@@ -6252,8 +6180,8 @@ function initDistortionDOMParserParseFromString$LWS({
6252
6180
  if (args$LWS.length >= 2) {
6253
6181
  // Override the value of the first argument with a sanitized version
6254
6182
  // of that argument.
6255
- const string$LWS = toSafeStringValue$LWS(args$LWS[0]);
6256
- const mimeType$LWS = toSafeStringValue$LWS(args$LWS[1]);
6183
+ const string$LWS = toString$LWS(args$LWS[0]);
6184
+ const mimeType$LWS = toString$LWS(args$LWS[1]);
6257
6185
  let contentType$LWS;
6258
6186
  switch (mimeType$LWS) {
6259
6187
  case 'application/xhtml+xml':
@@ -6284,7 +6212,7 @@ function initDistortionDOMParserParseFromString$LWS({
6284
6212
  };
6285
6213
  }
6286
6214
  const {
6287
- isSharedElement: isSharedElement$r$LWS,
6215
+ isSharedElement: isSharedElement$q$LWS,
6288
6216
  isAllowedSharedElementChild: isAllowedSharedElementChild$6$LWS
6289
6217
  } = rootValidator$LWS;
6290
6218
  function initDistortionElementAfter$LWS({
@@ -6299,13 +6227,13 @@ function initDistortionElementAfter$LWS({
6299
6227
  }) {
6300
6228
  const distortionEntry$LWS = [originalAfter$LWS, function after$LWS(...args$LWS) {
6301
6229
  // istanbul ignore else: needs default platform behavior test
6302
- if (isSharedElement$r$LWS(this)) {
6230
+ if (isSharedElement$q$LWS(this)) {
6303
6231
  for (let i$LWS = 0, {
6304
6232
  length: length$LWS
6305
6233
  } = args$LWS; i$LWS < length$LWS; i$LWS += 1) {
6306
6234
  const argValue$LWS = args$LWS[i$LWS];
6307
6235
  if (!isAllowedSharedElementChild$6$LWS(argValue$LWS)) {
6308
- const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toSafeStringValue$LWS(argValue$LWS);
6236
+ const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
6309
6237
  throw new LockerSecurityError$LWS(`Cannot insert ${nodeNameOrString$LWS} after ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6310
6238
  }
6311
6239
  }
@@ -6317,7 +6245,7 @@ function initDistortionElementAfter$LWS({
6317
6245
  };
6318
6246
  }
6319
6247
  const {
6320
- isSharedElement: isSharedElement$q$LWS,
6248
+ isSharedElement: isSharedElement$p$LWS,
6321
6249
  isAllowedSharedElementChild: isAllowedSharedElementChild$5$LWS
6322
6250
  } = rootValidator$LWS;
6323
6251
  function initDistortionElementAppend$LWS({
@@ -6332,7 +6260,7 @@ function initDistortionElementAppend$LWS({
6332
6260
  }) {
6333
6261
  const distortionEntry$LWS = [originalAppend$LWS, function append$LWS(...args$LWS) {
6334
6262
  // istanbul ignore else: needs default platform behavior test
6335
- if (isSharedElement$q$LWS(this)) {
6263
+ if (isSharedElement$p$LWS(this)) {
6336
6264
  // Element.prototype.append(...args) accepts an arbitrary number
6337
6265
  // of arguments which can be comprised of Nodes and DOMStrings.
6338
6266
  for (let i$LWS = 0, {
@@ -6343,7 +6271,7 @@ function initDistortionElementAppend$LWS({
6343
6271
  // element child which is limited to script and link, an
6344
6272
  // exception is thrown.
6345
6273
  if (!isAllowedSharedElementChild$5$LWS(argValue$LWS)) {
6346
- const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toSafeStringValue$LWS(argValue$LWS);
6274
+ const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
6347
6275
  throw new LockerSecurityError$LWS(`Cannot append ${nodeNameOrString$LWS} to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6348
6276
  }
6349
6277
  }
@@ -6354,6 +6282,25 @@ function initDistortionElementAppend$LWS({
6354
6282
  return distortionEntry$LWS;
6355
6283
  };
6356
6284
  }
6285
+ const elementShadowRootBySandboxKeyRegistry$LWS = {
6286
+ __proto__: null
6287
+ };
6288
+ function registerShadowRootInSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
6289
+ const {
6290
+ [sandboxKey$LWS]: elementShadowRootRegistry$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
6291
+ } = elementShadowRootBySandboxKeyRegistry$LWS;
6292
+ elementShadowRootRegistry$LWS.add(shadowRoot$LWS);
6293
+ if (!elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS]) {
6294
+ elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS] = elementShadowRootRegistry$LWS;
6295
+ }
6296
+ }
6297
+ function isShadowRootAccessibleInThisSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
6298
+ const elementShadowRootRegistry$LWS = elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS];
6299
+ if (!elementShadowRootRegistry$LWS) {
6300
+ return false;
6301
+ }
6302
+ return elementShadowRootRegistry$LWS.has(shadowRoot$LWS);
6303
+ }
6357
6304
  function initDistortionElementAttachShadow$LWS({
6358
6305
  globalObject: {
6359
6306
  Element: {
@@ -6410,7 +6357,7 @@ function initDistortionElementAttributesGetter$LWS({
6410
6357
  };
6411
6358
  }
6412
6359
  const {
6413
- isSharedElement: isSharedElement$p$LWS,
6360
+ isSharedElement: isSharedElement$o$LWS,
6414
6361
  isAllowedSharedElementChild: isAllowedSharedElementChild$4$LWS
6415
6362
  } = rootValidator$LWS;
6416
6363
  function initDistortionElementBefore$LWS({
@@ -6425,14 +6372,14 @@ function initDistortionElementBefore$LWS({
6425
6372
  }) {
6426
6373
  const distortionEntry$LWS = [originalBefore$LWS, function before$LWS(...args$LWS) {
6427
6374
  // istanbul ignore else: needs default platform behavior test
6428
- if (isSharedElement$p$LWS(this)) {
6375
+ if (isSharedElement$o$LWS(this)) {
6429
6376
  for (let i$LWS = 0, {
6430
6377
  length: length$LWS
6431
6378
  } = args$LWS; i$LWS < length$LWS; i$LWS += 1) {
6432
6379
  const argValue$LWS = args$LWS[i$LWS];
6433
6380
  // istanbul ignore else: needs default platform behavior test
6434
6381
  if (!isAllowedSharedElementChild$4$LWS(argValue$LWS)) {
6435
- const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toSafeStringValue$LWS(argValue$LWS);
6382
+ const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
6436
6383
  throw new LockerSecurityError$LWS(`Cannot insert ${nodeNameOrString$LWS} before ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6437
6384
  }
6438
6385
  }
@@ -6486,7 +6433,7 @@ function initDistortionElementGetInnerHTML$LWS({
6486
6433
  };
6487
6434
  }
6488
6435
  function scriptPropertySetters$LWS(incomingThis$LWS, property$LWS, valueAsTrustedString$LWS, originalScriptPropertyGetter$LWS, originalScriptPropertySetter$LWS, distortions$LWS, sandboxEvaluator$LWS, signedScriptHookSourceText$LWS) {
6489
- const valueAsString$LWS = toSafeStringValue$LWS(valueAsTrustedString$LWS);
6436
+ const valueAsString$LWS = toString$LWS(valueAsTrustedString$LWS);
6490
6437
  if (!isScriptPropertyEvaluatorHookDefined$LWS(incomingThis$LWS)) {
6491
6438
  const distortedScriptPropertyGetter$LWS = distortions$LWS.get(originalScriptPropertyGetter$LWS);
6492
6439
  defineScriptAccessorProperty$LWS(incomingThis$LWS, property$LWS, distortedScriptPropertyGetter$LWS, originalScriptPropertySetter$LWS);
@@ -6516,8 +6463,8 @@ function scriptPropertySetters$LWS(incomingThis$LWS, property$LWS, valueAsTruste
6516
6463
  return false;
6517
6464
  }
6518
6465
  const {
6519
- isInherentlyUnsecure: isInherentlyUnsecure$2$LWS,
6520
- isSharedElement: isSharedElement$o$LWS
6466
+ isInherentlyUnsecure: isInherentlyUnsecure$3$LWS,
6467
+ isSharedElement: isSharedElement$n$LWS
6521
6468
  } = rootValidator$LWS;
6522
6469
  function initDistortionElementInnerHTMLSetter$LWS({
6523
6470
  document: document$LWS,
@@ -6543,7 +6490,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
6543
6490
  const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
6544
6491
  if (!isOwnerXMLDocument$LWS) {
6545
6492
  // istanbul ignore else: needs default platform behavior test
6546
- if (isSharedElement$o$LWS(this)) {
6493
+ if (isSharedElement$n$LWS(this)) {
6547
6494
  throw new LockerSecurityError$LWS(`Cannot set innerHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6548
6495
  }
6549
6496
  if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement) {
@@ -6560,7 +6507,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
6560
6507
  const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
6561
6508
  value$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
6562
6509
  }
6563
- if (isInherentlyUnsecure$2$LWS(value$LWS)) {
6510
+ if (isInherentlyUnsecure$3$LWS(value$LWS)) {
6564
6511
  throw new LockerSecurityError$LWS(`Cannot set 'innerHTML' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
6565
6512
  }
6566
6513
  ReflectApply$LWS$1(originalInnerHTMLSetter$LWS, this, [value$LWS]);
@@ -6568,7 +6515,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
6568
6515
  };
6569
6516
  }
6570
6517
  const {
6571
- isSharedElement: isSharedElement$n$LWS,
6518
+ isSharedElement: isSharedElement$m$LWS,
6572
6519
  isAllowedSharedElementChild: isAllowedSharedElementChild$3$LWS
6573
6520
  } = rootValidator$LWS;
6574
6521
  function initDistortionElementInsertAdjacentElement$LWS({
@@ -6587,7 +6534,7 @@ function initDistortionElementInsertAdjacentElement$LWS({
6587
6534
  1: element$LWS
6588
6535
  } = args$LWS;
6589
6536
  // istanbul ignore else: needs default platform behavior test
6590
- if (isSharedElement$n$LWS(this) && !isAllowedSharedElementChild$3$LWS(element$LWS)) {
6537
+ if (isSharedElement$m$LWS(this) && !isAllowedSharedElementChild$3$LWS(element$LWS)) {
6591
6538
  throw new LockerSecurityError$LWS(`Cannot insert ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, element$LWS, [])} adjacent to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6592
6539
  }
6593
6540
  }
@@ -6598,7 +6545,8 @@ function initDistortionElementInsertAdjacentElement$LWS({
6598
6545
  };
6599
6546
  }
6600
6547
  const {
6601
- isSharedElement: isSharedElement$m$LWS
6548
+ isInherentlyUnsecure: isInherentlyUnsecure$2$LWS,
6549
+ isSharedElement: isSharedElement$l$LWS
6602
6550
  } = rootValidator$LWS;
6603
6551
  const allowedElementHTMLRegExp$LWS = /^\s*<(link|script|style)/i;
6604
6552
  function initDistortionElementInsertAdjacentHTML$LWS({
@@ -6618,7 +6566,7 @@ function initDistortionElementInsertAdjacentHTML$LWS({
6618
6566
  // istanbul ignore else: needs default platform behavior test
6619
6567
  if (args$LWS.length > 1) {
6620
6568
  const match$LWS = ReflectApply$LWS$1(StringProtoMatch$LWS, args$LWS[1], [allowedElementHTMLRegExp$LWS]);
6621
- if (isSharedElement$m$LWS(this) && match$LWS === null) {
6569
+ if (isSharedElement$l$LWS(this) && match$LWS === null) {
6622
6570
  throw new LockerSecurityError$LWS(`Cannot insert adjacent HTML to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}`);
6623
6571
  }
6624
6572
  // This must be called to signal to the virtual
@@ -6628,13 +6576,17 @@ function initDistortionElementInsertAdjacentHTML$LWS({
6628
6576
  setCustomElementsRegistry$LWS(document$LWS, key$LWS);
6629
6577
  const contentType$LWS = this instanceof SVGElement ? ContentType$LWS.SVG : ContentType$LWS.HTML;
6630
6578
  args$LWS[1] = lwsInternalPolicy$LWS.createHTML(args$LWS[1], key$LWS, contentType$LWS);
6579
+ if (isInherentlyUnsecure$2$LWS(args$LWS[1])) {
6580
+ throw new LockerSecurityError$LWS(`Cannot 'insertAdjacentHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[1])}.`);
6581
+ }
6631
6582
  }
6632
6583
  ReflectApply$LWS$1(originalInsertAdjacentHTML$LWS, this, args$LWS);
6633
6584
  }];
6634
6585
  };
6635
6586
  }
6636
6587
  const {
6637
- isSharedElement: isSharedElement$l$LWS
6588
+ isInherentlyUnsecure: isInherentlyUnsecure$1$LWS,
6589
+ isSharedElement: isSharedElement$k$LWS
6638
6590
  } = rootValidator$LWS;
6639
6591
  function initDistortionElementOuterHTMLSetter$LWS({
6640
6592
  document: document$LWS,
@@ -6648,7 +6600,7 @@ function initDistortionElementOuterHTMLSetter$LWS({
6648
6600
  }) {
6649
6601
  return [originalOuterHTMLSetter$LWS, function outerHTML$LWS(value$LWS) {
6650
6602
  // istanbul ignore else: needs default platform behavior test
6651
- if (isSharedElement$l$LWS(this)) {
6603
+ if (isSharedElement$k$LWS(this)) {
6652
6604
  throw new LockerSecurityError$LWS(`Cannot set outerHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6653
6605
  }
6654
6606
  // This must be called to signal to the virtual
@@ -6657,12 +6609,15 @@ function initDistortionElementOuterHTMLSetter$LWS({
6657
6609
  // association to this sandbox.
6658
6610
  setCustomElementsRegistry$LWS(document$LWS, key$LWS);
6659
6611
  const html$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, ContentType$LWS.HTML);
6612
+ if (isInherentlyUnsecure$1$LWS(html$LWS)) {
6613
+ throw new LockerSecurityError$LWS(`Cannot set 'outerHTML' using an unsecure ${toSafeTemplateStringValue$LWS(html$LWS)}.`);
6614
+ }
6660
6615
  ReflectApply$LWS$1(originalOuterHTMLSetter$LWS, this, [html$LWS]);
6661
6616
  }];
6662
6617
  };
6663
6618
  }
6664
6619
  const {
6665
- isSharedElement: isSharedElement$k$LWS,
6620
+ isSharedElement: isSharedElement$j$LWS,
6666
6621
  isAllowedSharedElementChild: isAllowedSharedElementChild$2$LWS
6667
6622
  } = rootValidator$LWS;
6668
6623
  function initDistortionElementPrepend$LWS({
@@ -6677,7 +6632,7 @@ function initDistortionElementPrepend$LWS({
6677
6632
  }) {
6678
6633
  const distortionEntry$LWS = [originalPrepend$LWS, function prepend$LWS(...args$LWS) {
6679
6634
  // istanbul ignore else: needs default platform behavior test
6680
- if (isSharedElement$k$LWS(this)) {
6635
+ if (isSharedElement$j$LWS(this)) {
6681
6636
  // Element.prototype.prepend(...args) accepts an arbitrary
6682
6637
  // number of arguments which can be comprised of Nodes and
6683
6638
  // DOMStrings.
@@ -6689,7 +6644,7 @@ function initDistortionElementPrepend$LWS({
6689
6644
  // element child, which is limited to script and link, an
6690
6645
  // exception is thrown.
6691
6646
  if (!isAllowedSharedElementChild$2$LWS(argValue$LWS)) {
6692
- const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toSafeStringValue$LWS(argValue$LWS);
6647
+ const nodeNameOrString$LWS = argValue$LWS instanceof Node$LWS ? ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, argValue$LWS, []) : /* istanbul ignore next: currently unreachable via tests */toString$LWS(argValue$LWS);
6693
6648
  throw new LockerSecurityError$LWS(`Cannot prepend ${nodeNameOrString$LWS} to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6694
6649
  }
6695
6650
  }
@@ -6701,7 +6656,7 @@ function initDistortionElementPrepend$LWS({
6701
6656
  };
6702
6657
  }
6703
6658
  const {
6704
- isSharedElement: isSharedElement$j$LWS
6659
+ isSharedElement: isSharedElement$i$LWS
6705
6660
  } = rootValidator$LWS;
6706
6661
  function initDistortionElementRemove$LWS({
6707
6662
  globalObject: {
@@ -6714,7 +6669,7 @@ function initDistortionElementRemove$LWS({
6714
6669
  }) {
6715
6670
  const distortionEntry$LWS = [originalRemove$LWS, function remove$LWS() {
6716
6671
  // istanbul ignore else: needs default platform behavior test
6717
- if (isSharedElement$j$LWS(this)) {
6672
+ if (isSharedElement$i$LWS(this)) {
6718
6673
  throw new LockerSecurityError$LWS(`Cannot remove ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6719
6674
  }
6720
6675
  ReflectApply$LWS$1(originalRemove$LWS, this, []);
@@ -6724,7 +6679,7 @@ function initDistortionElementRemove$LWS({
6724
6679
  };
6725
6680
  }
6726
6681
  const {
6727
- isSharedElement: isSharedElement$i$LWS
6682
+ isSharedElement: isSharedElement$h$LWS
6728
6683
  } = rootValidator$LWS;
6729
6684
  function initDistortionElementReplaceChildren$LWS({
6730
6685
  globalObject: {
@@ -6737,7 +6692,7 @@ function initDistortionElementReplaceChildren$LWS({
6737
6692
  }) {
6738
6693
  const distortionEntry$LWS = [originalReplaceChildren$LWS, function replaceChildren$LWS(...args$LWS) {
6739
6694
  // istanbul ignore else: needs default platform behavior test
6740
- if (isSharedElement$i$LWS(this)) {
6695
+ if (isSharedElement$h$LWS(this)) {
6741
6696
  throw new LockerSecurityError$LWS(`Cannot replace children of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6742
6697
  }
6743
6698
  return ReflectApply$LWS$1(originalReplaceChildren$LWS, this, args$LWS);
@@ -6747,7 +6702,7 @@ function initDistortionElementReplaceChildren$LWS({
6747
6702
  };
6748
6703
  }
6749
6704
  const {
6750
- isSharedElement: isSharedElement$h$LWS
6705
+ isSharedElement: isSharedElement$g$LWS
6751
6706
  } = rootValidator$LWS;
6752
6707
  function initDistortionElementReplaceWith$LWS({
6753
6708
  globalObject: {
@@ -6760,7 +6715,7 @@ function initDistortionElementReplaceWith$LWS({
6760
6715
  }) {
6761
6716
  const distortionEntry$LWS = [originalReplaceWith$LWS, function replaceWith$LWS(...args$LWS) {
6762
6717
  // istanbul ignore else: needs default platform behavior test
6763
- if (isSharedElement$h$LWS(this)) {
6718
+ if (isSharedElement$g$LWS(this)) {
6764
6719
  throw new LockerSecurityError$LWS(`Cannot replace ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6765
6720
  }
6766
6721
  return ReflectApply$LWS$1(originalReplaceWith$LWS, this, args$LWS);
@@ -6781,8 +6736,8 @@ function initDistortionElementSetAttribute$LWS({
6781
6736
  return function distortionElementSetAttribute$LWS(record$LWS) {
6782
6737
  return [originalSetAttribute$LWS, function setAttribute$LWS(...args$LWS) {
6783
6738
  if (args$LWS.length > 1) {
6784
- const attrName$LWS = normalizeNamespacedAttributeName$LWS(toSafeStringValue$LWS(args$LWS[0]));
6785
- const attrValue$LWS = toSafeStringValue$LWS(args$LWS[1]);
6739
+ const attrName$LWS = normalizeNamespacedAttributeName$LWS(toString$LWS(args$LWS[0]));
6740
+ const attrValue$LWS = toString$LWS(args$LWS[1]);
6786
6741
  const distortion$LWS = getAttributeDistortion$LWS(record$LWS, this, attrName$LWS);
6787
6742
  if (distortion$LWS) {
6788
6743
  ReflectApply$LWS$1(distortion$LWS, this, [attrValue$LWS]);
@@ -6935,10 +6890,10 @@ function initDistortionElementSetAttributeNS$LWS({
6935
6890
  0: attrNamespace$LWS
6936
6891
  } = args$LWS;
6937
6892
  if (attrNamespace$LWS !== null && attrNamespace$LWS !== undefined) {
6938
- attrNamespace$LWS = toSafeStringValue$LWS(attrNamespace$LWS);
6893
+ attrNamespace$LWS = toString$LWS(attrNamespace$LWS);
6939
6894
  }
6940
- const attrName$LWS = normalizeNamespacedAttributeName$LWS(toSafeStringValue$LWS(args$LWS[1]));
6941
- const attrValue$LWS = toSafeStringValue$LWS(args$LWS[2]);
6895
+ const attrName$LWS = normalizeNamespacedAttributeName$LWS(toString$LWS(args$LWS[1]));
6896
+ const attrValue$LWS = toString$LWS(args$LWS[2]);
6942
6897
  const normalizedNamespace$LWS = normalizeNamespace$LWS(attrNamespace$LWS);
6943
6898
  const distortion$LWS = getAttributeDistortion$LWS(record$LWS, this, attrName$LWS, normalizedNamespace$LWS);
6944
6899
  // istanbul ignore else: needs default platform behavior test
@@ -6966,8 +6921,8 @@ function initDistortionElementSetAttributeNS$LWS({
6966
6921
  };
6967
6922
  }
6968
6923
  const {
6969
- isInherentlyUnsecure: isInherentlyUnsecure$1$LWS,
6970
- isSharedElement: isSharedElement$g$LWS
6924
+ isInherentlyUnsecure: isInherentlyUnsecure$LWS,
6925
+ isSharedElement: isSharedElement$f$LWS
6971
6926
  } = rootValidator$LWS;
6972
6927
  function initDistortionElementSetHTML$LWS({
6973
6928
  document: document$LWS,
@@ -6993,7 +6948,7 @@ function initDistortionElementSetHTML$LWS({
6993
6948
  const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
6994
6949
  if (!isOwnerXMLDocument$LWS) {
6995
6950
  // istanbul ignore else: needs default platform behavior test
6996
- if (isSharedElement$g$LWS(this)) {
6951
+ if (isSharedElement$f$LWS(this)) {
6997
6952
  throw new LockerSecurityError$LWS(`Cannot setHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
6998
6953
  }
6999
6954
  // This must be called to signal to the virtual
@@ -7006,7 +6961,7 @@ function initDistortionElementSetHTML$LWS({
7006
6961
  const value$LWS = args$LWS[0];
7007
6962
  const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
7008
6963
  args$LWS[0] = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
7009
- if (isInherentlyUnsecure$1$LWS(args$LWS[0])) {
6964
+ if (isInherentlyUnsecure$LWS(args$LWS[0])) {
7010
6965
  throw new LockerSecurityError$LWS(`Cannot 'setHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[0])}.`);
7011
6966
  }
7012
6967
  }
@@ -7014,68 +6969,6 @@ function initDistortionElementSetHTML$LWS({
7014
6969
  }];
7015
6970
  };
7016
6971
  }
7017
- const {
7018
- isInherentlyUnsecure: isInherentlyUnsecure$LWS,
7019
- isSharedElement: isSharedElement$f$LWS
7020
- } = rootValidator$LWS;
7021
- function initDistortionElementSetHTMLUnsafe$LWS({
7022
- document: document$LWS,
7023
- globalObject: {
7024
- Element: Element$LWS,
7025
- Element: {
7026
- prototype: {
7027
- setHTMLUnsafe: originalSetHTMLUnsafe$LWS
7028
- }
7029
- },
7030
- HTMLScriptElement: HTMLScriptElement$LWS,
7031
- SVGElement: SVGElement$LWS,
7032
- XMLDocument: XMLDocument$LWS
7033
- },
7034
- root: {
7035
- distortions: distortions$LWS
7036
- }
7037
- }) {
7038
- // istanbul ignore if: currently unreachable via tests
7039
- if (typeof originalSetHTMLUnsafe$LWS !== 'function') {
7040
- return noop$LWS$1;
7041
- }
7042
- return function distortionElementSetHTMLUnsafe$LWS({
7043
- key: key$LWS,
7044
- sandboxEvaluator: sandboxEvaluator$LWS
7045
- }) {
7046
- const {
7047
- get: originalInnerHTMLGetter$LWS,
7048
- set: originalInnerHTMLSetter$LWS
7049
- } = ReflectGetOwnPropertyDescriptor$LWS(Element$LWS.prototype, 'innerHTML');
7050
- return [originalSetHTMLUnsafe$LWS, function innerHTML$LWS(value$LWS) {
7051
- const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
7052
- if (!isOwnerXMLDocument$LWS) {
7053
- // istanbul ignore else: needs default platform behavior test
7054
- if (isSharedElement$f$LWS(this)) {
7055
- throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
7056
- }
7057
- // This is necessary to support script.setHTMLUnsafe(...)
7058
- if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement) {
7059
- const scriptWasNotEvaluatedInScriptPropertySetter$LWS = scriptPropertySetters$LWS(this, 'innerHTML', trusted.createScript(value$LWS), originalInnerHTMLGetter$LWS, originalInnerHTMLSetter$LWS, distortions$LWS, sandboxEvaluator$LWS, trusted.createScript(SCRIPT_HOOK_SOURCE_TEXT$LWS));
7060
- if (scriptWasNotEvaluatedInScriptPropertySetter$LWS) {
7061
- return;
7062
- }
7063
- }
7064
- // This must be called to signal to the virtual
7065
- // CustomElementRegistry that the next thing created
7066
- // MAY CONTAIN a custom element, which must be marked for
7067
- // association to this sandbox.
7068
- setCustomElementsRegistry$LWS(document$LWS, key$LWS);
7069
- const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
7070
- value$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
7071
- }
7072
- if (isInherentlyUnsecure$LWS(value$LWS)) {
7073
- throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
7074
- }
7075
- ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [value$LWS]);
7076
- }];
7077
- };
7078
- }
7079
6972
  function initDistortionElementShadowRootGetter$LWS({
7080
6973
  globalObject: {
7081
6974
  Element: Element$LWS
@@ -7111,7 +7004,7 @@ function initDistortionElementToggleAttribute$LWS({
7111
7004
  } = args$LWS;
7112
7005
  // istanbul ignore else: needs default platform behavior test
7113
7006
  if (length$LWS > 0) {
7114
- const attrName$LWS = toSafeStringValue$LWS(args$LWS[0]);
7007
+ const attrName$LWS = toString$LWS(args$LWS[0]);
7115
7008
  const distortion$LWS = getAttributeDistortion$LWS(record$LWS, this, attrName$LWS);
7116
7009
  // istanbul ignore else: needs default platform behavior test
7117
7010
  if (distortion$LWS) {
@@ -7148,7 +7041,7 @@ function initDistortionEval$LWS({
7148
7041
  }) {
7149
7042
  return [originalEval$LWS, function (sourceText$LWS) {
7150
7043
  throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'eval');
7151
- return sandboxEvaluator$LWS(transformSourceText$LWS(toSafeStringValue$LWS(sourceText$LWS)), UNCOMPILED_CONTEXT$LWS);
7044
+ return sandboxEvaluator$LWS(transformSourceText$LWS(toString$LWS(sourceText$LWS)), UNCOMPILED_CONTEXT$LWS);
7152
7045
  }];
7153
7046
  };
7154
7047
  }
@@ -7232,7 +7125,7 @@ function initDistortionEventTargetAddEventListener$LWS({
7232
7125
  // should fail if less than 2 arguments are provided.
7233
7126
  // istanbul ignore else: needs default platform behavior test
7234
7127
  if (length$LWS > 1) {
7235
- const eventName$LWS = toSafeStringValue$LWS(args$LWS[0]);
7128
+ const eventName$LWS = toString$LWS(args$LWS[0]);
7236
7129
  if (isEventTargetRestricted$LWS(record$LWS, this, eventName$LWS)) {
7237
7130
  throw new LockerSecurityError$LWS(createEventListenerExceptionMessage$LWS(this, eventName$LWS));
7238
7131
  }
@@ -7267,7 +7160,7 @@ function initDistortionFunction$LWS({
7267
7160
  return ReflectApply$LWS$1(sandboxFuncCtor$LWS, this, []);
7268
7161
  }
7269
7162
  const lastIndex$LWS = length$LWS - 1;
7270
- const funcBody$LWS = toSafeStringValue$LWS(args$LWS[lastIndex$LWS]);
7163
+ const funcBody$LWS = toString$LWS(args$LWS[lastIndex$LWS]);
7271
7164
  // Validate parsing the function body.
7272
7165
  ReflectApply$LWS$1(sandboxFuncCtor$LWS, this, [funcBody$LWS]);
7273
7166
  // Make function body empty to create the wire-frame.
@@ -7423,16 +7316,6 @@ function initDistortionHTMLElementInnerTextSetter$LWS({
7423
7316
  return distortionEntry$LWS;
7424
7317
  };
7425
7318
  }
7426
- function initDistortionHTMLElementOnsecuritypolicyviolation$LWS({
7427
- globalObject: {
7428
- HTMLElement: {
7429
- prototype: HTMLElementProto$LWS
7430
- },
7431
- HTMLElement: HTMLElement$LWS
7432
- }
7433
- }) {
7434
- return createEventDistortionFactory$LWS(HTMLElementProto$LWS, HTMLElement$LWS, 'securitypolicyviolation');
7435
- }
7436
7319
  const {
7437
7320
  isSharedElement: isSharedElement$d$LWS
7438
7321
  } = rootValidator$LWS;
@@ -7522,77 +7405,12 @@ function initDistortionIFrameElementContentWindowGetter$LWS({
7522
7405
  return distortionEntry$LWS;
7523
7406
  };
7524
7407
  }
7525
- function initDistortionHTMLIFrameElementSandboxGetter$LWS({
7526
- globalObject: {
7527
- HTMLIFrameElement: HTMLIFrameElement$LWS
7528
- }
7529
- }) {
7530
- const originalSandboxGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElement$LWS.prototype, 'sandbox');
7531
- return function distortionHTMLIFrameElementSandboxGetter$LWS({
7532
- key: key$LWS
7533
- }) {
7534
- return [originalSandboxGetter$LWS, function sandbox$LWS() {
7535
- const sandboxTokenList$LWS = ReflectApply$LWS$1(HTMLIFrameElementProtoSandboxGetter$LWS, this, []);
7536
- if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(key$LWS, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
7537
- // By returning a "copy" of the real "sandbox" DOMTokenList as an array of strings, LWS ensures
7538
- // that the real "sandbox" DOMTokenList is not accessible from code within the LWS sandbox.
7539
- return [...sandboxTokenList$LWS];
7540
- }
7541
- // istanbul ignore next: this line is untested because tests are run with all gates enabled.
7542
- return sandboxTokenList$LWS;
7543
- }];
7544
- };
7545
- }
7546
- const ABOUT_BLANK_TOKEN$LWS = 'about:blank';
7547
- const ALLOW_SAME_ORIGIN_TOKEN$LWS = 'allow-same-origin';
7548
- const ALLOW_SCRIPTS_TOKEN$LWS = 'allow-scripts';
7549
- const sameOriginSandboxedByLWS$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
7550
- function enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(iframe$LWS) {
7551
- const sandboxTokenList$LWS = ReflectApply$LWS$1(HTMLIFrameElementProtoSandboxGetter$LWS, iframe$LWS, []);
7552
- const srcValue$LWS = ReflectApply$LWS$1(HTMLIFrameElementProtoSrcGetter$LWS, iframe$LWS, []);
7553
- // Before adding "allow-scripts", check that "allow-same-origin" isn't present. If it is,
7554
- // throw an exception because LWS cannot allow an iframe created by component code to
7555
- // have sandbox="allow-same-origin allow-scripts", because that would enable access to
7556
- // the top level global object.
7557
- if (ReflectApply$LWS$1(DOMTokenListProtoContains$LWS, sandboxTokenList$LWS, [ALLOW_SAME_ORIGIN_TOKEN$LWS])) {
7558
- // Remove the 'allow-same-origin' sandbox token and throw an exception. This prevents
7559
- // component code from wrapping the operation in a try catch and then exploiting
7560
- // the iframe that may now have "allow-scripts allow-same-origin".
7561
- ReflectApply$LWS$1(DOMTokenListProtoRemove$LWS, sandboxTokenList$LWS, [ALLOW_SAME_ORIGIN_TOKEN$LWS]);
7562
- throw new LockerSecurityError$LWS('HTMLIFrameElement.sandbox cannot be set to "allow-same-origin"');
7563
- }
7564
- if (srcValue$LWS !== '' && srcValue$LWS !== ABOUT_BLANK_TOKEN$LWS) {
7565
- // If there is a valid src value and it is not "about:blank", parse it and
7566
- // compare it to the top level window's location.origin. We don't want to
7567
- // impose the sandbox="allow-scripts" on cross-origin iframes.
7568
- try {
7569
- const srcUrlOrigin$LWS = ReflectApply$LWS$1(URLProtoOriginGetter$LWS, new URLCtor$LWS(srcValue$LWS), []);
7570
- // If this iframe.src is cross-origin, let the browser take care of security.
7571
- if (srcUrlOrigin$LWS && srcUrlOrigin$LWS !== rootWindow$LWS$1.location.origin) {
7572
- return;
7573
- }
7574
- } catch (_unused2$LWS) {
7575
- /* empty */
7576
- }
7577
- if (!ReflectApply$LWS$1(DOMTokenListProtoContains$LWS, sandboxTokenList$LWS, [ALLOW_SCRIPTS_TOKEN$LWS])) {
7578
- // Track that LWS added this token
7579
- sameOriginSandboxedByLWS$LWS.add(iframe$LWS);
7580
- ReflectApply$LWS$1(DOMTokenListProtoAdd$LWS, sandboxTokenList$LWS, [ALLOW_SCRIPTS_TOKEN$LWS]);
7581
- }
7582
- } else {
7583
- if (srcValue$LWS === ABOUT_BLANK_TOKEN$LWS && sameOriginSandboxedByLWS$LWS.has(iframe$LWS)) {
7584
- // If the sandboxed code is navigated away from a same origin url,
7585
- // to "about:blank", and the only token is the one we created,
7586
- // then we can remove the sandbox attribute entirely.
7587
- sameOriginSandboxedByLWS$LWS.delete(iframe$LWS);
7588
- ReflectApply$LWS$1(DOMTokenListProtoRemove$LWS, sandboxTokenList$LWS, [ALLOW_SCRIPTS_TOKEN$LWS]);
7589
- // If after removing ALLOW_SCRIPTS_TOKEN, the sandbox attribute is empty,
7590
- // we can remove it entirely.
7591
- if (ReflectApply$LWS$1(DOMTokenListProtoLengthGetter$LWS, sandboxTokenList$LWS, []) === 0) {
7592
- ReflectApply$LWS$1(ElementProtoRemoveAttribute$LWS, iframe$LWS, ['sandbox']);
7593
- }
7594
- }
7408
+ function src$LWS(value$LWS) {
7409
+ const urlString$LWS = sanitizeURLForElement$LWS(value$LWS);
7410
+ if (!isValidURLScheme$LWS(urlString$LWS)) {
7411
+ throw new LockerSecurityError$LWS('HTMLIFrameElement.src supports http://, https:// schemes, relative urls and about:blank.');
7595
7412
  }
7413
+ ReflectApply$LWS$1(HTMLIFrameElementProtoSrcSetter$LWS, this, [urlString$LWS]);
7596
7414
  }
7597
7415
  function initDistortionHTMLIFrameElementSrcSetter$LWS({
7598
7416
  globalObject: {
@@ -7600,40 +7418,10 @@ function initDistortionHTMLIFrameElementSrcSetter$LWS({
7600
7418
  }
7601
7419
  }) {
7602
7420
  const originalSrcSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElement$LWS.prototype, 'src');
7421
+ const distortionMapEntry$LWS = [originalSrcSetter$LWS, src$LWS];
7603
7422
  return function distortionHTMLIFrameElementSrcSetter$LWS(record$LWS) {
7604
- function src$LWS(value$LWS) {
7605
- const normalizedSrcValue$LWS = toSafeStringValue$LWS(value$LWS);
7606
- // If the string being set to iframe.src is not an empty string, sanitize it for assignment
7607
- // to iframe.src. If it is an empty string, let it be and proceed.
7608
- // Otherwise, take no action.
7609
- const urlString$LWS = normalizedSrcValue$LWS !== '' ? sanitizeURLForElement$LWS(normalizedSrcValue$LWS) : '';
7610
- if (urlString$LWS && !isValidURLScheme$LWS(urlString$LWS)) {
7611
- throw new LockerSecurityError$LWS('HTMLIFrameElement.src supports http://, https:// schemes, relative urls and about:blank.');
7612
- }
7613
- ReflectApply$LWS$1(HTMLIFrameElementProtoSrcSetter$LWS, this, [urlString$LWS]);
7614
- if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(record$LWS.key, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
7615
- enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(this);
7616
- }
7617
- }
7618
7423
  registerAttributeDistortion$LWS(record$LWS, HTMLIFrameElement$LWS, 'src', NAMESPACE_DEFAULT$LWS, src$LWS);
7619
- return [originalSrcSetter$LWS, src$LWS];
7620
- };
7621
- }
7622
- function initDistortionHTMLIFrameElementSandboxSetter$LWS({
7623
- globalObject: {
7624
- HTMLIFrameElement: HTMLIFrameElement$LWS
7625
- }
7626
- }) {
7627
- const originalSandboxSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElement$LWS.prototype, 'sandbox');
7628
- return function distortionHTMLIFrameElementSandboxSetter$LWS(record$LWS) {
7629
- function sandbox$LWS(value$LWS) {
7630
- ReflectApply$LWS$1(HTMLIFrameElementProtoSandboxSetter$LWS, this, [value$LWS]);
7631
- if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(record$LWS.key, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
7632
- enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(this);
7633
- }
7634
- }
7635
- registerAttributeDistortion$LWS(record$LWS, HTMLIFrameElement$LWS, 'sandbox', NAMESPACE_DEFAULT$LWS, sandbox$LWS);
7636
- return [originalSandboxSetter$LWS, sandbox$LWS];
7424
+ return distortionMapEntry$LWS;
7637
7425
  };
7638
7426
  }
7639
7427
  const importRegExp$LWS = /import/i;
@@ -7648,7 +7436,7 @@ function initDistortionHTMLLinkElementRelSetter$LWS({
7648
7436
  }) {
7649
7437
  const originalRelSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLLinkElement$LWS.prototype, 'rel');
7650
7438
  function rel$LWS(value$LWS) {
7651
- const valueAsString$LWS = toSafeStringValue$LWS(value$LWS);
7439
+ const valueAsString$LWS = toString$LWS(value$LWS);
7652
7440
  if (isValidRelValue$LWS(valueAsString$LWS)) {
7653
7441
  ReflectApply$LWS$1(originalRelSetter$LWS, this, [valueAsString$LWS]);
7654
7442
  return;
@@ -7669,7 +7457,7 @@ function initDistortionHTMLLinkElementRelListSetter$LWS({
7669
7457
  }) {
7670
7458
  const originalRelListSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLLinkElement$LWS.prototype, 'relList');
7671
7459
  const distortionEntry$LWS = [originalRelListSetter$LWS, function relList$LWS(relListValue$LWS) {
7672
- const string$LWS = relList$LWS instanceof DOMTokenList$LWS ? /* istanbul ignore next: needs default platform behavior test */ReflectApply$LWS$1(DOMTokenListProtoValueGetter$LWS, relListValue$LWS, []) : toSafeStringValue$LWS(relListValue$LWS);
7460
+ const string$LWS = relList$LWS instanceof DOMTokenList$LWS ? /* istanbul ignore next: needs default platform behavior test */ReflectApply$LWS$1(DOMTokenListProtoValueGetter$LWS, relListValue$LWS, []) : toString$LWS(relListValue$LWS);
7673
7461
  if (isValidRelValue$LWS(string$LWS)) {
7674
7462
  ReflectApply$LWS$1(originalRelListSetter$LWS, this, [string$LWS]);
7675
7463
  return;
@@ -7989,16 +7777,6 @@ function initDistortionIDBObjectStorePut$LWS({
7989
7777
  return distortionEntry$LWS;
7990
7778
  };
7991
7779
  }
7992
- function initDistortionMathMLElementOnsecuritypolicyviolation$LWS({
7993
- globalObject: {
7994
- MathMLElement: {
7995
- prototype: MathMLElementProto$LWS
7996
- },
7997
- MathMLElement: MathMLElement$LWS
7998
- }
7999
- }) {
8000
- return createEventDistortionFactory$LWS(MathMLElementProto$LWS, MathMLElement$LWS, 'securitypolicyviolation');
8001
- }
8002
7780
  function initDistortionMessagePortPostMessage$LWS({
8003
7781
  globalObject: {
8004
7782
  DOMException: DOMException$LWS,
@@ -8090,7 +7868,7 @@ function initDistortionNavigatorSendBeacon$LWS({
8090
7868
  }) {
8091
7869
  const distortionEntry$LWS = [originalSendBeacon$LWS, function sendBeacon$LWS(...args$LWS) {
8092
7870
  if (args$LWS.length) {
8093
- const parsedURL$LWS = parseURL$LWS(toSafeStringValue$LWS(args$LWS[0]));
7871
+ const parsedURL$LWS = parseURL$LWS(toString$LWS(args$LWS[0]));
8094
7872
  if (!isValidURL$LWS(parsedURL$LWS)) {
8095
7873
  throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
8096
7874
  }
@@ -8611,7 +8389,7 @@ const {
8611
8389
  isSharedElement: isSharedElement$5$LWS
8612
8390
  } = rootValidator$LWS;
8613
8391
  function createRangeProtoMethodDistortionFactoryInitializer$LWS(methodName$LWS) {
8614
- return function initDistortionRangeProtoMethod$LWS({
8392
+ return function initDistortionContentWindowGetter$LWS({
8615
8393
  globalObject: {
8616
8394
  Range: {
8617
8395
  // @ts-ignore: Prevent index type error.
@@ -8641,7 +8419,7 @@ function createRangeProtoMethodDistortionFactoryInitializer$LWS(methodName$LWS)
8641
8419
  }
8642
8420
  };
8643
8421
  const distortionEntry$LWS = [originalMethod$LWS, distortion$LWS];
8644
- return function distortionRangeProtoMethod$LWS() {
8422
+ return function distortionContentWindowGetter$LWS() {
8645
8423
  return distortionEntry$LWS;
8646
8424
  };
8647
8425
  };
@@ -8835,33 +8613,6 @@ function initDistortionShadowRootInnerHTMLSetter$LWS({
8835
8613
  }];
8836
8614
  };
8837
8615
  }
8838
- function initDistortionShadowRootSetHTMLUnsafe$LWS({
8839
- document: document$LWS,
8840
- globalObject: {
8841
- ShadowRoot: {
8842
- prototype: {
8843
- setHTMLUnsafe: originalSetHTMLUnsafe$LWS
8844
- }
8845
- }
8846
- }
8847
- }) {
8848
- // istanbul ignore if: currently unreachable via tests
8849
- if (typeof originalSetHTMLUnsafe$LWS !== 'function') {
8850
- return noop$LWS$1;
8851
- }
8852
- return function distortionShadowRootSetHTMLUnsafe$LWS({
8853
- key: key$LWS
8854
- }) {
8855
- return [originalSetHTMLUnsafe$LWS, function setHTMLUnsafe$LWS(value$LWS) {
8856
- // This must be called to signal to the virtual
8857
- // CustomElementRegistry that the next thing created
8858
- // MAY CONTAIN a custom element, which must be marked for
8859
- // association to this sandbox.
8860
- setCustomElementsRegistry$LWS(document$LWS, key$LWS);
8861
- ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, ContentType$LWS.HTML)]);
8862
- }];
8863
- };
8864
- }
8865
8616
  function SharedWorker$LWS(scriptURL$LWS) {
8866
8617
  throw new LockerSecurityError$LWS(`Cannot create SharedWorker with ${toSafeTemplateStringValue$LWS(scriptURL$LWS)}.`);
8867
8618
  }
@@ -9073,7 +8824,7 @@ class PatchedStorage$LWS {
9073
8824
  storage: storage$LWS
9074
8825
  } = getStorageMetaOrThrowInvalidInvocation$LWS(this);
9075
8826
  if (args$LWS.length) {
9076
- args$LWS[0] = prependStorageNamespaceMarker$LWS(toSafeStringValue$LWS(args$LWS[0]), namespace$LWS);
8827
+ args$LWS[0] = prependStorageNamespaceMarker$LWS(toString$LWS(args$LWS[0]), namespace$LWS);
9077
8828
  }
9078
8829
  return ReflectApply$LWS$1(StorageProtoGetItem$LWS, storage$LWS, args$LWS);
9079
8830
  }
@@ -9083,8 +8834,8 @@ class PatchedStorage$LWS {
9083
8834
  storage: storage$LWS
9084
8835
  } = getStorageMetaOrThrowInvalidInvocation$LWS(this);
9085
8836
  if (args$LWS.length > 1) {
9086
- args$LWS[0] = prependStorageNamespaceMarker$LWS(toSafeStringValue$LWS(args$LWS[0]), namespace$LWS);
9087
- args$LWS[1] = toSafeStringValue$LWS(args$LWS[1]);
8837
+ args$LWS[0] = prependStorageNamespaceMarker$LWS(toString$LWS(args$LWS[0]), namespace$LWS);
8838
+ args$LWS[1] = toString$LWS(args$LWS[1]);
9088
8839
  }
9089
8840
  ReflectApply$LWS$1(StorageProtoSetItem$LWS, storage$LWS, args$LWS);
9090
8841
  }
@@ -9094,7 +8845,7 @@ class PatchedStorage$LWS {
9094
8845
  storage: storage$LWS
9095
8846
  } = getStorageMetaOrThrowInvalidInvocation$LWS(this);
9096
8847
  if (args$LWS.length) {
9097
- args$LWS[0] = prependStorageNamespaceMarker$LWS(toSafeStringValue$LWS(args$LWS[0]), namespace$LWS);
8848
+ args$LWS[0] = prependStorageNamespaceMarker$LWS(toString$LWS(args$LWS[0]), namespace$LWS);
9098
8849
  }
9099
8850
  ReflectApply$LWS$1(StorageProtoRemoveItem$LWS, storage$LWS, args$LWS);
9100
8851
  }
@@ -9144,7 +8895,7 @@ function createDistortionStorageFactoryInitializer$LWS(storageName$LWS) {
9144
8895
  try {
9145
8896
  originalStorageObject$LWS = globalObject$LWS[storageName$LWS];
9146
8897
  // eslint-disable-next-line no-empty
9147
- } catch (_unused3$LWS) {}
8898
+ } catch (_unused2$LWS) {}
9148
8899
  // istanbul ignore if: currently unreachable via tests
9149
8900
  if (!isObject$LWS$1(originalStorageObject$LWS)) {
9150
8901
  return noop$LWS$1;
@@ -9364,16 +9115,6 @@ function initDistortionSVGElementDatasetGetter$LWS({
9364
9115
  return distortionEntry$LWS;
9365
9116
  };
9366
9117
  }
9367
- function initDistortionSVGElementOnsecuritypolicyviolation$LWS({
9368
- globalObject: {
9369
- SVGElement: {
9370
- prototype: SVGElementProto$LWS
9371
- },
9372
- SVGElement: SVGElement$LWS
9373
- }
9374
- }) {
9375
- return createEventDistortionFactory$LWS(SVGElementProto$LWS, SVGElement$LWS, 'securitypolicyviolation');
9376
- }
9377
9118
  function initDistortionSVGElementStyleGetter$LWS({
9378
9119
  globalObject: {
9379
9120
  SVGElement: SVGElement$LWS
@@ -9533,7 +9274,7 @@ function initDistortionTrustedTypePolicyFactoryCreatePolicy$LWS({
9533
9274
  try {
9534
9275
  // istanbul ignore next: needs default platform behavior test
9535
9276
  return ReflectApply$LWS$1(originalCreatePolicy$LWS, this, args$LWS);
9536
- } catch (_unused4$LWS) {
9277
+ } catch (_unused3$LWS) {
9537
9278
  // istanbul ignore next: this is tested, but currently cannot be tested in the coverage environment
9538
9279
  consoleWarn$LWS(`${createTrustedTypesExceptionMessage$LWS(name$LWS)} Substituting with Lightning Web Security policy.`);
9539
9280
  }
@@ -9604,12 +9345,16 @@ function initDistortionURLCreateObjectURL$LWS({
9604
9345
  ReflectApply$LWS$1(XhrProtoOpen$LWS, xhr$LWS, ['GET', outURL$LWS, false]);
9605
9346
  try {
9606
9347
  ReflectApply$LWS$1(XhrProtoSend$LWS, xhr$LWS, []);
9607
- } catch (_unused5$LWS) {
9348
+ } catch (_unused4$LWS) {
9608
9349
  throw new LockerSecurityError$LWS(`Unable to verify ${toSafeTemplateStringValue$LWS(blobObject$LWS)} is secure.`);
9609
9350
  }
9610
9351
  const responseText$LWS = ReflectApply$LWS$1(XhrProtoResponseTextGetter$LWS, xhr$LWS, []);
9352
+ // W-15987833
9353
+ if (isInherentlyUnsecure$LWS(responseText$LWS)) {
9354
+ throw new LockerSecurityError$LWS(createInsecureBlobErrorMessage$LWS(blobObject$LWS));
9355
+ }
9611
9356
  const sanitized$LWS = sanitizer$LWS.sanitize(responseText$LWS);
9612
- if (!isEqualDomString$LWS(trusted.createHTML(responseText$LWS), trusted.createHTML(sanitized$LWS)) || isInherentlyUnsecure$LWS(responseText$LWS)) {
9357
+ if (!isEqualDomString$LWS(trusted.createHTML(responseText$LWS), trusted.createHTML(sanitized$LWS))) {
9613
9358
  URLRevokeObjectURL$LWS(outURL$LWS);
9614
9359
  throw new LockerSecurityError$LWS(createInsecureBlobErrorMessage$LWS(blobObject$LWS));
9615
9360
  }
@@ -9640,7 +9385,7 @@ function initDistortionWindowFetch$LWS({
9640
9385
  // similar to link element's href.
9641
9386
  parsedURL$LWS = parseURL$LWS(ReflectApply$LWS$1(RequestProtoURLGetter$LWS, url$LWS, []));
9642
9387
  } else {
9643
- parsedURL$LWS = parseURL$LWS(toSafeStringValue$LWS(url$LWS));
9388
+ parsedURL$LWS = parseURL$LWS(toString$LWS(url$LWS));
9644
9389
  url$LWS = parsedURL$LWS.normalizedURL;
9645
9390
  args$LWS[0] = url$LWS;
9646
9391
  }
@@ -10007,7 +9752,7 @@ function initDistortionWindowSetInterval$LWS({
10007
9752
  } = args$LWS;
10008
9753
  if (callback$LWS !== null && callback$LWS !== undefined && typeof callback$LWS !== 'function') {
10009
9754
  // Snapshot callback source to prevent shapeshifting.
10010
- const sourceText$LWS = toSafeStringValue$LWS(callback$LWS);
9755
+ const sourceText$LWS = toString$LWS(callback$LWS);
10011
9756
  // Defer transforming source text asynchronously.
10012
9757
  let transformedSourceText$LWS;
10013
9758
  // Replace callback parameter.
@@ -10042,7 +9787,7 @@ function initDistortionWindowSetTimeout$LWS({
10042
9787
  } = args$LWS;
10043
9788
  if (callback$LWS !== null && callback$LWS !== undefined && typeof callback$LWS !== 'function') {
10044
9789
  // Snapshot callback source to prevent shapeshifting.
10045
- const sourceText$LWS = toSafeStringValue$LWS(callback$LWS);
9790
+ const sourceText$LWS = toString$LWS(callback$LWS);
10046
9791
  // Replace callback parameter.
10047
9792
  args$LWS[0] = () => {
10048
9793
  // Defer transforming source text asynchronously.
@@ -10141,7 +9886,7 @@ function initDistortionXMLHttpRequestOpen$LWS({
10141
9886
  // Let the native method handle missing parameters error or null/undefined URL case.
10142
9887
  const url$LWS = args$LWS.length > 1 ? args$LWS[1] : undefined;
10143
9888
  if (url$LWS !== null && url$LWS !== undefined) {
10144
- const parsedURL$LWS = parseURL$LWS(toSafeStringValue$LWS(url$LWS));
9889
+ const parsedURL$LWS = parseURL$LWS(toString$LWS(url$LWS));
10145
9890
  if (!isValidURL$LWS(parsedURL$LWS)) {
10146
9891
  throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
10147
9892
  }
@@ -10235,7 +9980,7 @@ initDistortionHistoryPushState$LWS, initDistortionHistoryReplaceState$LWS,
10235
9980
  // HTMLElement
10236
9981
  initDistortionHTMLElementDatasetGetter$LWS, initDistortionHTMLElementInnerTextSetter$LWS, initDistortionHTMLElementOuterTextSetter$LWS, initDistortionHTMLElementStyleGetter$LWS,
10237
9982
  // HTMLIFrameElement
10238
- initDistortionIFrameElementContentDocumentGetter$LWS, initDistortionIFrameElementContentWindowGetter$LWS, initDistortionHTMLIFrameElementSandboxGetter$LWS, initDistortionHTMLIFrameElementSandboxSetter$LWS, initDistortionHTMLIFrameElementSrcSetter$LWS,
9983
+ initDistortionIFrameElementContentDocumentGetter$LWS, initDistortionIFrameElementContentWindowGetter$LWS, initDistortionHTMLIFrameElementSrcSetter$LWS,
10239
9984
  // HTMLLinkElement
10240
9985
  initDistortionHTMLLinkElementRelSetter$LWS, initDistortionHTMLLinkElementRelListSetter$LWS,
10241
9986
  // HTMLObjectElement
@@ -10283,8 +10028,6 @@ initDistortionWorkerCtor$LWS, initDistortionWorkerProto$LWS,
10283
10028
  // XHR
10284
10029
  initDistortionXMLHttpRequestOpen$LWS];
10285
10030
  const internalKeyedDistortionFactoryInitializers$LWS = [
10286
- // AbstractRange
10287
- initDistortionAbstractRangeEndContainerGetter$LWS, initDistortionAbstractRangeStartContainerGetter$LWS,
10288
10031
  // Attr
10289
10032
  initDistortionAttrValueSetter$LWS,
10290
10033
  // Aura
@@ -10300,7 +10043,7 @@ initDistortionDocumentCookieGetter$LWS, initDistortionDocumentCookieSetter$LWS,
10300
10043
  // DOMParser
10301
10044
  initDistortionDOMParserParseFromString$LWS,
10302
10045
  // Element
10303
- initDistortionElementAttachShadow$LWS, initDistortionElementInnerHTMLSetter$LWS, initDistortionElementInsertAdjacentHTML$LWS, initDistortionElementOuterHTMLSetter$LWS, initDistortionElementSetAttribute$LWS, initDistortionElementSetAttributeNode$LWS, initDistortionElementSetAttributeNodeNS$LWS, initDistortionElementSetAttributeNS$LWS, initDistortionElementSetHTML$LWS, initDistortionElementSetHTMLUnsafe$LWS, initDistortionElementShadowRootGetter$LWS, initDistortionElementToggleAttribute$LWS,
10046
+ initDistortionElementAttachShadow$LWS, initDistortionElementInnerHTMLSetter$LWS, initDistortionElementInsertAdjacentHTML$LWS, initDistortionElementOuterHTMLSetter$LWS, initDistortionElementSetAttribute$LWS, initDistortionElementSetAttributeNode$LWS, initDistortionElementSetAttributeNodeNS$LWS, initDistortionElementSetAttributeNS$LWS, initDistortionElementSetHTML$LWS, initDistortionElementShadowRootGetter$LWS, initDistortionElementToggleAttribute$LWS,
10304
10047
  // Eval
10305
10048
  initDistortionEval$LWS,
10306
10049
  // Event
@@ -10310,13 +10053,11 @@ initDistortionEventTargetAddEventListener$LWS,
10310
10053
  // HTMLBodyElement
10311
10054
  initDistortionHTMLBodyElementOnrejectionhandled$LWS, initDistortionHTMLBodyElementOnstorage$LWS, initDistortionHTMLBodyElementOnunhandledrejection$LWS,
10312
10055
  // HTMLElement
10313
- initDistortionHTMLElementCtor$LWS, initDistortionHTMLElementOnsecuritypolicyviolation$LWS,
10056
+ initDistortionHTMLElementCtor$LWS,
10314
10057
  // HTMLFrameSetElement
10315
10058
  initDistortionHTMLFrameSetElementOnrejectionhandled$LWS, initDistortionHTMLFrameSetElementOnstorage$LWS, initDistortionHTMLFrameSetElementOnunhandledrejection$LWS,
10316
10059
  // HTMLScriptElement,
10317
10060
  initDistortionHTMLScriptElementSrcSetter$LWS, initDistortionHTMLScriptElementTextSetter$LWS,
10318
- // MathMLElement
10319
- initDistortionMathMLElementOnsecuritypolicyviolation$LWS,
10320
10061
  // NamedNodeMap
10321
10062
  initDistortionNamedNodeMapSetNamedItem$LWS, initDistortionNamedNodeMapSetNamedItemNS$LWS,
10322
10063
  // Node
@@ -10324,7 +10065,7 @@ initDistortionNodeValueSetter$LWS, initDistortionNodeTextContentGetter$LWS, init
10324
10065
  // Range
10325
10066
  initDistortionRangeCreateContextualFragment$LWS,
10326
10067
  // ShadowRoot
10327
- initDistortionShadowRootInnerHTMLSetter$LWS, initDistortionShadowRootSetHTMLUnsafe$LWS,
10068
+ initDistortionShadowRootInnerHTMLSetter$LWS,
10328
10069
  // Storage
10329
10070
  initDistortionLocalStorage$LWS, initDistortionSessionStorage$LWS,
10330
10071
  // SVGAnimationElement
@@ -10332,7 +10073,7 @@ initDistortionSVGAnimateElementAttributeNameAttribute$LWS,
10332
10073
  // SVGScriptElement
10333
10074
  initDistortionSVGScriptElementHrefGetter$LWS, initDistortionSVGScriptElementHrefSetter$LWS,
10334
10075
  // SVGSetElement
10335
- initDistortionSVGSetElementAttributeNameAttribute$LWS, initDistortionSVGElementOnsecuritypolicyviolation$LWS,
10076
+ initDistortionSVGSetElementAttributeNameAttribute$LWS,
10336
10077
  // URL
10337
10078
  initDistortionURLCreateObjectURL$LWS,
10338
10079
  // Window
@@ -10349,8 +10090,8 @@ initDistortionElementAfter$LWS, initDistortionElementAppend$LWS, initDistortionE
10349
10090
  initDistortionNodeInsertBefore$LWS]);
10350
10091
  const externalKeyedDistortionFactoryInitializers$LWS = internalKeyedDistortionFactoryInitializers$LWS;
10351
10092
  const distortionFactoryInitializerToggleSwitches$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1([[initDistortionCacheStorageDelete$LWS, 'caches'], [initDistortionCacheStorageHas$LWS, 'caches'], [initDistortionCacheStorageKeys$LWS, 'caches'], [initDistortionCacheStorageMatch$LWS, 'caches'], [initDistortionCacheStorageOpen$LWS, 'caches'], [initDistortionCookieStoreDelete$LWS, 'cookieStore'], [initDistortionCookieStoreGet$LWS, 'cookieStore'], [initDistortionCookieStoreGetAll$LWS, 'cookieStore'], [initDistortionCookieStoreOnChange$LWS, 'cookieStore'], [initDistortionCookieStoreSet$LWS, 'cookieStore'], [initDistortionCSSStyleRuleStyleGetter$LWS, 'style'], [initDistortionCustomElementRegistryDefine$LWS, 'customElements'], [initDistortionCustomElementRegistryGet$LWS, 'customElements'], [initDistortionCustomElementRegistryUpgrade$LWS, 'customElements'], [initDistortionCustomElementRegistryWhenDefined$LWS, 'customElements'], [initDistortionDocumentCookieGetter$LWS, 'documentCookie'], [initDistortionDocumentCookieSetter$LWS, 'documentCookie'], [initDistortionDocumentDomainSetter$LWS, 'documentDomain'], [initDistortionDocumentExecCommand$LWS, 'documentExecCommand'], [initDistortionDOMParserParseFromString$LWS, 'domParserParseFromString'], [initDistortionElementAfter$LWS, 'element'], [initDistortionElementAppend$LWS, 'element'], [initDistortionElementAttributesGetter$LWS, 'attributes'], [initDistortionElementBefore$LWS, 'element'], [initDistortionElementGetInnerHTML$LWS, 'innerHTML'], [initDistortionElementInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionElementInsertAdjacentElement$LWS, 'element'], [initDistortionElementInsertAdjacentHTML$LWS, 'element'], [initDistortionElementOuterHTMLSetter$LWS, 'element'], [initDistortionElementPrepend$LWS, 'element'], [initDistortionElementRemove$LWS, 'element'], [initDistortionElementReplaceChildren$LWS, 'element'], [initDistortionElementReplaceWith$LWS, 'element'], [initDistortionElementSetAttribute$LWS, 'attributes'], [initDistortionElementSetAttributeNode$LWS, 'attributes'], [initDistortionElementSetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementSetAttributeNS$LWS, 'attributes'], [initDistortionElementSetHTML$LWS, 'element'], [initDistortionElementToggleAttribute$LWS, 'attributes'], [initDistortionHistoryPushState$LWS, 'history'], [initDistortionHistoryReplaceState$LWS, 'history'], [initDistortionHTMLElementDatasetGetter$LWS, 'dataset'], [initDistortionHTMLElementStyleGetter$LWS, 'style'], [initDistortionHTMLScriptElementSrcGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcSetter$LWS, 'script'], [initDistortionHTMLScriptElementTextSetter$LWS, 'script'], [initDistortionIDBObjectStoreAdd$LWS, 'indexedDB'], [initDistortionIDBObjectStorePut$LWS, 'indexedDB'], [initDistortionLocalStorage$LWS, 'storage'], [initDistortionMessagePortPostMessage$LWS, 'postMessage'], [initDistortionNamedNodeMapSetNamedItem$LWS, 'attributes'], [initDistortionNamedNodeMapSetNamedItemNS$LWS, 'attributes'], [initDistortionNavigatorSendBeacon$LWS, 'navigatorSendBeacon'], [initDistortionNodeInsertBefore$LWS, 'node'], [initDistortionNodeRemoveChild$LWS, 'node'], [initDistortionNodeReplaceChild$LWS, 'node'], [initDistortionNodeTextContentGetter$LWS, 'node'], [initDistortionNodeTextContentSetter$LWS, 'node'], [initDistortionNodeValueSetter$LWS, 'node'], [initDistortionNotificationCtor$LWS, 'notification'], [initDistortionPerformanceMark$LWS, 'performance'], [initDistortionPerformanceMarkCtor$LWS, 'performance'], [initDistortionPerformanceMeasure$LWS, 'performance'], [initDistortionRangeCreateContextualFragment$LWS, 'range'], [initDistortionRangeDeleteContents$LWS, 'range'], [initDistortionRangeExtractContents$LWS, 'range'], [initDistortionRangeInsertNode$LWS, 'range'], [initDistortionRangeSelectNode$LWS, 'range'], [initDistortionRangeSelectNodeContents$LWS, 'range'], [initDistortionRangeSetEnd$LWS, 'range'], [initDistortionRangeSetEndAfter$LWS, 'range'], [initDistortionRangeSetEndBefore$LWS, 'range'], [initDistortionRangeSetStart$LWS, 'range'], [initDistortionRangeSetStartAfter$LWS, 'range'], [initDistortionRangeSetStartBefore$LWS, 'range'], [initDistortionRangeSurroundContents$LWS, 'range'], [initDistortionSelectionCollapse$LWS, 'selection'], [initDistortionSelectionExtend$LWS, 'selection'], [initDistortionSelectionSelectAllChildren$LWS, 'selection'], [initDistortionSelectionSetBaseAndExtent$LWS, 'selection'], [initDistortionSelectionSetPosition$LWS, 'selection'], [initDistortionSessionStorage$LWS, 'storage'], [initDistortionShadowRootInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionStorage$LWS, 'storage'], [initDistortionStorageClear$LWS, 'storage'], [initDistortionStorageGetItem$LWS, 'storage'], [initDistortionStorageKey$LWS, 'storage'], [initDistortionStorageLength$LWS, 'storage'], [initDistortionStorageRemoveItem$LWS, 'storage'], [initDistortionStorageSetItem$LWS, 'storage'], [initDistortionSVGElementDatasetGetter$LWS, 'dataset'], [initDistortionSVGElementStyleGetter$LWS, 'style'], [initDistortionSVGScriptElementHrefGetter$LWS, 'script'], [initDistortionSVGScriptElementHrefSetter$LWS, 'script'], [initDistortionWindowFetch$LWS, 'windowFetch'], [initDistortionWindowFramesGetter$LWS, 'windowFrames'], [initDistortionWindowGetComputedStyle$LWS, 'style'], [initDistortionWindowLengthGetter$LWS, 'windowFrames'], [initDistortionWindowPostMessage$LWS, 'postMessage'], [initDistortionWindowSetInterval$LWS, 'setInterval'], [initDistortionWindowSetTimeout$LWS, 'setTimeout'], [initDistortionXMLHttpRequestResponseGetter$LWS, 'xhr'], [initDistortionXMLHttpRequestResponseXMLGetter$LWS, 'xhr']]));
10352
- const DocumentBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', 'requestStorageAccess', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
10353
- const ElementBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
10093
+ const DocumentBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
10094
+ const ElementBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'setHTMLUnsafe', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
10354
10095
  const EventBlockedProperties$LWS = ['originalTarget', 'explicitOriginalTarget'];
10355
10096
  const HTMLElementBlockedAttributes$LWS = ['nonce'];
10356
10097
  const HTMLElementBlockedProperties$LWS = ['nonce', 'onrejectionhandled', 'onunhandledrejection'];
@@ -10367,7 +10108,7 @@ const SVGElementBlockedProperties$LWS = ['nonce'];
10367
10108
  const UIEventBlockedProperties$LWS = ['rangeParent'];
10368
10109
  const WindowBlockedProperties$LWS = ['find', 'requestFileSystem', 'webkitRequestFileSystem'];
10369
10110
  const XSLTProcessorBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
10370
- /*! version: 0.23.6 */
10111
+ /*! version: 0.22.5 */
10371
10112
 
10372
10113
  /*!
10373
10114
  * Copyright (C) 2019 salesforce.com, inc.
@@ -15027,7 +14768,7 @@ class VirtualEnvironment$LWS {
15027
14768
  * problematic, and requires a lot more work to guarantee that objects from both sides
15028
14769
  * can be considered equivalents (without identity discontinuity).
15029
14770
  */
15030
- function getESGlobalKeys$LWS(maxPerfMode$LWS) {
14771
+ function getESGlobalKeys$LWS(remapTypedArrays$LWS = true) {
15031
14772
  const ESGlobalKeys$LWS = [
15032
14773
  // *** 19.1 Value Properties of the Global Object
15033
14774
  'globalThis', 'Infinity', 'NaN', 'undefined',
@@ -15043,7 +14784,8 @@ function getESGlobalKeys$LWS(maxPerfMode$LWS) {
15043
14784
  // 'EvalError', // Reflective
15044
14785
  'FinalizationRegistry',
15045
14786
  // 'Function', // dangerous & Reflective
15046
- 'Map', 'Number',
14787
+ // 'Map', // Remapped
14788
+ 'Number',
15047
14789
  // 'Object', // Reflective
15048
14790
  // Allow blue `Promise` constructor to overwrite the Red one so that promises
15049
14791
  // created by the `Promise` constructor or APIs like `fetch` will work.
@@ -15051,11 +14793,15 @@ function getESGlobalKeys$LWS(maxPerfMode$LWS) {
15051
14793
  // 'Proxy', // Reflective
15052
14794
  // 'RangeError', // Reflective
15053
14795
  // 'ReferenceError', // Reflective
15054
- 'RegExp', 'Set', 'String', 'Symbol',
14796
+ 'RegExp',
14797
+ // 'Set', // Remapped
14798
+ 'String', 'Symbol',
15055
14799
  // 'SyntaxError', // Reflective
15056
14800
  // 'TypeError', // Reflective
15057
14801
  // 'URIError', // Reflective
15058
- 'WeakMap', 'WeakSet', 'WeakRef',
14802
+ // 'WeakMap', // Remapped
14803
+ // 'WeakSet', // Remapped
14804
+ 'WeakRef',
15059
14805
  // *** 18.4 Other Properties of the Global Object
15060
14806
  // 'Atomics', // Remapped
15061
14807
  'JSON', 'Math', 'Reflect',
@@ -15064,22 +14810,16 @@ function getESGlobalKeys$LWS(maxPerfMode$LWS) {
15064
14810
  // *** ECMA-402
15065
14811
  // 'Intl', // Remapped
15066
14812
  ];
15067
- // This set is for maxPerfMode, all of these must be from the same global object
15068
- const maxPerfModeKeys$LWS = {
15069
- intrinsics: ['ArrayBuffer', 'Atomics', 'BigInt64Array', 'BigUint64Array', 'DataView', 'Float32Array', 'Float64Array', 'Int16Array', 'Int32Array', 'Int8Array', 'SharedArrayBuffer', 'Uint16Array', 'Uint32Array', 'Uint8Array', 'Uint8ClampedArray'],
15070
- // Ideally these should come from browser-realm, that's a code reorg improvement for later
15071
- browser: ['Blob', 'crypto', 'Crypto', 'File', 'FileReader', 'SubtleCrypto', 'URL']
15072
- };
15073
- if (maxPerfMode$LWS) {
15074
- ESGlobalKeys$LWS.push(...maxPerfModeKeys$LWS.intrinsics, ...maxPerfModeKeys$LWS.browser);
14813
+ if (remapTypedArrays$LWS === false) {
14814
+ ESGlobalKeys$LWS.push('ArrayBuffer', 'BigInt64Array', 'BigUint64Array', 'DataView', 'Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int32Array', 'SharedArrayBuffer', 'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array');
15075
14815
  }
15076
14816
  return ESGlobalKeys$LWS;
15077
14817
  }
15078
14818
  // These are foundational things that should never be wrapped but are equivalent
15079
14819
  // @TODO: Revisit this list.
15080
14820
  const ReflectiveIntrinsicObjectNames$LWS = ['AggregateError', 'Array', 'Error', 'EvalError', 'Function', 'Object', 'Proxy', 'RangeError', 'ReferenceError', 'SyntaxError', 'TypeError', 'URIError', 'eval', 'globalThis'];
15081
- function getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(maxPerfMode$LWS) {
15082
- const ESGlobalKeys$LWS = getESGlobalKeys$LWS(maxPerfMode$LWS);
14821
+ function getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(remapTypedArrays$LWS = true) {
14822
+ const ESGlobalKeys$LWS = getESGlobalKeys$LWS(remapTypedArrays$LWS);
15083
14823
  return toSafeArray$LWS([...ESGlobalKeys$LWS, ...ReflectiveIntrinsicObjectNames$LWS]);
15084
14824
  }
15085
14825
  function getGlobalObjectOwnKeys$LWS(source$LWS) {
@@ -15092,9 +14832,9 @@ function getGlobalObjectOwnKeys$LWS(source$LWS) {
15092
14832
  }
15093
14833
  return ownKeys$LWS;
15094
14834
  }
15095
- function assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(descs$LWS, source$LWS, maxPerfMode$LWS) {
14835
+ function assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(descs$LWS, source$LWS, includeTypedArrays$LWS) {
15096
14836
  const ownKeys$LWS = getGlobalObjectOwnKeys$LWS(source$LWS);
15097
- const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(maxPerfMode$LWS);
14837
+ const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(includeTypedArrays$LWS);
15098
14838
  for (let i$LWS = 0, {
15099
14839
  length: length$LWS
15100
14840
  } = ownKeys$LWS; i$LWS < length$LWS; i$LWS += 1) {
@@ -15117,11 +14857,11 @@ function assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(descs$LWS,
15117
14857
  }
15118
14858
  return descs$LWS;
15119
14859
  }
15120
- function getFilteredGlobalOwnKeys$LWS(source$LWS, maxPerfMode$LWS) {
14860
+ function getFilteredGlobalOwnKeys$LWS(source$LWS, includeTypedArrays$LWS) {
15121
14861
  const result$LWS = [];
15122
14862
  let resultOffset$LWS = 0;
15123
14863
  const ownKeys$LWS = getGlobalObjectOwnKeys$LWS(source$LWS);
15124
- const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(maxPerfMode$LWS);
14864
+ const ESGlobalsAndReflectiveIntrinsicObjectNames$LWS = getESGlobalsAndReflectiveIntrinsicObjectNames$LWS(includeTypedArrays$LWS);
15125
14865
  for (let i$LWS = 0, {
15126
14866
  length: length$LWS
15127
14867
  } = ownKeys$LWS; i$LWS < length$LWS; i$LWS += 1) {
@@ -15195,8 +14935,18 @@ function getCachedGlobalObjectReferences$LWS(globalObject$LWS) {
15195
14935
  blueDocumentToRecordMap$LWS.set(document$LWS, record$LWS);
15196
14936
  return record$LWS;
15197
14937
  }
15198
- function filterWindowKeys$LWS(keys$LWS) {
14938
+ function filterWindowKeys$LWS(keys$LWS, remapTypedArrays$LWS) {
15199
14939
  const excludedKeys$LWS = new SetCtor$LWS(['document', 'location', 'top', 'window']);
14940
+ // Crypto and typed arrays must be from the same global object
14941
+ if (remapTypedArrays$LWS === false) {
14942
+ excludedKeys$LWS.add('crypto');
14943
+ excludedKeys$LWS.add('Crypto');
14944
+ excludedKeys$LWS.add('SubtleCrypto');
14945
+ excludedKeys$LWS.add('Blob');
14946
+ excludedKeys$LWS.add('File');
14947
+ excludedKeys$LWS.add('FileReader');
14948
+ excludedKeys$LWS.add('URL');
14949
+ }
15200
14950
  const result$LWS = [];
15201
14951
  let resultOffset$LWS = 0;
15202
14952
  for (let i$LWS = 0, {
@@ -15237,7 +14987,7 @@ function filterWindowKeys$LWS(keys$LWS) {
15237
14987
  * that will be installed (via the membrane) as global descriptors in
15238
14988
  * the red realm.
15239
14989
  */
15240
- function removeWindowDescriptors$LWS(unsafeDescs$LWS) {
14990
+ function removeWindowDescriptors$LWS(unsafeDescs$LWS, remapTypedArrays$LWS) {
15241
14991
  // Remove unforgeable descriptors that cannot be installed.
15242
14992
  ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'document');
15243
14993
  ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'location');
@@ -15245,6 +14995,16 @@ function removeWindowDescriptors$LWS(unsafeDescs$LWS) {
15245
14995
  ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'window');
15246
14996
  // Remove other browser specific unforgeables.
15247
14997
  ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'chrome');
14998
+ // Crypto and typed arrays must be from the same global object
14999
+ if (remapTypedArrays$LWS === false) {
15000
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'crypto');
15001
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'Crypto');
15002
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'SubtleCrypto');
15003
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'Blob');
15004
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'File');
15005
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'FileReader');
15006
+ ReflectDeleteProperty$LWS(unsafeDescs$LWS, 'URL');
15007
+ }
15248
15008
  return unsafeDescs$LWS;
15249
15009
  }
15250
15010
  /**
@@ -15285,7 +15045,7 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
15285
15045
  instrumentation: instrumentation$LWS,
15286
15046
  keepAlive: keepAlive$LWS = true,
15287
15047
  liveTargetCallback: liveTargetCallback$LWS,
15288
- maxPerfMode: maxPerfMode$LWS = false,
15048
+ remapTypedArrays: remapTypedArrays$LWS = true,
15289
15049
  signSourceCallback: signSourceCallback$LWS
15290
15050
  // eslint-disable-next-line prefer-object-spread
15291
15051
  } = ObjectAssign$LWS({
@@ -15294,7 +15054,7 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
15294
15054
  const iframe$LWS = createDetachableIframe$LWS(blueRefs$LWS.document);
15295
15055
  const redWindow$LWS = ReflectApply$LWS(HTMLIFrameElementProtoContentWindowGetter$LWS, iframe$LWS, []);
15296
15056
  const shouldUseDefaultGlobalOwnKeys$LWS = typeof globalObjectShape$LWS !== 'object' || globalObjectShape$LWS === null;
15297
- const defaultGlobalOwnKeys$LWS = filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(redWindow$LWS, maxPerfMode$LWS));
15057
+ const defaultGlobalOwnKeys$LWS = filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(redWindow$LWS, remapTypedArrays$LWS), remapTypedArrays$LWS);
15298
15058
  let blueConnector$LWS = blueCreateHooksCallbackCache$LWS.get(blueRefs$LWS.document);
15299
15059
  if (blueConnector$LWS === undefined) {
15300
15060
  blueConnector$LWS = createBlueConnector$LWS(globalObject$LWS);
@@ -15335,7 +15095,7 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
15335
15095
  // window.__proto__.__proto__.__proto__ (aka EventTarget.prototype)
15336
15096
  env$LWS.link('__proto__', '__proto__', '__proto__');
15337
15097
  env$LWS.remapProto(blueRefs$LWS.document, blueRefs$LWS.DocumentProto);
15338
- env$LWS.lazyRemapProperties(blueRefs$LWS.window, shouldUseDefaultGlobalOwnKeys$LWS ? defaultGlobalOwnKeys$LWS : filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(globalObjectShape$LWS, maxPerfMode$LWS)),
15098
+ env$LWS.lazyRemapProperties(blueRefs$LWS.window, shouldUseDefaultGlobalOwnKeys$LWS ? defaultGlobalOwnKeys$LWS : filterWindowKeys$LWS(getFilteredGlobalOwnKeys$LWS(globalObjectShape$LWS), remapTypedArrays$LWS),
15339
15099
  // Chromium based browsers have a bug that nulls the result of `window`
15340
15100
  // getters in detached iframes when the property descriptor of `window.window`
15341
15101
  // is retrieved.
@@ -15343,8 +15103,8 @@ function createIframeVirtualEnvironment$LWS(globalObject$LWS, providedOptions$LW
15343
15103
  keepAlive$LWS ? undefined : unforgeablePoisonedWindowKeys$LWS);
15344
15104
  if (endowments$LWS) {
15345
15105
  const filteredEndowments$LWS = {};
15346
- assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(filteredEndowments$LWS, endowments$LWS, maxPerfMode$LWS);
15347
- removeWindowDescriptors$LWS(filteredEndowments$LWS);
15106
+ assignFilteredGlobalDescriptorsFromPropertyDescriptorMap$LWS(filteredEndowments$LWS, endowments$LWS, remapTypedArrays$LWS);
15107
+ removeWindowDescriptors$LWS(filteredEndowments$LWS, remapTypedArrays$LWS);
15348
15108
  env$LWS.remapProperties(blueRefs$LWS.window, filteredEndowments$LWS);
15349
15109
  }
15350
15110
  // We intentionally skip remapping Window.prototype because there is nothing
@@ -15631,7 +15391,7 @@ function createEvalHelpersFactoryArgs$LWS(record$LWS) {
15631
15391
  // DOM per url per sandbox.
15632
15392
  // istanbul ignore next: currently unreachable via tests, platformResourceLoader testing is exclusively done in AMD format mode
15633
15393
  function loadScript$LWS(_thisArg$LWS, url$LWS) {
15634
- const urlResolved$LWS = resolveURL$LWS(toSafeStringValue$LWS(url$LWS));
15394
+ const urlResolved$LWS = resolveURL$LWS(toString$LWS(url$LWS));
15635
15395
  const scripts$LWS = ReflectApply$LWS$1(ElementProtoQuerySelectorAll$LWS, head$LWS, ['script']);
15636
15396
  for (let i$LWS = 0, {
15637
15397
  length: length$LWS
@@ -15671,7 +15431,7 @@ function createEvalHelpersFactoryArgs$LWS(record$LWS) {
15671
15431
  // per url for all the sandboxes.
15672
15432
  // istanbul ignore next: currently unreachable via tests, platformResourceLoader testing is exclusively done in AMD format mode
15673
15433
  function loadStyle$LWS(_thisArg$LWS, url$LWS) {
15674
- const urlResolved$LWS = resolveURL$LWS(toSafeStringValue$LWS(url$LWS));
15434
+ const urlResolved$LWS = resolveURL$LWS(toString$LWS(url$LWS));
15675
15435
  let link$LWS = ReflectApply$LWS$1(ElementProtoQuerySelector$LWS, head$LWS, [`link[href=${enquote$LWS(urlResolved$LWS)}]`]);
15676
15436
  if (link$LWS) {
15677
15437
  var _resourceStatusCache$2$LWS;
@@ -15694,7 +15454,7 @@ function createEvalHelpersFactoryArgs$LWS(record$LWS) {
15694
15454
  }];
15695
15455
  }
15696
15456
  function toSourceText$LWS(value$LWS, sourceType$LWS) {
15697
- let sourceText$LWS = typeof value$LWS === 'function' ? extractFunctionBodySource$LWS(value$LWS) : toSafeStringValue$LWS(value$LWS);
15457
+ let sourceText$LWS = typeof value$LWS === 'function' ? extractFunctionBodySource$LWS(value$LWS) : toString$LWS(value$LWS);
15698
15458
  // We workaround bundlers, like Rollup, aggressively stripping inline source
15699
15459
  // maps by compiling them with the name "sandboxMappingURL". At runtime the
15700
15460
  // name is changed so the inline source map is registered.
@@ -15703,7 +15463,7 @@ function toSourceText$LWS(value$LWS, sourceType$LWS) {
15703
15463
  // tools from mistaking the regexp or the replacement string for an
15704
15464
  // actual source mapping URL.
15705
15465
  /\/\/# sandbox(?=MappingURL=.*?\s*$)/, '//# source']);
15706
- sourceText$LWS = `\n//# LWS Version = "0.23.6"\n${sourceText$LWS}`;
15466
+ sourceText$LWS = `\n//# LWS Version = "0.22.5"\n${sourceText$LWS}`;
15707
15467
  return sourceType$LWS === 1 /* SourceType.Module */ && indexOfPragma$LWS(sourceText$LWS, 'use strict') === -1 ?
15708
15468
  // Append "'use strict'" to the extracted function body so it is
15709
15469
  // evaluated in strict mode.
@@ -15796,9 +15556,13 @@ function createVirtualEnvironment$LWS(record$LWS) {
15796
15556
  },
15797
15557
  type: type$LWS
15798
15558
  } = record$LWS;
15799
- const maxPerfMode$LWS = isGaterEnabledFeature$LWS(ENABLE_MAX_PERF_MODE_GATE$LWS) ||
15800
- // 'devopsimpkg*' or exact 'omnistudio' will override INTO maxPerfMode
15801
- isAllowedToOverrideGaterEnabledFeature$LWS(key$LWS, ENABLE_MAX_PERF_MODE_GATE$LWS);
15559
+ // only Omnistudio test namespaces 'devopsimpkg*' or exact 'omnistudio' name
15560
+ let remapTypedArrays$LWS = true;
15561
+ if (key$LWS === 'omnistudio') {
15562
+ remapTypedArrays$LWS = false;
15563
+ } else if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, key$LWS, ['devopsimpkg'])) {
15564
+ remapTypedArrays$LWS = false;
15565
+ }
15802
15566
  return createIframeVirtualEnvironment$LWS(globalObject$LWS, {
15803
15567
  defaultPolicy: {
15804
15568
  createScript:
@@ -15888,10 +15652,10 @@ function createVirtualEnvironment$LWS(record$LWS) {
15888
15652
  // accessible from inside the sandbox.
15889
15653
  ObjectAssign$LWS$1({}, DEFAULT_ENDOWMENTS_DESCRIPTOR_MAP$LWS, ObjectGetOwnPropertyDescriptors$LWS(endowments$LWS)) : DEFAULT_ENDOWMENTS_DESCRIPTOR_MAP$LWS,
15890
15654
  instrumentation: instrumentation$LWS,
15891
- maxPerfMode: maxPerfMode$LWS,
15655
+ remapTypedArrays: remapTypedArrays$LWS,
15892
15656
  keepAlive:
15893
15657
  // istanbul ignore next: cannot test isLockerFeatureEnabled
15894
- maxPerfMode$LWS && isLockerFeatureEnabled$LWS('isLockerNextForOmnistudioEnabled') || IFRAME_KEEP_ALIVE_FLAG$LWS,
15658
+ !remapTypedArrays$LWS && isLockerFeatureEnabled$LWS('isLockerNextForOmnistudioEnabled') || IFRAME_KEEP_ALIVE_FLAG$LWS,
15895
15659
  liveTargetCallback: isTargetLive$LWS,
15896
15660
  signSourceCallback: sourceText$LWS => trusted.createScript(sourceText$LWS)
15897
15661
  });
@@ -15917,7 +15681,6 @@ function createRootWindowSandboxRecord$LWS({
15917
15681
  if (record$LWS) {
15918
15682
  return record$LWS;
15919
15683
  }
15920
- // istanbul ignore next: instrumentation is not tested
15921
15684
  const LOCKER_INSTRUMENTATION_FLAG$LWS =
15922
15685
  // In the future we can preface the LOCKER_INSTRUMENTATION_FLAG
15923
15686
  // definition with a LOCKER_UNMINIFIED_FLAG check to have instrumentation
@@ -16224,30 +15987,24 @@ function internalEvaluateInSandbox$LWS(evaluateOptions$LWS) {
16224
15987
  }
16225
15988
  let result$LWS;
16226
15989
  const sourceText$LWS = toSourceText$LWS(source$LWS, sourceType$LWS);
16227
- // istanbul ignore next: instrumentation is not tested
16228
15990
  const activity$LWS = LOCKER_INSTRUMENTATION_FLAG$LWS ? instrumentation$LWS == null ? void 0 : instrumentation$LWS.startActivity('lws.evaluate') : undefined;
16229
15991
  try {
16230
15992
  // Protecting against errors during evaluation can guarantee the state
16231
15993
  // of the EvalContext to avoid leaking context values
16232
15994
  result$LWS = virtualEnvironmentEvaluator$LWS(sourceText$LWS);
16233
- // istanbul ignore next: instrumentation is not tested
16234
15995
  instrumentation$LWS == null || instrumentation$LWS.incrementCounter == null || instrumentation$LWS.incrementCounter('lws.evaluate', 1, false);
16235
15996
  } catch (error) {
16236
- // istanbul ignore next: instrumentation is not tested
16237
15997
  instrumentation$LWS == null || instrumentation$LWS.incrementCounter == null || instrumentation$LWS.incrementCounter('lws.evaluate', 1, true);
16238
- // istanbul ignore next: instrumentation is not tested
16239
15998
  activity$LWS == null || activity$LWS.error({
16240
15999
  sandboxKey: key$LWS,
16241
16000
  error
16242
16001
  });
16243
- // istanbul ignore next: instrumentation is not tested
16244
16002
  activity$LWS == null || activity$LWS.stop();
16245
16003
  throw error;
16246
16004
  } finally {
16247
16005
  clearEvalContext$LWS();
16248
16006
  clearEvalHelpers$LWS();
16249
16007
  }
16250
- // istanbul ignore next: instrumentation is not tested
16251
16008
  activity$LWS == null || activity$LWS.stop();
16252
16009
  return result$LWS;
16253
16010
  }
@@ -16390,7 +16147,7 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
16390
16147
  depRegistry$LWS.set(dep$LWS, secureDep$LWS);
16391
16148
  return secureDep$LWS;
16392
16149
  }
16393
- /*! version: 0.23.6 */
16150
+ /*! version: 0.22.5 */
16394
16151
 
16395
16152
  const loaderDefine = globalThis.LWR.define;
16396
16153