@rankingcoach/vanguard 1.3.1 → 1.4.2

package/dist/index-sanitize-html2.js

@@ -1,672 +0,0 @@
-import { __require as de } from "./index-lib5.js";
-import { __require as ue } from "./index-escape-string-regexp.js";
-import { __require as ge } from "./index-is-plain-object.js";
-import { __require as pe } from "./index-cjs.js";
-import { __require as he } from "./index-parse-srcset.js";
-import { __require as me } from "./index-postcss.js";
-var F, Y;
-function Se() {
-  if (Y) return F;
-  Y = 1;
-  const J = /* @__PURE__ */ de(), D = ue(), { isPlainObject: K } = ge(), B = pe(), Q = he(), { parse: j } = me(), ee = [
-    "img",
-    "audio",
-    "video",
-    "picture",
-    "svg",
-    "object",
-    "map",
-    "iframe",
-    "embed"
-  ], te = ["script", "style"];
-  function v(f, t) {
-    f && Object.keys(f).forEach(function(w) {
-      t(f[w], w);
-    });
-  }
-  function x(f, t) {
-    return {}.hasOwnProperty.call(f, t);
-  }
-  function U(f, t) {
-    const w = [];
-    return v(f, function(l) {
-      t(l) && w.push(l);
-    }), w;
-  }
-  function re(f) {
-    for (const t in f)
-      if (x(f, t))
-        return !1;
-    return !0;
-  }
-  function ne(f) {
-    return f.map(function(t) {
-      if (!t.url)
-        throw new Error("URL missing");
-      return t.url + (t.w ? ` ${t.w}w` : "") + (t.h ? ` ${t.h}h` : "") + (t.d ? ` ${t.d}x` : "");
-    }).join(", ");
-  }
-  F = C;
-  const ie = /^[^\0\t\n\f\r /<=>]+$/;
-  function C(f, t, w) {
-    if (f == null)
-      return "";
-    typeof f == "number" && (f = f.toString());
-    let l = "", m = "";
-    function M(e, n) {
-      const r = this;
-      this.tag = e, this.attribs = n || {}, this.tagPosition = l.length, this.text = "", this.mediaChildren = [], this.updateParentNodeText = function() {
-        if (u.length) {
-          const i = u[u.length - 1];
-          i.text += r.text;
-        }
-      }, this.updateParentNodeMediaChildren = function() {
-        u.length && ee.includes(this.tag) && u[u.length - 1].mediaChildren.push(this.tag);
-      };
-    }
-    t = Object.assign({}, C.defaults, t), t.parser = Object.assign({}, se, t.parser);
-    const H = function(e) {
-      return t.allowedTags === !1 || (t.allowedTags || []).indexOf(e) > -1;
-    };
-    te.forEach(function(e) {
-      H(e) && t.allowVulnerableTags;
-    });
-    const oe = t.nonTextTags || [
-      "script",
-      "style",
-      "textarea",
-      "option"
-    ];
-    let d, S;
-    t.allowedAttributes && (d = {}, S = {}, v(t.allowedAttributes, function(e, n) {
-      d[n] = [];
-      const r = [];
-      e.forEach(function(i) {
-        typeof i == "string" && i.indexOf("*") >= 0 ? r.push(D(i).replace(/\\\*/g, ".*")) : d[n].push(i);
-      }), r.length && (S[n] = new RegExp("^(" + r.join("|") + ")$"));
-    }));
-    const O = {}, P = {}, z = {};
-    v(t.allowedClasses, function(e, n) {
-      if (d && (x(d, n) || (d[n] = []), d[n].push("class")), O[n] = e, Array.isArray(e)) {
-        const r = [];
-        O[n] = [], z[n] = [], e.forEach(function(i) {
-          typeof i == "string" && i.indexOf("*") >= 0 ? r.push(D(i).replace(/\\\*/g, ".*")) : i instanceof RegExp ? z[n].push(i) : O[n].push(i);
-        }), r.length && (P[n] = new RegExp("^(" + r.join("|") + ")$"));
-      }
-    });
-    const I = {};
-    let N;
-    v(t.transformTags, function(e, n) {
-      let r;
-      typeof e == "function" ? r = e : typeof e == "string" && (r = C.simpleTransform(e)), n === "*" ? N = r : I[n] = r;
-    });
-    let p, u, A, R, T, q, _ = !1;
-    G();
-    const L = new J.Parser({
-      onopentag: function(e, n) {
-        if (t.enforceHtmlBoundary && e === "html" && G(), T) {
-          q++;
-          return;
-        }
-        const r = new M(e, n);
-        u.push(r);
-        let i = !1;
-        const h = !!r.text;
-        let g;
-        if (x(I, e) && (g = I[e](e, n), r.attribs = n = g.attribs, g.text !== void 0 && (r.innerText = g.text), e !== g.tagName && (r.name = e = g.tagName, R[p] = g.tagName)), N && (g = N(e, n), r.attribs = n = g.attribs, e !== g.tagName && (r.name = e = g.tagName, R[p] = g.tagName)), (!H(e) || t.disallowedTagsMode === "recursiveEscape" && !re(A) || t.nestingLimit != null && p >= t.nestingLimit) && (i = !0, A[p] = !0, t.disallowedTagsMode === "discard" && oe.indexOf(e) !== -1 && (T = !0, q = 1), A[p] = !0), p++, i) {
-          if (t.disallowedTagsMode === "discard")
-            return;
-          m = l, l = "";
-        }
-        l += "<" + e, e === "script" && (t.allowedScriptHostnames || t.allowedScriptDomains) && (r.innerText = ""), (!d || x(d, e) || d["*"]) && v(n, function(c, a) {
-          if (!ie.test(a)) {
-            delete r.attribs[a];
-            return;
-          }
-          if (c === "" && (t.nonBooleanAttributes.includes(a) || t.nonBooleanAttributes.includes("*"))) {
-            delete r.attribs[a];
-            return;
-          }
-          let $ = !1;
-          if (!d || x(d, e) && d[e].indexOf(a) !== -1 || d["*"] && d["*"].indexOf(a) !== -1 || x(S, e) && S[e].test(a) || S["*"] && S["*"].test(a))
-            $ = !0;
-          else if (d && d[e]) {
-            for (const s of d[e])
-              if (K(s) && s.name && s.name === a) {
-                $ = !0;
-                let o = "";
-                if (s.multiple === !0) {
-                  const k = c.split(" ");
-                  for (const y of k)
-                    s.values.indexOf(y) !== -1 && (o === "" ? o = y : o += " " + y);
-                } else s.values.indexOf(c) >= 0 && (o = c);
-                c = o;
-              }
-          }
-          if ($) {
-            if (t.allowedSchemesAppliedToAttributes.indexOf(a) !== -1 && W(e, c)) {
-              delete r.attribs[a];
-              return;
-            }
-            if (e === "script" && a === "src") {
-              let s = !0;
-              try {
-                const o = V(c);
-                if (t.allowedScriptHostnames || t.allowedScriptDomains) {
-                  const k = (t.allowedScriptHostnames || []).find(function(b) {
-                    return b === o.url.hostname;
-                  }), y = (t.allowedScriptDomains || []).find(function(b) {
-                    return o.url.hostname === b || o.url.hostname.endsWith(`.${b}`);
-                  });
-                  s = k || y;
-                }
-              } catch {
-                s = !1;
-              }
-              if (!s) {
-                delete r.attribs[a];
-                return;
-              }
-            }
-            if (e === "iframe" && a === "src") {
-              let s = !0;
-              try {
-                const o = V(c);
-                if (o.isRelativeUrl)
-                  s = x(t, "allowIframeRelativeUrls") ? t.allowIframeRelativeUrls : !t.allowedIframeHostnames && !t.allowedIframeDomains;
-                else if (t.allowedIframeHostnames || t.allowedIframeDomains) {
-                  const k = (t.allowedIframeHostnames || []).find(function(b) {
-                    return b === o.url.hostname;
-                  }), y = (t.allowedIframeDomains || []).find(function(b) {
-                    return o.url.hostname === b || o.url.hostname.endsWith(`.${b}`);
-                  });
-                  s = k || y;
-                }
-              } catch {
-                s = !1;
-              }
-              if (!s) {
-                delete r.attribs[a];
-                return;
-              }
-            }
-            if (a === "srcset")
-              try {
-                let s = Q(c);
-                if (s.forEach(function(o) {
-                  W("srcset", o.url) && (o.evil = !0);
-                }), s = U(s, function(o) {
-                  return !o.evil;
-                }), s.length)
-                  c = ne(U(s, function(o) {
-                    return !o.evil;
-                  })), r.attribs[a] = c;
-                else {
-                  delete r.attribs[a];
-                  return;
-                }
-              } catch {
-                delete r.attribs[a];
-                return;
-              }
-            if (a === "class") {
-              const s = O[e], o = O["*"], k = P[e], y = z[e], b = P["*"], X = [
-                k,
-                b
-              ].concat(y).filter(function(fe) {
-                return fe;
-              });
-              if (s && o ? c = Z(c, B(s, o), X) : c = Z(c, s || o, X), !c.length) {
-                delete r.attribs[a];
-                return;
-              }
-            }
-            if (a === "style") {
-              if (t.parseStyleAttributes)
-                try {
-                  const s = j(e + " {" + c + "}"), o = le(s, t.allowedStyles);
-                  if (c = ae(o), c.length === 0) {
-                    delete r.attribs[a];
-                    return;
-                  }
-                } catch {
-                  delete r.attribs[a];
-                  return;
-                }
-              else if (t.allowedStyles)
-                throw new Error("allowedStyles option cannot be used together with parseStyleAttributes: false.");
-            }
-            l += " " + a, c && c.length && (l += '="' + E(c, !0) + '"');
-          } else
-            delete r.attribs[a];
-        }), t.selfClosing.indexOf(e) !== -1 ? l += " />" : (l += ">", r.innerText && !h && !t.textFilter && (l += E(r.innerText), _ = !0)), i && (l = m + E(l), m = "");
-      },
-      ontext: function(e) {
-        if (T)
-          return;
-        const n = u[u.length - 1];
-        let r;
-        if (n && (r = n.tag, e = n.innerText !== void 0 ? n.innerText : e), t.disallowedTagsMode === "discard" && (r === "script" || r === "style"))
-          l += e;
-        else {
-          const i = E(e, !1);
-          t.textFilter && !_ ? l += t.textFilter(i, r) : _ || (l += i);
-        }
-        if (u.length) {
-          const i = u[u.length - 1];
-          i.text += e;
-        }
-      },
-      onclosetag: function(e, n) {
-        if (T)
-          if (q--, !q)
-            T = !1;
-          else
-            return;
-        const r = u.pop();
-        if (!r)
-          return;
-        if (r.tag !== e) {
-          u.push(r);
-          return;
-        }
-        T = t.enforceHtmlBoundary ? e === "html" : !1, p--;
-        const i = A[p];
-        if (i) {
-          if (delete A[p], t.disallowedTagsMode === "discard") {
-            r.updateParentNodeText();
-            return;
-          }
-          m = l, l = "";
-        }
-        if (R[p] && (e = R[p], delete R[p]), t.exclusiveFilter && t.exclusiveFilter(r)) {
-          l = l.substr(0, r.tagPosition);
-          return;
-        }
-        if (r.updateParentNodeMediaChildren(), r.updateParentNodeText(), // Already output />
-        t.selfClosing.indexOf(e) !== -1 || // Escaped tag, closing tag is implied
-        n && !H(e) && ["escape", "recursiveEscape"].indexOf(t.disallowedTagsMode) >= 0) {
-          i && (l = m, m = "");
-          return;
-        }
-        l += "</" + e + ">", i && (l = m + E(l), m = ""), _ = !1;
-      }
-    }, t.parser);
-    return L.write(f), L.end(), l;
-    function G() {
-      l = "", p = 0, u = [], A = {}, R = {}, T = !1, q = 0;
-    }
-    function E(e, n) {
-      return typeof e != "string" && (e = e + ""), t.parser.decodeEntities && (e = e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;"), n && (e = e.replace(/"/g, "&quot;"))), e = e.replace(/&(?![a-zA-Z0-9#]{1,20};)/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;"), n && (e = e.replace(/"/g, "&quot;")), e;
-    }
-    function W(e, n) {
-      for (n = n.replace(/[\x00-\x20]+/g, ""); ; ) {
-        const h = n.indexOf("<!--");
-        if (h === -1)
-          break;
-        const g = n.indexOf("-->", h + 4);
-        if (g === -1)
-          break;
-        n = n.substring(0, h) + n.substring(g + 3);
-      }
-      const r = n.match(/^([a-zA-Z][a-zA-Z0-9.\-+]*):/);
-      if (!r)
-        return n.match(/^[/\\]{2}/) ? !t.allowProtocolRelative : !1;
-      const i = r[1].toLowerCase();
-      return x(t.allowedSchemesByTag, e) ? t.allowedSchemesByTag[e].indexOf(i) === -1 : !t.allowedSchemes || t.allowedSchemes.indexOf(i) === -1;
-    }
-    function V(e) {
-      if (e = e.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, "$1//"), e.startsWith("relative:"))
-        throw new Error("relative: exploit attempt");
-      let n = "relative://relative-site";
-      for (let h = 0; h < 100; h++)
-        n += `/${h}`;
-      const r = new URL(e, n);
-      return {
-        isRelativeUrl: r && r.hostname === "relative-site" && r.protocol === "relative:",
-        url: r
-      };
-    }
-    function le(e, n) {
-      if (!n)
-        return e;
-      const r = e.nodes[0];
-      let i;
-      return n[r.selector] && n["*"] ? i = B(
-        n[r.selector],
-        n["*"]
-      ) : i = n[r.selector] || n["*"], i && (e.nodes[0].nodes = r.nodes.reduce(ce(i), [])), e;
-    }
-    function ae(e) {
-      return e.nodes[0].nodes.reduce(function(n, r) {
-        return n.push(
-          `${r.prop}:${r.value}${r.important ? " !important" : ""}`
-        ), n;
-      }, []).join(";");
-    }
-    function ce(e) {
-      return function(n, r) {
-        return x(e, r.prop) && e[r.prop].some(function(h) {
-          return h.test(r.value);
-        }) && n.push(r), n;
-      };
-    }
-    function Z(e, n, r) {
-      return n ? (e = e.split(/\s+/), e.filter(function(i) {
-        return n.indexOf(i) !== -1 || r.some(function(h) {
-          return h.test(i);
-        });
-      }).join(" ")) : e;
-    }
-  }
-  const se = {
-    decodeEntities: !0
-  };
-  return C.defaults = {
-    allowedTags: [
-      // Sections derived from MDN element categories and limited to the more
-      // benign categories.
-      // https://developer.mozilla.org/en-US/docs/Web/HTML/Element
-      // Content sectioning
-      "address",
-      "article",
-      "aside",
-      "footer",
-      "header",
-      "h1",
-      "h2",
-      "h3",
-      "h4",
-      "h5",
-      "h6",
-      "hgroup",
-      "main",
-      "nav",
-      "section",
-      // Text content
-      "blockquote",
-      "dd",
-      "div",
-      "dl",
-      "dt",
-      "figcaption",
-      "figure",
-      "hr",
-      "li",
-      "main",
-      "ol",
-      "p",
-      "pre",
-      "ul",
-      // Inline text semantics
-      "a",
-      "abbr",
-      "b",
-      "bdi",
-      "bdo",
-      "br",
-      "cite",
-      "code",
-      "data",
-      "dfn",
-      "em",
-      "i",
-      "kbd",
-      "mark",
-      "q",
-      "rb",
-      "rp",
-      "rt",
-      "rtc",
-      "ruby",
-      "s",
-      "samp",
-      "small",
-      "span",
-      "strong",
-      "sub",
-      "sup",
-      "time",
-      "u",
-      "var",
-      "wbr",
-      // Table content
-      "caption",
-      "col",
-      "colgroup",
-      "table",
-      "tbody",
-      "td",
-      "tfoot",
-      "th",
-      "thead",
-      "tr"
-    ],
-    // Tags that cannot be boolean
-    nonBooleanAttributes: [
-      "abbr",
-      "accept",
-      "accept-charset",
-      "accesskey",
-      "action",
-      "allow",
-      "alt",
-      "as",
-      "autocapitalize",
-      "autocomplete",
-      "blocking",
-      "charset",
-      "cite",
-      "class",
-      "color",
-      "cols",
-      "colspan",
-      "content",
-      "contenteditable",
-      "coords",
-      "crossorigin",
-      "data",
-      "datetime",
-      "decoding",
-      "dir",
-      "dirname",
-      "download",
-      "draggable",
-      "enctype",
-      "enterkeyhint",
-      "fetchpriority",
-      "for",
-      "form",
-      "formaction",
-      "formenctype",
-      "formmethod",
-      "formtarget",
-      "headers",
-      "height",
-      "hidden",
-      "high",
-      "href",
-      "hreflang",
-      "http-equiv",
-      "id",
-      "imagesizes",
-      "imagesrcset",
-      "inputmode",
-      "integrity",
-      "is",
-      "itemid",
-      "itemprop",
-      "itemref",
-      "itemtype",
-      "kind",
-      "label",
-      "lang",
-      "list",
-      "loading",
-      "low",
-      "max",
-      "maxlength",
-      "media",
-      "method",
-      "min",
-      "minlength",
-      "name",
-      "nonce",
-      "optimum",
-      "pattern",
-      "ping",
-      "placeholder",
-      "popover",
-      "popovertarget",
-      "popovertargetaction",
-      "poster",
-      "preload",
-      "referrerpolicy",
-      "rel",
-      "rows",
-      "rowspan",
-      "sandbox",
-      "scope",
-      "shape",
-      "size",
-      "sizes",
-      "slot",
-      "span",
-      "spellcheck",
-      "src",
-      "srcdoc",
-      "srclang",
-      "srcset",
-      "start",
-      "step",
-      "style",
-      "tabindex",
-      "target",
-      "title",
-      "translate",
-      "type",
-      "usemap",
-      "value",
-      "width",
-      "wrap",
-      // Event handlers
-      "onauxclick",
-      "onafterprint",
-      "onbeforematch",
-      "onbeforeprint",
-      "onbeforeunload",
-      "onbeforetoggle",
-      "onblur",
-      "oncancel",
-      "oncanplay",
-      "oncanplaythrough",
-      "onchange",
-      "onclick",
-      "onclose",
-      "oncontextlost",
-      "oncontextmenu",
-      "oncontextrestored",
-      "oncopy",
-      "oncuechange",
-      "oncut",
-      "ondblclick",
-      "ondrag",
-      "ondragend",
-      "ondragenter",
-      "ondragleave",
-      "ondragover",
-      "ondragstart",
-      "ondrop",
-      "ondurationchange",
-      "onemptied",
-      "onended",
-      "onerror",
-      "onfocus",
-      "onformdata",
-      "onhashchange",
-      "oninput",
-      "oninvalid",
-      "onkeydown",
-      "onkeypress",
-      "onkeyup",
-      "onlanguagechange",
-      "onload",
-      "onloadeddata",
-      "onloadedmetadata",
-      "onloadstart",
-      "onmessage",
-      "onmessageerror",
-      "onmousedown",
-      "onmouseenter",
-      "onmouseleave",
-      "onmousemove",
-      "onmouseout",
-      "onmouseover",
-      "onmouseup",
-      "onoffline",
-      "ononline",
-      "onpagehide",
-      "onpageshow",
-      "onpaste",
-      "onpause",
-      "onplay",
-      "onplaying",
-      "onpopstate",
-      "onprogress",
-      "onratechange",
-      "onreset",
-      "onresize",
-      "onrejectionhandled",
-      "onscroll",
-      "onscrollend",
-      "onsecuritypolicyviolation",
-      "onseeked",
-      "onseeking",
-      "onselect",
-      "onslotchange",
-      "onstalled",
-      "onstorage",
-      "onsubmit",
-      "onsuspend",
-      "ontimeupdate",
-      "ontoggle",
-      "onunhandledrejection",
-      "onunload",
-      "onvolumechange",
-      "onwaiting",
-      "onwheel"
-    ],
-    disallowedTagsMode: "discard",
-    allowedAttributes: {
-      a: ["href", "name", "target"],
-      // We don't currently allow img itself by default, but
-      // these attributes would make sense if we did.
-      img: ["src", "srcset", "alt", "title", "width", "height", "loading"]
-    },
-    // Lots of these won't come up by default because we don't allow them
-    selfClosing: ["img", "br", "hr", "area", "base", "basefont", "input", "link", "meta"],
-    // URL schemes we permit
-    allowedSchemes: ["http", "https", "ftp", "mailto", "tel"],
-    allowedSchemesByTag: {},
-    allowedSchemesAppliedToAttributes: ["href", "src", "cite"],
-    allowProtocolRelative: !0,
-    enforceHtmlBoundary: !1,
-    parseStyleAttributes: !0
-  }, C.simpleTransform = function(f, t, w) {
-    return w = w === void 0 ? !0 : w, t = t || {}, function(l, m) {
-      let M;
-      if (w)
-        for (M in t)
-          m[M] = t[M];
-      else
-        m = t;
-      return {
-        tagName: f,
-        attribs: m
-      };
-    };
-  }, F;
-}
-export {
-  Se as __require
-};