@oscarpalmer/toretto 0.29.0 → 0.30.1

package/dist/attribute/index.js

@@ -1,4 +1,16 @@
 import { getAttribute, getAttributes } from "./get.js";
-import { booleanAttributes, isBadAttribute, isBooleanAttribute, isEmptyNonBooleanAttribute, isInvalidBooleanAttribute } from "../internal/attribute.js";
+import { booleanAttributes, isBadAttribute as isBadAttribute$1, isBooleanAttribute as isBooleanAttribute$1, isEmptyNonBooleanAttribute as isEmptyNonBooleanAttribute$1, isInvalidBooleanAttribute as isInvalidBooleanAttribute$1 } from "../internal/attribute.js";
 import { setAttribute, setAttributes, setProperties, setProperty } from "./set.js";
+function isBadAttribute(first, second) {
+	return isBadAttribute$1(first, second, true);
+}
+function isBooleanAttribute(first) {
+	return isBooleanAttribute$1(first, true);
+}
+function isEmptyNonBooleanAttribute(first, second) {
+	return isEmptyNonBooleanAttribute$1(first, second, true);
+}
+function isInvalidBooleanAttribute(first, second) {
+	return isInvalidBooleanAttribute$1(first, second, true);
+}
 export { booleanAttributes, getAttribute, getAttributes, isBadAttribute, isBooleanAttribute, isEmptyNonBooleanAttribute, isInvalidBooleanAttribute, setAttribute, setAttributes, setProperties, setProperty };

package/dist/{html.js → html/index.js}

@@ -1,15 +1,15 @@
-import { sanitizeNodes } from "./internal/sanitize.js";
+import { sanitizeNodes } from "./sanitize.js";
 import { isPlainObject } from "@oscarpalmer/atoms/is";
 function createHtml(value) {
 	const html$1 = getParser().parseFromString(typeof value === "string" ? value : value.innerHTML, HTML_PARSE_TYPE);
 	html$1.body.normalize();
-	sanitizeNodes([html$1.body]);
+	sanitizeNodes([html$1.body], 0);
 	return html$1.body.innerHTML;
 }
 function createTemplate(value, options) {
 	const template = document.createElement(TEMPLATE_TAG);
 	template.innerHTML = createHtml(value);
-	if (typeof value === "string" && !options.ignoreCache) templates[value] = template;
+	if (typeof value === "string" && options.cache) templates[value] = template;
 	return template;
 }
 function getNodes(value, options) {
@@ -19,7 +19,7 @@ function getNodes(value, options) {
 }
 function getOptions(input) {
 	const options = isPlainObject(input) ? input : {};
-	options.ignoreCache = typeof options.ignoreCache === "boolean" ? options.ignoreCache : false;
+	options.cache = typeof options.cache === "boolean" ? options.cache : true;
 	return options;
 }
 function getParser() {
@@ -53,7 +53,7 @@ html.remove = (template) => {
 	templates = updated;
 };
 function sanitize(value) {
-	return sanitizeNodes(Array.isArray(value) ? value : [value]);
+	return sanitizeNodes(Array.isArray(value) ? value : [value], 0);
 }
 var EXPRESSION_ID = /^[a-z][\w-]*$/i;
 var HTML_PARSE_TYPE = "text/html";

package/dist/html/sanitize.js

@@ -0,0 +1,40 @@
+import { isBadAttribute, isEmptyNonBooleanAttribute, isInvalidBooleanAttribute } from "../internal/attribute.js";
+function handleElement(element, depth) {
+	if (isClobbered(element)) {
+		element.remove();
+		return true;
+	}
+	if (depth === 0) {
+		const scripts = element.querySelectorAll("script");
+		for (const script of scripts) script.remove();
+	}
+	sanitizeAttributes(element, [...element.attributes]);
+	return false;
+}
+function isClobbered(element) {
+	return element instanceof HTMLFormElement && (typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function");
+}
+function sanitizeAttributes(element, attributes) {
+	const { length } = attributes;
+	for (let index = 0; index < length; index += 1) {
+		const { name, value } = attributes[index];
+		if (isBadAttribute(name, value, false) || isEmptyNonBooleanAttribute(name, value, false)) element.removeAttribute(name);
+		else if (isInvalidBooleanAttribute(name, value, false)) element.setAttribute(name, "");
+	}
+}
+function sanitizeNodes(nodes, depth) {
+	const actual = nodes.filter((node) => node instanceof Node);
+	let { length } = nodes;
+	for (let index = 0; index < length; index += 1) {
+		const node = actual[index];
+		if (node instanceof Element && handleElement(node, depth)) {
+			actual.splice(index, 1);
+			length -= 1;
+			index -= 1;
+			continue;
+		}
+		if (node.hasChildNodes()) sanitizeNodes([...node.childNodes], depth + 1);
+	}
+	return nodes;
+}
+export { sanitizeAttributes, sanitizeNodes };

package/dist/index.js

@@ -1,15 +1,12 @@
 import { isEventTarget, isHTMLOrSVGElement } from "./internal/is.js";
-import { getAttribute, getAttributes } from "./attribute/get.js";
-import { booleanAttributes, isBadAttribute, isBooleanAttribute, isEmptyNonBooleanAttribute, isInvalidBooleanAttribute } from "./internal/attribute.js";
-import { setAttribute, setAttributes, setProperties, setProperty } from "./attribute/set.js";
-import "./attribute/index.js";
+import { isBadAttribute, isBooleanAttribute, isEmptyNonBooleanAttribute, isInvalidBooleanAttribute } from "./attribute/index.js";
 import { isChildNode, isInDocument } from "./is.js";
 import { getData, setData } from "./data.js";
 import { dispatch, getPosition, off, on } from "./event/index.js";
 import { findAncestor, findRelatives } from "./find/relative.js";
 import { $ as findElement, $$ as findElements, getElementUnderPointer } from "./find/index.js";
 import { getFocusable, getTabbable, isFocusable, isTabbable } from "./focusable.js";
-import { html, sanitize } from "./html.js";
+import { html, sanitize } from "./html/index.js";
 import touch_default from "./touch.js";
 import { getStyle, getStyles, getTextDirection, setStyle, setStyles, toggleStyles } from "./style.js";
-export { findElement as $, findElement, findElements as $$, findElements, booleanAttributes, dispatch, findAncestor, findRelatives, getAttribute, getAttributes, getData, getElementUnderPointer, getFocusable, getPosition, getStyle, getStyles, getTabbable, getTextDirection, html, isBadAttribute, isBooleanAttribute, isChildNode, isEmptyNonBooleanAttribute, isEventTarget, isFocusable, isHTMLOrSVGElement, isInDocument, isInvalidBooleanAttribute, isTabbable, off, on, sanitize, setAttribute, setAttributes, setData, setProperties, setProperty, setStyle, setStyles, touch_default as supportsTouch, toggleStyles };
+export { findElement as $, findElement, findElements as $$, findElements, dispatch, findAncestor, findRelatives, getData, getElementUnderPointer, getFocusable, getPosition, getStyle, getStyles, getTabbable, getTextDirection, html, isBadAttribute, isBooleanAttribute, isChildNode, isEmptyNonBooleanAttribute, isEventTarget, isFocusable, isHTMLOrSVGElement, isInDocument, isInvalidBooleanAttribute, isTabbable, off, on, sanitize, setData, setStyle, setStyles, touch_default as supportsTouch, toggleStyles };

package/dist/internal/attribute.js

@@ -1,40 +1,59 @@
 import { isHTMLOrSVGElement } from "./is.js";
 import { getString } from "@oscarpalmer/atoms/string";
 import { isPlainObject } from "@oscarpalmer/atoms/is";
+function badAttributeHandler(name, value) {
+	if (name == null || value == null) return true;
+	if (EXPRESSION_CLOBBERED_NAME.test(name) && (value in document || value in formElement) || EXPRESSION_EVENT_NAME.test(name)) return true;
+	if (EXPRESSION_SKIP_NAME.test(name) || EXPRESSION_URI_VALUE.test(value) || isValidSourceAttribute(name, value)) return false;
+	return EXPRESSION_DATA_OR_SCRIPT.test(value);
+}
+function booleanAttributeHandler(name, value) {
+	if (name == null || value == null) return true;
+	if (!booleanAttributesSet.has(name)) return false;
+	const normalized = value.toLowerCase().trim();
+	return !(normalized.length === 0 || normalized === name);
+}
+function decodeAttribute(value) {
+	textArea ??= document.createElement("textarea");
+	textArea.innerHTML = value;
+	return decodeURIComponent(textArea.value);
+}
+function handleAttribute(callback, decode, first, second) {
+	let name;
+	let value;
+	if (isAttribute(first)) {
+		name = first.name;
+		value = String(first.value);
+	} else if (typeof first === "string" && typeof second === "string") {
+		name = first;
+		value = second;
+	}
+	if (decode && value != null) value = decodeAttribute(value);
+	return callback(name, value?.replace(EXPRESSION_WHITESPACE, ""));
+}
 function isAttribute(value) {
 	return value instanceof Attr || isPlainObject(value) && typeof value.name === "string" && typeof value.value === "string";
 }
-function isBadAttribute(first, second) {
-	return isValidAttribute((attribute) => attribute == null || EXPRESSION_ON_PREFIX.test(attribute.name) || EXPRESSION_SOURCE_PREFIX.test(attribute.name) && EXPRESSION_VALUE_PREFIX.test(String(attribute.value)), first, second);
+function isBadAttribute(first, second, decode) {
+	return handleAttribute(badAttributeHandler, decode, first, second);
 }
-function isBooleanAttribute(value) {
-	return isValidAttribute((attribute) => attribute != null && booleanAttributes.includes(attribute.name.toLowerCase()), value, "");
+function isBooleanAttribute(first, decode) {
+	return handleAttribute((name) => booleanAttributesSet.has(name?.toLowerCase()), decode, first, "");
 }
-function isEmptyNonBooleanAttribute(first, second) {
-	return isValidAttribute((attribute) => attribute != null && !booleanAttributes.includes(attribute.name) && String(attribute.value).trim().length === 0, first, second);
+function isEmptyNonBooleanAttribute(first, second, decode) {
+	return handleAttribute((name, value) => name != null && value != null && !booleanAttributesSet.has(name) && value.trim().length === 0, decode, first, second);
 }
-function isInvalidBooleanAttribute(first, second) {
-	return isValidAttribute((attribute) => {
-		if (attribute == null) return true;
-		if (!booleanAttributes.includes(attribute.name)) return false;
-		const normalized = String(attribute.value).toLowerCase().trim();
-		return !(normalized.length === 0 || normalized === attribute.name);
-	}, first, second);
+function isInvalidBooleanAttribute(first, second, decode) {
+	return handleAttribute(booleanAttributeHandler, decode, first, second);
 }
 function isProperty(value) {
 	return isPlainObject(value) && typeof value.name === "string";
 }
-function isValidAttribute(callback, first, second) {
-	let attribute;
-	if (isAttribute(first)) attribute = first;
-	else if (typeof first === "string" && typeof second === "string") attribute = {
-		name: first,
-		value: second
-	};
-	return callback(attribute);
+function isValidSourceAttribute(name, value) {
+	return EXPRESSION_SOURCE_NAME.test(name) && EXPRESSION_SOURCE_VALUE.test(value);
 }
 function updateAttribute(element, name, value) {
-	const isBoolean = booleanAttributes.includes(name.toLowerCase());
+	const isBoolean = booleanAttributesSet.has(name.toLowerCase());
 	if (isBoolean) updateProperty(element, name, value);
 	if (isBoolean ? value !== true : value == null) element.removeAttribute(name);
 	else element.setAttribute(name, isBoolean ? "" : getString(value));
@@ -59,9 +78,14 @@ function updateValues(element, values) {
 		else updateAttribute(element, entry[0], entry[1]);
 	}
 }
-var EXPRESSION_ON_PREFIX = /^on/i;
-var EXPRESSION_SOURCE_PREFIX = /^(href|src|xlink:href)$/i;
-var EXPRESSION_VALUE_PREFIX = /(data:text\/html|javascript:)/i;
+var EXPRESSION_CLOBBERED_NAME = /^(id|name)$/i;
+var EXPRESSION_DATA_OR_SCRIPT = /^(?:data|\w+script):/i;
+var EXPRESSION_EVENT_NAME = /^on/i;
+var EXPRESSION_SKIP_NAME = /^(aria-[-\w]+|data-[-\w.\u00B7-\uFFFF]+)$/i;
+var EXPRESSION_SOURCE_NAME = /^src$/i;
+var EXPRESSION_SOURCE_VALUE = /^data:/i;
+var EXPRESSION_URI_VALUE = /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.-]+(?:[^a-z+.\-:]|$))/i;
+var EXPRESSION_WHITESPACE = /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g;
 const booleanAttributes = Object.freeze([
 	"async",
 	"autofocus",
@@ -88,4 +112,7 @@ const booleanAttributes = Object.freeze([
 	"reversed",
 	"selected"
 ]);
+var booleanAttributesSet = new Set(booleanAttributes);
+var formElement = document.createElement("form");
+var textArea;
 export { booleanAttributes, isBadAttribute, isBooleanAttribute, isEmptyNonBooleanAttribute, isInvalidBooleanAttribute, isProperty, updateValue, updateValues };