@researchdatabox/redbox-core 0.0.0-bootstrap.0

package/dist/services/DomSanitizerService.d.ts

@@ -0,0 +1,105 @@
+import { Services as coreServices } from '../CoreService';
+export declare namespace Services {
+    /**
+     * SVG and DOM sanitization service using DOMPurify.
+     *
+     * This service provides secure sanitization of SVG and other DOM content using
+     * configurable DOMPurify profiles defined in config/dompurify.js.
+     *
+     * Security Approach & OWASP References:
+     * ======================================
+     * This service implements defense-in-depth sanitization following OWASP recommendations:
+     *
+     * 1. **DOMPurify Library** (OWASP Recommended):
+     *    - Uses DOMPurify, an OWASP-recommended DOM sanitization library
+     *    - Reference: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#html-sanitization
+     *    - DOMPurify GitHub: https://github.com/cure53/DOMPurify
+     *    - Actively maintained with regular security audits
+     *
+     * 2. **Multi-Layer Validation** (Defense in Depth):
+     *    - Pre-sanitization validation: Size limits, structural checks, dangerous pattern detection
+     *    - DOMPurify sanitization: Main sanitization pass with configurable profiles
+     *    - Post-sanitization validation: Final security checks for remaining dangerous patterns
+     *    - Reference: https://owasp.org/www-community/Defense_in_Depth
+     *
+     * 3. **SVG-Specific Threats Addressed**:
+     *    - Script injection via <script> tags, event handlers (onclick, onload, etc.)
+     *    - JavaScript/VBScript protocols in href/xlink:href attributes
+     *    - Data URLs that could contain malicious payloads
+     *    - Foreign object elements allowing arbitrary HTML injection
+     *    - CDATA sections and processing instructions
+     *    - External resource references (http/https URLs)
+     *    - Reference: https://owasp.org/www-community/attacks/Billion_laughs_attack
+     *    - Reference: https://owasp.org/www-community/attacks/Cross-site_Scripting_(XSS)
+     *
+     * 4. **Protocol Validation**:
+     *    - Blocks dangerous protocols: javascript:, vbscript:, data:, file:, etc.
+     *    - Blocks external references to prevent privacy leaks and SSRF
+     *    - Reference: https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html
+     *
+     * 5. **Content Security Policy (CSP) Compatible**:
+     *    - Sanitized content is safe for use with strict CSP
+     *    - No inline scripts or event handlers in output
+     *    - Reference: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+     *
+     * 6. **Size & Complexity Limits**:
+     *    - Prevents billion laughs attacks and resource exhaustion
+     *    - Configurable maximum size limits
+     *    - Nesting depth validation
+     *
+     * Available profiles:
+     * - 'svg': Strict SVG sanitization for user-uploaded SVG files
+     * - 'html': General HTML content sanitization for rich text
+     * - 'minimal': Light sanitization for trusted content
+     *
+     * Usage:
+     * - sanitize(svg): Sanitizes SVG content with full validation and error reporting
+     * - sanitizeWithProfile(content, profile): Generic sanitization with any profile
+     *
+     * Security Notes:
+     * - Always validate sanitization results before rendering
+     * - Review errors array for blocked threats
+     * - Consider additional application-specific validation
+     * - Keep DOMPurify updated for latest security patches
+     */
+    class DomSanitizer extends coreServices.Core.Service {
+        constructor();
+        getMaxBytes(): number;
+        /**
+         * Generic DOM sanitization method that can use any configured profile.
+         * @param content - The content to sanitize
+         * @param profileName - The DOMPurify profile to use
+         * @returns Sanitized content
+         */
+        sanitizeWithProfile(content: string, profileName?: string): string;
+        /**
+         * Get DOMPurify configuration for the specified profile.
+         * @param profileName - The configuration profile to use (defaults to 'svg')
+         */
+        private getDOMPurifyConfig;
+        /**
+         * Validate href/xlink:href attributes to ensure they are safe.
+         */
+        private validateHrefAttributes;
+        /**
+         * Sanitize an SVG string using DOMPurify.
+         * Returns object with safety status, sanitized markup, and errors/warnings.
+         */
+        sanitize(svg: string): {
+            safe: boolean;
+            sanitized: string;
+            errors: string[];
+            warnings: string[];
+            info: {
+                originalBytes: number;
+                sanitizedBytes: number;
+            };
+        };
+        private inspectSvgStructure;
+    }
+}
+export default Services;
+declare global {
+    let DomSanitizerService: Services.DomSanitizer;
+}
+//# sourceMappingURL=DomSanitizerService.d.ts.map

package/dist/services/DomSanitizerService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DomSanitizerService.d.ts","sourceRoot":"","sources":["../../src/services/DomSanitizerService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA+K1D,yBAAiB,QAAQ,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6DG;IACH,MAAa,YAAa,SAAQ,YAAY,CAAC,IAAI,CAAC,OAAO;;QAOzD,WAAW,IAAI,MAAM;QAIrB;;;;;WAKG;QACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,GAAE,MAAe,GAAG,MAAM;QAe1E;;;WAGG;QACH,OAAO,CAAC,kBAAkB;QAuB1B;;WAEG;QACH,OAAO,CAAC,sBAAsB;QAmD9B;;;WAGG;QACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;YACrB,IAAI,EAAE,OAAO,CAAC;YACd,SAAS,EAAE,MAAM,CAAC;YAClB,MAAM,EAAE,MAAM,EAAE,CAAC;YACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,IAAI,EAAE;gBAAE,aAAa,EAAE,MAAM,CAAC;gBAAC,cAAc,EAAE,MAAM,CAAA;aAAE,CAAC;SACzD;QA+MD,OAAO,CAAC,mBAAmB;KA8B5B;CAGF;AAGD,eAAe,QAAQ,CAAC;AAGxB,OAAO,CAAC,MAAM,CAAC;IACb,IAAI,mBAAmB,EAAE,QAAQ,CAAC,YAAY,CAAC;CAChD"}

package/dist/services/DomSanitizerService.js

@@ -0,0 +1,506 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Services = void 0;
+const PopulateExportedMethods_decorator_1 = require("../decorator/PopulateExportedMethods.decorator");
+const CoreService_1 = require("../CoreService");
+const domPurify = require("dompurify");
+const buffer_1 = require("buffer");
+const jsdom_1 = require("jsdom");
+const isDomPurifyInstance = (candidate) => {
+    if (!candidate || (typeof candidate !== 'object' && typeof candidate !== 'function')) {
+        return false;
+    }
+    const record = candidate;
+    return typeof record.sanitize === 'function'
+        && typeof record.addHook === 'function'
+        && typeof record.removeHook === 'function';
+};
+const isSanitizerNode = (candidate) => {
+    if (!candidate || typeof candidate !== 'object') {
+        return false;
+    }
+    const record = candidate;
+    return typeof record.remove === 'function'
+        && typeof record.removeAttribute === 'function'
+        && typeof record.getAttribute === 'function';
+};
+const isDomPurifyConfig = (candidate) => {
+    if (!candidate || typeof candidate !== 'object') {
+        return false;
+    }
+    const record = candidate;
+    return typeof record.profiles === 'object' && record.profiles !== null;
+};
+const getWindow = () => {
+    const globalCache = globalThis;
+    const globalWindow = globalCache.window;
+    if (globalWindow && typeof globalWindow.document !== 'undefined') {
+        return globalWindow;
+    }
+    const cacheKey = '__domSanitizerWindow';
+    if (!globalCache[cacheKey]) {
+        const { window } = new jsdom_1.JSDOM('', { pretendToBeVisual: true });
+        globalCache[cacheKey] = window;
+    }
+    return globalCache[cacheKey];
+};
+const instantiateDomPurify = (factoryModule) => {
+    if (!factoryModule) {
+        return null;
+    }
+    const windowRef = getWindow();
+    const tryGet = (candidate) => (isDomPurifyInstance(candidate) ? candidate : null);
+    const moduleRecord = (typeof factoryModule === 'object' || typeof factoryModule === 'function')
+        ? factoryModule
+        : null;
+    const candidates = [
+        () => tryGet(factoryModule),
+        () => tryGet(moduleRecord?.default),
+        () => tryGet(moduleRecord?.DOMPurify),
+        () => {
+            const createDOMPurify = moduleRecord?.createDOMPurify;
+            if (typeof createDOMPurify === 'function') {
+                return tryGet(createDOMPurify(windowRef));
+            }
+            return null;
+        },
+        () => {
+            if (typeof factoryModule === 'function') {
+                return tryGet(factoryModule(windowRef));
+            }
+            return null;
+        },
+        () => {
+            const defaultExport = moduleRecord?.default;
+            if (typeof defaultExport === 'function') {
+                return tryGet(defaultExport(windowRef));
+            }
+            return null;
+        }
+    ];
+    for (const resolver of candidates) {
+        try {
+            const instance = resolver();
+            if (instance) {
+                return instance;
+            }
+        }
+        catch (error) {
+            sails?.log?.silly?.('DomSanitizerService:: DOMPurify instantiation attempt failed', error);
+        }
+    }
+    return null;
+};
+const initialiseDOMPurify = () => {
+    const instanceFromDomPurify = instantiateDomPurify(domPurify);
+    if (instanceFromDomPurify) {
+        return instanceFromDomPurify;
+    }
+    throw new Error('DomSanitizerService: Failed to initialise DOMPurify with hook support');
+};
+const DOMPurify = initialiseDOMPurify();
+globalThis.DOMPurify = DOMPurify;
+const createDOMPurifyForCall = () => {
+    const windowRef = getWindow();
+    const moduleRecord = (typeof domPurify === 'object' || typeof domPurify === 'function')
+        ? domPurify
+        : null;
+    const createDOMPurify = (typeof moduleRecord?.createDOMPurify === 'function' && moduleRecord.createDOMPurify)
+        || (typeof domPurify === 'function' && domPurify)
+        || (typeof moduleRecord?.default === 'function' && moduleRecord.default)
+        || null;
+    if (typeof createDOMPurify === 'function') {
+        try {
+            const instance = createDOMPurify(windowRef);
+            if (isDomPurifyInstance(instance)) {
+                return instance;
+            }
+        }
+        catch (error) {
+            sails?.log?.silly?.('DomSanitizerService:: per-call DOMPurify creation failed, falling back', error);
+        }
+    }
+    const fallback = instantiateDomPurify(domPurify);
+    if (fallback) {
+        return fallback;
+    }
+    throw new Error('DomSanitizerService: Failed to initialise DOMPurify instance for sanitize call');
+};
+var Services;
+(function (Services) {
+    /**
+     * SVG and DOM sanitization service using DOMPurify.
+     *
+     * This service provides secure sanitization of SVG and other DOM content using
+     * configurable DOMPurify profiles defined in config/dompurify.js.
+     *
+     * Security Approach & OWASP References:
+     * ======================================
+     * This service implements defense-in-depth sanitization following OWASP recommendations:
+     *
+     * 1. **DOMPurify Library** (OWASP Recommended):
+     *    - Uses DOMPurify, an OWASP-recommended DOM sanitization library
+     *    - Reference: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#html-sanitization
+     *    - DOMPurify GitHub: https://github.com/cure53/DOMPurify
+     *    - Actively maintained with regular security audits
+     *
+     * 2. **Multi-Layer Validation** (Defense in Depth):
+     *    - Pre-sanitization validation: Size limits, structural checks, dangerous pattern detection
+     *    - DOMPurify sanitization: Main sanitization pass with configurable profiles
+     *    - Post-sanitization validation: Final security checks for remaining dangerous patterns
+     *    - Reference: https://owasp.org/www-community/Defense_in_Depth
+     *
+     * 3. **SVG-Specific Threats Addressed**:
+     *    - Script injection via <script> tags, event handlers (onclick, onload, etc.)
+     *    - JavaScript/VBScript protocols in href/xlink:href attributes
+     *    - Data URLs that could contain malicious payloads
+     *    - Foreign object elements allowing arbitrary HTML injection
+     *    - CDATA sections and processing instructions
+     *    - External resource references (http/https URLs)
+     *    - Reference: https://owasp.org/www-community/attacks/Billion_laughs_attack
+     *    - Reference: https://owasp.org/www-community/attacks/Cross-site_Scripting_(XSS)
+     *
+     * 4. **Protocol Validation**:
+     *    - Blocks dangerous protocols: javascript:, vbscript:, data:, file:, etc.
+     *    - Blocks external references to prevent privacy leaks and SSRF
+     *    - Reference: https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html
+     *
+     * 5. **Content Security Policy (CSP) Compatible**:
+     *    - Sanitized content is safe for use with strict CSP
+     *    - No inline scripts or event handlers in output
+     *    - Reference: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+     *
+     * 6. **Size & Complexity Limits**:
+     *    - Prevents billion laughs attacks and resource exhaustion
+     *    - Configurable maximum size limits
+     *    - Nesting depth validation
+     *
+     * Available profiles:
+     * - 'svg': Strict SVG sanitization for user-uploaded SVG files
+     * - 'html': General HTML content sanitization for rich text
+     * - 'minimal': Light sanitization for trusted content
+     *
+     * Usage:
+     * - sanitize(svg): Sanitizes SVG content with full validation and error reporting
+     * - sanitizeWithProfile(content, profile): Generic sanitization with any profile
+     *
+     * Security Notes:
+     * - Always validate sanitization results before rendering
+     * - Review errors array for blocked threats
+     * - Consider additional application-specific validation
+     * - Keep DOMPurify updated for latest security patches
+     */
+    class DomSanitizer extends CoreService_1.Services.Core.Service {
+        constructor() {
+            super();
+            this.logHeader = "DomSanitizerService::";
+        }
+        getMaxBytes() {
+            return _.get(sails.config, 'record.form.svgMaxBytes', 1048576); // 1MB default
+        }
+        /**
+         * Generic DOM sanitization method that can use any configured profile.
+         * @param content - The content to sanitize
+         * @param profileName - The DOMPurify profile to use
+         * @returns Sanitized content
+         */
+        sanitizeWithProfile(content, profileName = 'html') {
+            if (!_.isString(content)) {
+                throw new Error('Content must be a string');
+            }
+            try {
+                const config = this.getDOMPurifyConfig(profileName);
+                const sanitized = DOMPurify.sanitize(content, config);
+                return String(sanitized);
+            }
+            catch (error) {
+                sails.log.error(`DomSanitizerService: Error sanitizing content with profile '${profileName}':`, error);
+                throw error;
+            }
+        }
+        /**
+         * Get DOMPurify configuration for the specified profile.
+         * @param profileName - The configuration profile to use (defaults to 'svg')
+         */
+        getDOMPurifyConfig(profileName = 'svg') {
+            const rawConfig = _.get(sails.config, 'dompurify', {});
+            const dompurifyConfig = isDomPurifyConfig(rawConfig)
+                ? rawConfig
+                : { profiles: {}, defaultProfile: 'svg', hooks: {}, globalSettings: {} };
+            const profiles = dompurifyConfig.profiles || {};
+            const globalSettings = dompurifyConfig.globalSettings || {};
+            // Get the requested profile or fall back to default
+            const profile = profiles[profileName] || profiles[dompurifyConfig.defaultProfile] || profiles.svg;
+            if (!profile) {
+                sails.log.error(`DomSanitizerService: DOMPurify profile '${profileName}' not found and no fallback available`);
+                throw new Error(`DOMPurify configuration profile '${profileName}' not found`);
+            }
+            // Merge profile settings with global settings
+            return {
+                ...globalSettings,
+                ...profile
+            };
+        }
+        /**
+         * Validate href/xlink:href attributes to ensure they are safe.
+         */
+        validateHrefAttributes(svg) {
+            const errors = [];
+            // Check for dangerous protocols in href attributes
+            const dangerousProtocols = [
+                'javascript:', 'vbscript:', 'data:', 'file:', 'ftp:', 'ftps:',
+                'chrome:', 'resource:', 'moz-extension:', 'chrome-extension:',
+                'ms-appx:', 'ms-appx-web:', 'about:', 'blob:', 'filesystem:'
+            ];
+            // Check for external references (http/https/protocol-relative)
+            const externalProtocols = ['http:', 'https:', '//'];
+            // Match href attributes with both quoted and unquoted values
+            // Group 1: quoted value (single or double quotes)
+            // Group 2: unquoted value (non-whitespace, non->)
+            const hrefPattern = /(?:href|xlink:href)\s*=\s*(?:["']([^"']*)["']|([^\s>]+))/gi;
+            let match;
+            while ((match = hrefPattern.exec(svg)) !== null) {
+                // Use whichever capture group matched (quoted = group 1, unquoted = group 2)
+                const url = (match[1] !== undefined ? match[1] : match[2]).toLowerCase().trim();
+                // Check for dangerous protocols
+                for (const protocol of dangerousProtocols) {
+                    if (url.startsWith(protocol)) {
+                        if (protocol === 'javascript:') {
+                            errors.push('javascript-protocol');
+                        }
+                        else if (protocol === 'vbscript:') {
+                            errors.push('vbscript-protocol');
+                        }
+                        else if (protocol === 'data:') {
+                            errors.push('data-url-embed');
+                        }
+                        else {
+                            errors.push('dangerous-protocol');
+                        }
+                        break;
+                    }
+                }
+                // Check for external references
+                for (const protocol of externalProtocols) {
+                    if (url.startsWith(protocol)) {
+                        errors.push('external-ref');
+                        break;
+                    }
+                }
+            }
+            return { valid: errors.length === 0, errors };
+        }
+        /**
+         * Sanitize an SVG string using DOMPurify.
+         * Returns object with safety status, sanitized markup, and errors/warnings.
+         */
+        sanitize(svg) {
+            const errors = [];
+            const warnings = [];
+            // Enhanced input validation
+            if (!_.isString(svg)) {
+                errors.push('not-a-string');
+                return { safe: false, sanitized: '', errors, warnings, info: { originalBytes: 0, sanitizedBytes: 0 } };
+            }
+            // Check for null bytes and other control characters
+            const containsControlCharacters = Array.from(svg).some((char) => {
+                const code = char.charCodeAt(0);
+                return (code >= 0 && code <= 8)
+                    || code === 11
+                    || code === 12
+                    || (code >= 14 && code <= 31)
+                    || code === 127;
+            });
+            if (containsControlCharacters) {
+                errors.push('contains-control-characters');
+            }
+            const originalBytes = buffer_1.Buffer.byteLength(svg, 'utf8');
+            const max = this.getMaxBytes();
+            if (originalBytes > max || svg.length > max) {
+                if (originalBytes > max) {
+                    errors.push('too-large');
+                }
+                if (svg.length > max) {
+                    errors.push('string-too-long');
+                }
+                return { safe: false, sanitized: '', errors, warnings, info: { originalBytes, sanitizedBytes: 0 } };
+            }
+            // Basic structural check
+            if (!/<svg[\s>]/i.test(svg)) {
+                errors.push('missing-svg-root');
+            }
+            // Check for excessive nesting and element count (resource exhaustion protection)
+            const svgStructure = this.inspectSvgStructure(svg);
+            if (svgStructure.maxDepth > 1000) {
+                errors.push('excessive-nesting');
+            }
+            if (svgStructure.totalElements > 100000) {
+                errors.push('excessive-elements');
+            }
+            // Check for suspicious CDATA sections
+            if (/<!\[CDATA\[/i.test(svg)) {
+                errors.push('cdata-section');
+            }
+            // Check for processing instructions
+            if (/<\?\w+/i.test(svg)) {
+                warnings.push('processing-instructions');
+            }
+            // Pre-validation: Check for dangerous patterns before sanitization
+            const hrefValidation = this.validateHrefAttributes(svg);
+            if (!hrefValidation.valid) {
+                // Filter out 'external-ref' as it will be caught by hooks
+                errors.push(...hrefValidation.errors.filter(e => e !== 'external-ref'));
+            }
+            // Check for script elements
+            if (/<script[\s>]/i.test(svg)) {
+                errors.push('script-element');
+            }
+            // Check for foreign object elements
+            if (/<foreignObject[\s>]/i.test(svg)) {
+                errors.push('foreign-object');
+            }
+            try {
+                // Use DOMPurify to sanitize the SVG
+                const config = this.getDOMPurifyConfig();
+                const beforeSanitizeElementsHook = (node) => {
+                    if (!isSanitizerNode(node)) {
+                        return;
+                    }
+                    if (node.tagName && /^(script|iframe|embed|object|applet)$/i.test(node.tagName)) {
+                        node.remove();
+                    }
+                };
+                const beforeSanitizeAttributesHook = (node) => {
+                    if (!isSanitizerNode(node)) {
+                        return;
+                    }
+                    if (node.attributes) {
+                        const attrs = Array.from(node.attributes);
+                        attrs.forEach((attr) => {
+                            if (attr.name.toLowerCase().startsWith('on')) {
+                                node.removeAttribute(attr.name);
+                                warnings.push('event-handlers-removed');
+                            }
+                        });
+                    }
+                    const href = node.getAttribute('href') || node.getAttribute('xlink:href');
+                    if (!href) {
+                        return;
+                    }
+                    const lowerHref = href.toLowerCase().trim();
+                    const dangerousProtocols = [
+                        'javascript:', 'vbscript:', 'data:', 'file:', 'chrome:',
+                        'resource:', 'moz-extension:', 'chrome-extension:', 'ms-appx:',
+                        'about:', 'blob:', 'filesystem:'
+                    ];
+                    const externalProtocols = ['http:', 'https:', '//'];
+                    let shouldRemove = false;
+                    for (const protocol of dangerousProtocols) {
+                        if (lowerHref.startsWith(protocol)) {
+                            shouldRemove = true;
+                            break;
+                        }
+                    }
+                    if (!shouldRemove) {
+                        for (const protocol of externalProtocols) {
+                            if (lowerHref.startsWith(protocol)) {
+                                shouldRemove = true;
+                                errors.push('external-ref');
+                                break;
+                            }
+                        }
+                    }
+                    if (shouldRemove) {
+                        node.removeAttribute('href');
+                        node.removeAttribute('xlink:href');
+                    }
+                };
+                const domPurifyForCall = createDOMPurifyForCall();
+                domPurifyForCall.addHook('beforeSanitizeElements', beforeSanitizeElementsHook);
+                domPurifyForCall.addHook('beforeSanitizeAttributes', beforeSanitizeAttributesHook);
+                let sanitized;
+                try {
+                    sanitized = domPurifyForCall.sanitize(svg, config);
+                }
+                finally {
+                    domPurifyForCall.removeHook('beforeSanitizeAttributes');
+                    domPurifyForCall.removeHook('beforeSanitizeElements');
+                }
+                // Post-sanitization validation
+                // Convert TrustedHTML to string for further processing
+                let working = String(sanitized);
+                // Final security checks for any remaining dangerous patterns
+                const dangerousPatterns = [
+                    { pattern: /javascript\s*:/gi, error: 'javascript-protocol-found' },
+                    { pattern: /vbscript\s*:/gi, error: 'vbscript-protocol-found' },
+                    // Block all data URLs - they can be used to embed malicious content
+                    // Pattern matches "data:" followed by any content (MIME type, encoding, data)
+                    // Examples blocked: data:text/html, data:image/svg+xml, data:application/javascript, etc.
+                    { pattern: /data\s*:[^,\s]*[,\s]/gi, error: 'unsafe-data-url-found' },
+                    { pattern: /<script[\s>]/gi, error: 'script-element-found' },
+                    { pattern: /<\/script\s*>/gi, error: 'script-closing-tag-found' },
+                    { pattern: /on\w+\s*=/gi, error: 'event-handler-found' }
+                ];
+                dangerousPatterns.forEach(check => {
+                    if (check.pattern.test(working)) {
+                        errors.push(check.error);
+                        // Remove the dangerous content
+                        working = working.replace(check.pattern, '');
+                    }
+                });
+                // Collapse excessive whitespace
+                working = working.replace(/\s{2,}/g, ' ').trim();
+                const sanitizedBytes = buffer_1.Buffer.byteLength(working, 'utf8');
+                const safe = errors.length === 0;
+                return {
+                    safe,
+                    sanitized: working,
+                    errors,
+                    warnings,
+                    info: { originalBytes, sanitizedBytes }
+                };
+            }
+            catch (error) {
+                // Handle any DOMPurify errors
+                errors.push('sanitization-error');
+                sails.log.error('SVG sanitization error:', error);
+                return {
+                    safe: false,
+                    sanitized: '',
+                    errors,
+                    warnings,
+                    info: { originalBytes, sanitizedBytes: 0 }
+                };
+            }
+        }
+        inspectSvgStructure(svg) {
+            const tagRegex = /<\s*(\/)?\s*([a-zA-Z][\w:.-]*)([^>]*)>/g;
+            let depth = 0;
+            let maxDepth = 0;
+            let totalElements = 0;
+            let match;
+            while ((match = tagRegex.exec(svg)) !== null) {
+                const isClosingTag = Boolean(match[1]);
+                const trailingSegment = match[3] ?? '';
+                const isSelfClosingTag = /\/\s*$/.test(trailingSegment);
+                if (isClosingTag) {
+                    depth = Math.max(0, depth - 1);
+                    continue;
+                }
+                totalElements += 1;
+                depth += 1;
+                if (depth > maxDepth) {
+                    maxDepth = depth;
+                }
+                if (isSelfClosingTag) {
+                    depth = Math.max(0, depth - 1);
+                }
+            }
+            return { maxDepth, totalElements };
+        }
+    }
+    Services.DomSanitizer = DomSanitizer;
+})(Services || (exports.Services = Services = {}));
+exports.default = Services;
+(0, PopulateExportedMethods_decorator_1.PopulateExportedMethods)(Services.DomSanitizer);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRG9tU2FuaXRpemVyU2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2aWNlcy9Eb21TYW5pdGl6ZXJTZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLHNHQUF5RjtBQUN6RixnREFBMEQ7QUFHMUQsdUNBQXdDO0FBQ3hDLG1DQUFnQztBQUNoQyxpQ0FBOEI7QUEwQjlCLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxTQUFrQixFQUFrQyxFQUFFO0lBQ2pGLElBQUksQ0FBQyxTQUFTLElBQUksQ0FBQyxPQUFPLFNBQVMsS0FBSyxRQUFRLElBQUksT0FBTyxTQUFTLEtBQUssVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNyRixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxTQUFvQyxDQUFDO0lBQ3BELE9BQU8sT0FBTyxNQUFNLENBQUMsUUFBUSxLQUFLLFVBQVU7V0FDdkMsT0FBTyxNQUFNLENBQUMsT0FBTyxLQUFLLFVBQVU7V0FDcEMsT0FBTyxNQUFNLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQztBQUMvQyxDQUFDLENBQUM7QUFFRixNQUFNLGVBQWUsR0FBRyxDQUFDLFNBQWtCLEVBQThCLEVBQUU7SUFDekUsSUFBSSxDQUFDLFNBQVMsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNoRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxTQUFvQyxDQUFDO0lBQ3BELE9BQU8sT0FBTyxNQUFNLENBQUMsTUFBTSxLQUFLLFVBQVU7V0FDckMsT0FBTyxNQUFNLENBQUMsZUFBZSxLQUFLLFVBQVU7V0FDNUMsT0FBTyxNQUFNLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQztBQUNqRCxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsU0FBa0IsRUFBZ0MsRUFBRTtJQUM3RSxJQUFJLENBQUMsU0FBUyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2hELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFNBQW9DLENBQUM7SUFDcEQsT0FBTyxPQUFPLE1BQU0sQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDO0FBQ3pFLENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLEdBQUcsRUFBRTtJQUNyQixNQUFNLFdBQVcsR0FBRyxVQUlPLENBQUM7SUFDNUIsTUFBTSxZQUFZLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQztJQUN4QyxJQUFJLFlBQVksSUFBSSxPQUFPLFlBQVksQ0FBQyxRQUFRLEtBQUssV0FBVyxFQUFFLENBQUM7UUFDakUsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLHNCQUFzQixDQUFDO0lBQ3hDLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMzQixNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsSUFBSSxhQUFLLENBQUMsRUFBRSxFQUFFLEVBQUUsaUJBQWlCLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUM5RCxXQUFXLENBQUMsUUFBUSxDQUFDLEdBQUcsTUFBTSxDQUFDO0lBQ2pDLENBQUM7SUFFRCxPQUFPLFdBQVcsQ0FBQyxRQUFRLENBQWUsQ0FBQztBQUM3QyxDQUFDLENBQUM7QUFFRixNQUFNLG9CQUFvQixHQUFHLENBQUMsYUFBc0IsRUFBNEIsRUFBRTtJQUNoRixJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDbkIsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUcsU0FBUyxFQUFFLENBQUM7SUFFOUIsTUFBTSxNQUFNLEdBQUcsQ0FBQyxTQUFrQixFQUFFLEVBQUUsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzNGLE1BQU0sWUFBWSxHQUFHLENBQUMsT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLE9BQU8sYUFBYSxLQUFLLFVBQVUsQ0FBQztRQUM3RixDQUFDLENBQUUsYUFBeUM7UUFDNUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUVULE1BQU0sVUFBVSxHQUFHO1FBQ2pCLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUM7UUFDM0IsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUM7UUFDbkMsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxTQUFTLENBQUM7UUFDckMsR0FBRyxFQUFFO1lBQ0gsTUFBTSxlQUFlLEdBQUcsWUFBWSxFQUFFLGVBQWUsQ0FBQztZQUN0RCxJQUFJLE9BQU8sZUFBZSxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUMxQyxPQUFPLE1BQU0sQ0FBRSxlQUFtRCxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDakYsQ0FBQztZQUNELE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELEdBQUcsRUFBRTtZQUNILElBQUksT0FBTyxhQUFhLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQ3hDLE9BQU8sTUFBTSxDQUFFLGFBQWlELENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUMvRSxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsR0FBRyxFQUFFO1lBQ0gsTUFBTSxhQUFhLEdBQUcsWUFBWSxFQUFFLE9BQU8sQ0FBQztZQUM1QyxJQUFJLE9BQU8sYUFBYSxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUN4QyxPQUFPLE1BQU0sQ0FBRSxhQUFpRCxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDL0UsQ0FBQztZQUNELE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztLQUNGLENBQUM7SUFFRixLQUFLLE1BQU0sUUFBUSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFHLFFBQVEsRUFBRSxDQUFDO1lBQzVCLElBQUksUUFBUSxFQUFFLENBQUM7Z0JBQ2IsT0FBTyxRQUFRLENBQUM7WUFDbEIsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsS0FBSyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQyw4REFBOEQsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM3RixDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxtQkFBbUIsR0FBRyxHQUFzQixFQUFFO0lBQ2xELE1BQU0scUJBQXFCLEdBQUcsb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUQsSUFBSSxxQkFBcUIsRUFBRSxDQUFDO1FBQzFCLE9BQU8scUJBQXFCLENBQUM7SUFDL0IsQ0FBQztJQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztBQUMzRixDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxtQkFBbUIsRUFBRSxDQUFDO0FBRXZDLFVBQW9FLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztBQUU1RixNQUFNLHNCQUFzQixHQUFHLEdBQXNCLEVBQUU7SUFDckQsTUFBTSxTQUFTLEdBQUcsU0FBUyxFQUFFLENBQUM7SUFDOUIsTUFBTSxZQUFZLEdBQUcsQ0FBQyxPQUFPLFNBQVMsS0FBSyxRQUFRLElBQUksT0FBTyxTQUFTLEtBQUssVUFBVSxDQUFDO1FBQ3JGLENBQUMsQ0FBRSxTQUFnRDtRQUNuRCxDQUFDLENBQUMsSUFBSSxDQUFDO0lBRVQsTUFBTSxlQUFlLEdBQ25CLENBQUMsT0FBTyxZQUFZLEVBQUUsZUFBZSxLQUFLLFVBQVUsSUFBSSxZQUFZLENBQUMsZUFBZSxDQUFDO1dBQ2xGLENBQUMsT0FBTyxTQUFTLEtBQUssVUFBVSxJQUFJLFNBQVMsQ0FBQztXQUM5QyxDQUFDLE9BQU8sWUFBWSxFQUFFLE9BQU8sS0FBSyxVQUFVLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQztXQUNyRSxJQUFJLENBQUM7SUFFVixJQUFJLE9BQU8sZUFBZSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFJLGVBQW1ELENBQUMsU0FBUyxDQUFDLENBQUM7WUFDakYsSUFBSSxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO2dCQUNsQyxPQUFPLFFBQVEsQ0FBQztZQUNsQixDQUFDO1FBQ0gsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixLQUFLLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxDQUFDLHdFQUF3RSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3ZHLENBQUM7SUFDSCxDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakQsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNiLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFRCxNQUFNLElBQUksS0FBSyxDQUFDLGdGQUFnRixDQUFDLENBQUM7QUFDcEcsQ0FBQyxDQUFDO0FBRUYsSUFBaUIsUUFBUSxDQTBheEI7QUExYUQsV0FBaUIsUUFBUTtJQUN2Qjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQTZERztJQUNILE1BQWEsWUFBYSxTQUFRLHNCQUFZLENBQUMsSUFBSSxDQUFDLE9BQU87UUFFekQ7WUFDRSxLQUFLLEVBQUUsQ0FBQztZQUNSLElBQUksQ0FBQyxTQUFTLEdBQUcsdUJBQXVCLENBQUM7UUFDM0MsQ0FBQztRQUVELFdBQVc7WUFDVCxPQUFPLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSx5QkFBeUIsRUFBRSxPQUFPLENBQVcsQ0FBQyxDQUFDLGNBQWM7UUFDMUYsQ0FBQztRQUVEOzs7OztXQUtHO1FBQ0gsbUJBQW1CLENBQUMsT0FBZSxFQUFFLGNBQXNCLE1BQU07WUFDL0QsSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDekIsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1lBQzlDLENBQUM7WUFFRCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUNwRCxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDdEQsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDM0IsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsK0RBQStELFdBQVcsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO2dCQUN2RyxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO1FBRUQ7OztXQUdHO1FBQ0ssa0JBQWtCLENBQUMsY0FBc0IsS0FBSztZQUNwRCxNQUFNLFNBQVMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sZUFBZSxHQUFHLGlCQUFpQixDQUFDLFNBQVMsQ0FBQztnQkFDbEQsQ0FBQyxDQUFDLFNBQVM7Z0JBQ1gsQ0FBQyxDQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsY0FBYyxFQUFFLEVBQUUsRUFBc0IsQ0FBQztZQUNoRyxNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQztZQUNoRCxNQUFNLGNBQWMsR0FBRyxlQUFlLENBQUMsY0FBYyxJQUFJLEVBQUUsQ0FBQztZQUU1RCxvREFBb0Q7WUFDcEQsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxlQUFlLENBQUMsY0FBYyxDQUFDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQztZQUVsRyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsMkNBQTJDLFdBQVcsdUNBQXVDLENBQUMsQ0FBQztnQkFDL0csTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsV0FBVyxhQUFhLENBQUMsQ0FBQztZQUNoRixDQUFDO1lBRUQsOENBQThDO1lBQzlDLE9BQU87Z0JBQ0wsR0FBRyxjQUFjO2dCQUNqQixHQUFHLE9BQU87YUFDWCxDQUFDO1FBQ0osQ0FBQztRQUVEOztXQUVHO1FBQ0ssc0JBQXNCLENBQUMsR0FBVztZQUN4QyxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7WUFFNUIsbURBQW1EO1lBQ25ELE1BQU0sa0JBQWtCLEdBQUc7Z0JBQ3pCLGFBQWEsRUFBRSxXQUFXLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTztnQkFDN0QsU0FBUyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsRUFBRSxtQkFBbUI7Z0JBQzdELFVBQVUsRUFBRSxjQUFjLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxhQUFhO2FBQzdELENBQUM7WUFFRiwrREFBK0Q7WUFDL0QsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFFcEQsNkRBQTZEO1lBQzdELGtEQUFrRDtZQUNsRCxrREFBa0Q7WUFDbEQsTUFBTSxXQUFXLEdBQUcsNERBQTRELENBQUM7WUFDakYsSUFBSSxLQUFLLENBQUM7WUFFVixPQUFPLENBQUMsS0FBSyxHQUFHLFdBQVcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDaEQsNkVBQTZFO2dCQUM3RSxNQUFNLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBRWhGLGdDQUFnQztnQkFDaEMsS0FBSyxNQUFNLFFBQVEsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO29CQUMxQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQzt3QkFDN0IsSUFBSSxRQUFRLEtBQUssYUFBYSxFQUFFLENBQUM7NEJBQy9CLE1BQU0sQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsQ0FBQzt3QkFDckMsQ0FBQzs2QkFBTSxJQUFJLFFBQVEsS0FBSyxXQUFXLEVBQUUsQ0FBQzs0QkFDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO3dCQUNuQyxDQUFDOzZCQUFNLElBQUksUUFBUSxLQUFLLE9BQU8sRUFBRSxDQUFDOzRCQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7d0JBQ2hDLENBQUM7NkJBQU0sQ0FBQzs0QkFDTixNQUFNLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUM7d0JBQ3BDLENBQUM7d0JBQ0QsTUFBTTtvQkFDUixDQUFDO2dCQUNILENBQUM7Z0JBRUQsZ0NBQWdDO2dCQUNoQyxLQUFLLE1BQU0sUUFBUSxJQUFJLGlCQUFpQixFQUFFLENBQUM7b0JBQ3pDLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO3dCQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO3dCQUM1QixNQUFNO29CQUNSLENBQUM7Z0JBQ0gsQ0FBQztZQUNILENBQUM7WUFFRCxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDO1FBQ2hELENBQUM7UUFFRDs7O1dBR0c7UUFDSCxRQUFRLENBQUMsR0FBVztZQU9sQixNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7WUFDNUIsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO1lBRTlCLDRCQUE0QjtZQUM1QixJQUFJLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUNyQixNQUFNLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO2dCQUM1QixPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxjQUFjLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUN6RyxDQUFDO1lBRUQsb0RBQW9EO1lBQ3BELE1BQU0seUJBQXlCLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRTtnQkFDOUQsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDaEMsT0FBTyxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsQ0FBQzt1QkFDMUIsSUFBSSxLQUFLLEVBQUU7dUJBQ1gsSUFBSSxLQUFLLEVBQUU7dUJBQ1gsQ0FBQyxJQUFJLElBQUksRUFBRSxJQUFJLElBQUksSUFBSSxFQUFFLENBQUM7dUJBQzFCLElBQUksS0FBSyxHQUFHLENBQUM7WUFDcEIsQ0FBQyxDQUFDLENBQUM7WUFDSCxJQUFJLHlCQUF5QixFQUFFLENBQUM7Z0JBQzlCLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztZQUM3QyxDQUFDO1lBRUQsTUFBTSxhQUFhLEdBQUcsZUFBTSxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDckQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQy9CLElBQUksYUFBYSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO2dCQUM1QyxJQUFJLGFBQWEsR0FBRyxHQUFHLEVBQUUsQ0FBQztvQkFDeEIsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztnQkFDM0IsQ0FBQztnQkFDRCxJQUFJLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7b0JBQ3JCLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztnQkFDakMsQ0FBQztnQkFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ3RHLENBQUM7WUFFRCx5QkFBeUI7WUFDekIsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1lBQ2xDLENBQUM7WUFFRCxpRkFBaUY7WUFDakYsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ25ELElBQUksWUFBWSxDQUFDLFFBQVEsR0FBRyxJQUFJLEVBQUUsQ0FBQztnQkFDakMsTUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1lBQ25DLENBQUM7WUFDRCxJQUFJLFlBQVksQ0FBQyxhQUFhLEdBQUcsTUFBTSxFQUFFLENBQUM7Z0JBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsQ0FBQztZQUNwQyxDQUFDO1lBRUQsc0NBQXNDO1lBQ3RDLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQy9CLENBQUM7WUFFRCxvQ0FBb0M7WUFDcEMsSUFBSSxTQUFTLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hCLFFBQVEsQ0FBQyxJQUFJLENBQUMseUJBQXlCLENBQUMsQ0FBQztZQUMzQyxDQUFDO1lBRUQsbUVBQW1FO1lBQ25FLE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN4RCxJQUFJLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUMxQiwwREFBMEQ7Z0JBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsS0FBSyxjQUFjLENBQUMsQ0FBQyxDQUFDO1lBQzFFLENBQUM7WUFFRCw0QkFBNEI7WUFDNUIsSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzlCLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUNoQyxDQUFDO1lBRUQsb0NBQW9DO1lBQ3BDLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUNoQyxDQUFDO1lBRUQsSUFBSSxDQUFDO2dCQUNILG9DQUFvQztnQkFDcEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUM7Z0JBRXpDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxJQUFhLEVBQUUsRUFBRTtvQkFDbkQsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO3dCQUMzQixPQUFPO29CQUNULENBQUM7b0JBQ0QsSUFBSSxJQUFJLENBQUMsT0FBTyxJQUFJLHdDQUF3QyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQzt3QkFDaEYsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO29CQUNoQixDQUFDO2dCQUNILENBQUMsQ0FBQztnQkFFRixNQUFNLDRCQUE0QixHQUFHLENBQUMsSUFBYSxFQUFFLEVBQUU7b0JBQ3JELElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQzt3QkFDM0IsT0FBTztvQkFDVCxDQUFDO29CQUNELElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO3dCQUNwQixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQzt3QkFDMUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFOzRCQUNyQixJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7Z0NBQzdDLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO2dDQUNoQyxRQUFRLENBQUMsSUFBSSxDQUFDLHdCQUF3QixDQUFDLENBQUM7NEJBQzFDLENBQUM7d0JBQ0gsQ0FBQyxDQUFDLENBQUM7b0JBQ0wsQ0FBQztvQkFFRCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLENBQUM7b0JBQzFFLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQzt3QkFDVixPQUFPO29CQUNULENBQUM7b0JBRUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDO29CQUM1QyxNQUFNLGtCQUFrQixHQUFHO3dCQUN6QixhQUFhLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUzt3QkFDdkQsV0FBVyxFQUFFLGdCQUFnQixFQUFFLG1CQUFtQixFQUFFLFVBQVU7d0JBQzlELFFBQVEsRUFBRSxPQUFPLEVBQUUsYUFBYTtxQkFDakMsQ0FBQztvQkFDRixNQUFNLGlCQUFpQixHQUFHLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztvQkFFcEQsSUFBSSxZQUFZLEdBQUcsS0FBSyxDQUFDO29CQUV6QixLQUFLLE1BQU0sUUFBUSxJQUFJLGtCQUFrQixFQUFFLENBQUM7d0JBQzFDLElBQUksU0FBUyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDOzRCQUNuQyxZQUFZLEdBQUcsSUFBSSxDQUFDOzRCQUNwQixNQUFNO3dCQUNSLENBQUM7b0JBQ0gsQ0FBQztvQkFFRCxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7d0JBQ2xCLEtBQUssTUFBTSxRQUFRLElBQUksaUJBQWlCLEVBQUUsQ0FBQzs0QkFDekMsSUFBSSxTQUFTLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0NBQ25DLFlBQVksR0FBRyxJQUFJLENBQUM7Z0NBQ3BCLE1BQU0sQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7Z0NBQzVCLE1BQU07NEJBQ1IsQ0FBQzt3QkFDSCxDQUFDO29CQUNILENBQUM7b0JBRUQsSUFBSSxZQUFZLEVBQUUsQ0FBQzt3QkFDakIsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQzt3QkFDN0IsSUFBSSxDQUFDLGVBQWUsQ0FBQyxZQUFZLENBQUMsQ0FBQztvQkFDckMsQ0FBQztnQkFDSCxDQUFDLENBQUM7Z0JBRUYsTUFBTSxnQkFBZ0IsR0FBRyxzQkFBc0IsRUFBRSxDQUFDO2dCQUNsRCxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLEVBQUUsMEJBQTBCLENBQUMsQ0FBQztnQkFDL0UsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLDBCQUEwQixFQUFFLDRCQUE0QixDQUFDLENBQUM7Z0JBRW5GLElBQUksU0FBa0IsQ0FBQztnQkFDdkIsSUFBSSxDQUFDO29CQUNILFNBQVMsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUNyRCxDQUFDO3dCQUFTLENBQUM7b0JBQ1QsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLDBCQUEwQixDQUFDLENBQUM7b0JBQ3hELGdCQUFnQixDQUFDLFVBQVUsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO2dCQUN4RCxDQUFDO2dCQUVELCtCQUErQjtnQkFDL0IsdURBQXVEO2dCQUN2RCxJQUFJLE9BQU8sR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBRWhDLDZEQUE2RDtnQkFDN0QsTUFBTSxpQkFBaUIsR0FBRztvQkFDeEIsRUFBRSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLDJCQUEyQixFQUFFO29CQUNuRSxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUseUJBQXlCLEVBQUU7b0JBQy9ELG9FQUFvRTtvQkFDcEUsOEVBQThFO29CQUM5RSwwRkFBMEY7b0JBQzFGLEVBQUUsT0FBTyxFQUFFLHdCQUF3QixFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRTtvQkFDckUsRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSyxFQUFFLHNCQUFzQixFQUFFO29CQUM1RCxFQUFFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxLQUFLLEVBQUUsMEJBQTBCLEVBQUU7b0JBQ2pFLEVBQUUsT0FBTyxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUscUJBQXFCLEVBQUU7aUJBQ3pELENBQUM7Z0JBRUYsaUJBQWlCLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFO29CQUNoQyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7d0JBQ2hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO3dCQUN6QiwrQkFBK0I7d0JBQy9CLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUM7b0JBQy9DLENBQUM7Z0JBQ0gsQ0FBQyxDQUFDLENBQUM7Z0JBRUgsZ0NBQWdDO2dCQUNoQyxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBRWpELE1BQU0sY0FBYyxHQUFHLGVBQU0sQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUMxRCxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQztnQkFFakMsT0FBTztvQkFDTCxJQUFJO29CQUNKLFNBQVMsRUFBRSxPQUFPO29CQUNsQixNQUFNO29CQUNOLFFBQVE7b0JBQ1IsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRTtpQkFDeEMsQ0FBQztZQUVKLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLDhCQUE4QjtnQkFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO2dCQUNsQyxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyx5QkFBeUIsRUFBRSxLQUFLLENBQUMsQ0FBQztnQkFFbEQsT0FBTztvQkFDTCxJQUFJLEVBQUUsS0FBSztvQkFDWCxTQUFTLEVBQUUsRUFBRTtvQkFDYixNQUFNO29CQUNOLFFBQVE7b0JBQ1IsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRSxDQUFDLEVBQUU7aUJBQzNDLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztRQUVPLG1CQUFtQixDQUFDLEdBQVc7WUFDckMsTUFBTSxRQUFRLEdBQUcseUNBQXlDLENBQUM7WUFDM0QsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO1lBQ2QsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDO1lBQ2pCLElBQUksYUFBYSxHQUFHLENBQUMsQ0FBQztZQUV0QixJQUFJLEtBQTZCLENBQUM7WUFDbEMsT0FBTyxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQzdDLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxlQUFlLEdBQUcsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDdkMsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO2dCQUV4RCxJQUFJLFlBQVksRUFBRSxDQUFDO29CQUNqQixLQUFLLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO29CQUMvQixTQUFTO2dCQUNYLENBQUM7Z0JBRUQsYUFBYSxJQUFJLENBQUMsQ0FBQztnQkFDbkIsS0FBSyxJQUFJLENBQUMsQ0FBQztnQkFDWCxJQUFJLEtBQUssR0FBRyxRQUFRLEVBQUUsQ0FBQztvQkFDckIsUUFBUSxHQUFHLEtBQUssQ0FBQztnQkFDbkIsQ0FBQztnQkFFRCxJQUFJLGdCQUFnQixFQUFFLENBQUM7b0JBQ3JCLEtBQUssR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ2pDLENBQUM7WUFDSCxDQUFDO1lBRUQsT0FBTyxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsQ0FBQztRQUNyQyxDQUFDO0tBQ0Y7SUF4V1kscUJBQVksZUF3V3hCLENBQUE7QUFHSCxDQUFDLEVBMWFnQixRQUFRLHdCQUFSLFFBQVEsUUEwYXhCO0FBR0Qsa0JBQWUsUUFBUSxDQUFDO0FBQ3hCLElBQUEsMkRBQXVCLEVBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDIn0=