@oat-sa/tao-core-ui 1.63.1 → 1.64.0

package/dist/resource/tree.js

@@ -1,4 +1,4 @@
-define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider', 'handlebars', 'i18n', 'lib/dompurify/purify'], function ($$1, _, component, selectable, hider, Handlebars, __, DOMPurify) { 'use strict';
+define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider', 'handlebars', 'lib/handlebars/helpers'], function ($$1, _, component, selectable, hider, Handlebars, Helpers0) { 'use strict';
 
     $$1 = $$1 && Object.prototype.hasOwnProperty.call($$1, 'default') ? $$1['default'] : $$1;
     _ = _ && Object.prototype.hasOwnProperty.call(_, 'default') ? _['default'] : _;
@@ -6,114 +6,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
     selectable = selectable && Object.prototype.hasOwnProperty.call(selectable, 'default') ? selectable['default'] : selectable;
     hider = hider && Object.prototype.hasOwnProperty.call(hider, 'default') ? hider['default'] : hider;
     Handlebars = Handlebars && Object.prototype.hasOwnProperty.call(Handlebars, 'default') ? Handlebars['default'] : Handlebars;
-    __ = __ && Object.prototype.hasOwnProperty.call(__, 'default') ? __['default'] : __;
-    DOMPurify = DOMPurify && Object.prototype.hasOwnProperty.call(DOMPurify, 'default') ? DOMPurify['default'] : DOMPurify;
-
-    /**
-     * This program is free software; you can redistribute it and/or
-     * modify it under the terms of the GNU General Public License
-     * as published by the Free Software Foundation; under version 2
-     * of the License (non-upgradable).
-     *
-     * This program is distributed in the hope that it will be useful,
-     * but WITHOUT ANY WARRANTY; without even the implied warranty of
-     * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-     * GNU General Public License for more details.
-     *
-     * You should have received a copy of the GNU General Public License
-     * along with this program; if not, write to the Free Software
-     * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-     *
-     * Copyright (c) 2013-2019 (original work) Open Assessment Technologies SA (under the project TAO-PRODUCT);
-     *
-     *
-     */
-    function Helpers0 (hb) {
-      //register a i18n helper
-      hb.registerHelper('__', function (key) {
-        return __(key);
-      });
-
-      /**
-       * Register dompurify helper
-       *
-       * https://github.com/cure53/DOMPurify
-       * with config SAFE_FOR_TEMPLATES: true
-       * to make output safe for template systems
-       */
-      hb.registerHelper('dompurify', function (context) {
-        return DOMPurify.sanitize(context);
-      });
-
-      /**
-       * Register join helper
-       *
-       * Example :
-       * var values = {a:v1, b:v2, c:v3};
-       * Using {{{join attributes '=' ' ' '"'}}} will return : a="v1" b="v2" c="v3"
-       * Using {{{join values null ' or ' '*'}}} will return : *v1* or *v2* or *v3*
-       */
-      hb.registerHelper('join', function (arr, keyValueGlue, fragmentGlue, wrapper) {
-        var fragments = [];
-        keyValueGlue = typeof keyValueGlue === 'string' ? keyValueGlue : undefined;
-        fragmentGlue = typeof fragmentGlue === 'string' ? fragmentGlue : ' ';
-        wrapper = typeof wrapper === 'string' ? wrapper : '"';
-        _.forIn(arr, function (value, key) {
-          var fragment = '';
-          if (value !== null || value !== undefined) {
-            if (typeof value === 'boolean') {
-              value = value ? 'true' : 'false';
-            } else if (typeof value === 'object') {
-              value = _.values(value).join(' ');
-            }
-          } else {
-            value = '';
-          }
-          if (keyValueGlue !== undefined) {
-            fragment += key + keyValueGlue;
-          }
-          fragment += wrapper + value + wrapper;
-          fragments.push(fragment);
-        });
-        return fragments.join(fragmentGlue);
-      });
-
-      //register a classic "for loop" helper
-      //it also adds a local variable "i" as the index in each iteration loop
-      hb.registerHelper('for', function (startIndex, stopIndex, increment, options) {
-        var ret = '';
-        startIndex = parseInt(startIndex);
-        stopIndex = parseInt(stopIndex);
-        increment = parseInt(increment);
-        for (var i = startIndex; i < stopIndex; i += increment) {
-          ret += options.fn(_.extend({}, this, {
-            i: i
-          }));
-        }
-        return ret;
-      });
-      hb.registerHelper('equal', function (var1, var2, options) {
-        if (var1 == var2) {
-          return options.fn(this);
-        } else {
-          return options.inverse(this);
-        }
-      });
-
-      // register a "get property" helper
-      // it gets the named property from the provided context
-      hb.registerHelper('property', function (name, context) {
-        return context[name] || '';
-      });
-
-      // register an 'includes' helper
-      // it checks if value is in array
-      hb.registerHelper('includes', function (haystack, needle, options) {
-        if (_.contains(haystack, needle)) {
-          return options.fn(this);
-        }
-      });
-    }
+    Helpers0 = Helpers0 && Object.prototype.hasOwnProperty.call(Helpers0, 'default') ? Helpers0['default'] : Helpers0;
 
     if (!Helpers0.__initialized) {
       Helpers0(Handlebars);
@@ -261,7 +154,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
       return (asString || true) ? html : $(html);
     }
 
-    /*! @license DOMPurify 2.4.0 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.0/LICENSE */
+    /*! @license DOMPurify 2.4.1 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.1/LICENSE */
 
     function _typeof(obj) {
       "@babel/helpers - typeof";
@@ -366,6 +259,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
     var arrayPop = unapply(Array.prototype.pop);
     var arrayPush = unapply(Array.prototype.push);
     var stringToLowerCase = unapply(String.prototype.toLowerCase);
+    var stringToString = unapply(String.prototype.toString);
     var stringMatch = unapply(String.prototype.match);
     var stringReplace = unapply(String.prototype.replace);
     var stringIndexOf = unapply(String.prototype.indexOf);
@@ -472,6 +366,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
     var MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
 
     var ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
+    var TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
     var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
 
     var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
@@ -536,7 +431,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
        * if DOMPurify is up to date or not
        */
 
-      DOMPurify.version = '2.4.0';
+      DOMPurify.version = '2.4.1';
       /**
        * Array of elements that DOMPurify removed during sanitation.
        * Empty if nothing was removed.
@@ -598,6 +493,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
       DOMPurify.isSupported = typeof getParentNode === 'function' && implementation && typeof implementation.createHTMLDocument !== 'undefined' && documentMode !== 9;
       var MUSTACHE_EXPR$1 = MUSTACHE_EXPR,
         ERB_EXPR$1 = ERB_EXPR,
+        TMPLIT_EXPR$1 = TMPLIT_EXPR,
         DATA_ATTR$1 = DATA_ATTR,
         ARIA_ATTR$1 = ARIA_ATTR,
         IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA,
@@ -737,6 +633,10 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
 
       var NAMESPACE = HTML_NAMESPACE;
       var IS_EMPTY_INPUT = false;
+      /* Allowed XHTML+XML namespaces */
+
+      var ALLOWED_NAMESPACES = null;
+      var DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
       /* Parsing of strict XHTML documents */
 
       var PARSER_MEDIA_TYPE;
@@ -777,13 +677,12 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
         // eslint-disable-next-line unicorn/prefer-includes
         SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
 
-        transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? function (x) {
-          return x;
-        } : stringToLowerCase;
+        transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
         /* Set configuration parameters */
 
         ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
         ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
+        ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
         URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES),
         // eslint-disable-line indent
         cfg.ADD_URI_SAFE_ATTR,
@@ -947,19 +846,22 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
 
         if (!parent || !parent.tagName) {
           parent = {
-            namespaceURI: HTML_NAMESPACE,
+            namespaceURI: NAMESPACE,
             tagName: 'template'
           };
         }
         var tagName = stringToLowerCase(element.tagName);
         var parentTagName = stringToLowerCase(parent.tagName);
+        if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
+          return false;
+        }
         if (element.namespaceURI === SVG_NAMESPACE) {
           // The only way to switch from HTML namespace to SVG
           // is via <svg>. If it happens via any other tag, then
           // it should be killed.
           if (parent.namespaceURI === HTML_NAMESPACE) {
             return tagName === 'svg';
-          } // The only way to switch from MathML to SVG is via
+          } // The only way to switch from MathML to SVG is via`
           // svg if parent is either <annotation-xml> or MathML
           // text integration points.
 
@@ -999,9 +901,14 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
           // or SVG and should never appear in HTML namespace
 
           return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
+        } // For XHTML and XML documents that support custom namespaces
+
+        if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
+          return true;
         } // The code should never reach this place (this means
         // that the element somehow got namespace that is not
-        // HTML, SVG or MathML). Return false just in case.
+        // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
+        // Return false just in case.
 
         return false;
       };
@@ -1077,7 +984,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
           var matches = stringMatch(dirty, /^[\r\n\t ]+/);
           leadingWhitespace = matches && matches[0];
         }
-        if (PARSER_MEDIA_TYPE === 'application/xhtml+xml') {
+        if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
           // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
           dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
         }
@@ -1132,7 +1039,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
        */
 
       var _isClobbered = function _isClobbered(elm) {
-        return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function');
+        return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
       };
       /**
        * _isNode
@@ -1250,6 +1157,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
           content = currentNode.textContent;
           content = stringReplace(content, MUSTACHE_EXPR$1, ' ');
           content = stringReplace(content, ERB_EXPR$1, ' ');
+          content = stringReplace(content, TMPLIT_EXPR$1, ' ');
           if (currentNode.textContent !== content) {
             arrayPush(DOMPurify.removed, {
               element: currentNode.cloneNode()
@@ -1383,6 +1291,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
           if (SAFE_FOR_TEMPLATES) {
             value = stringReplace(value, MUSTACHE_EXPR$1, ' ');
             value = stringReplace(value, ERB_EXPR$1, ' ');
+            value = stringReplace(value, TMPLIT_EXPR$1, ' ');
           }
           /* Is `value` valid for this attribute? */
 
@@ -1635,6 +1544,7 @@ define(['jquery', 'lodash', 'ui/component', 'ui/resource/selectable', 'ui/hider'
         if (SAFE_FOR_TEMPLATES) {
           serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR$1, ' ');
           serializedHTML = stringReplace(serializedHTML, ERB_EXPR$1, ' ');
+          serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR$1, ' ');
         }
         return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
       };