@mulmoclaude/core 4.5.0 → 4.7.0

package/dist/plugin-vue/index.cjs

@@ -138,7 +138,7 @@ IconGlyph.props = {
 };
 //#endregion
 //#region ../../node_modules/dompurify/dist/purify.es.mjs
-/*! @license DOMPurify 3.4.13 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.13/LICENSE */
+/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */
 function _arrayLikeToArray(r, a) {
 	(null == a || a > r.length) && (a = r.length);
 	for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
@@ -297,9 +297,11 @@ function clone(object) {
 		var _ref3 = _slicedToArray(_ref2, 2);
 		const property = _ref3[0];
 		const value = _ref3[1];
-		if (objectHasOwnProperty(object, property)) if (arrayIsArray(value)) newObject[property] = cleanArray(value);
-		else if (value && typeof value === "object" && value.constructor === Object) newObject[property] = clone(value);
-		else newObject[property] = value;
+		if (objectHasOwnProperty(object, property)) {
+			if (arrayIsArray(value)) newObject[property] = cleanArray(value);
+			else if (value && typeof value === "object" && value.constructor === Object) newObject[property] = clone(value);
+			else newObject[property] = value;
+		}
 	}
 	return newObject;
 }
@@ -867,6 +869,7 @@ var svg = freeze([
 	"patterncontentunits",
 	"patterntransform",
 	"patternunits",
+	"pointer-events",
 	"points",
 	"preservealpha",
 	"preserveaspectratio",
@@ -921,6 +924,7 @@ var svg = freeze([
 	"u2",
 	"unicode",
 	"values",
+	"vector-effect",
 	"viewbox",
 	"visibility",
 	"version",
@@ -1034,6 +1038,24 @@ var NODE_TYPE = {
 	documentFragment: 11,
 	notation: 12
 };
+var LITERAL_TEXT_ELEMENT_NAMES = [
+	"style",
+	"script",
+	"xmp",
+	"iframe",
+	"noembed",
+	"noframes",
+	"plaintext",
+	"noscript"
+];
+var LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, LITERAL_TEXT_ELEMENT_NAMES));
+var LITERAL_TEXT_CLOSE = function() {
+	const map = {};
+	arrayForEach(LITERAL_TEXT_ELEMENT_NAMES, (name) => {
+		map[name] = seal(new RegExp("</" + name + "(?=[\\t\\n\\f\\r />])", "i"));
+	});
+	return freeze(map);
+}();
 var getGlobal = function getGlobal() {
 	return typeof window === "undefined" ? null : window;
 };
@@ -1093,10 +1115,25 @@ var _createHooksMap = function _createHooksMap() {
 var _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options) {
 	return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback;
 };
+/**
+* Resolve an object-valued configuration option: a prototype-free clone
+* of cfg[key] when it is an own, truthy object property, else a fresh
+* fallback built by makeFallback (fresh on every parse, so a previous
+* parse can never leak state into the next one).
+*
+* @param cfg the cloned, prototype-free configuration object
+* @param key the configuration property to read
+* @param makeFallback builds the fallback value when the option is absent
+* @returns the resolved object
+*/
+var _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallback) {
+	const value = objectHasOwnProperty(cfg, key) ? cfg[key] : void 0;
+	return value && typeof value === "object" ? clone(value) : makeFallback();
+};
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.13";
+	DOMPurify.version = "3.4.14";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -1121,6 +1158,12 @@ function createDOMPurify() {
 	const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeType") : null;
 	const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeName") : null;
 	const getOwnerDocument = Node && Node.prototype ? lookupGetter(Node.prototype, "ownerDocument") : null;
+	const _readNodeType = function _readNodeType(node) {
+		return getNodeType ? getNodeType(node) : node.nodeType;
+	};
+	const _readNodeName = function _readNodeName(node) {
+		return getNodeName ? getNodeName(node) : node.nodeName;
+	};
 	if (typeof HTMLTemplateElement === "function") {
 		const template = document.createElement("template");
 		if (template.content && template.content.ownerDocument) document = template.content.ownerDocument;
@@ -1378,9 +1421,9 @@ function createDOMPurify() {
 		IN_PLACE = cfg.IN_PLACE || false;
 		IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI;
 		NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE;
-		MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
-		HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
-		const customElementHandling = objectHasOwnProperty(cfg, "CUSTOM_ELEMENT_HANDLING") && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === "object" ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
+		MATHML_TEXT_INTEGRATION_POINTS = _resolveObjectOption(cfg, "MATHML_TEXT_INTEGRATION_POINTS", () => addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS));
+		HTML_INTEGRATION_POINTS = _resolveObjectOption(cfg, "HTML_INTEGRATION_POINTS", () => addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS));
+		const customElementHandling = _resolveObjectOption(cfg, "CUSTOM_ELEMENT_HANDLING", () => create(null));
 		CUSTOM_ELEMENT_HANDLING = create(null);
 		if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck;
 		if (objectHasOwnProperty(customElementHandling, "attributeNameCheck") && isRegexOrFunction(customElementHandling.attributeNameCheck)) CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck;
@@ -1427,11 +1470,6 @@ function createDOMPurify() {
 				addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
 			}
 		}
-		if (objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR)) addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
-		if (objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS)) {
-			if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) FORBID_CONTENTS = clone(FORBID_CONTENTS);
-			addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
-		}
 		if (objectHasOwnProperty(cfg, "ADD_FORBID_CONTENTS") && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) {
 			if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) FORBID_CONTENTS = clone(FORBID_CONTENTS);
 			addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
@@ -1548,6 +1586,32 @@ function createDOMPurify() {
 		}
 	};
 	/**
+	* _stripAttributeNode
+	*
+	* Remove a single Attr node case/namespace-exactly on an attribute-teardown
+	* path. Name-based removeAttribute() ASCII-lowercases its lookup key for an
+	* HTML element in an HTML document and so silently misses a case-preserved
+	* handler (e.g. `ONERROR` off an XML/XHTML import) - the same defect
+	* _removeAttribute() was fixed for, which a name-based call would reintroduce
+	* on these IN_PLACE teardown paths. Unlike _removeAttribute this does not
+	* record into DOMPurify.removed: the neutralize passes intentionally do not
+	* book-keep. A clobbered/detached node falls back to best-effort name-based
+	* removal.
+	*
+	* @param element the element to strip the attribute from
+	* @param attribute the Attr node to remove
+	* @param name the attribute's name, for the fallback path
+	*/
+	const _stripAttributeNode = function _stripAttributeNode(element, attribute, name) {
+		try {
+			element.removeAttributeNode(attribute);
+		} catch (_) {
+			try {
+				element.removeAttribute(name);
+			} catch (_) {}
+		}
+	};
+	/**
 	* _neutralizeRoot
 	*
 	* Fail-closed teardown of an in-place root after the sanitize walk aborts
@@ -1581,36 +1645,53 @@ function createDOMPurify() {
 		if (attributes) for (let i = attributes.length - 1; i >= 0; --i) {
 			const attribute = attributes[i];
 			const name = attribute && attribute.name;
-			if (typeof name === "string") try {
-				root.removeAttribute(name);
-			} catch (_) {}
+			if (typeof name === "string") _stripAttributeNode(root, attribute, name);
 		}
 	};
 	/**
 	* _removeAttribute
 	*
+	* Name-based getAttributeNode()/removeAttribute() ASCII-lowercase their
+	* lookup key for HTML elements in an HTML document, so they silently miss an
+	* attribute whose stored qualified name still contains uppercase ASCII
+	* letters. That happens when the node came from a case-preserving source
+	* (an XML/XHTML document imported via importNode(), or createAttributeNS()),
+	* where e.g. `ONERROR` survives the walk: the policy check lowercases to
+	* `onerror` and rejects it, but `removeAttribute('ONERROR')` looks up
+	* `onerror` and finds nothing. Remove the exact Attr node instead, which is
+	* case- and namespace-exact, and fall back to name-based removal only when
+	* the caller could not supply the node.
+	*
 	* @param name an Attribute name
 	* @param element a DOM node
+	* @param attr the exact Attr node to remove, when the caller has it
 	*/
-	const _removeAttribute = function _removeAttribute(name, element) {
+	const _removeAttribute = function _removeAttribute(name, element, attr) {
+		if (!attr) try {
+			attr = element.getAttributeNode(name);
+		} catch (_) {
+			attr = null;
+		}
+		arrayPush(DOMPurify.removed, {
+			attribute: attr || null,
+			from: element
+		});
 		try {
-			arrayPush(DOMPurify.removed, {
-				attribute: element.getAttributeNode(name),
-				from: element
-			});
+			if (attr) element.removeAttributeNode(attr);
+			else element.removeAttribute(name);
 		} catch (_) {
-			arrayPush(DOMPurify.removed, {
-				attribute: null,
-				from: element
-			});
+			try {
+				element.removeAttribute(name);
+			} catch (_) {}
+		}
+		if (name === "is") {
+			if (RETURN_DOM || RETURN_DOM_FRAGMENT) try {
+				_forceRemove(element);
+			} catch (_) {}
+			else try {
+				element.setAttribute(name, "");
+			} catch (_) {}
 		}
-		element.removeAttribute(name);
-		if (name === "is") if (RETURN_DOM || RETURN_DOM_FRAGMENT) try {
-			_forceRemove(element);
-		} catch (_) {}
-		else try {
-			element.setAttribute(name, "");
-		} catch (_) {}
 	};
 	/**
 	* _stripDisallowedAttributes
@@ -1629,9 +1710,7 @@ function createDOMPurify() {
 			const attribute = attributes[i];
 			const name = attribute && attribute.name;
 			if (typeof name !== "string" || ALLOWED_ATTR[transformCaseFunc(name)]) continue;
-			try {
-				element.removeAttribute(name);
-			} catch (_) {}
+			_stripAttributeNode(element, attribute, name);
 		}
 	};
 	/**
@@ -1660,7 +1739,7 @@ function createDOMPurify() {
 		const stack = [root];
 		while (stack.length > 0) {
 			const node = stack.pop();
-			if ((getNodeType ? getNodeType(node) : node.nodeType) === NODE_TYPE.element) _stripDisallowedAttributes(node);
+			if (_readNodeType(node) === NODE_TYPE.element) _stripDisallowedAttributes(node);
 			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
 		}
@@ -1700,12 +1779,28 @@ function createDOMPurify() {
 	*
 	* @param root the in-place root to sweep
 	*/
+	/**
+	* Central policy for declarative-partial-updates patch-linkage attributes,
+	* shared by the _neutralizePatchLinkage pre-pass and _isValidAttribute so
+	* the two sites cannot drift: `patchsrc` always links, `for` links
+	* everywhere except on <label>/<output>, and the whole policy is gated on
+	* SAFE_FOR_XML (see the rationale block in _isValidAttribute).
+	*
+	* @param lcName the transformCaseFunc'd attribute name
+	* @param lcTag the transformCaseFunc'd tag name of the carrying element
+	* @return true if the attribute is patch linkage and must be dropped
+	*/
+	const _isPatchLinkageAttribute = function _isPatchLinkageAttribute(lcName, lcTag) {
+		if (!SAFE_FOR_XML) return false;
+		if (lcName === "patchsrc") return true;
+		return lcName === "for" && lcTag !== "label" && lcTag !== "output";
+	};
 	const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
 		if (!SAFE_FOR_XML) return;
 		const stack = [root];
 		while (stack.length > 0) {
 			const node = stack.pop();
-			const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+			const nodeType = _readNodeType(node);
 			if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
 				try {
 					remove(node);
@@ -1714,10 +1809,10 @@ function createDOMPurify() {
 			}
 			if (nodeType === NODE_TYPE.element) {
 				const element = node;
-				const lcTag = transformCaseFunc(getNodeName ? getNodeName(node) : node.nodeName);
+				const lcTag = transformCaseFunc(_readNodeName(node));
 				try {
 					if (element.hasAttribute && element.hasAttribute("patchsrc")) element.removeAttribute("patchsrc");
-					if (element.hasAttribute && element.hasAttribute("for") && lcTag !== "label" && lcTag !== "output") element.removeAttribute("for");
+					if (element.hasAttribute && element.hasAttribute("for") && _isPatchLinkageAttribute("for", lcTag)) element.removeAttribute("for");
 				} catch (_) {}
 			}
 			const childNodes = getChildNodes(node);
@@ -1886,12 +1981,32 @@ function createDOMPurify() {
 	*/
 	const _isUnsafeNode = function _isUnsafeNode(currentNode, tagName) {
 		if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) return true;
-		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) return true;
+		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && LITERAL_TEXT_ELEMENTS[tagName] && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(LITERAL_TEXT_CLOSE[tagName], currentNode.textContent))) return true;
 		if (currentNode.nodeType === NODE_TYPE.processingInstruction) return true;
 		if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) return true;
 		return false;
 	};
 	/**
+	* Evaluate a CUSTOM_ELEMENT_HANDLING check (a RegExp or a predicate
+	* function, per the validation in _parseConfig) against a name.
+	* Additional arguments are forwarded to predicate functions - the
+	* attributeNameCheck predicate receives the tag name as its second
+	* argument. A null/absent check never matches.
+	*
+	* @param check the configured tagNameCheck / attributeNameCheck value
+	* @param name the name to test
+	* @param args extra arguments forwarded to a predicate function
+	* @return true if the check matches the name
+	*/
+	const _matchesNameCheck = function _matchesNameCheck(check, name) {
+		if (check instanceof RegExp) return regExpTest(check, name);
+		if (check instanceof Function) {
+			for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) args[_key - 2] = arguments[_key];
+			return Boolean(check(name, ...args));
+		}
+		return false;
+	};
+	/**
 	* Handle a node whose tag is forbidden or not allowlisted: keep
 	* allowed custom elements (false return exits _sanitizeElements
 	* early - the namespace and fallback-tag removal checks are
@@ -1909,10 +2024,7 @@ function createDOMPurify() {
 	* @return true if the node was removed, false if kept
 	*/
 	const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName, root) {
-		if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
-			if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
-			if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
-		}
+		if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
 		if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
 			const parentNode = getParentNode(currentNode);
 			const childNodes = getChildNodes(currentNode);
@@ -1946,6 +2058,42 @@ function createDOMPurify() {
 		return set === defaultSet || set === setConfigSet ? clone(set) : set;
 	};
 	/**
+	* Shared guard for a node that a hook has detached from the walk tree,
+	* used after each element-hook site in _sanitizeElements. Detaching is a
+	* long-standing user pattern (issue #469; draw.io-style foreignObject
+	* filtering). Per the cached, unclobberable parentNode getter the node is
+	* genuinely out of the tree, so it can reach neither the serialized
+	* output nor an IN_PLACE live tree; treat it as removed and stop
+	* processing it. Without this guard, the unsafe-node / namespace checks
+	* would call _forceRemove on a parentless node and hit the REPORT-3
+	* fail-closed throw — which exists for nodes DOMPurify wants gone but
+	* *cannot* detach (clobbered / parentless roots), the opposite of a node
+	* that is already safely gone. The walk root is exempt: a detached
+	* IN_PLACE root is legitimate input and must still be fully sanitized,
+	* and a kill-decision on it must keep hitting the REPORT-3 throw.
+	*
+	* Nodes detached by hooks stay the hook's responsibility for placement:
+	* they are not recorded in DOMPurify.removed, so the post-walk IN_PLACE
+	* pass (which iterates DOMPurify.removed) does not reach them. But a
+	* hook-detached subtree can still hold a queued resource-event handler -
+	* e.g. an <img onload> that began loading when the caller built the live
+	* tree - which fires in page scope after sanitize returns even though the
+	* handler never reached the returned tree. That is the audit-5 F1 hazard,
+	* and the documented node.remove() hook pattern walks straight into it.
+	* So on the IN_PLACE path we neutralize the detached subtree inline,
+	* stripping its non-allow-listed attributes before returning, exactly as
+	* the post-walk pass does for _forceRemove'd subtrees.
+	*
+	* @param currentNode the node a hook may have detached
+	* @param root the current walk root
+	* @return true if the node is detached and now handled, false otherwise
+	*/
+	const _handleHookDetachedNode = function _handleHookDetachedNode(currentNode, root) {
+		if (currentNode === root || getParentNode(currentNode) !== null) return false;
+		if (IN_PLACE) _neutralizeSubtree(currentNode);
+		return true;
+	};
+	/**
 	* _sanitizeElements
 	*
 	* @protect nodeName
@@ -1956,24 +2104,18 @@ function createDOMPurify() {
 	*/
 	const _sanitizeElements = function _sanitizeElements(currentNode, root) {
 		_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
-		if (currentNode !== root && getParentNode(currentNode) === null) {
-			if (IN_PLACE) _neutralizeSubtree(currentNode);
-			return true;
-		}
+		if (_handleHookDetachedNode(currentNode, root)) return true;
 		if (_isClobbered(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
 		}
-		const tagName = transformCaseFunc(getNodeName ? getNodeName(currentNode) : currentNode.nodeName);
+		const tagName = transformCaseFunc(_readNodeName(currentNode));
 		ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS);
 		_executeHooks(hooks.uponSanitizeElement, currentNode, {
 			tagName,
 			allowedTags: ALLOWED_TAGS
 		});
-		if (currentNode !== root && getParentNode(currentNode) === null) {
-			if (IN_PLACE) _neutralizeSubtree(currentNode);
-			return true;
-		}
+		if (_handleHookDetachedNode(currentNode, root)) return true;
 		if (_isUnsafeNode(currentNode, tagName)) {
 			_forceRemove(currentNode);
 			return true;
@@ -1983,7 +2125,7 @@ function createDOMPurify() {
 			if (removed === false) _executeHooks(hooks.afterSanitizeElements, currentNode, null);
 			return removed;
 		}
-		if ((getNodeType ? getNodeType(currentNode) : currentNode.nodeType) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
+		if (_readNodeType(currentNode) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
 		}
@@ -2011,20 +2153,17 @@ function createDOMPurify() {
 	*/
 	const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
 		if (FORBID_ATTR[lcName]) return false;
-		if (SAFE_FOR_XML && lcName === "patchsrc") return false;
-		if (SAFE_FOR_XML && lcName === "for" && lcTag !== "label" && lcTag !== "output") return false;
+		if (_isPatchLinkageAttribute(lcName, lcTag)) return false;
 		if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) return false;
 		const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
-		if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName));
-		else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName));
-		else if (!nameIsPermitted) if (_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value)));
-		else return false;
-		else if (URI_SAFE_ATTRIBUTES[lcName]);
-		else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, "")));
-		else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]);
-		else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, "")));
-		else if (value) return false;
-		return true;
+		if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) return true;
+		if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) return true;
+		if (!nameIsPermitted) return _isBasicCustomElement(lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName, lcTag) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value);
+		if (URI_SAFE_ATTRIBUTES[lcName]) return true;
+		if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) return true;
+		if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) return true;
+		if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) return true;
+		return !value;
 	};
 	const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, [
 		"annotation-xml",
@@ -2126,29 +2265,29 @@ function createDOMPurify() {
 			_executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
 			value = hookEvent.attrValue;
 			if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				value = SANITIZE_NAMED_PROPS_PREFIX + value;
 			}
 			if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			if (lcName === "attributename" && stringMatch(value, "href")) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			if (hookEvent.forceKeepAttr) continue;
 			if (!hookEvent.keepAttr) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			if (SAFE_FOR_TEMPLATES) value = _stripTemplateExpressions(value);
 			if (!_isValidAttribute(lcTag, lcName, value)) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
@@ -2170,7 +2309,7 @@ function createDOMPurify() {
 			_sanitizeElements(shadowNode, fragment);
 			_sanitizeAttributes(shadowNode);
 			if (_isDocumentFragment(shadowNode.content)) _sanitizeShadowDOM2(shadowNode.content);
-			if ((getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType) === NODE_TYPE.element) {
+			if (_readNodeType(shadowNode) === NODE_TYPE.element) {
 				const innerSr = getShadowRoot(shadowNode);
 				if (_isDocumentFragment(innerSr)) {
 					_sanitizeAttachedShadowRoots(innerSr);
@@ -2211,7 +2350,7 @@ function createDOMPurify() {
 				continue;
 			}
 			const node = item.node;
-			const isElement = (getNodeType ? getNodeType(node) : node.nodeType) === NODE_TYPE.element;
+			const isElement = _readNodeType(node) === NODE_TYPE.element;
 			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push({
 				node: childNodes[i],
@@ -2262,7 +2401,7 @@ function createDOMPurify() {
 		const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
 		if (inPlace) {
 			_neutralizePatchLinkage(dirty);
-			const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
+			const nn = _readNodeName(dirty);
 			if (typeof nn === "string") {
 				const tagName = transformCaseFunc(nn);
 				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {