@seeqdev/qomponents 0.0.109 → 0.0.110

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (219) hide show
  1. package/dist/ProgressBar/ProgressBar.d.ts +4 -0
  2. package/dist/ProgressBar/ProgressBar.js +16 -0
  3. package/dist/ProgressBar/ProgressBar.js.map +1 -0
  4. package/dist/ProgressBar/ProgressBar.stories.d.ts +5 -0
  5. package/dist/ProgressBar/ProgressBar.stories.js +42 -0
  6. package/dist/ProgressBar/ProgressBar.stories.js.map +1 -0
  7. package/dist/ProgressBar/ProgressBar.test.d.ts +1 -0
  8. package/dist/ProgressBar/ProgressBar.test.js +32 -0
  9. package/dist/ProgressBar/ProgressBar.test.js.map +1 -0
  10. package/dist/ProgressBar/ProgressBar.types.d.ts +10 -0
  11. package/dist/ProgressBar/ProgressBar.types.js +2 -0
  12. package/dist/ProgressBar/ProgressBar.types.js.map +1 -0
  13. package/dist/ProgressBar/index.d.ts +1 -0
  14. package/dist/ProgressBar/index.js +2 -0
  15. package/dist/ProgressBar/index.js.map +1 -0
  16. package/dist/Slider/Slider.d.ts +6 -0
  17. package/dist/Slider/Slider.js +13 -0
  18. package/dist/Slider/Slider.js.map +1 -0
  19. package/dist/Slider/Slider.stories.d.ts +5 -0
  20. package/dist/Slider/Slider.stories.js +58 -0
  21. package/dist/Slider/Slider.stories.js.map +1 -0
  22. package/dist/Slider/Slider.test.d.ts +1 -0
  23. package/dist/Slider/Slider.test.js +38 -0
  24. package/dist/Slider/Slider.test.js.map +1 -0
  25. package/dist/Slider/Slider.types.d.ts +13 -0
  26. package/dist/Slider/Slider.types.js +2 -0
  27. package/dist/Slider/Slider.types.js.map +1 -0
  28. package/dist/Slider/index.d.ts +1 -0
  29. package/dist/Slider/index.js +2 -0
  30. package/dist/Slider/index.js.map +1 -0
  31. package/dist/index.d.ts +2 -0
  32. package/dist/index.esm.js +1667 -1725
  33. package/dist/index.esm.js.map +1 -1
  34. package/dist/index.js +1667 -1724
  35. package/dist/index.js.map +1 -1
  36. package/dist/styles.css +28 -0
  37. package/package.json +5 -4
  38. package/dist/Accordion/Accordion.js +0 -9
  39. package/dist/Accordion/Accordion.js.map +0 -1
  40. package/dist/Accordion/Accordion.stories.js +0 -115
  41. package/dist/Accordion/Accordion.stories.js.map +0 -1
  42. package/dist/Accordion/Accordion.test.js +0 -55
  43. package/dist/Accordion/Accordion.test.js.map +0 -1
  44. package/dist/Accordion/Accordion.types.js +0 -2
  45. package/dist/Accordion/Accordion.types.js.map +0 -1
  46. package/dist/Accordion/index.js +0 -2
  47. package/dist/Accordion/index.js.map +0 -1
  48. package/dist/Alert/Alert.js +0 -32
  49. package/dist/Alert/Alert.js.map +0 -1
  50. package/dist/Alert/Alert.stories.js +0 -45
  51. package/dist/Alert/Alert.stories.js.map +0 -1
  52. package/dist/Alert/Alert.test.js +0 -51
  53. package/dist/Alert/Alert.test.js.map +0 -1
  54. package/dist/Alert/Alert.types.js +0 -2
  55. package/dist/Alert/Alert.types.js.map +0 -1
  56. package/dist/Alert/index.js +0 -2
  57. package/dist/Alert/index.js.map +0 -1
  58. package/dist/Button/Button.js +0 -92
  59. package/dist/Button/Button.js.map +0 -1
  60. package/dist/Button/Button.stories.js +0 -98
  61. package/dist/Button/Button.stories.js.map +0 -1
  62. package/dist/Button/Button.test.js +0 -49
  63. package/dist/Button/Button.test.js.map +0 -1
  64. package/dist/Button/Button.types.js +0 -5
  65. package/dist/Button/Button.types.js.map +0 -1
  66. package/dist/Button/index.js +0 -2
  67. package/dist/Button/index.js.map +0 -1
  68. package/dist/ButtonWithDropdown/ButtonWithDropdown.js +0 -67
  69. package/dist/ButtonWithDropdown/ButtonWithDropdown.js.map +0 -1
  70. package/dist/ButtonWithDropdown/ButtonWithDropdown.stories.js +0 -98
  71. package/dist/ButtonWithDropdown/ButtonWithDropdown.stories.js.map +0 -1
  72. package/dist/ButtonWithDropdown/ButtonWithDropdown.test.js +0 -85
  73. package/dist/ButtonWithDropdown/ButtonWithDropdown.test.js.map +0 -1
  74. package/dist/ButtonWithDropdown/ButtonWithDropdown.types.js +0 -2
  75. package/dist/ButtonWithDropdown/ButtonWithDropdown.types.js.map +0 -1
  76. package/dist/ButtonWithDropdown/index.js +0 -2
  77. package/dist/ButtonWithDropdown/index.js.map +0 -1
  78. package/dist/ButtonWithPopover/ButtonWithPopover.js +0 -53
  79. package/dist/ButtonWithPopover/ButtonWithPopover.js.map +0 -1
  80. package/dist/ButtonWithPopover/ButtonWithPopover.stories.js +0 -75
  81. package/dist/ButtonWithPopover/ButtonWithPopover.stories.js.map +0 -1
  82. package/dist/ButtonWithPopover/ButtonWithPopover.test.js +0 -82
  83. package/dist/ButtonWithPopover/ButtonWithPopover.test.js.map +0 -1
  84. package/dist/ButtonWithPopover/ButtonWithPopover.types.js +0 -2
  85. package/dist/ButtonWithPopover/ButtonWithPopover.types.js.map +0 -1
  86. package/dist/ButtonWithPopover/index.js +0 -2
  87. package/dist/ButtonWithPopover/index.js.map +0 -1
  88. package/dist/Checkbox/Checkbox.js +0 -26
  89. package/dist/Checkbox/Checkbox.js.map +0 -1
  90. package/dist/Checkbox/Checkbox.stories.js +0 -34
  91. package/dist/Checkbox/Checkbox.stories.js.map +0 -1
  92. package/dist/Checkbox/Checkbox.test.js +0 -94
  93. package/dist/Checkbox/Checkbox.test.js.map +0 -1
  94. package/dist/Checkbox/Checkbox.types.js +0 -2
  95. package/dist/Checkbox/Checkbox.types.js.map +0 -1
  96. package/dist/Checkbox/index.js +0 -2
  97. package/dist/Checkbox/index.js.map +0 -1
  98. package/dist/Icon/Icon.js +0 -55
  99. package/dist/Icon/Icon.js.map +0 -1
  100. package/dist/Icon/Icon.stories.js +0 -45
  101. package/dist/Icon/Icon.stories.js.map +0 -1
  102. package/dist/Icon/Icon.test.js +0 -55
  103. package/dist/Icon/Icon.test.js.map +0 -1
  104. package/dist/Icon/Icon.types.js +0 -16
  105. package/dist/Icon/Icon.types.js.map +0 -1
  106. package/dist/Icon/index.js +0 -2
  107. package/dist/Icon/index.js.map +0 -1
  108. package/dist/InputGroup/InputGroup.js +0 -26
  109. package/dist/InputGroup/InputGroup.js.map +0 -1
  110. package/dist/InputGroup/InputGroup.stories.js +0 -142
  111. package/dist/InputGroup/InputGroup.stories.js.map +0 -1
  112. package/dist/InputGroup/InputGroup.test.js +0 -43
  113. package/dist/InputGroup/InputGroup.test.js.map +0 -1
  114. package/dist/InputGroup/InputGroup.types.js +0 -2
  115. package/dist/InputGroup/InputGroup.types.js.map +0 -1
  116. package/dist/InputGroup/index.js +0 -2
  117. package/dist/InputGroup/index.js.map +0 -1
  118. package/dist/Modal/Modal.js +0 -100
  119. package/dist/Modal/Modal.js.map +0 -1
  120. package/dist/Modal/Modal.stories.js +0 -127
  121. package/dist/Modal/Modal.stories.js.map +0 -1
  122. package/dist/Modal/Modal.test.js +0 -108
  123. package/dist/Modal/Modal.test.js.map +0 -1
  124. package/dist/Modal/Modal.types.js +0 -2
  125. package/dist/Modal/Modal.types.js.map +0 -1
  126. package/dist/Modal/index.js +0 -2
  127. package/dist/Modal/index.js.map +0 -1
  128. package/dist/SeeqActionDropdown/SeeqActionDropdown.js +0 -48
  129. package/dist/SeeqActionDropdown/SeeqActionDropdown.js.map +0 -1
  130. package/dist/SeeqActionDropdown/SeeqActionDropdown.stories.js +0 -80
  131. package/dist/SeeqActionDropdown/SeeqActionDropdown.stories.js.map +0 -1
  132. package/dist/SeeqActionDropdown/SeeqActionDropdown.test.js +0 -73
  133. package/dist/SeeqActionDropdown/SeeqActionDropdown.test.js.map +0 -1
  134. package/dist/SeeqActionDropdown/SeeqActionDropdown.types.js +0 -2
  135. package/dist/SeeqActionDropdown/SeeqActionDropdown.types.js.map +0 -1
  136. package/dist/SeeqActionDropdown/index.js +0 -2
  137. package/dist/SeeqActionDropdown/index.js.map +0 -1
  138. package/dist/SeeqActionDropdown/variants.js +0 -23
  139. package/dist/SeeqActionDropdown/variants.js.map +0 -1
  140. package/dist/Select/Select.js +0 -174
  141. package/dist/Select/Select.js.map +0 -1
  142. package/dist/Select/Select.stories.js +0 -80
  143. package/dist/Select/Select.stories.js.map +0 -1
  144. package/dist/Select/Select.test.js +0 -182
  145. package/dist/Select/Select.test.js.map +0 -1
  146. package/dist/Select/Select.types.js +0 -2
  147. package/dist/Select/Select.types.js.map +0 -1
  148. package/dist/Select/index.js +0 -3
  149. package/dist/Select/index.js.map +0 -1
  150. package/dist/Tabs/Tabs.js +0 -22
  151. package/dist/Tabs/Tabs.js.map +0 -1
  152. package/dist/Tabs/Tabs.stories.js +0 -91
  153. package/dist/Tabs/Tabs.stories.js.map +0 -1
  154. package/dist/Tabs/Tabs.test.js +0 -91
  155. package/dist/Tabs/Tabs.test.js.map +0 -1
  156. package/dist/Tabs/Tabs.types.js +0 -2
  157. package/dist/Tabs/Tabs.types.js.map +0 -1
  158. package/dist/Tabs/index.js +0 -2
  159. package/dist/Tabs/index.js.map +0 -1
  160. package/dist/TextArea/TextArea.js +0 -25
  161. package/dist/TextArea/TextArea.js.map +0 -1
  162. package/dist/TextArea/TextArea.stories.js +0 -46
  163. package/dist/TextArea/TextArea.stories.js.map +0 -1
  164. package/dist/TextArea/TextArea.test.js +0 -68
  165. package/dist/TextArea/TextArea.test.js.map +0 -1
  166. package/dist/TextArea/TextArea.types.js +0 -2
  167. package/dist/TextArea/TextArea.types.js.map +0 -1
  168. package/dist/TextArea/index.js +0 -2
  169. package/dist/TextArea/index.js.map +0 -1
  170. package/dist/TextField/TextField.js +0 -79
  171. package/dist/TextField/TextField.js.map +0 -1
  172. package/dist/TextField/TextField.stories.js +0 -70
  173. package/dist/TextField/TextField.stories.js.map +0 -1
  174. package/dist/TextField/TextField.test.js +0 -39
  175. package/dist/TextField/TextField.test.js.map +0 -1
  176. package/dist/TextField/TextField.types.js +0 -2
  177. package/dist/TextField/TextField.types.js.map +0 -1
  178. package/dist/TextField/index.js +0 -2
  179. package/dist/TextField/index.js.map +0 -1
  180. package/dist/ToolbarButton/ToolbarButton.js +0 -75
  181. package/dist/ToolbarButton/ToolbarButton.js.map +0 -1
  182. package/dist/ToolbarButton/ToolbarButton.stories.js +0 -94
  183. package/dist/ToolbarButton/ToolbarButton.stories.js.map +0 -1
  184. package/dist/ToolbarButton/ToolbarButton.test.js +0 -93
  185. package/dist/ToolbarButton/ToolbarButton.test.js.map +0 -1
  186. package/dist/ToolbarButton/ToolbarButton.types.js +0 -2
  187. package/dist/ToolbarButton/ToolbarButton.types.js.map +0 -1
  188. package/dist/ToolbarButton/index.js +0 -2
  189. package/dist/ToolbarButton/index.js.map +0 -1
  190. package/dist/Tooltip/QTip.stories.js +0 -45
  191. package/dist/Tooltip/QTip.stories.js.map +0 -1
  192. package/dist/Tooltip/QTip.types.js +0 -2
  193. package/dist/Tooltip/QTip.types.js.map +0 -1
  194. package/dist/Tooltip/QTipPerformance.stories.js +0 -30
  195. package/dist/Tooltip/QTipPerformance.stories.js.map +0 -1
  196. package/dist/Tooltip/Qtip.js +0 -155
  197. package/dist/Tooltip/Qtip.js.map +0 -1
  198. package/dist/Tooltip/Tooltip.js +0 -36
  199. package/dist/Tooltip/Tooltip.js.map +0 -1
  200. package/dist/Tooltip/Tooltip.stories.js +0 -32
  201. package/dist/Tooltip/Tooltip.stories.js.map +0 -1
  202. package/dist/Tooltip/Tooltip.types.js +0 -3
  203. package/dist/Tooltip/Tooltip.types.js.map +0 -1
  204. package/dist/Tooltip/TooltipPerformance.stories.js +0 -30
  205. package/dist/Tooltip/TooltipPerformance.stories.js.map +0 -1
  206. package/dist/Tooltip/index.js +0 -3
  207. package/dist/Tooltip/index.js.map +0 -1
  208. package/dist/Tooltip/qTip.utilities.js +0 -11
  209. package/dist/Tooltip/qTip.utilities.js.map +0 -1
  210. package/dist/types.js +0 -2
  211. package/dist/types.js.map +0 -1
  212. package/dist/utils/browserId.js +0 -29
  213. package/dist/utils/browserId.js.map +0 -1
  214. package/dist/utils/svg.js +0 -20
  215. package/dist/utils/svg.js.map +0 -1
  216. package/dist/utils/validateStyleDimension.js +0 -14
  217. package/dist/utils/validateStyleDimension.js.map +0 -1
  218. package/dist/utils/validateStyleDimension.test.js +0 -20
  219. package/dist/utils/validateStyleDimension.test.js.map +0 -1
package/dist/index.js CHANGED
@@ -2,6 +2,7 @@
2
2
 
3
3
  var React = require('react');
4
4
  var ReactDOM = require('react-dom');
5
+ var jsxRuntime = require('react/jsx-runtime');
5
6
 
6
7
  function _interopNamespaceDefault(e) {
7
8
  var n = Object.create(null);
@@ -1084,14 +1085,8 @@ function $1746a345f3d73bb7$export$f680877a34711e37(deterministicId) {
1084
1085
  */
1085
1086
 
1086
1087
  const sides = ['top', 'right', 'bottom', 'left'];
1087
- const min = Math.min;
1088
- const max = Math.max;
1089
- const round = Math.round;
1090
- const floor = Math.floor;
1091
- const createCoords = v => ({
1092
- x: v,
1093
- y: v
1094
- });
1088
+ const min$1 = Math.min;
1089
+ const max$1 = Math.max;
1095
1090
  const oppositeSideMap = {
1096
1091
  left: 'right',
1097
1092
  right: 'left',
@@ -1103,7 +1098,7 @@ const oppositeAlignmentMap = {
1103
1098
  end: 'start'
1104
1099
  };
1105
1100
  function clamp(start, value, end) {
1106
- return max(start, min(value, end));
1101
+ return max$1(start, min$1(value, end));
1107
1102
  }
1108
1103
  function evaluate(value, param) {
1109
1104
  return typeof value === 'function' ? value(param) : value;
@@ -1420,7 +1415,7 @@ async function detectOverflow(state, options) {
1420
1415
  * appears centered to the reference element.
1421
1416
  * @see https://floating-ui.com/docs/arrow
1422
1417
  */
1423
- const arrow$2 = options => ({
1418
+ const arrow$1 = options => ({
1424
1419
  name: 'arrow',
1425
1420
  options,
1426
1421
  async fn(state) {
@@ -1467,22 +1462,22 @@ const arrow$2 = options => ({
1467
1462
  // If the padding is large enough that it causes the arrow to no longer be
1468
1463
  // centered, modify the padding so that it is centered.
1469
1464
  const largestPossiblePadding = clientSize / 2 - arrowDimensions[length] / 2 - 1;
1470
- const minPadding = min(paddingObject[minProp], largestPossiblePadding);
1471
- const maxPadding = min(paddingObject[maxProp], largestPossiblePadding);
1465
+ const minPadding = min$1(paddingObject[minProp], largestPossiblePadding);
1466
+ const maxPadding = min$1(paddingObject[maxProp], largestPossiblePadding);
1472
1467
 
1473
1468
  // Make sure the arrow doesn't overflow the floating element if the center
1474
1469
  // point is outside the floating element's bounds.
1475
- const min$1 = minPadding;
1470
+ const min$1$1 = minPadding;
1476
1471
  const max = clientSize - arrowDimensions[length] - maxPadding;
1477
1472
  const center = clientSize / 2 - arrowDimensions[length] / 2 + centerToReference;
1478
- const offset = clamp(min$1, center, max);
1473
+ const offset = clamp(min$1$1, center, max);
1479
1474
 
1480
1475
  // If the reference is small enough that the arrow's padding causes it to
1481
1476
  // to point to nothing for an aligned placement, adjust the offset of the
1482
1477
  // floating element itself. To ensure `shift()` continues to take action,
1483
1478
  // a single reset is performed when this is true.
1484
- const shouldAddOffset = !middlewareData.arrow && getAlignment(placement) != null && center != offset && rects.reference[length] / 2 - (center < min$1 ? minPadding : maxPadding) - arrowDimensions[length] / 2 < 0;
1485
- const alignmentOffset = shouldAddOffset ? center < min$1 ? center - min$1 : center - max : 0;
1479
+ const shouldAddOffset = !middlewareData.arrow && getAlignment(placement) != null && center != offset && rects.reference[length] / 2 - (center < min$1$1 ? minPadding : maxPadding) - arrowDimensions[length] / 2 < 0;
1480
+ const alignmentOffset = shouldAddOffset ? center < min$1$1 ? center - min$1$1 : center - max : 0;
1486
1481
  return {
1487
1482
  [axis]: coords[axis] + alignmentOffset,
1488
1483
  data: {
@@ -1503,7 +1498,7 @@ const arrow$2 = options => ({
1503
1498
  * clipping boundary. Alternative to `autoPlacement`.
1504
1499
  * @see https://floating-ui.com/docs/flip
1505
1500
  */
1506
- const flip$1 = function (options) {
1501
+ const flip = function (options) {
1507
1502
  if (options === void 0) {
1508
1503
  options = {};
1509
1504
  }
@@ -1628,7 +1623,7 @@ function isAnySideFullyClipped(overflow) {
1628
1623
  * when it is not in the same clipping context as the reference element.
1629
1624
  * @see https://floating-ui.com/docs/hide
1630
1625
  */
1631
- const hide$1 = function (options) {
1626
+ const hide = function (options) {
1632
1627
  if (options === void 0) {
1633
1628
  options = {};
1634
1629
  }
@@ -1771,7 +1766,7 @@ const offset = function (options) {
1771
1766
  * keep it in view when it will overflow the clipping boundary.
1772
1767
  * @see https://floating-ui.com/docs/shift
1773
1768
  */
1774
- const shift$1 = function (options) {
1769
+ const shift = function (options) {
1775
1770
  if (options === void 0) {
1776
1771
  options = {};
1777
1772
  }
@@ -1842,7 +1837,7 @@ const shift$1 = function (options) {
1842
1837
  /**
1843
1838
  * Built-in `limiter` that will stop `shift()` at a certain point.
1844
1839
  */
1845
- const limitShift$1 = function (options) {
1840
+ const limitShift = function (options) {
1846
1841
  if (options === void 0) {
1847
1842
  options = {};
1848
1843
  }
@@ -1914,7 +1909,7 @@ const limitShift$1 = function (options) {
1914
1909
  * width of the reference element.
1915
1910
  * @see https://floating-ui.com/docs/size
1916
1911
  */
1917
- const size$1 = function (options) {
1912
+ const size = function (options) {
1918
1913
  if (options === void 0) {
1919
1914
  options = {};
1920
1915
  }
@@ -1956,20 +1951,20 @@ const size$1 = function (options) {
1956
1951
  let availableWidth = overflowAvailableWidth;
1957
1952
  if (isYAxis) {
1958
1953
  const maximumClippingWidth = width - overflow.left - overflow.right;
1959
- availableWidth = alignment || noShift ? min(overflowAvailableWidth, maximumClippingWidth) : maximumClippingWidth;
1954
+ availableWidth = alignment || noShift ? min$1(overflowAvailableWidth, maximumClippingWidth) : maximumClippingWidth;
1960
1955
  } else {
1961
1956
  const maximumClippingHeight = height - overflow.top - overflow.bottom;
1962
- availableHeight = alignment || noShift ? min(overflowAvailableHeight, maximumClippingHeight) : maximumClippingHeight;
1957
+ availableHeight = alignment || noShift ? min$1(overflowAvailableHeight, maximumClippingHeight) : maximumClippingHeight;
1963
1958
  }
1964
1959
  if (noShift && !alignment) {
1965
- const xMin = max(overflow.left, 0);
1966
- const xMax = max(overflow.right, 0);
1967
- const yMin = max(overflow.top, 0);
1968
- const yMax = max(overflow.bottom, 0);
1960
+ const xMin = max$1(overflow.left, 0);
1961
+ const xMax = max$1(overflow.right, 0);
1962
+ const yMin = max$1(overflow.top, 0);
1963
+ const yMax = max$1(overflow.bottom, 0);
1969
1964
  if (isYAxis) {
1970
- availableWidth = width - 2 * (xMin !== 0 || xMax !== 0 ? xMin + xMax : max(overflow.left, overflow.right));
1965
+ availableWidth = width - 2 * (xMin !== 0 || xMax !== 0 ? xMin + xMax : max$1(overflow.left, overflow.right));
1971
1966
  } else {
1972
- availableHeight = height - 2 * (yMin !== 0 || yMax !== 0 ? yMin + yMax : max(overflow.top, overflow.bottom));
1967
+ availableHeight = height - 2 * (yMin !== 0 || yMax !== 0 ? yMin + yMax : max$1(overflow.top, overflow.bottom));
1973
1968
  }
1974
1969
  }
1975
1970
  await apply({
@@ -1990,6 +1985,15 @@ const size$1 = function (options) {
1990
1985
  };
1991
1986
  };
1992
1987
 
1988
+ const min = Math.min;
1989
+ const max = Math.max;
1990
+ const round = Math.round;
1991
+ const floor = Math.floor;
1992
+ const createCoords = v => ({
1993
+ x: v,
1994
+ y: v
1995
+ });
1996
+
1993
1997
  function getNodeName(node) {
1994
1998
  if (isNode(node)) {
1995
1999
  return (node.nodeName || '').toLowerCase();
@@ -2001,7 +2005,7 @@ function getNodeName(node) {
2001
2005
  }
2002
2006
  function getWindow(node) {
2003
2007
  var _node$ownerDocument;
2004
- return (node == null || (_node$ownerDocument = node.ownerDocument) == null ? void 0 : _node$ownerDocument.defaultView) || window;
2008
+ return (node == null ? void 0 : (_node$ownerDocument = node.ownerDocument) == null ? void 0 : _node$ownerDocument.defaultView) || window;
2005
2009
  }
2006
2010
  function getDocumentElement(node) {
2007
2011
  var _ref;
@@ -2385,7 +2389,7 @@ function getClippingElementAncestors(element, cache) {
2385
2389
  if (cachedResult) {
2386
2390
  return cachedResult;
2387
2391
  }
2388
- let result = getOverflowAncestors(element, [], false).filter(el => isElement(el) && getNodeName(el) !== 'body');
2392
+ let result = getOverflowAncestors(element).filter(el => isElement(el) && getNodeName(el) !== 'body');
2389
2393
  let currentContainingBlockComputedStyle = null;
2390
2394
  const elementIsFixed = getComputedStyle$1(element).position === 'fixed';
2391
2395
  let currentNode = elementIsFixed ? getParentNode(element) : element;
@@ -2440,14 +2444,7 @@ function getClippingRect(_ref) {
2440
2444
  }
2441
2445
 
2442
2446
  function getDimensions(element) {
2443
- const {
2444
- width,
2445
- height
2446
- } = getCssDimensions(element);
2447
- return {
2448
- width,
2449
- height
2450
- };
2447
+ return getCssDimensions(element);
2451
2448
  }
2452
2449
 
2453
2450
  function getRectRelativeToOffsetParent(element, offsetParent, strategy) {
@@ -2693,51 +2690,10 @@ function autoUpdate(reference, floating, update, options) {
2693
2690
  };
2694
2691
  }
2695
2692
 
2696
- /**
2697
- * Optimizes the visibility of the floating element by shifting it in order to
2698
- * keep it in view when it will overflow the clipping boundary.
2699
- * @see https://floating-ui.com/docs/shift
2700
- */
2701
- const shift = shift$1;
2702
-
2703
- /**
2704
- * Optimizes the visibility of the floating element by flipping the `placement`
2705
- * in order to keep it in view when the preferred placement(s) will overflow the
2706
- * clipping boundary. Alternative to `autoPlacement`.
2707
- * @see https://floating-ui.com/docs/flip
2708
- */
2709
- const flip = flip$1;
2710
-
2711
- /**
2712
- * Provides data that allows you to change the size of the floating element —
2713
- * for instance, prevent it from overflowing the clipping boundary or match the
2714
- * width of the reference element.
2715
- * @see https://floating-ui.com/docs/size
2716
- */
2717
- const size = size$1;
2718
-
2719
- /**
2720
- * Provides data to hide the floating element in applicable situations, such as
2721
- * when it is not in the same clipping context as the reference element.
2722
- * @see https://floating-ui.com/docs/hide
2723
- */
2724
- const hide = hide$1;
2725
-
2726
- /**
2727
- * Provides data to position an inner element of the floating element so that it
2728
- * appears centered to the reference element.
2729
- * @see https://floating-ui.com/docs/arrow
2730
- */
2731
- const arrow$1 = arrow$2;
2732
-
2733
- /**
2734
- * Built-in `limiter` that will stop `shift()` at a certain point.
2735
- */
2736
- const limitShift = limitShift$1;
2737
-
2738
2693
  /**
2739
2694
  * Computes the `x` and `y` coordinates that will place the floating element
2740
- * next to a given reference element.
2695
+ * next to a reference element when it is given a certain CSS positioning
2696
+ * strategy.
2741
2697
  */
2742
2698
  const computePosition = (reference, floating, options) => {
2743
2699
  // This caches the expensive `getClippingElementAncestors` function so that
@@ -4841,1648 +4797,1335 @@ const Tooltip = ({ position = 'bottom', children, text, delay = DEFAULT_TOOL_TIP
4841
4797
  tw-absolute tw-opacity-0 group-hover:tw-opacity-100 tw-rounded tw-bg-black tw-p-2 tw-text-xs tw-text-white ${placements[position]}` }, text)));
4842
4798
  };
4843
4799
 
4844
- var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
4845
-
4846
- var purifyExports = {};
4847
- var purify = {
4848
- get exports(){ return purifyExports; },
4849
- set exports(v){ purifyExports = v; },
4850
- };
4851
-
4852
- /*! @license DOMPurify 3.0.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.5/LICENSE */
4853
-
4854
- (function (module, exports) {
4855
- (function (global, factory) {
4856
- module.exports = factory() ;
4857
- })(commonjsGlobal, (function () {
4858
- const {
4859
- entries,
4860
- setPrototypeOf,
4861
- isFrozen,
4862
- getPrototypeOf,
4863
- getOwnPropertyDescriptor
4864
- } = Object;
4865
- let {
4866
- freeze,
4867
- seal,
4868
- create
4869
- } = Object; // eslint-disable-line import/no-mutable-exports
4870
-
4871
- let {
4872
- apply,
4873
- construct
4874
- } = typeof Reflect !== 'undefined' && Reflect;
4875
-
4876
- if (!apply) {
4877
- apply = function apply(fun, thisValue, args) {
4878
- return fun.apply(thisValue, args);
4879
- };
4880
- }
4881
-
4882
- if (!freeze) {
4883
- freeze = function freeze(x) {
4884
- return x;
4885
- };
4886
- }
4887
-
4888
- if (!seal) {
4889
- seal = function seal(x) {
4890
- return x;
4891
- };
4892
- }
4893
-
4894
- if (!construct) {
4895
- construct = function construct(Func, args) {
4896
- return new Func(...args);
4897
- };
4898
- }
4899
-
4900
- const arrayForEach = unapply(Array.prototype.forEach);
4901
- const arrayPop = unapply(Array.prototype.pop);
4902
- const arrayPush = unapply(Array.prototype.push);
4903
- const stringToLowerCase = unapply(String.prototype.toLowerCase);
4904
- const stringToString = unapply(String.prototype.toString);
4905
- const stringMatch = unapply(String.prototype.match);
4906
- const stringReplace = unapply(String.prototype.replace);
4907
- const stringIndexOf = unapply(String.prototype.indexOf);
4908
- const stringTrim = unapply(String.prototype.trim);
4909
- const regExpTest = unapply(RegExp.prototype.test);
4910
- const typeErrorCreate = unconstruct(TypeError);
4911
- function unapply(func) {
4912
- return function (thisArg) {
4913
- for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
4914
- args[_key - 1] = arguments[_key];
4915
- }
4916
-
4917
- return apply(func, thisArg, args);
4918
- };
4919
- }
4920
- function unconstruct(func) {
4921
- return function () {
4922
- for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
4923
- args[_key2] = arguments[_key2];
4924
- }
4925
-
4926
- return construct(func, args);
4927
- };
4928
- }
4929
- /* Add properties to a lookup table */
4930
-
4931
- function addToSet(set, array, transformCaseFunc) {
4932
- var _transformCaseFunc;
4933
-
4934
- transformCaseFunc = (_transformCaseFunc = transformCaseFunc) !== null && _transformCaseFunc !== void 0 ? _transformCaseFunc : stringToLowerCase;
4935
-
4936
- if (setPrototypeOf) {
4937
- // Make 'in' and truthy checks like Boolean(set.constructor)
4938
- // independent of any properties defined on Object.prototype.
4939
- // Prevent prototype setters from intercepting set as a this value.
4940
- setPrototypeOf(set, null);
4941
- }
4942
-
4943
- let l = array.length;
4944
-
4945
- while (l--) {
4946
- let element = array[l];
4947
-
4948
- if (typeof element === 'string') {
4949
- const lcElement = transformCaseFunc(element);
4950
-
4951
- if (lcElement !== element) {
4952
- // Config presets (e.g. tags.js, attrs.js) are immutable.
4953
- if (!isFrozen(array)) {
4954
- array[l] = lcElement;
4955
- }
4956
-
4957
- element = lcElement;
4958
- }
4959
- }
4960
-
4961
- set[element] = true;
4962
- }
4963
-
4964
- return set;
4965
- }
4966
- /* Shallow clone an object */
4967
-
4968
- function clone(object) {
4969
- const newObject = create(null);
4970
-
4971
- for (const [property, value] of entries(object)) {
4972
- newObject[property] = value;
4973
- }
4974
-
4975
- return newObject;
4976
- }
4977
- /* This method automatically checks if the prop is function
4978
- * or getter and behaves accordingly. */
4979
-
4980
- function lookupGetter(object, prop) {
4981
- while (object !== null) {
4982
- const desc = getOwnPropertyDescriptor(object, prop);
4983
-
4984
- if (desc) {
4985
- if (desc.get) {
4986
- return unapply(desc.get);
4987
- }
4988
-
4989
- if (typeof desc.value === 'function') {
4990
- return unapply(desc.value);
4991
- }
4992
- }
4993
-
4994
- object = getPrototypeOf(object);
4995
- }
4996
-
4997
- function fallbackValue(element) {
4998
- console.warn('fallback value for', element);
4999
- return null;
5000
- }
5001
-
5002
- return fallbackValue;
5003
- }
5004
-
5005
- const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
5006
-
5007
- const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
5008
- const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
5009
- // We still need to know them so that we can do namespace
5010
- // checks properly in case one wants to add them to
5011
- // allow-list.
5012
-
5013
- const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
5014
- const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']); // Similarly to SVG, we want to know all MathML elements,
5015
- // even those that we disallow by default.
5016
-
5017
- const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
5018
- const text = freeze(['#text']);
5019
-
5020
- const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
5021
- const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
5022
- const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
5023
- const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
5024
-
5025
- const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
5026
-
5027
- const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
5028
- const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
5029
- const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
5030
-
5031
- const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
5032
-
5033
- const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
5034
- );
5035
- const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
5036
- const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
5037
- );
5038
- const DOCTYPE_NAME = seal(/^html$/i);
5039
-
5040
- var EXPRESSIONS = /*#__PURE__*/Object.freeze({
5041
- __proto__: null,
5042
- MUSTACHE_EXPR: MUSTACHE_EXPR,
5043
- ERB_EXPR: ERB_EXPR,
5044
- TMPLIT_EXPR: TMPLIT_EXPR,
5045
- DATA_ATTR: DATA_ATTR,
5046
- ARIA_ATTR: ARIA_ATTR,
5047
- IS_ALLOWED_URI: IS_ALLOWED_URI,
5048
- IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
5049
- ATTR_WHITESPACE: ATTR_WHITESPACE,
5050
- DOCTYPE_NAME: DOCTYPE_NAME
5051
- });
5052
-
5053
- const getGlobal = () => typeof window === 'undefined' ? null : window;
5054
- /**
5055
- * Creates a no-op policy for internal use only.
5056
- * Don't export this function outside this module!
5057
- * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
5058
- * @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
5059
- * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
5060
- * are not supported or creating the policy failed).
5061
- */
5062
-
5063
-
5064
- const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
5065
- if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
5066
- return null;
5067
- } // Allow the callers to control the unique policy name
5068
- // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
5069
- // Policy creation with duplicate names throws in Trusted Types.
5070
-
5071
-
5072
- let suffix = null;
5073
- const ATTR_NAME = 'data-tt-policy-suffix';
5074
-
5075
- if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
5076
- suffix = purifyHostElement.getAttribute(ATTR_NAME);
5077
- }
5078
-
5079
- const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
5080
-
5081
- try {
5082
- return trustedTypes.createPolicy(policyName, {
5083
- createHTML(html) {
5084
- return html;
5085
- },
5086
-
5087
- createScriptURL(scriptUrl) {
5088
- return scriptUrl;
5089
- }
5090
-
5091
- });
5092
- } catch (_) {
5093
- // Policy creation failed (most likely another DOMPurify script has
5094
- // already run). Skip creating the policy, as this will only cause errors
5095
- // if TT are enforced.
5096
- console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
5097
- return null;
5098
- }
5099
- };
5100
-
5101
- function createDOMPurify() {
5102
- let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
5103
-
5104
- const DOMPurify = root => createDOMPurify(root);
5105
- /**
5106
- * Version label, exposed for easier checks
5107
- * if DOMPurify is up to date or not
5108
- */
5109
-
5110
-
5111
- DOMPurify.version = '3.0.5';
5112
- /**
5113
- * Array of elements that DOMPurify removed during sanitation.
5114
- * Empty if nothing was removed.
5115
- */
5116
-
5117
- DOMPurify.removed = [];
5118
-
5119
- if (!window || !window.document || window.document.nodeType !== 9) {
5120
- // Not running in a browser, provide a factory function
5121
- // so that you can pass your own Window
5122
- DOMPurify.isSupported = false;
5123
- return DOMPurify;
5124
- }
5125
-
5126
- const originalDocument = window.document;
5127
- const currentScript = originalDocument.currentScript;
5128
- let {
5129
- document
5130
- } = window;
5131
- const {
5132
- DocumentFragment,
5133
- HTMLTemplateElement,
5134
- Node,
5135
- Element,
5136
- NodeFilter,
5137
- NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,
5138
- HTMLFormElement,
5139
- DOMParser,
5140
- trustedTypes
5141
- } = window;
5142
- const ElementPrototype = Element.prototype;
5143
- const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
5144
- const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
5145
- const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
5146
- const getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
5147
- // new document created via createHTMLDocument. As per the spec
5148
- // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
5149
- // a new empty registry is used when creating a template contents owner
5150
- // document, so we use that as our parent document to ensure nothing
5151
- // is inherited.
5152
-
5153
- if (typeof HTMLTemplateElement === 'function') {
5154
- const template = document.createElement('template');
5155
-
5156
- if (template.content && template.content.ownerDocument) {
5157
- document = template.content.ownerDocument;
5158
- }
5159
- }
5160
-
5161
- let trustedTypesPolicy;
5162
- let emptyHTML = '';
5163
- const {
5164
- implementation,
5165
- createNodeIterator,
5166
- createDocumentFragment,
5167
- getElementsByTagName
5168
- } = document;
5169
- const {
5170
- importNode
5171
- } = originalDocument;
5172
- let hooks = {};
5173
- /**
5174
- * Expose whether this browser supports running the full DOMPurify.
5175
- */
5176
-
5177
- DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
5178
- const {
5179
- MUSTACHE_EXPR,
5180
- ERB_EXPR,
5181
- TMPLIT_EXPR,
5182
- DATA_ATTR,
5183
- ARIA_ATTR,
5184
- IS_SCRIPT_OR_DATA,
5185
- ATTR_WHITESPACE
5186
- } = EXPRESSIONS;
5187
- let {
5188
- IS_ALLOWED_URI: IS_ALLOWED_URI$1
5189
- } = EXPRESSIONS;
5190
- /**
5191
- * We consider the elements and attributes below to be safe. Ideally
5192
- * don't add any new ones but feel free to remove unwanted ones.
5193
- */
5194
-
5195
- /* allowed element names */
5196
-
5197
- let ALLOWED_TAGS = null;
5198
- const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
5199
- /* Allowed attribute names */
5200
-
5201
- let ALLOWED_ATTR = null;
5202
- const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
5203
- /*
5204
- * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
5205
- * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
5206
- * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
5207
- * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
5208
- */
5209
-
5210
- let CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
5211
- tagNameCheck: {
5212
- writable: true,
5213
- configurable: false,
5214
- enumerable: true,
5215
- value: null
5216
- },
5217
- attributeNameCheck: {
5218
- writable: true,
5219
- configurable: false,
5220
- enumerable: true,
5221
- value: null
5222
- },
5223
- allowCustomizedBuiltInElements: {
5224
- writable: true,
5225
- configurable: false,
5226
- enumerable: true,
5227
- value: false
5228
- }
5229
- }));
5230
- /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
5231
-
5232
- let FORBID_TAGS = null;
5233
- /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
5234
-
5235
- let FORBID_ATTR = null;
5236
- /* Decide if ARIA attributes are okay */
5237
-
5238
- let ALLOW_ARIA_ATTR = true;
5239
- /* Decide if custom data attributes are okay */
5240
-
5241
- let ALLOW_DATA_ATTR = true;
5242
- /* Decide if unknown protocols are okay */
5243
-
5244
- let ALLOW_UNKNOWN_PROTOCOLS = false;
5245
- /* Decide if self-closing tags in attributes are allowed.
5246
- * Usually removed due to a mXSS issue in jQuery 3.0 */
5247
-
5248
- let ALLOW_SELF_CLOSE_IN_ATTR = true;
5249
- /* Output should be safe for common template engines.
5250
- * This means, DOMPurify removes data attributes, mustaches and ERB
5251
- */
5252
-
5253
- let SAFE_FOR_TEMPLATES = false;
5254
- /* Decide if document with <html>... should be returned */
5255
-
5256
- let WHOLE_DOCUMENT = false;
5257
- /* Track whether config is already set on this instance of DOMPurify. */
5258
-
5259
- let SET_CONFIG = false;
5260
- /* Decide if all elements (e.g. style, script) must be children of
5261
- * document.body. By default, browsers might move them to document.head */
5262
-
5263
- let FORCE_BODY = false;
5264
- /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
5265
- * string (or a TrustedHTML object if Trusted Types are supported).
5266
- * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
5267
- */
5268
-
5269
- let RETURN_DOM = false;
5270
- /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
5271
- * string (or a TrustedHTML object if Trusted Types are supported) */
5272
-
5273
- let RETURN_DOM_FRAGMENT = false;
5274
- /* Try to return a Trusted Type object instead of a string, return a string in
5275
- * case Trusted Types are not supported */
5276
-
5277
- let RETURN_TRUSTED_TYPE = false;
5278
- /* Output should be free from DOM clobbering attacks?
5279
- * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
5280
- */
5281
-
5282
- let SANITIZE_DOM = true;
5283
- /* Achieve full DOM Clobbering protection by isolating the namespace of named
5284
- * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
5285
- *
5286
- * HTML/DOM spec rules that enable DOM Clobbering:
5287
- * - Named Access on Window (§7.3.3)
5288
- * - DOM Tree Accessors (§3.1.5)
5289
- * - Form Element Parent-Child Relations (§4.10.3)
5290
- * - Iframe srcdoc / Nested WindowProxies (§4.8.5)
5291
- * - HTMLCollection (§4.2.10.2)
5292
- *
5293
- * Namespace isolation is implemented by prefixing `id` and `name` attributes
5294
- * with a constant string, i.e., `user-content-`
5295
- */
5296
-
5297
- let SANITIZE_NAMED_PROPS = false;
5298
- const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
5299
- /* Keep element content when removing element? */
5300
-
5301
- let KEEP_CONTENT = true;
5302
- /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
5303
- * of importing it into a new Document and returning a sanitized copy */
5304
-
5305
- let IN_PLACE = false;
5306
- /* Allow usage of profiles like html, svg and mathMl */
5307
-
5308
- let USE_PROFILES = {};
5309
- /* Tags to ignore content of when KEEP_CONTENT is true */
5310
-
5311
- let FORBID_CONTENTS = null;
5312
- const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
5313
- /* Tags that are safe for data: URIs */
5314
-
5315
- let DATA_URI_TAGS = null;
5316
- const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
5317
- /* Attributes safe for values like "javascript:" */
5318
-
5319
- let URI_SAFE_ATTRIBUTES = null;
5320
- const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
5321
- const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
5322
- const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
5323
- const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
5324
- /* Document namespace */
5325
-
5326
- let NAMESPACE = HTML_NAMESPACE;
5327
- let IS_EMPTY_INPUT = false;
5328
- /* Allowed XHTML+XML namespaces */
5329
-
5330
- let ALLOWED_NAMESPACES = null;
5331
- const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
5332
- /* Parsing of strict XHTML documents */
5333
-
5334
- let PARSER_MEDIA_TYPE;
5335
- const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
5336
- const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
5337
- let transformCaseFunc;
5338
- /* Keep a reference to config to pass to hooks */
5339
-
5340
- let CONFIG = null;
5341
- /* Ideally, do not touch anything below this line */
5342
-
5343
- /* ______________________________________________ */
5344
-
5345
- const formElement = document.createElement('form');
5346
-
5347
- const isRegexOrFunction = function isRegexOrFunction(testValue) {
5348
- return testValue instanceof RegExp || testValue instanceof Function;
5349
- };
5350
- /**
5351
- * _parseConfig
5352
- *
5353
- * @param {Object} cfg optional config literal
5354
- */
5355
- // eslint-disable-next-line complexity
5356
-
5357
-
5358
- const _parseConfig = function _parseConfig(cfg) {
5359
- if (CONFIG && CONFIG === cfg) {
5360
- return;
5361
- }
5362
- /* Shield configuration object from tampering */
5363
-
5364
-
5365
- if (!cfg || typeof cfg !== 'object') {
5366
- cfg = {};
5367
- }
5368
- /* Shield configuration object from prototype pollution */
5369
-
5370
-
5371
- cfg = clone(cfg);
5372
- PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
5373
- SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
5374
-
5375
- transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
5376
- /* Set configuration parameters */
5377
-
5378
- ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
5379
- ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
5380
- ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
5381
- URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent
5382
- cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent
5383
- transformCaseFunc // eslint-disable-line indent
5384
- ) // eslint-disable-line indent
5385
- : DEFAULT_URI_SAFE_ATTRIBUTES;
5386
- DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
5387
- cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
5388
- transformCaseFunc // eslint-disable-line indent
5389
- ) // eslint-disable-line indent
5390
- : DEFAULT_DATA_URI_TAGS;
5391
- FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
5392
- FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
5393
- FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
5394
- USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
5395
- ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
5396
-
5397
- ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
5398
-
5399
- ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
5400
-
5401
- ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
5402
-
5403
- SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
5404
-
5405
- WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
5406
-
5407
- RETURN_DOM = cfg.RETURN_DOM || false; // Default false
5408
-
5409
- RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
5410
-
5411
- RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
5412
-
5413
- FORCE_BODY = cfg.FORCE_BODY || false; // Default false
5414
-
5415
- SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
5416
-
5417
- SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
5418
-
5419
- KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
5420
-
5421
- IN_PLACE = cfg.IN_PLACE || false; // Default false
5422
-
5423
- IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
5424
- NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
5425
- CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
5426
-
5427
- if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
5428
- CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
5429
- }
5430
-
5431
- if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
5432
- CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
5433
- }
5434
-
5435
- if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
5436
- CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
5437
- }
5438
-
5439
- if (SAFE_FOR_TEMPLATES) {
5440
- ALLOW_DATA_ATTR = false;
5441
- }
5442
-
5443
- if (RETURN_DOM_FRAGMENT) {
5444
- RETURN_DOM = true;
5445
- }
5446
- /* Parse profile info */
5447
-
5448
-
5449
- if (USE_PROFILES) {
5450
- ALLOWED_TAGS = addToSet({}, [...text]);
5451
- ALLOWED_ATTR = [];
5452
-
5453
- if (USE_PROFILES.html === true) {
5454
- addToSet(ALLOWED_TAGS, html$1);
5455
- addToSet(ALLOWED_ATTR, html);
5456
- }
5457
-
5458
- if (USE_PROFILES.svg === true) {
5459
- addToSet(ALLOWED_TAGS, svg$1);
5460
- addToSet(ALLOWED_ATTR, svg);
5461
- addToSet(ALLOWED_ATTR, xml);
5462
- }
5463
-
5464
- if (USE_PROFILES.svgFilters === true) {
5465
- addToSet(ALLOWED_TAGS, svgFilters);
5466
- addToSet(ALLOWED_ATTR, svg);
5467
- addToSet(ALLOWED_ATTR, xml);
5468
- }
5469
-
5470
- if (USE_PROFILES.mathMl === true) {
5471
- addToSet(ALLOWED_TAGS, mathMl$1);
5472
- addToSet(ALLOWED_ATTR, mathMl);
5473
- addToSet(ALLOWED_ATTR, xml);
5474
- }
5475
- }
5476
- /* Merge configuration parameters */
5477
-
5478
-
5479
- if (cfg.ADD_TAGS) {
5480
- if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
5481
- ALLOWED_TAGS = clone(ALLOWED_TAGS);
5482
- }
5483
-
5484
- addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
5485
- }
5486
-
5487
- if (cfg.ADD_ATTR) {
5488
- if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
5489
- ALLOWED_ATTR = clone(ALLOWED_ATTR);
5490
- }
5491
-
5492
- addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
5493
- }
5494
-
5495
- if (cfg.ADD_URI_SAFE_ATTR) {
5496
- addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
5497
- }
5498
-
5499
- if (cfg.FORBID_CONTENTS) {
5500
- if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
5501
- FORBID_CONTENTS = clone(FORBID_CONTENTS);
5502
- }
5503
-
5504
- addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
5505
- }
5506
- /* Add #text in case KEEP_CONTENT is set to true */
5507
-
5508
-
5509
- if (KEEP_CONTENT) {
5510
- ALLOWED_TAGS['#text'] = true;
5511
- }
5512
- /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
5513
-
5514
-
5515
- if (WHOLE_DOCUMENT) {
5516
- addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
5517
- }
5518
- /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
5519
-
5520
-
5521
- if (ALLOWED_TAGS.table) {
5522
- addToSet(ALLOWED_TAGS, ['tbody']);
5523
- delete FORBID_TAGS.tbody;
5524
- }
5525
-
5526
- if (cfg.TRUSTED_TYPES_POLICY) {
5527
- if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
5528
- throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
5529
- }
5530
-
5531
- if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
5532
- throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
5533
- } // Overwrite existing TrustedTypes policy.
5534
-
5535
-
5536
- trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; // Sign local variables required by `sanitize`.
5537
-
5538
- emptyHTML = trustedTypesPolicy.createHTML('');
5539
- } else {
5540
- // Uninitialized policy, attempt to initialize the internal dompurify policy.
5541
- if (trustedTypesPolicy === undefined) {
5542
- trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
5543
- } // If creating the internal policy succeeded sign internal variables.
5544
-
5545
-
5546
- if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
5547
- emptyHTML = trustedTypesPolicy.createHTML('');
5548
- }
5549
- } // Prevent further manipulation of configuration.
5550
- // Not available in IE8, Safari 5, etc.
5551
-
5552
-
5553
- if (freeze) {
5554
- freeze(cfg);
5555
- }
5556
-
5557
- CONFIG = cfg;
5558
- };
5559
-
5560
- const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
5561
- const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
5562
- // namespace. We need to specify them explicitly
5563
- // so that they don't get erroneously deleted from
5564
- // HTML namespace.
5565
-
5566
- const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
5567
- /* Keep track of all possible SVG and MathML tags
5568
- * so that we can perform the namespace checks
5569
- * correctly. */
5570
-
5571
- const ALL_SVG_TAGS = addToSet({}, svg$1);
5572
- addToSet(ALL_SVG_TAGS, svgFilters);
5573
- addToSet(ALL_SVG_TAGS, svgDisallowed);
5574
- const ALL_MATHML_TAGS = addToSet({}, mathMl$1);
5575
- addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
5576
- /**
5577
- *
5578
- *
5579
- * @param {Element} element a DOM element whose namespace is being checked
5580
- * @returns {boolean} Return false if the element has a
5581
- * namespace that a spec-compliant parser would never
5582
- * return. Return true otherwise.
5583
- */
5584
-
5585
- const _checkValidNamespace = function _checkValidNamespace(element) {
5586
- let parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
5587
- // can be null. We just simulate parent in this case.
5588
-
5589
- if (!parent || !parent.tagName) {
5590
- parent = {
5591
- namespaceURI: NAMESPACE,
5592
- tagName: 'template'
5593
- };
5594
- }
5595
-
5596
- const tagName = stringToLowerCase(element.tagName);
5597
- const parentTagName = stringToLowerCase(parent.tagName);
5598
-
5599
- if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
5600
- return false;
5601
- }
5602
-
5603
- if (element.namespaceURI === SVG_NAMESPACE) {
5604
- // The only way to switch from HTML namespace to SVG
5605
- // is via <svg>. If it happens via any other tag, then
5606
- // it should be killed.
5607
- if (parent.namespaceURI === HTML_NAMESPACE) {
5608
- return tagName === 'svg';
5609
- } // The only way to switch from MathML to SVG is via`
5610
- // svg if parent is either <annotation-xml> or MathML
5611
- // text integration points.
5612
-
5613
-
5614
- if (parent.namespaceURI === MATHML_NAMESPACE) {
5615
- return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
5616
- } // We only allow elements that are defined in SVG
5617
- // spec. All others are disallowed in SVG namespace.
5618
-
5619
-
5620
- return Boolean(ALL_SVG_TAGS[tagName]);
5621
- }
5622
-
5623
- if (element.namespaceURI === MATHML_NAMESPACE) {
5624
- // The only way to switch from HTML namespace to MathML
5625
- // is via <math>. If it happens via any other tag, then
5626
- // it should be killed.
5627
- if (parent.namespaceURI === HTML_NAMESPACE) {
5628
- return tagName === 'math';
5629
- } // The only way to switch from SVG to MathML is via
5630
- // <math> and HTML integration points
5631
-
5632
-
5633
- if (parent.namespaceURI === SVG_NAMESPACE) {
5634
- return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
5635
- } // We only allow elements that are defined in MathML
5636
- // spec. All others are disallowed in MathML namespace.
5637
-
5638
-
5639
- return Boolean(ALL_MATHML_TAGS[tagName]);
5640
- }
5641
-
5642
- if (element.namespaceURI === HTML_NAMESPACE) {
5643
- // The only way to switch from SVG to HTML is via
5644
- // HTML integration points, and from MathML to HTML
5645
- // is via MathML text integration points
5646
- if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
5647
- return false;
5648
- }
5649
-
5650
- if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
5651
- return false;
5652
- } // We disallow tags that are specific for MathML
5653
- // or SVG and should never appear in HTML namespace
5654
-
5655
-
5656
- return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
5657
- } // For XHTML and XML documents that support custom namespaces
5658
-
5659
-
5660
- if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
5661
- return true;
5662
- } // The code should never reach this place (this means
5663
- // that the element somehow got namespace that is not
5664
- // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
5665
- // Return false just in case.
5666
-
5667
-
5668
- return false;
5669
- };
5670
- /**
5671
- * _forceRemove
5672
- *
5673
- * @param {Node} node a DOM node
5674
- */
5675
-
5676
-
5677
- const _forceRemove = function _forceRemove(node) {
5678
- arrayPush(DOMPurify.removed, {
5679
- element: node
5680
- });
5681
-
5682
- try {
5683
- // eslint-disable-next-line unicorn/prefer-dom-node-remove
5684
- node.parentNode.removeChild(node);
5685
- } catch (_) {
5686
- node.remove();
5687
- }
5688
- };
5689
- /**
5690
- * _removeAttribute
5691
- *
5692
- * @param {String} name an Attribute name
5693
- * @param {Node} node a DOM node
5694
- */
5695
-
5696
-
5697
- const _removeAttribute = function _removeAttribute(name, node) {
5698
- try {
5699
- arrayPush(DOMPurify.removed, {
5700
- attribute: node.getAttributeNode(name),
5701
- from: node
5702
- });
5703
- } catch (_) {
5704
- arrayPush(DOMPurify.removed, {
5705
- attribute: null,
5706
- from: node
5707
- });
5708
- }
5709
-
5710
- node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
5711
-
5712
- if (name === 'is' && !ALLOWED_ATTR[name]) {
5713
- if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
5714
- try {
5715
- _forceRemove(node);
5716
- } catch (_) {}
5717
- } else {
5718
- try {
5719
- node.setAttribute(name, '');
5720
- } catch (_) {}
5721
- }
5722
- }
5723
- };
5724
- /**
5725
- * _initDocument
5726
- *
5727
- * @param {String} dirty a string of dirty markup
5728
- * @return {Document} a DOM, filled with the dirty markup
5729
- */
5730
-
5731
-
5732
- const _initDocument = function _initDocument(dirty) {
5733
- /* Create a HTML document */
5734
- let doc;
5735
- let leadingWhitespace;
5736
-
5737
- if (FORCE_BODY) {
5738
- dirty = '<remove></remove>' + dirty;
5739
- } else {
5740
- /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
5741
- const matches = stringMatch(dirty, /^[\r\n\t ]+/);
5742
- leadingWhitespace = matches && matches[0];
5743
- }
5744
-
5745
- if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
5746
- // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
5747
- dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
5748
- }
5749
-
5750
- const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
5751
- /*
5752
- * Use the DOMParser API by default, fallback later if needs be
5753
- * DOMParser not work for svg when has multiple root element.
5754
- */
5755
-
5756
- if (NAMESPACE === HTML_NAMESPACE) {
5757
- try {
5758
- doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
5759
- } catch (_) {}
5760
- }
5761
- /* Use createHTMLDocument in case DOMParser is not available */
5762
-
5763
-
5764
- if (!doc || !doc.documentElement) {
5765
- doc = implementation.createDocument(NAMESPACE, 'template', null);
5766
-
5767
- try {
5768
- doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
5769
- } catch (_) {// Syntax error if dirtyPayload is invalid xml
5770
- }
5771
- }
5772
-
5773
- const body = doc.body || doc.documentElement;
5774
-
5775
- if (dirty && leadingWhitespace) {
5776
- body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
5777
- }
5778
- /* Work on whole document or just its body */
5779
-
5780
-
5781
- if (NAMESPACE === HTML_NAMESPACE) {
5782
- return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
5783
- }
5784
-
5785
- return WHOLE_DOCUMENT ? doc.documentElement : body;
5786
- };
5787
- /**
5788
- * _createIterator
5789
- *
5790
- * @param {Document} root document/fragment to create iterator for
5791
- * @return {Iterator} iterator instance
5792
- */
5793
-
5794
-
5795
- const _createIterator = function _createIterator(root) {
5796
- return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
5797
- NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
5798
- };
5799
- /**
5800
- * _isClobbered
5801
- *
5802
- * @param {Node} elm element to check for clobbering attacks
5803
- * @return {Boolean} true if clobbered, false if safe
5804
- */
5805
-
5806
-
5807
- const _isClobbered = function _isClobbered(elm) {
5808
- return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
5809
- };
5810
- /**
5811
- * _isNode
5812
- *
5813
- * @param {Node} obj object to check whether it's a DOM node
5814
- * @return {Boolean} true is object is a DOM node
5815
- */
5816
-
5817
-
5818
- const _isNode = function _isNode(object) {
5819
- return typeof Node === 'object' ? object instanceof Node : object && typeof object === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
5820
- };
5821
- /**
5822
- * _executeHook
5823
- * Execute user configurable hooks
5824
- *
5825
- * @param {String} entryPoint Name of the hook's entry point
5826
- * @param {Node} currentNode node to work on with the hook
5827
- * @param {Object} data additional hook parameters
5828
- */
5829
-
5830
-
5831
- const _executeHook = function _executeHook(entryPoint, currentNode, data) {
5832
- if (!hooks[entryPoint]) {
5833
- return;
5834
- }
5835
-
5836
- arrayForEach(hooks[entryPoint], hook => {
5837
- hook.call(DOMPurify, currentNode, data, CONFIG);
5838
- });
5839
- };
5840
- /**
5841
- * _sanitizeElements
5842
- *
5843
- * @protect nodeName
5844
- * @protect textContent
5845
- * @protect removeChild
5846
- *
5847
- * @param {Node} currentNode to check for permission to exist
5848
- * @return {Boolean} true if node was killed, false if left alive
5849
- */
5850
-
5851
-
5852
- const _sanitizeElements = function _sanitizeElements(currentNode) {
5853
- let content;
5854
- /* Execute a hook if present */
5855
-
5856
- _executeHook('beforeSanitizeElements', currentNode, null);
5857
- /* Check if element is clobbered or can clobber */
5858
-
5859
-
5860
- if (_isClobbered(currentNode)) {
5861
- _forceRemove(currentNode);
5862
-
5863
- return true;
5864
- }
5865
- /* Now let's check the element's type and name */
5866
-
5867
-
5868
- const tagName = transformCaseFunc(currentNode.nodeName);
5869
- /* Execute a hook if present */
5870
-
5871
- _executeHook('uponSanitizeElement', currentNode, {
5872
- tagName,
5873
- allowedTags: ALLOWED_TAGS
5874
- });
5875
- /* Detect mXSS attempts abusing namespace confusion */
5876
-
5877
-
5878
- if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
5879
- _forceRemove(currentNode);
5880
-
5881
- return true;
5882
- }
5883
- /* Remove element if anything forbids its presence */
5884
-
5885
-
5886
- if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
5887
- /* Check if we have a custom element to handle */
5888
- if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
5889
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
5890
- if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
5891
- }
5892
- /* Keep content except for bad-listed elements */
5893
-
5894
-
5895
- if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
5896
- const parentNode = getParentNode(currentNode) || currentNode.parentNode;
5897
- const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
5898
-
5899
- if (childNodes && parentNode) {
5900
- const childCount = childNodes.length;
5901
-
5902
- for (let i = childCount - 1; i >= 0; --i) {
5903
- parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
5904
- }
5905
- }
5906
- }
5907
-
5908
- _forceRemove(currentNode);
5909
-
5910
- return true;
5911
- }
5912
- /* Check whether element has a valid namespace */
5913
-
5914
-
5915
- if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
5916
- _forceRemove(currentNode);
5917
-
5918
- return true;
5919
- }
5920
- /* Make sure that older browsers don't get fallback-tag mXSS */
5921
-
5922
-
5923
- if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
5924
- _forceRemove(currentNode);
5925
-
5926
- return true;
5927
- }
5928
- /* Sanitize element content to be template-safe */
5929
-
5930
-
5931
- if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
5932
- /* Get the element's text content */
5933
- content = currentNode.textContent;
5934
- content = stringReplace(content, MUSTACHE_EXPR, ' ');
5935
- content = stringReplace(content, ERB_EXPR, ' ');
5936
- content = stringReplace(content, TMPLIT_EXPR, ' ');
5937
-
5938
- if (currentNode.textContent !== content) {
5939
- arrayPush(DOMPurify.removed, {
5940
- element: currentNode.cloneNode()
5941
- });
5942
- currentNode.textContent = content;
5943
- }
5944
- }
5945
- /* Execute a hook if present */
5946
-
5947
-
5948
- _executeHook('afterSanitizeElements', currentNode, null);
5949
-
5950
- return false;
5951
- };
5952
- /**
5953
- * _isValidAttribute
5954
- *
5955
- * @param {string} lcTag Lowercase tag name of containing element.
5956
- * @param {string} lcName Lowercase attribute name.
5957
- * @param {string} value Attribute value.
5958
- * @return {Boolean} Returns true if `value` is valid, otherwise false.
5959
- */
5960
- // eslint-disable-next-line complexity
5961
-
5962
-
5963
- const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
5964
- /* Make sure attribute cannot clobber */
5965
- if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
5966
- return false;
5967
- }
5968
- /* Allow valid data-* attributes: At least one character after "-"
5969
- (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
5970
- XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
5971
- We don't need to check the value; it's always URI safe. */
5972
-
5973
-
5974
- if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
5975
- if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
5976
- // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
5977
- // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
5978
- _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
5979
- // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
5980
- lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
5981
- return false;
5982
- }
5983
- /* Check value is safe. First, is attr inert? If so, is safe */
5984
-
5985
- } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
5986
- return false;
5987
- } else ;
5988
-
5989
- return true;
5990
- };
5991
- /**
5992
- * _basicCustomElementCheck
5993
- * checks if at least one dash is included in tagName, and it's not the first char
5994
- * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
5995
- * @param {string} tagName name of the tag of the node to sanitize
5996
- */
5997
-
5998
-
5999
- const _basicCustomElementTest = function _basicCustomElementTest(tagName) {
6000
- return tagName.indexOf('-') > 0;
6001
- };
6002
- /**
6003
- * _sanitizeAttributes
6004
- *
6005
- * @protect attributes
6006
- * @protect nodeName
6007
- * @protect removeAttribute
6008
- * @protect setAttribute
6009
- *
6010
- * @param {Node} currentNode to sanitize
6011
- */
6012
-
6013
-
6014
- const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
6015
- let attr;
6016
- let value;
6017
- let lcName;
6018
- let l;
6019
- /* Execute a hook if present */
6020
-
6021
- _executeHook('beforeSanitizeAttributes', currentNode, null);
6022
-
6023
- const {
6024
- attributes
6025
- } = currentNode;
6026
- /* Check if we have attributes; if not we might have a text node */
6027
-
6028
- if (!attributes) {
6029
- return;
6030
- }
6031
-
6032
- const hookEvent = {
6033
- attrName: '',
6034
- attrValue: '',
6035
- keepAttr: true,
6036
- allowedAttributes: ALLOWED_ATTR
6037
- };
6038
- l = attributes.length;
6039
- /* Go backwards over all attributes; safely remove bad ones */
6040
-
6041
- while (l--) {
6042
- attr = attributes[l];
6043
- const {
6044
- name,
6045
- namespaceURI
6046
- } = attr;
6047
- value = name === 'value' ? attr.value : stringTrim(attr.value);
6048
- lcName = transformCaseFunc(name);
6049
- /* Execute a hook if present */
6050
-
6051
- hookEvent.attrName = lcName;
6052
- hookEvent.attrValue = value;
6053
- hookEvent.keepAttr = true;
6054
- hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
6055
-
6056
- _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
6057
-
6058
- value = hookEvent.attrValue;
6059
- /* Did the hooks approve of the attribute? */
6060
-
6061
- if (hookEvent.forceKeepAttr) {
6062
- continue;
6063
- }
6064
- /* Remove attribute */
6065
-
6066
-
6067
- _removeAttribute(name, currentNode);
6068
- /* Did the hooks approve of the attribute? */
6069
-
6070
-
6071
- if (!hookEvent.keepAttr) {
6072
- continue;
6073
- }
6074
- /* Work around a security issue in jQuery 3.0 */
6075
-
6076
-
6077
- if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
6078
- _removeAttribute(name, currentNode);
6079
-
6080
- continue;
6081
- }
6082
- /* Sanitize attribute content to be template-safe */
6083
-
6084
-
6085
- if (SAFE_FOR_TEMPLATES) {
6086
- value = stringReplace(value, MUSTACHE_EXPR, ' ');
6087
- value = stringReplace(value, ERB_EXPR, ' ');
6088
- value = stringReplace(value, TMPLIT_EXPR, ' ');
6089
- }
6090
- /* Is `value` valid for this attribute? */
6091
-
6092
-
6093
- const lcTag = transformCaseFunc(currentNode.nodeName);
6094
-
6095
- if (!_isValidAttribute(lcTag, lcName, value)) {
6096
- continue;
6097
- }
6098
- /* Full DOM Clobbering protection via namespace isolation,
6099
- * Prefix id and name attributes with `user-content-`
6100
- */
6101
-
6102
-
6103
- if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
6104
- // Remove the attribute with this value
6105
- _removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
6106
-
6107
-
6108
- value = SANITIZE_NAMED_PROPS_PREFIX + value;
6109
- }
6110
- /* Handle attributes that require Trusted Types */
6111
-
6112
-
6113
- if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
6114
- if (namespaceURI) ; else {
6115
- switch (trustedTypes.getAttributeType(lcTag, lcName)) {
6116
- case 'TrustedHTML':
6117
- {
6118
- value = trustedTypesPolicy.createHTML(value);
6119
- break;
6120
- }
6121
-
6122
- case 'TrustedScriptURL':
6123
- {
6124
- value = trustedTypesPolicy.createScriptURL(value);
6125
- break;
6126
- }
6127
- }
6128
- }
6129
- }
6130
- /* Handle invalid data-* attribute set by try-catching it */
6131
-
6132
-
6133
- try {
6134
- if (namespaceURI) {
6135
- currentNode.setAttributeNS(namespaceURI, name, value);
6136
- } else {
6137
- /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
6138
- currentNode.setAttribute(name, value);
6139
- }
6140
-
6141
- arrayPop(DOMPurify.removed);
6142
- } catch (_) {}
6143
- }
6144
- /* Execute a hook if present */
6145
-
6146
-
6147
- _executeHook('afterSanitizeAttributes', currentNode, null);
6148
- };
6149
- /**
6150
- * _sanitizeShadowDOM
6151
- *
6152
- * @param {DocumentFragment} fragment to iterate over recursively
6153
- */
6154
-
6155
-
6156
- const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
6157
- let shadowNode;
6158
-
6159
- const shadowIterator = _createIterator(fragment);
6160
- /* Execute a hook if present */
6161
-
6162
-
6163
- _executeHook('beforeSanitizeShadowDOM', fragment, null);
6164
-
6165
- while (shadowNode = shadowIterator.nextNode()) {
6166
- /* Execute a hook if present */
6167
- _executeHook('uponSanitizeShadowNode', shadowNode, null);
6168
- /* Sanitize tags and elements */
6169
-
6170
-
6171
- if (_sanitizeElements(shadowNode)) {
6172
- continue;
6173
- }
6174
- /* Deep shadow DOM detected */
6175
-
6176
-
6177
- if (shadowNode.content instanceof DocumentFragment) {
6178
- _sanitizeShadowDOM(shadowNode.content);
6179
- }
6180
- /* Check attributes, sanitize if necessary */
6181
-
6182
-
6183
- _sanitizeAttributes(shadowNode);
6184
- }
6185
- /* Execute a hook if present */
6186
-
6187
-
6188
- _executeHook('afterSanitizeShadowDOM', fragment, null);
6189
- };
6190
- /**
6191
- * Sanitize
6192
- * Public method providing core sanitation functionality
6193
- *
6194
- * @param {String|Node} dirty string or DOM node
6195
- * @param {Object} configuration object
6196
- */
6197
- // eslint-disable-next-line complexity
6198
-
6199
-
6200
- DOMPurify.sanitize = function (dirty) {
6201
- let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
6202
- let body;
6203
- let importedNode;
6204
- let currentNode;
6205
- let returnNode;
6206
- /* Make sure we have a string to sanitize.
6207
- DO NOT return early, as this will return the wrong type if
6208
- the user has requested a DOM object rather than a string */
6209
-
6210
- IS_EMPTY_INPUT = !dirty;
6211
-
6212
- if (IS_EMPTY_INPUT) {
6213
- dirty = '<!-->';
6214
- }
6215
- /* Stringify, in case dirty is an object */
6216
-
6217
-
6218
- if (typeof dirty !== 'string' && !_isNode(dirty)) {
6219
- if (typeof dirty.toString === 'function') {
6220
- dirty = dirty.toString();
6221
-
6222
- if (typeof dirty !== 'string') {
6223
- throw typeErrorCreate('dirty is not a string, aborting');
6224
- }
6225
- } else {
6226
- throw typeErrorCreate('toString is not a function');
6227
- }
6228
- }
6229
- /* Return dirty HTML if DOMPurify cannot run */
6230
-
6231
-
6232
- if (!DOMPurify.isSupported) {
6233
- return dirty;
6234
- }
6235
- /* Assign config vars */
6236
-
6237
-
6238
- if (!SET_CONFIG) {
6239
- _parseConfig(cfg);
6240
- }
6241
- /* Clean up removed elements */
6242
-
6243
-
6244
- DOMPurify.removed = [];
6245
- /* Check if dirty is correctly typed for IN_PLACE */
6246
-
6247
- if (typeof dirty === 'string') {
6248
- IN_PLACE = false;
6249
- }
6250
-
6251
- if (IN_PLACE) {
6252
- /* Do some early pre-sanitization to avoid unsafe root nodes */
6253
- if (dirty.nodeName) {
6254
- const tagName = transformCaseFunc(dirty.nodeName);
6255
-
6256
- if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
6257
- throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
6258
- }
6259
- }
6260
- } else if (dirty instanceof Node) {
6261
- /* If dirty is a DOM element, append to an empty document to avoid
6262
- elements being stripped by the parser */
6263
- body = _initDocument('<!---->');
6264
- importedNode = body.ownerDocument.importNode(dirty, true);
6265
-
6266
- if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
6267
- /* Node is already a body, use as is */
6268
- body = importedNode;
6269
- } else if (importedNode.nodeName === 'HTML') {
6270
- body = importedNode;
6271
- } else {
6272
- // eslint-disable-next-line unicorn/prefer-dom-node-append
6273
- body.appendChild(importedNode);
6274
- }
6275
- } else {
6276
- /* Exit directly if we have nothing to do */
6277
- if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
6278
- dirty.indexOf('<') === -1) {
6279
- return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
6280
- }
6281
- /* Initialize the document to work on */
6282
-
6283
-
6284
- body = _initDocument(dirty);
6285
- /* Check we have a DOM node from the data */
6286
-
6287
- if (!body) {
6288
- return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
6289
- }
6290
- }
6291
- /* Remove first element node (ours) if FORCE_BODY is set */
6292
-
6293
-
6294
- if (body && FORCE_BODY) {
6295
- _forceRemove(body.firstChild);
6296
- }
6297
- /* Get node iterator */
6298
-
6299
-
6300
- const nodeIterator = _createIterator(IN_PLACE ? dirty : body);
6301
- /* Now start iterating over the created document */
6302
-
6303
-
6304
- while (currentNode = nodeIterator.nextNode()) {
6305
- /* Sanitize tags and elements */
6306
- if (_sanitizeElements(currentNode)) {
6307
- continue;
6308
- }
6309
- /* Shadow DOM detected, sanitize it */
6310
-
6311
-
6312
- if (currentNode.content instanceof DocumentFragment) {
6313
- _sanitizeShadowDOM(currentNode.content);
6314
- }
6315
- /* Check attributes, sanitize if necessary */
6316
-
6317
-
6318
- _sanitizeAttributes(currentNode);
6319
- }
6320
- /* If we sanitized `dirty` in-place, return it. */
6321
-
6322
-
6323
- if (IN_PLACE) {
6324
- return dirty;
6325
- }
6326
- /* Return sanitized string or DOM */
6327
-
6328
-
6329
- if (RETURN_DOM) {
6330
- if (RETURN_DOM_FRAGMENT) {
6331
- returnNode = createDocumentFragment.call(body.ownerDocument);
6332
-
6333
- while (body.firstChild) {
6334
- // eslint-disable-next-line unicorn/prefer-dom-node-append
6335
- returnNode.appendChild(body.firstChild);
6336
- }
6337
- } else {
6338
- returnNode = body;
6339
- }
6340
-
6341
- if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
6342
- /*
6343
- AdoptNode() is not used because internal state is not reset
6344
- (e.g. the past names map of a HTMLFormElement), this is safe
6345
- in theory but we would rather not risk another attack vector.
6346
- The state that is cloned by importNode() is explicitly defined
6347
- by the specs.
6348
- */
6349
- returnNode = importNode.call(originalDocument, returnNode, true);
6350
- }
6351
-
6352
- return returnNode;
6353
- }
6354
-
6355
- let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
6356
- /* Serialize doctype if allowed */
6357
-
6358
- if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
6359
- serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
6360
- }
6361
- /* Sanitize final string template-safe */
6362
-
6363
-
6364
- if (SAFE_FOR_TEMPLATES) {
6365
- serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');
6366
- serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');
6367
- serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');
6368
- }
6369
-
6370
- return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
6371
- };
6372
- /**
6373
- * Public method to set the configuration once
6374
- * setConfig
6375
- *
6376
- * @param {Object} cfg configuration object
6377
- */
6378
-
6379
-
6380
- DOMPurify.setConfig = function (cfg) {
6381
- _parseConfig(cfg);
6382
-
6383
- SET_CONFIG = true;
6384
- };
6385
- /**
6386
- * Public method to remove the configuration
6387
- * clearConfig
6388
- *
6389
- */
6390
-
6391
-
6392
- DOMPurify.clearConfig = function () {
6393
- CONFIG = null;
6394
- SET_CONFIG = false;
6395
- };
6396
- /**
6397
- * Public method to check if an attribute value is valid.
6398
- * Uses last set config, if any. Otherwise, uses config defaults.
6399
- * isValidAttribute
6400
- *
6401
- * @param {string} tag Tag name of containing element.
6402
- * @param {string} attr Attribute name.
6403
- * @param {string} value Attribute value.
6404
- * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
6405
- */
6406
-
6407
-
6408
- DOMPurify.isValidAttribute = function (tag, attr, value) {
6409
- /* Initialize shared config vars if necessary. */
6410
- if (!CONFIG) {
6411
- _parseConfig({});
6412
- }
6413
-
6414
- const lcTag = transformCaseFunc(tag);
6415
- const lcName = transformCaseFunc(attr);
6416
- return _isValidAttribute(lcTag, lcName, value);
6417
- };
6418
- /**
6419
- * AddHook
6420
- * Public method to add DOMPurify hooks
6421
- *
6422
- * @param {String} entryPoint entry point for the hook to add
6423
- * @param {Function} hookFunction function to execute
6424
- */
6425
-
6426
-
6427
- DOMPurify.addHook = function (entryPoint, hookFunction) {
6428
- if (typeof hookFunction !== 'function') {
6429
- return;
6430
- }
6431
-
6432
- hooks[entryPoint] = hooks[entryPoint] || [];
6433
- arrayPush(hooks[entryPoint], hookFunction);
6434
- };
6435
- /**
6436
- * RemoveHook
6437
- * Public method to remove a DOMPurify hook at a given entryPoint
6438
- * (pops it from the stack of hooks if more are present)
6439
- *
6440
- * @param {String} entryPoint entry point for the hook to remove
6441
- * @return {Function} removed(popped) hook
6442
- */
6443
-
6444
-
6445
- DOMPurify.removeHook = function (entryPoint) {
6446
- if (hooks[entryPoint]) {
6447
- return arrayPop(hooks[entryPoint]);
6448
- }
6449
- };
6450
- /**
6451
- * RemoveHooks
6452
- * Public method to remove all DOMPurify hooks at a given entryPoint
6453
- *
6454
- * @param {String} entryPoint entry point for the hooks to remove
6455
- */
6456
-
6457
-
6458
- DOMPurify.removeHooks = function (entryPoint) {
6459
- if (hooks[entryPoint]) {
6460
- hooks[entryPoint] = [];
6461
- }
6462
- };
6463
- /**
6464
- * RemoveAllHooks
6465
- * Public method to remove all DOMPurify hooks
6466
- *
6467
- */
6468
-
6469
-
6470
- DOMPurify.removeAllHooks = function () {
6471
- hooks = {};
6472
- };
6473
-
6474
- return DOMPurify;
6475
- }
6476
-
6477
- var purify = createDOMPurify();
6478
-
6479
- return purify;
6480
-
6481
- }));
6482
-
6483
- } (purify));
4800
+ /*! @license DOMPurify 3.2.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.3/LICENSE */
4801
+
4802
+ const {
4803
+ entries,
4804
+ setPrototypeOf,
4805
+ isFrozen,
4806
+ getPrototypeOf,
4807
+ getOwnPropertyDescriptor
4808
+ } = Object;
4809
+ let {
4810
+ freeze,
4811
+ seal,
4812
+ create
4813
+ } = Object; // eslint-disable-line import/no-mutable-exports
4814
+ let {
4815
+ apply,
4816
+ construct
4817
+ } = typeof Reflect !== 'undefined' && Reflect;
4818
+ if (!freeze) {
4819
+ freeze = function freeze(x) {
4820
+ return x;
4821
+ };
4822
+ }
4823
+ if (!seal) {
4824
+ seal = function seal(x) {
4825
+ return x;
4826
+ };
4827
+ }
4828
+ if (!apply) {
4829
+ apply = function apply(fun, thisValue, args) {
4830
+ return fun.apply(thisValue, args);
4831
+ };
4832
+ }
4833
+ if (!construct) {
4834
+ construct = function construct(Func, args) {
4835
+ return new Func(...args);
4836
+ };
4837
+ }
4838
+ const arrayForEach = unapply(Array.prototype.forEach);
4839
+ const arrayPop = unapply(Array.prototype.pop);
4840
+ const arrayPush = unapply(Array.prototype.push);
4841
+ const stringToLowerCase = unapply(String.prototype.toLowerCase);
4842
+ const stringToString = unapply(String.prototype.toString);
4843
+ const stringMatch = unapply(String.prototype.match);
4844
+ const stringReplace = unapply(String.prototype.replace);
4845
+ const stringIndexOf = unapply(String.prototype.indexOf);
4846
+ const stringTrim = unapply(String.prototype.trim);
4847
+ const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
4848
+ const regExpTest = unapply(RegExp.prototype.test);
4849
+ const typeErrorCreate = unconstruct(TypeError);
4850
+ /**
4851
+ * Creates a new function that calls the given function with a specified thisArg and arguments.
4852
+ *
4853
+ * @param func - The function to be wrapped and called.
4854
+ * @returns A new function that calls the given function with a specified thisArg and arguments.
4855
+ */
4856
+ function unapply(func) {
4857
+ return function (thisArg) {
4858
+ for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
4859
+ args[_key - 1] = arguments[_key];
4860
+ }
4861
+ return apply(func, thisArg, args);
4862
+ };
4863
+ }
4864
+ /**
4865
+ * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
4866
+ *
4867
+ * @param func - The constructor function to be wrapped and called.
4868
+ * @returns A new function that constructs an instance of the given constructor function with the provided arguments.
4869
+ */
4870
+ function unconstruct(func) {
4871
+ return function () {
4872
+ for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
4873
+ args[_key2] = arguments[_key2];
4874
+ }
4875
+ return construct(func, args);
4876
+ };
4877
+ }
4878
+ /**
4879
+ * Add properties to a lookup table
4880
+ *
4881
+ * @param set - The set to which elements will be added.
4882
+ * @param array - The array containing elements to be added to the set.
4883
+ * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
4884
+ * @returns The modified set with added elements.
4885
+ */
4886
+ function addToSet(set, array) {
4887
+ let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
4888
+ if (setPrototypeOf) {
4889
+ // Make 'in' and truthy checks like Boolean(set.constructor)
4890
+ // independent of any properties defined on Object.prototype.
4891
+ // Prevent prototype setters from intercepting set as a this value.
4892
+ setPrototypeOf(set, null);
4893
+ }
4894
+ let l = array.length;
4895
+ while (l--) {
4896
+ let element = array[l];
4897
+ if (typeof element === 'string') {
4898
+ const lcElement = transformCaseFunc(element);
4899
+ if (lcElement !== element) {
4900
+ // Config presets (e.g. tags.js, attrs.js) are immutable.
4901
+ if (!isFrozen(array)) {
4902
+ array[l] = lcElement;
4903
+ }
4904
+ element = lcElement;
4905
+ }
4906
+ }
4907
+ set[element] = true;
4908
+ }
4909
+ return set;
4910
+ }
4911
+ /**
4912
+ * Clean up an array to harden against CSPP
4913
+ *
4914
+ * @param array - The array to be cleaned.
4915
+ * @returns The cleaned version of the array
4916
+ */
4917
+ function cleanArray(array) {
4918
+ for (let index = 0; index < array.length; index++) {
4919
+ const isPropertyExist = objectHasOwnProperty(array, index);
4920
+ if (!isPropertyExist) {
4921
+ array[index] = null;
4922
+ }
4923
+ }
4924
+ return array;
4925
+ }
4926
+ /**
4927
+ * Shallow clone an object
4928
+ *
4929
+ * @param object - The object to be cloned.
4930
+ * @returns A new object that copies the original.
4931
+ */
4932
+ function clone(object) {
4933
+ const newObject = create(null);
4934
+ for (const [property, value] of entries(object)) {
4935
+ const isPropertyExist = objectHasOwnProperty(object, property);
4936
+ if (isPropertyExist) {
4937
+ if (Array.isArray(value)) {
4938
+ newObject[property] = cleanArray(value);
4939
+ } else if (value && typeof value === 'object' && value.constructor === Object) {
4940
+ newObject[property] = clone(value);
4941
+ } else {
4942
+ newObject[property] = value;
4943
+ }
4944
+ }
4945
+ }
4946
+ return newObject;
4947
+ }
4948
+ /**
4949
+ * This method automatically checks if the prop is function or getter and behaves accordingly.
4950
+ *
4951
+ * @param object - The object to look up the getter function in its prototype chain.
4952
+ * @param prop - The property name for which to find the getter function.
4953
+ * @returns The getter function found in the prototype chain or a fallback function.
4954
+ */
4955
+ function lookupGetter(object, prop) {
4956
+ while (object !== null) {
4957
+ const desc = getOwnPropertyDescriptor(object, prop);
4958
+ if (desc) {
4959
+ if (desc.get) {
4960
+ return unapply(desc.get);
4961
+ }
4962
+ if (typeof desc.value === 'function') {
4963
+ return unapply(desc.value);
4964
+ }
4965
+ }
4966
+ object = getPrototypeOf(object);
4967
+ }
4968
+ function fallbackValue() {
4969
+ return null;
4970
+ }
4971
+ return fallbackValue;
4972
+ }
4973
+
4974
+ const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
4975
+ const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
4976
+ const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
4977
+ // List of SVG elements that are disallowed by default.
4978
+ // We still need to know them so that we can do namespace
4979
+ // checks properly in case one wants to add them to
4980
+ // allow-list.
4981
+ const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
4982
+ const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
4983
+ // Similarly to SVG, we want to know all MathML elements,
4984
+ // even those that we disallow by default.
4985
+ const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
4986
+ const text = freeze(['#text']);
4987
+
4988
+ const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns', 'slot']);
4989
+ const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
4990
+ const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
4991
+ const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
4992
+
4993
+ // eslint-disable-next-line unicorn/better-regex
4994
+ const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
4995
+ const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
4996
+ const TMPLIT_EXPR = seal(/\$\{[\w\W]*}/gm); // eslint-disable-line unicorn/better-regex
4997
+ const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
4998
+ const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
4999
+ const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
5000
+ );
5001
+ const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
5002
+ const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
5003
+ );
5004
+ const DOCTYPE_NAME = seal(/^html$/i);
5005
+ const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
5006
+
5007
+ var EXPRESSIONS = /*#__PURE__*/Object.freeze({
5008
+ __proto__: null,
5009
+ ARIA_ATTR: ARIA_ATTR,
5010
+ ATTR_WHITESPACE: ATTR_WHITESPACE,
5011
+ CUSTOM_ELEMENT: CUSTOM_ELEMENT,
5012
+ DATA_ATTR: DATA_ATTR,
5013
+ DOCTYPE_NAME: DOCTYPE_NAME,
5014
+ ERB_EXPR: ERB_EXPR,
5015
+ IS_ALLOWED_URI: IS_ALLOWED_URI,
5016
+ IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
5017
+ MUSTACHE_EXPR: MUSTACHE_EXPR,
5018
+ TMPLIT_EXPR: TMPLIT_EXPR
5019
+ });
6484
5020
 
6485
- var DOMPurify = purifyExports;
5021
+ /* eslint-disable @typescript-eslint/indent */
5022
+ // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
5023
+ const NODE_TYPE = {
5024
+ element: 1,
5025
+ attribute: 2,
5026
+ text: 3,
5027
+ cdataSection: 4,
5028
+ entityReference: 5,
5029
+ // Deprecated
5030
+ entityNode: 6,
5031
+ // Deprecated
5032
+ progressingInstruction: 7,
5033
+ comment: 8,
5034
+ document: 9,
5035
+ documentType: 10,
5036
+ documentFragment: 11,
5037
+ notation: 12 // Deprecated
5038
+ };
5039
+ const getGlobal = function getGlobal() {
5040
+ return typeof window === 'undefined' ? null : window;
5041
+ };
5042
+ /**
5043
+ * Creates a no-op policy for internal use only.
5044
+ * Don't export this function outside this module!
5045
+ * @param trustedTypes The policy factory.
5046
+ * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
5047
+ * @return The policy created (or null, if Trusted Types
5048
+ * are not supported or creating the policy failed).
5049
+ */
5050
+ const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
5051
+ if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
5052
+ return null;
5053
+ }
5054
+ // Allow the callers to control the unique policy name
5055
+ // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
5056
+ // Policy creation with duplicate names throws in Trusted Types.
5057
+ let suffix = null;
5058
+ const ATTR_NAME = 'data-tt-policy-suffix';
5059
+ if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
5060
+ suffix = purifyHostElement.getAttribute(ATTR_NAME);
5061
+ }
5062
+ const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
5063
+ try {
5064
+ return trustedTypes.createPolicy(policyName, {
5065
+ createHTML(html) {
5066
+ return html;
5067
+ },
5068
+ createScriptURL(scriptUrl) {
5069
+ return scriptUrl;
5070
+ }
5071
+ });
5072
+ } catch (_) {
5073
+ // Policy creation failed (most likely another DOMPurify script has
5074
+ // already run). Skip creating the policy, as this will only cause errors
5075
+ // if TT are enforced.
5076
+ console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
5077
+ return null;
5078
+ }
5079
+ };
5080
+ const _createHooksMap = function _createHooksMap() {
5081
+ return {
5082
+ afterSanitizeAttributes: [],
5083
+ afterSanitizeElements: [],
5084
+ afterSanitizeShadowDOM: [],
5085
+ beforeSanitizeAttributes: [],
5086
+ beforeSanitizeElements: [],
5087
+ beforeSanitizeShadowDOM: [],
5088
+ uponSanitizeAttribute: [],
5089
+ uponSanitizeElement: [],
5090
+ uponSanitizeShadowNode: []
5091
+ };
5092
+ };
5093
+ function createDOMPurify() {
5094
+ let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
5095
+ const DOMPurify = root => createDOMPurify(root);
5096
+ DOMPurify.version = '3.2.3';
5097
+ DOMPurify.removed = [];
5098
+ if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document) {
5099
+ // Not running in a browser, provide a factory function
5100
+ // so that you can pass your own Window
5101
+ DOMPurify.isSupported = false;
5102
+ return DOMPurify;
5103
+ }
5104
+ let {
5105
+ document
5106
+ } = window;
5107
+ const originalDocument = document;
5108
+ const currentScript = originalDocument.currentScript;
5109
+ const {
5110
+ DocumentFragment,
5111
+ HTMLTemplateElement,
5112
+ Node,
5113
+ Element,
5114
+ NodeFilter,
5115
+ NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,
5116
+ HTMLFormElement,
5117
+ DOMParser,
5118
+ trustedTypes
5119
+ } = window;
5120
+ const ElementPrototype = Element.prototype;
5121
+ const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
5122
+ const remove = lookupGetter(ElementPrototype, 'remove');
5123
+ const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
5124
+ const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
5125
+ const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
5126
+ // As per issue #47, the web-components registry is inherited by a
5127
+ // new document created via createHTMLDocument. As per the spec
5128
+ // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
5129
+ // a new empty registry is used when creating a template contents owner
5130
+ // document, so we use that as our parent document to ensure nothing
5131
+ // is inherited.
5132
+ if (typeof HTMLTemplateElement === 'function') {
5133
+ const template = document.createElement('template');
5134
+ if (template.content && template.content.ownerDocument) {
5135
+ document = template.content.ownerDocument;
5136
+ }
5137
+ }
5138
+ let trustedTypesPolicy;
5139
+ let emptyHTML = '';
5140
+ const {
5141
+ implementation,
5142
+ createNodeIterator,
5143
+ createDocumentFragment,
5144
+ getElementsByTagName
5145
+ } = document;
5146
+ const {
5147
+ importNode
5148
+ } = originalDocument;
5149
+ let hooks = _createHooksMap();
5150
+ /**
5151
+ * Expose whether this browser supports running the full DOMPurify.
5152
+ */
5153
+ DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
5154
+ const {
5155
+ MUSTACHE_EXPR,
5156
+ ERB_EXPR,
5157
+ TMPLIT_EXPR,
5158
+ DATA_ATTR,
5159
+ ARIA_ATTR,
5160
+ IS_SCRIPT_OR_DATA,
5161
+ ATTR_WHITESPACE,
5162
+ CUSTOM_ELEMENT
5163
+ } = EXPRESSIONS;
5164
+ let {
5165
+ IS_ALLOWED_URI: IS_ALLOWED_URI$1
5166
+ } = EXPRESSIONS;
5167
+ /**
5168
+ * We consider the elements and attributes below to be safe. Ideally
5169
+ * don't add any new ones but feel free to remove unwanted ones.
5170
+ */
5171
+ /* allowed element names */
5172
+ let ALLOWED_TAGS = null;
5173
+ const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
5174
+ /* Allowed attribute names */
5175
+ let ALLOWED_ATTR = null;
5176
+ const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
5177
+ /*
5178
+ * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
5179
+ * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
5180
+ * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
5181
+ * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
5182
+ */
5183
+ let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
5184
+ tagNameCheck: {
5185
+ writable: true,
5186
+ configurable: false,
5187
+ enumerable: true,
5188
+ value: null
5189
+ },
5190
+ attributeNameCheck: {
5191
+ writable: true,
5192
+ configurable: false,
5193
+ enumerable: true,
5194
+ value: null
5195
+ },
5196
+ allowCustomizedBuiltInElements: {
5197
+ writable: true,
5198
+ configurable: false,
5199
+ enumerable: true,
5200
+ value: false
5201
+ }
5202
+ }));
5203
+ /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
5204
+ let FORBID_TAGS = null;
5205
+ /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
5206
+ let FORBID_ATTR = null;
5207
+ /* Decide if ARIA attributes are okay */
5208
+ let ALLOW_ARIA_ATTR = true;
5209
+ /* Decide if custom data attributes are okay */
5210
+ let ALLOW_DATA_ATTR = true;
5211
+ /* Decide if unknown protocols are okay */
5212
+ let ALLOW_UNKNOWN_PROTOCOLS = false;
5213
+ /* Decide if self-closing tags in attributes are allowed.
5214
+ * Usually removed due to a mXSS issue in jQuery 3.0 */
5215
+ let ALLOW_SELF_CLOSE_IN_ATTR = true;
5216
+ /* Output should be safe for common template engines.
5217
+ * This means, DOMPurify removes data attributes, mustaches and ERB
5218
+ */
5219
+ let SAFE_FOR_TEMPLATES = false;
5220
+ /* Output should be safe even for XML used within HTML and alike.
5221
+ * This means, DOMPurify removes comments when containing risky content.
5222
+ */
5223
+ let SAFE_FOR_XML = true;
5224
+ /* Decide if document with <html>... should be returned */
5225
+ let WHOLE_DOCUMENT = false;
5226
+ /* Track whether config is already set on this instance of DOMPurify. */
5227
+ let SET_CONFIG = false;
5228
+ /* Decide if all elements (e.g. style, script) must be children of
5229
+ * document.body. By default, browsers might move them to document.head */
5230
+ let FORCE_BODY = false;
5231
+ /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
5232
+ * string (or a TrustedHTML object if Trusted Types are supported).
5233
+ * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
5234
+ */
5235
+ let RETURN_DOM = false;
5236
+ /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
5237
+ * string (or a TrustedHTML object if Trusted Types are supported) */
5238
+ let RETURN_DOM_FRAGMENT = false;
5239
+ /* Try to return a Trusted Type object instead of a string, return a string in
5240
+ * case Trusted Types are not supported */
5241
+ let RETURN_TRUSTED_TYPE = false;
5242
+ /* Output should be free from DOM clobbering attacks?
5243
+ * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
5244
+ */
5245
+ let SANITIZE_DOM = true;
5246
+ /* Achieve full DOM Clobbering protection by isolating the namespace of named
5247
+ * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
5248
+ *
5249
+ * HTML/DOM spec rules that enable DOM Clobbering:
5250
+ * - Named Access on Window (§7.3.3)
5251
+ * - DOM Tree Accessors (§3.1.5)
5252
+ * - Form Element Parent-Child Relations (§4.10.3)
5253
+ * - Iframe srcdoc / Nested WindowProxies (§4.8.5)
5254
+ * - HTMLCollection (§4.2.10.2)
5255
+ *
5256
+ * Namespace isolation is implemented by prefixing `id` and `name` attributes
5257
+ * with a constant string, i.e., `user-content-`
5258
+ */
5259
+ let SANITIZE_NAMED_PROPS = false;
5260
+ const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
5261
+ /* Keep element content when removing element? */
5262
+ let KEEP_CONTENT = true;
5263
+ /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
5264
+ * of importing it into a new Document and returning a sanitized copy */
5265
+ let IN_PLACE = false;
5266
+ /* Allow usage of profiles like html, svg and mathMl */
5267
+ let USE_PROFILES = {};
5268
+ /* Tags to ignore content of when KEEP_CONTENT is true */
5269
+ let FORBID_CONTENTS = null;
5270
+ const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
5271
+ /* Tags that are safe for data: URIs */
5272
+ let DATA_URI_TAGS = null;
5273
+ const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
5274
+ /* Attributes safe for values like "javascript:" */
5275
+ let URI_SAFE_ATTRIBUTES = null;
5276
+ const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
5277
+ const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
5278
+ const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
5279
+ const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
5280
+ /* Document namespace */
5281
+ let NAMESPACE = HTML_NAMESPACE;
5282
+ let IS_EMPTY_INPUT = false;
5283
+ /* Allowed XHTML+XML namespaces */
5284
+ let ALLOWED_NAMESPACES = null;
5285
+ const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
5286
+ let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
5287
+ let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
5288
+ // Certain elements are allowed in both SVG and HTML
5289
+ // namespace. We need to specify them explicitly
5290
+ // so that they don't get erroneously deleted from
5291
+ // HTML namespace.
5292
+ const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
5293
+ /* Parsing of strict XHTML documents */
5294
+ let PARSER_MEDIA_TYPE = null;
5295
+ const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
5296
+ const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
5297
+ let transformCaseFunc = null;
5298
+ /* Keep a reference to config to pass to hooks */
5299
+ let CONFIG = null;
5300
+ /* Ideally, do not touch anything below this line */
5301
+ /* ______________________________________________ */
5302
+ const formElement = document.createElement('form');
5303
+ const isRegexOrFunction = function isRegexOrFunction(testValue) {
5304
+ return testValue instanceof RegExp || testValue instanceof Function;
5305
+ };
5306
+ /**
5307
+ * _parseConfig
5308
+ *
5309
+ * @param cfg optional config literal
5310
+ */
5311
+ // eslint-disable-next-line complexity
5312
+ const _parseConfig = function _parseConfig() {
5313
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
5314
+ if (CONFIG && CONFIG === cfg) {
5315
+ return;
5316
+ }
5317
+ /* Shield configuration object from tampering */
5318
+ if (!cfg || typeof cfg !== 'object') {
5319
+ cfg = {};
5320
+ }
5321
+ /* Shield configuration object from prototype pollution */
5322
+ cfg = clone(cfg);
5323
+ PARSER_MEDIA_TYPE =
5324
+ // eslint-disable-next-line unicorn/prefer-includes
5325
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
5326
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
5327
+ transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
5328
+ /* Set configuration parameters */
5329
+ ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
5330
+ ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
5331
+ ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
5332
+ URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
5333
+ DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
5334
+ FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
5335
+ FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
5336
+ FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
5337
+ USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
5338
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
5339
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
5340
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
5341
+ ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
5342
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
5343
+ SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
5344
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
5345
+ RETURN_DOM = cfg.RETURN_DOM || false; // Default false
5346
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
5347
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
5348
+ FORCE_BODY = cfg.FORCE_BODY || false; // Default false
5349
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
5350
+ SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
5351
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
5352
+ IN_PLACE = cfg.IN_PLACE || false; // Default false
5353
+ IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
5354
+ NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
5355
+ MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
5356
+ HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
5357
+ CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
5358
+ if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
5359
+ CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
5360
+ }
5361
+ if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
5362
+ CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
5363
+ }
5364
+ if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
5365
+ CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
5366
+ }
5367
+ if (SAFE_FOR_TEMPLATES) {
5368
+ ALLOW_DATA_ATTR = false;
5369
+ }
5370
+ if (RETURN_DOM_FRAGMENT) {
5371
+ RETURN_DOM = true;
5372
+ }
5373
+ /* Parse profile info */
5374
+ if (USE_PROFILES) {
5375
+ ALLOWED_TAGS = addToSet({}, text);
5376
+ ALLOWED_ATTR = [];
5377
+ if (USE_PROFILES.html === true) {
5378
+ addToSet(ALLOWED_TAGS, html$1);
5379
+ addToSet(ALLOWED_ATTR, html);
5380
+ }
5381
+ if (USE_PROFILES.svg === true) {
5382
+ addToSet(ALLOWED_TAGS, svg$1);
5383
+ addToSet(ALLOWED_ATTR, svg);
5384
+ addToSet(ALLOWED_ATTR, xml);
5385
+ }
5386
+ if (USE_PROFILES.svgFilters === true) {
5387
+ addToSet(ALLOWED_TAGS, svgFilters);
5388
+ addToSet(ALLOWED_ATTR, svg);
5389
+ addToSet(ALLOWED_ATTR, xml);
5390
+ }
5391
+ if (USE_PROFILES.mathMl === true) {
5392
+ addToSet(ALLOWED_TAGS, mathMl$1);
5393
+ addToSet(ALLOWED_ATTR, mathMl);
5394
+ addToSet(ALLOWED_ATTR, xml);
5395
+ }
5396
+ }
5397
+ /* Merge configuration parameters */
5398
+ if (cfg.ADD_TAGS) {
5399
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
5400
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
5401
+ }
5402
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
5403
+ }
5404
+ if (cfg.ADD_ATTR) {
5405
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
5406
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
5407
+ }
5408
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
5409
+ }
5410
+ if (cfg.ADD_URI_SAFE_ATTR) {
5411
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
5412
+ }
5413
+ if (cfg.FORBID_CONTENTS) {
5414
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
5415
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
5416
+ }
5417
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
5418
+ }
5419
+ /* Add #text in case KEEP_CONTENT is set to true */
5420
+ if (KEEP_CONTENT) {
5421
+ ALLOWED_TAGS['#text'] = true;
5422
+ }
5423
+ /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
5424
+ if (WHOLE_DOCUMENT) {
5425
+ addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
5426
+ }
5427
+ /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
5428
+ if (ALLOWED_TAGS.table) {
5429
+ addToSet(ALLOWED_TAGS, ['tbody']);
5430
+ delete FORBID_TAGS.tbody;
5431
+ }
5432
+ if (cfg.TRUSTED_TYPES_POLICY) {
5433
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
5434
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
5435
+ }
5436
+ if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
5437
+ throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
5438
+ }
5439
+ // Overwrite existing TrustedTypes policy.
5440
+ trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
5441
+ // Sign local variables required by `sanitize`.
5442
+ emptyHTML = trustedTypesPolicy.createHTML('');
5443
+ } else {
5444
+ // Uninitialized policy, attempt to initialize the internal dompurify policy.
5445
+ if (trustedTypesPolicy === undefined) {
5446
+ trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
5447
+ }
5448
+ // If creating the internal policy succeeded sign internal variables.
5449
+ if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
5450
+ emptyHTML = trustedTypesPolicy.createHTML('');
5451
+ }
5452
+ }
5453
+ // Prevent further manipulation of configuration.
5454
+ // Not available in IE8, Safari 5, etc.
5455
+ if (freeze) {
5456
+ freeze(cfg);
5457
+ }
5458
+ CONFIG = cfg;
5459
+ };
5460
+ /* Keep track of all possible SVG and MathML tags
5461
+ * so that we can perform the namespace checks
5462
+ * correctly. */
5463
+ const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
5464
+ const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
5465
+ /**
5466
+ * @param element a DOM element whose namespace is being checked
5467
+ * @returns Return false if the element has a
5468
+ * namespace that a spec-compliant parser would never
5469
+ * return. Return true otherwise.
5470
+ */
5471
+ const _checkValidNamespace = function _checkValidNamespace(element) {
5472
+ let parent = getParentNode(element);
5473
+ // In JSDOM, if we're inside shadow DOM, then parentNode
5474
+ // can be null. We just simulate parent in this case.
5475
+ if (!parent || !parent.tagName) {
5476
+ parent = {
5477
+ namespaceURI: NAMESPACE,
5478
+ tagName: 'template'
5479
+ };
5480
+ }
5481
+ const tagName = stringToLowerCase(element.tagName);
5482
+ const parentTagName = stringToLowerCase(parent.tagName);
5483
+ if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
5484
+ return false;
5485
+ }
5486
+ if (element.namespaceURI === SVG_NAMESPACE) {
5487
+ // The only way to switch from HTML namespace to SVG
5488
+ // is via <svg>. If it happens via any other tag, then
5489
+ // it should be killed.
5490
+ if (parent.namespaceURI === HTML_NAMESPACE) {
5491
+ return tagName === 'svg';
5492
+ }
5493
+ // The only way to switch from MathML to SVG is via`
5494
+ // svg if parent is either <annotation-xml> or MathML
5495
+ // text integration points.
5496
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
5497
+ return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
5498
+ }
5499
+ // We only allow elements that are defined in SVG
5500
+ // spec. All others are disallowed in SVG namespace.
5501
+ return Boolean(ALL_SVG_TAGS[tagName]);
5502
+ }
5503
+ if (element.namespaceURI === MATHML_NAMESPACE) {
5504
+ // The only way to switch from HTML namespace to MathML
5505
+ // is via <math>. If it happens via any other tag, then
5506
+ // it should be killed.
5507
+ if (parent.namespaceURI === HTML_NAMESPACE) {
5508
+ return tagName === 'math';
5509
+ }
5510
+ // The only way to switch from SVG to MathML is via
5511
+ // <math> and HTML integration points
5512
+ if (parent.namespaceURI === SVG_NAMESPACE) {
5513
+ return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
5514
+ }
5515
+ // We only allow elements that are defined in MathML
5516
+ // spec. All others are disallowed in MathML namespace.
5517
+ return Boolean(ALL_MATHML_TAGS[tagName]);
5518
+ }
5519
+ if (element.namespaceURI === HTML_NAMESPACE) {
5520
+ // The only way to switch from SVG to HTML is via
5521
+ // HTML integration points, and from MathML to HTML
5522
+ // is via MathML text integration points
5523
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
5524
+ return false;
5525
+ }
5526
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
5527
+ return false;
5528
+ }
5529
+ // We disallow tags that are specific for MathML
5530
+ // or SVG and should never appear in HTML namespace
5531
+ return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
5532
+ }
5533
+ // For XHTML and XML documents that support custom namespaces
5534
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
5535
+ return true;
5536
+ }
5537
+ // The code should never reach this place (this means
5538
+ // that the element somehow got namespace that is not
5539
+ // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
5540
+ // Return false just in case.
5541
+ return false;
5542
+ };
5543
+ /**
5544
+ * _forceRemove
5545
+ *
5546
+ * @param node a DOM node
5547
+ */
5548
+ const _forceRemove = function _forceRemove(node) {
5549
+ arrayPush(DOMPurify.removed, {
5550
+ element: node
5551
+ });
5552
+ try {
5553
+ // eslint-disable-next-line unicorn/prefer-dom-node-remove
5554
+ getParentNode(node).removeChild(node);
5555
+ } catch (_) {
5556
+ remove(node);
5557
+ }
5558
+ };
5559
+ /**
5560
+ * _removeAttribute
5561
+ *
5562
+ * @param name an Attribute name
5563
+ * @param element a DOM node
5564
+ */
5565
+ const _removeAttribute = function _removeAttribute(name, element) {
5566
+ try {
5567
+ arrayPush(DOMPurify.removed, {
5568
+ attribute: element.getAttributeNode(name),
5569
+ from: element
5570
+ });
5571
+ } catch (_) {
5572
+ arrayPush(DOMPurify.removed, {
5573
+ attribute: null,
5574
+ from: element
5575
+ });
5576
+ }
5577
+ element.removeAttribute(name);
5578
+ // We void attribute values for unremovable "is" attributes
5579
+ if (name === 'is') {
5580
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
5581
+ try {
5582
+ _forceRemove(element);
5583
+ } catch (_) {}
5584
+ } else {
5585
+ try {
5586
+ element.setAttribute(name, '');
5587
+ } catch (_) {}
5588
+ }
5589
+ }
5590
+ };
5591
+ /**
5592
+ * _initDocument
5593
+ *
5594
+ * @param dirty - a string of dirty markup
5595
+ * @return a DOM, filled with the dirty markup
5596
+ */
5597
+ const _initDocument = function _initDocument(dirty) {
5598
+ /* Create a HTML document */
5599
+ let doc = null;
5600
+ let leadingWhitespace = null;
5601
+ if (FORCE_BODY) {
5602
+ dirty = '<remove></remove>' + dirty;
5603
+ } else {
5604
+ /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
5605
+ const matches = stringMatch(dirty, /^[\r\n\t ]+/);
5606
+ leadingWhitespace = matches && matches[0];
5607
+ }
5608
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
5609
+ // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
5610
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
5611
+ }
5612
+ const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
5613
+ /*
5614
+ * Use the DOMParser API by default, fallback later if needs be
5615
+ * DOMParser not work for svg when has multiple root element.
5616
+ */
5617
+ if (NAMESPACE === HTML_NAMESPACE) {
5618
+ try {
5619
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
5620
+ } catch (_) {}
5621
+ }
5622
+ /* Use createHTMLDocument in case DOMParser is not available */
5623
+ if (!doc || !doc.documentElement) {
5624
+ doc = implementation.createDocument(NAMESPACE, 'template', null);
5625
+ try {
5626
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
5627
+ } catch (_) {
5628
+ // Syntax error if dirtyPayload is invalid xml
5629
+ }
5630
+ }
5631
+ const body = doc.body || doc.documentElement;
5632
+ if (dirty && leadingWhitespace) {
5633
+ body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
5634
+ }
5635
+ /* Work on whole document or just its body */
5636
+ if (NAMESPACE === HTML_NAMESPACE) {
5637
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
5638
+ }
5639
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
5640
+ };
5641
+ /**
5642
+ * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
5643
+ *
5644
+ * @param root The root element or node to start traversing on.
5645
+ * @return The created NodeIterator
5646
+ */
5647
+ const _createNodeIterator = function _createNodeIterator(root) {
5648
+ return createNodeIterator.call(root.ownerDocument || root, root,
5649
+ // eslint-disable-next-line no-bitwise
5650
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
5651
+ };
5652
+ /**
5653
+ * _isClobbered
5654
+ *
5655
+ * @param element element to check for clobbering attacks
5656
+ * @return true if clobbered, false if safe
5657
+ */
5658
+ const _isClobbered = function _isClobbered(element) {
5659
+ return element instanceof HTMLFormElement && (typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function');
5660
+ };
5661
+ /**
5662
+ * Checks whether the given object is a DOM node.
5663
+ *
5664
+ * @param value object to check whether it's a DOM node
5665
+ * @return true is object is a DOM node
5666
+ */
5667
+ const _isNode = function _isNode(value) {
5668
+ return typeof Node === 'function' && value instanceof Node;
5669
+ };
5670
+ function _executeHooks(hooks, currentNode, data) {
5671
+ arrayForEach(hooks, hook => {
5672
+ hook.call(DOMPurify, currentNode, data, CONFIG);
5673
+ });
5674
+ }
5675
+ /**
5676
+ * _sanitizeElements
5677
+ *
5678
+ * @protect nodeName
5679
+ * @protect textContent
5680
+ * @protect removeChild
5681
+ * @param currentNode to check for permission to exist
5682
+ * @return true if node was killed, false if left alive
5683
+ */
5684
+ const _sanitizeElements = function _sanitizeElements(currentNode) {
5685
+ let content = null;
5686
+ /* Execute a hook if present */
5687
+ _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
5688
+ /* Check if element is clobbered or can clobber */
5689
+ if (_isClobbered(currentNode)) {
5690
+ _forceRemove(currentNode);
5691
+ return true;
5692
+ }
5693
+ /* Now let's check the element's type and name */
5694
+ const tagName = transformCaseFunc(currentNode.nodeName);
5695
+ /* Execute a hook if present */
5696
+ _executeHooks(hooks.uponSanitizeElement, currentNode, {
5697
+ tagName,
5698
+ allowedTags: ALLOWED_TAGS
5699
+ });
5700
+ /* Detect mXSS attempts abusing namespace confusion */
5701
+ if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
5702
+ _forceRemove(currentNode);
5703
+ return true;
5704
+ }
5705
+ /* Remove any occurrence of processing instructions */
5706
+ if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
5707
+ _forceRemove(currentNode);
5708
+ return true;
5709
+ }
5710
+ /* Remove any kind of possibly harmful comments */
5711
+ if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
5712
+ _forceRemove(currentNode);
5713
+ return true;
5714
+ }
5715
+ /* Remove element if anything forbids its presence */
5716
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
5717
+ /* Check if we have a custom element to handle */
5718
+ if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
5719
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
5720
+ return false;
5721
+ }
5722
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
5723
+ return false;
5724
+ }
5725
+ }
5726
+ /* Keep content except for bad-listed elements */
5727
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
5728
+ const parentNode = getParentNode(currentNode) || currentNode.parentNode;
5729
+ const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
5730
+ if (childNodes && parentNode) {
5731
+ const childCount = childNodes.length;
5732
+ for (let i = childCount - 1; i >= 0; --i) {
5733
+ const childClone = cloneNode(childNodes[i], true);
5734
+ childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
5735
+ parentNode.insertBefore(childClone, getNextSibling(currentNode));
5736
+ }
5737
+ }
5738
+ }
5739
+ _forceRemove(currentNode);
5740
+ return true;
5741
+ }
5742
+ /* Check whether element has a valid namespace */
5743
+ if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
5744
+ _forceRemove(currentNode);
5745
+ return true;
5746
+ }
5747
+ /* Make sure that older browsers don't get fallback-tag mXSS */
5748
+ if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
5749
+ _forceRemove(currentNode);
5750
+ return true;
5751
+ }
5752
+ /* Sanitize element content to be template-safe */
5753
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
5754
+ /* Get the element's text content */
5755
+ content = currentNode.textContent;
5756
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
5757
+ content = stringReplace(content, expr, ' ');
5758
+ });
5759
+ if (currentNode.textContent !== content) {
5760
+ arrayPush(DOMPurify.removed, {
5761
+ element: currentNode.cloneNode()
5762
+ });
5763
+ currentNode.textContent = content;
5764
+ }
5765
+ }
5766
+ /* Execute a hook if present */
5767
+ _executeHooks(hooks.afterSanitizeElements, currentNode, null);
5768
+ return false;
5769
+ };
5770
+ /**
5771
+ * _isValidAttribute
5772
+ *
5773
+ * @param lcTag Lowercase tag name of containing element.
5774
+ * @param lcName Lowercase attribute name.
5775
+ * @param value Attribute value.
5776
+ * @return Returns true if `value` is valid, otherwise false.
5777
+ */
5778
+ // eslint-disable-next-line complexity
5779
+ const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
5780
+ /* Make sure attribute cannot clobber */
5781
+ if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
5782
+ return false;
5783
+ }
5784
+ /* Allow valid data-* attributes: At least one character after "-"
5785
+ (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
5786
+ XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
5787
+ We don't need to check the value; it's always URI safe. */
5788
+ if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
5789
+ if (
5790
+ // First condition does a very basic check if a) it's basically a valid custom element tagname AND
5791
+ // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
5792
+ // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
5793
+ _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
5794
+ // Alternative, second condition checks if it's an `is`-attribute, AND
5795
+ // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
5796
+ lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
5797
+ return false;
5798
+ }
5799
+ /* Check value is safe. First, is attr inert? If so, is safe */
5800
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
5801
+ return false;
5802
+ } else ;
5803
+ return true;
5804
+ };
5805
+ /**
5806
+ * _isBasicCustomElement
5807
+ * checks if at least one dash is included in tagName, and it's not the first char
5808
+ * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
5809
+ *
5810
+ * @param tagName name of the tag of the node to sanitize
5811
+ * @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
5812
+ */
5813
+ const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
5814
+ return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
5815
+ };
5816
+ /**
5817
+ * _sanitizeAttributes
5818
+ *
5819
+ * @protect attributes
5820
+ * @protect nodeName
5821
+ * @protect removeAttribute
5822
+ * @protect setAttribute
5823
+ *
5824
+ * @param currentNode to sanitize
5825
+ */
5826
+ const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
5827
+ /* Execute a hook if present */
5828
+ _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
5829
+ const {
5830
+ attributes
5831
+ } = currentNode;
5832
+ /* Check if we have attributes; if not we might have a text node */
5833
+ if (!attributes || _isClobbered(currentNode)) {
5834
+ return;
5835
+ }
5836
+ const hookEvent = {
5837
+ attrName: '',
5838
+ attrValue: '',
5839
+ keepAttr: true,
5840
+ allowedAttributes: ALLOWED_ATTR,
5841
+ forceKeepAttr: undefined
5842
+ };
5843
+ let l = attributes.length;
5844
+ /* Go backwards over all attributes; safely remove bad ones */
5845
+ while (l--) {
5846
+ const attr = attributes[l];
5847
+ const {
5848
+ name,
5849
+ namespaceURI,
5850
+ value: attrValue
5851
+ } = attr;
5852
+ const lcName = transformCaseFunc(name);
5853
+ let value = name === 'value' ? attrValue : stringTrim(attrValue);
5854
+ /* Execute a hook if present */
5855
+ hookEvent.attrName = lcName;
5856
+ hookEvent.attrValue = value;
5857
+ hookEvent.keepAttr = true;
5858
+ hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
5859
+ _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
5860
+ value = hookEvent.attrValue;
5861
+ /* Full DOM Clobbering protection via namespace isolation,
5862
+ * Prefix id and name attributes with `user-content-`
5863
+ */
5864
+ if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
5865
+ // Remove the attribute with this value
5866
+ _removeAttribute(name, currentNode);
5867
+ // Prefix the value and later re-create the attribute with the sanitized value
5868
+ value = SANITIZE_NAMED_PROPS_PREFIX + value;
5869
+ }
5870
+ /* Work around a security issue with comments inside attributes */
5871
+ if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
5872
+ _removeAttribute(name, currentNode);
5873
+ continue;
5874
+ }
5875
+ /* Did the hooks approve of the attribute? */
5876
+ if (hookEvent.forceKeepAttr) {
5877
+ continue;
5878
+ }
5879
+ /* Remove attribute */
5880
+ _removeAttribute(name, currentNode);
5881
+ /* Did the hooks approve of the attribute? */
5882
+ if (!hookEvent.keepAttr) {
5883
+ continue;
5884
+ }
5885
+ /* Work around a security issue in jQuery 3.0 */
5886
+ if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
5887
+ _removeAttribute(name, currentNode);
5888
+ continue;
5889
+ }
5890
+ /* Sanitize attribute content to be template-safe */
5891
+ if (SAFE_FOR_TEMPLATES) {
5892
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
5893
+ value = stringReplace(value, expr, ' ');
5894
+ });
5895
+ }
5896
+ /* Is `value` valid for this attribute? */
5897
+ const lcTag = transformCaseFunc(currentNode.nodeName);
5898
+ if (!_isValidAttribute(lcTag, lcName, value)) {
5899
+ continue;
5900
+ }
5901
+ /* Handle attributes that require Trusted Types */
5902
+ if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
5903
+ if (namespaceURI) ; else {
5904
+ switch (trustedTypes.getAttributeType(lcTag, lcName)) {
5905
+ case 'TrustedHTML':
5906
+ {
5907
+ value = trustedTypesPolicy.createHTML(value);
5908
+ break;
5909
+ }
5910
+ case 'TrustedScriptURL':
5911
+ {
5912
+ value = trustedTypesPolicy.createScriptURL(value);
5913
+ break;
5914
+ }
5915
+ }
5916
+ }
5917
+ }
5918
+ /* Handle invalid data-* attribute set by try-catching it */
5919
+ try {
5920
+ if (namespaceURI) {
5921
+ currentNode.setAttributeNS(namespaceURI, name, value);
5922
+ } else {
5923
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
5924
+ currentNode.setAttribute(name, value);
5925
+ }
5926
+ if (_isClobbered(currentNode)) {
5927
+ _forceRemove(currentNode);
5928
+ } else {
5929
+ arrayPop(DOMPurify.removed);
5930
+ }
5931
+ } catch (_) {}
5932
+ }
5933
+ /* Execute a hook if present */
5934
+ _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
5935
+ };
5936
+ /**
5937
+ * _sanitizeShadowDOM
5938
+ *
5939
+ * @param fragment to iterate over recursively
5940
+ */
5941
+ const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
5942
+ let shadowNode = null;
5943
+ const shadowIterator = _createNodeIterator(fragment);
5944
+ /* Execute a hook if present */
5945
+ _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
5946
+ while (shadowNode = shadowIterator.nextNode()) {
5947
+ /* Execute a hook if present */
5948
+ _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
5949
+ /* Sanitize tags and elements */
5950
+ _sanitizeElements(shadowNode);
5951
+ /* Check attributes next */
5952
+ _sanitizeAttributes(shadowNode);
5953
+ /* Deep shadow DOM detected */
5954
+ if (shadowNode.content instanceof DocumentFragment) {
5955
+ _sanitizeShadowDOM(shadowNode.content);
5956
+ }
5957
+ }
5958
+ /* Execute a hook if present */
5959
+ _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
5960
+ };
5961
+ // eslint-disable-next-line complexity
5962
+ DOMPurify.sanitize = function (dirty) {
5963
+ let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
5964
+ let body = null;
5965
+ let importedNode = null;
5966
+ let currentNode = null;
5967
+ let returnNode = null;
5968
+ /* Make sure we have a string to sanitize.
5969
+ DO NOT return early, as this will return the wrong type if
5970
+ the user has requested a DOM object rather than a string */
5971
+ IS_EMPTY_INPUT = !dirty;
5972
+ if (IS_EMPTY_INPUT) {
5973
+ dirty = '<!-->';
5974
+ }
5975
+ /* Stringify, in case dirty is an object */
5976
+ if (typeof dirty !== 'string' && !_isNode(dirty)) {
5977
+ if (typeof dirty.toString === 'function') {
5978
+ dirty = dirty.toString();
5979
+ if (typeof dirty !== 'string') {
5980
+ throw typeErrorCreate('dirty is not a string, aborting');
5981
+ }
5982
+ } else {
5983
+ throw typeErrorCreate('toString is not a function');
5984
+ }
5985
+ }
5986
+ /* Return dirty HTML if DOMPurify cannot run */
5987
+ if (!DOMPurify.isSupported) {
5988
+ return dirty;
5989
+ }
5990
+ /* Assign config vars */
5991
+ if (!SET_CONFIG) {
5992
+ _parseConfig(cfg);
5993
+ }
5994
+ /* Clean up removed elements */
5995
+ DOMPurify.removed = [];
5996
+ /* Check if dirty is correctly typed for IN_PLACE */
5997
+ if (typeof dirty === 'string') {
5998
+ IN_PLACE = false;
5999
+ }
6000
+ if (IN_PLACE) {
6001
+ /* Do some early pre-sanitization to avoid unsafe root nodes */
6002
+ if (dirty.nodeName) {
6003
+ const tagName = transformCaseFunc(dirty.nodeName);
6004
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
6005
+ throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
6006
+ }
6007
+ }
6008
+ } else if (dirty instanceof Node) {
6009
+ /* If dirty is a DOM element, append to an empty document to avoid
6010
+ elements being stripped by the parser */
6011
+ body = _initDocument('<!---->');
6012
+ importedNode = body.ownerDocument.importNode(dirty, true);
6013
+ if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
6014
+ /* Node is already a body, use as is */
6015
+ body = importedNode;
6016
+ } else if (importedNode.nodeName === 'HTML') {
6017
+ body = importedNode;
6018
+ } else {
6019
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
6020
+ body.appendChild(importedNode);
6021
+ }
6022
+ } else {
6023
+ /* Exit directly if we have nothing to do */
6024
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
6025
+ // eslint-disable-next-line unicorn/prefer-includes
6026
+ dirty.indexOf('<') === -1) {
6027
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
6028
+ }
6029
+ /* Initialize the document to work on */
6030
+ body = _initDocument(dirty);
6031
+ /* Check we have a DOM node from the data */
6032
+ if (!body) {
6033
+ return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
6034
+ }
6035
+ }
6036
+ /* Remove first element node (ours) if FORCE_BODY is set */
6037
+ if (body && FORCE_BODY) {
6038
+ _forceRemove(body.firstChild);
6039
+ }
6040
+ /* Get node iterator */
6041
+ const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
6042
+ /* Now start iterating over the created document */
6043
+ while (currentNode = nodeIterator.nextNode()) {
6044
+ /* Sanitize tags and elements */
6045
+ _sanitizeElements(currentNode);
6046
+ /* Check attributes next */
6047
+ _sanitizeAttributes(currentNode);
6048
+ /* Shadow DOM detected, sanitize it */
6049
+ if (currentNode.content instanceof DocumentFragment) {
6050
+ _sanitizeShadowDOM(currentNode.content);
6051
+ }
6052
+ }
6053
+ /* If we sanitized `dirty` in-place, return it. */
6054
+ if (IN_PLACE) {
6055
+ return dirty;
6056
+ }
6057
+ /* Return sanitized string or DOM */
6058
+ if (RETURN_DOM) {
6059
+ if (RETURN_DOM_FRAGMENT) {
6060
+ returnNode = createDocumentFragment.call(body.ownerDocument);
6061
+ while (body.firstChild) {
6062
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
6063
+ returnNode.appendChild(body.firstChild);
6064
+ }
6065
+ } else {
6066
+ returnNode = body;
6067
+ }
6068
+ if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
6069
+ /*
6070
+ AdoptNode() is not used because internal state is not reset
6071
+ (e.g. the past names map of a HTMLFormElement), this is safe
6072
+ in theory but we would rather not risk another attack vector.
6073
+ The state that is cloned by importNode() is explicitly defined
6074
+ by the specs.
6075
+ */
6076
+ returnNode = importNode.call(originalDocument, returnNode, true);
6077
+ }
6078
+ return returnNode;
6079
+ }
6080
+ let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
6081
+ /* Serialize doctype if allowed */
6082
+ if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
6083
+ serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
6084
+ }
6085
+ /* Sanitize final string template-safe */
6086
+ if (SAFE_FOR_TEMPLATES) {
6087
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
6088
+ serializedHTML = stringReplace(serializedHTML, expr, ' ');
6089
+ });
6090
+ }
6091
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
6092
+ };
6093
+ DOMPurify.setConfig = function () {
6094
+ let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
6095
+ _parseConfig(cfg);
6096
+ SET_CONFIG = true;
6097
+ };
6098
+ DOMPurify.clearConfig = function () {
6099
+ CONFIG = null;
6100
+ SET_CONFIG = false;
6101
+ };
6102
+ DOMPurify.isValidAttribute = function (tag, attr, value) {
6103
+ /* Initialize shared config vars if necessary. */
6104
+ if (!CONFIG) {
6105
+ _parseConfig({});
6106
+ }
6107
+ const lcTag = transformCaseFunc(tag);
6108
+ const lcName = transformCaseFunc(attr);
6109
+ return _isValidAttribute(lcTag, lcName, value);
6110
+ };
6111
+ DOMPurify.addHook = function (entryPoint, hookFunction) {
6112
+ if (typeof hookFunction !== 'function') {
6113
+ return;
6114
+ }
6115
+ arrayPush(hooks[entryPoint], hookFunction);
6116
+ };
6117
+ DOMPurify.removeHook = function (entryPoint) {
6118
+ return arrayPop(hooks[entryPoint]);
6119
+ };
6120
+ DOMPurify.removeHooks = function (entryPoint) {
6121
+ hooks[entryPoint] = [];
6122
+ };
6123
+ DOMPurify.removeAllHooks = function () {
6124
+ hooks = _createHooksMap();
6125
+ };
6126
+ return DOMPurify;
6127
+ }
6128
+ var purify = createDOMPurify();
6486
6129
 
6487
6130
  const noop$1 = () => { };
6488
6131
 
@@ -6545,7 +6188,7 @@ const getArrowStyle = (position, x, arrowWidth, tooltipHeight, tooltipWidth) =>
6545
6188
  };
6546
6189
  const HTMLTip = ({ text }) => {
6547
6190
  return React.createElement('div', {
6548
- dangerouslySetInnerHTML: { __html: DOMPurify.sanitize(text) },
6191
+ dangerouslySetInnerHTML: { __html: purify.sanitize(text) },
6549
6192
  });
6550
6193
  };
6551
6194
  /** Tooltips can cause SystemTests to be flaky, so we suppress them in Playwright and Protractor */
@@ -16320,6 +15963,305 @@ const InputGroup = ({ readonly = false, onChange, onKeyUp, onFocus, onBlur, onKe
16320
15963
  append.filter(Boolean).map((item, index) => item.variant === 'button' ? (React.createElement(Button, { key: index, extraClassNames: "tw-ml-[-1px] focus:tw-z-40 focus:tw-border tw-rounded-l-none tw-rounded-r-none last:tw-rounded-r-sm", onClick: item.buttonProps.onClick, variant: item.buttonProps.variant, icon: item.buttonProps.icon, iconColor: item.buttonProps.iconColor, testId: item.buttonProps.testId, disabled: item.buttonProps.disabled, label: item.buttonProps.label, iconStyle: item.buttonProps.iconStyle })) : (React.createElement("div", { key: index, className: `${borderColorClasses} tw-flex tw-items-center tw-h-inputs tw-justify-center tw-rounded-none tw-ml-[-1px] focus:tw-z-40 focus:tw-border last:tw-border last:tw-rounded-r-sm` }, item.element)))));
16321
15964
  };
16322
15965
 
15966
+ // packages/react/context/src/createContext.tsx
15967
+ function createContextScope(scopeName, createContextScopeDeps = []) {
15968
+ let defaultContexts = [];
15969
+ function createContext3(rootComponentName, defaultContext) {
15970
+ const BaseContext = React__namespace.createContext(defaultContext);
15971
+ const index = defaultContexts.length;
15972
+ defaultContexts = [...defaultContexts, defaultContext];
15973
+ const Provider = (props) => {
15974
+ const { scope, children, ...context } = props;
15975
+ const Context = scope?.[scopeName]?.[index] || BaseContext;
15976
+ const value = React__namespace.useMemo(() => context, Object.values(context));
15977
+ return /* @__PURE__ */ jsxRuntime.jsx(Context.Provider, { value, children });
15978
+ };
15979
+ Provider.displayName = rootComponentName + "Provider";
15980
+ function useContext2(consumerName, scope) {
15981
+ const Context = scope?.[scopeName]?.[index] || BaseContext;
15982
+ const context = React__namespace.useContext(Context);
15983
+ if (context) return context;
15984
+ if (defaultContext !== void 0) return defaultContext;
15985
+ throw new Error(`\`${consumerName}\` must be used within \`${rootComponentName}\``);
15986
+ }
15987
+ return [Provider, useContext2];
15988
+ }
15989
+ const createScope = () => {
15990
+ const scopeContexts = defaultContexts.map((defaultContext) => {
15991
+ return React__namespace.createContext(defaultContext);
15992
+ });
15993
+ return function useScope(scope) {
15994
+ const contexts = scope?.[scopeName] || scopeContexts;
15995
+ return React__namespace.useMemo(
15996
+ () => ({ [`__scope${scopeName}`]: { ...scope, [scopeName]: contexts } }),
15997
+ [scope, contexts]
15998
+ );
15999
+ };
16000
+ };
16001
+ createScope.scopeName = scopeName;
16002
+ return [createContext3, composeContextScopes(createScope, ...createContextScopeDeps)];
16003
+ }
16004
+ function composeContextScopes(...scopes) {
16005
+ const baseScope = scopes[0];
16006
+ if (scopes.length === 1) return baseScope;
16007
+ const createScope = () => {
16008
+ const scopeHooks = scopes.map((createScope2) => ({
16009
+ useScope: createScope2(),
16010
+ scopeName: createScope2.scopeName
16011
+ }));
16012
+ return function useComposedScopes(overrideScopes) {
16013
+ const nextScopes = scopeHooks.reduce((nextScopes2, { useScope, scopeName }) => {
16014
+ const scopeProps = useScope(overrideScopes);
16015
+ const currentScope = scopeProps[`__scope${scopeName}`];
16016
+ return { ...nextScopes2, ...currentScope };
16017
+ }, {});
16018
+ return React__namespace.useMemo(() => ({ [`__scope${baseScope.scopeName}`]: nextScopes }), [nextScopes]);
16019
+ };
16020
+ };
16021
+ createScope.scopeName = baseScope.scopeName;
16022
+ return createScope;
16023
+ }
16024
+
16025
+ // packages/react/compose-refs/src/composeRefs.tsx
16026
+ function setRef(ref, value) {
16027
+ if (typeof ref === "function") {
16028
+ return ref(value);
16029
+ } else if (ref !== null && ref !== void 0) {
16030
+ ref.current = value;
16031
+ }
16032
+ }
16033
+ function composeRefs(...refs) {
16034
+ return (node) => {
16035
+ let hasCleanup = false;
16036
+ const cleanups = refs.map((ref) => {
16037
+ const cleanup = setRef(ref, node);
16038
+ if (!hasCleanup && typeof cleanup == "function") {
16039
+ hasCleanup = true;
16040
+ }
16041
+ return cleanup;
16042
+ });
16043
+ if (hasCleanup) {
16044
+ return () => {
16045
+ for (let i = 0; i < cleanups.length; i++) {
16046
+ const cleanup = cleanups[i];
16047
+ if (typeof cleanup == "function") {
16048
+ cleanup();
16049
+ } else {
16050
+ setRef(refs[i], null);
16051
+ }
16052
+ }
16053
+ };
16054
+ }
16055
+ };
16056
+ }
16057
+
16058
+ // packages/react/slot/src/Slot.tsx
16059
+ var Slot = React__namespace.forwardRef((props, forwardedRef) => {
16060
+ const { children, ...slotProps } = props;
16061
+ const childrenArray = React__namespace.Children.toArray(children);
16062
+ const slottable = childrenArray.find(isSlottable);
16063
+ if (slottable) {
16064
+ const newElement = slottable.props.children;
16065
+ const newChildren = childrenArray.map((child) => {
16066
+ if (child === slottable) {
16067
+ if (React__namespace.Children.count(newElement) > 1) return React__namespace.Children.only(null);
16068
+ return React__namespace.isValidElement(newElement) ? newElement.props.children : null;
16069
+ } else {
16070
+ return child;
16071
+ }
16072
+ });
16073
+ return /* @__PURE__ */ jsxRuntime.jsx(SlotClone, { ...slotProps, ref: forwardedRef, children: React__namespace.isValidElement(newElement) ? React__namespace.cloneElement(newElement, void 0, newChildren) : null });
16074
+ }
16075
+ return /* @__PURE__ */ jsxRuntime.jsx(SlotClone, { ...slotProps, ref: forwardedRef, children });
16076
+ });
16077
+ Slot.displayName = "Slot";
16078
+ var SlotClone = React__namespace.forwardRef((props, forwardedRef) => {
16079
+ const { children, ...slotProps } = props;
16080
+ if (React__namespace.isValidElement(children)) {
16081
+ const childrenRef = getElementRef(children);
16082
+ return React__namespace.cloneElement(children, {
16083
+ ...mergeProps(slotProps, children.props),
16084
+ // @ts-ignore
16085
+ ref: forwardedRef ? composeRefs(forwardedRef, childrenRef) : childrenRef
16086
+ });
16087
+ }
16088
+ return React__namespace.Children.count(children) > 1 ? React__namespace.Children.only(null) : null;
16089
+ });
16090
+ SlotClone.displayName = "SlotClone";
16091
+ var Slottable = ({ children }) => {
16092
+ return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
16093
+ };
16094
+ function isSlottable(child) {
16095
+ return React__namespace.isValidElement(child) && child.type === Slottable;
16096
+ }
16097
+ function mergeProps(slotProps, childProps) {
16098
+ const overrideProps = { ...childProps };
16099
+ for (const propName in childProps) {
16100
+ const slotPropValue = slotProps[propName];
16101
+ const childPropValue = childProps[propName];
16102
+ const isHandler = /^on[A-Z]/.test(propName);
16103
+ if (isHandler) {
16104
+ if (slotPropValue && childPropValue) {
16105
+ overrideProps[propName] = (...args) => {
16106
+ childPropValue(...args);
16107
+ slotPropValue(...args);
16108
+ };
16109
+ } else if (slotPropValue) {
16110
+ overrideProps[propName] = slotPropValue;
16111
+ }
16112
+ } else if (propName === "style") {
16113
+ overrideProps[propName] = { ...slotPropValue, ...childPropValue };
16114
+ } else if (propName === "className") {
16115
+ overrideProps[propName] = [slotPropValue, childPropValue].filter(Boolean).join(" ");
16116
+ }
16117
+ }
16118
+ return { ...slotProps, ...overrideProps };
16119
+ }
16120
+ function getElementRef(element) {
16121
+ let getter = Object.getOwnPropertyDescriptor(element.props, "ref")?.get;
16122
+ let mayWarn = getter && "isReactWarning" in getter && getter.isReactWarning;
16123
+ if (mayWarn) {
16124
+ return element.ref;
16125
+ }
16126
+ getter = Object.getOwnPropertyDescriptor(element, "ref")?.get;
16127
+ mayWarn = getter && "isReactWarning" in getter && getter.isReactWarning;
16128
+ if (mayWarn) {
16129
+ return element.props.ref;
16130
+ }
16131
+ return element.props.ref || element.ref;
16132
+ }
16133
+
16134
+ // packages/react/primitive/src/Primitive.tsx
16135
+ var NODES = [
16136
+ "a",
16137
+ "button",
16138
+ "div",
16139
+ "form",
16140
+ "h2",
16141
+ "h3",
16142
+ "img",
16143
+ "input",
16144
+ "label",
16145
+ "li",
16146
+ "nav",
16147
+ "ol",
16148
+ "p",
16149
+ "span",
16150
+ "svg",
16151
+ "ul"
16152
+ ];
16153
+ var Primitive = NODES.reduce((primitive, node) => {
16154
+ const Node = React__namespace.forwardRef((props, forwardedRef) => {
16155
+ const { asChild, ...primitiveProps } = props;
16156
+ const Comp = asChild ? Slot : node;
16157
+ if (typeof window !== "undefined") {
16158
+ window[Symbol.for("radix-ui")] = true;
16159
+ }
16160
+ return /* @__PURE__ */ jsxRuntime.jsx(Comp, { ...primitiveProps, ref: forwardedRef });
16161
+ });
16162
+ Node.displayName = `Primitive.${node}`;
16163
+ return { ...primitive, [node]: Node };
16164
+ }, {});
16165
+
16166
+ var PROGRESS_NAME = "Progress";
16167
+ var DEFAULT_MAX = 100;
16168
+ var [createProgressContext, createProgressScope] = createContextScope(PROGRESS_NAME);
16169
+ var [ProgressProvider, useProgressContext] = createProgressContext(PROGRESS_NAME);
16170
+ var Progress = React__namespace.forwardRef(
16171
+ (props, forwardedRef) => {
16172
+ const {
16173
+ __scopeProgress,
16174
+ value: valueProp = null,
16175
+ max: maxProp,
16176
+ getValueLabel = defaultGetValueLabel,
16177
+ ...progressProps
16178
+ } = props;
16179
+ if ((maxProp || maxProp === 0) && !isValidMaxNumber(maxProp)) {
16180
+ console.error(getInvalidMaxError(`${maxProp}`, "Progress"));
16181
+ }
16182
+ const max = isValidMaxNumber(maxProp) ? maxProp : DEFAULT_MAX;
16183
+ if (valueProp !== null && !isValidValueNumber(valueProp, max)) {
16184
+ console.error(getInvalidValueError(`${valueProp}`, "Progress"));
16185
+ }
16186
+ const value = isValidValueNumber(valueProp, max) ? valueProp : null;
16187
+ const valueLabel = isNumber(value) ? getValueLabel(value, max) : void 0;
16188
+ return /* @__PURE__ */ jsxRuntime.jsx(ProgressProvider, { scope: __scopeProgress, value, max, children: /* @__PURE__ */ jsxRuntime.jsx(
16189
+ Primitive.div,
16190
+ {
16191
+ "aria-valuemax": max,
16192
+ "aria-valuemin": 0,
16193
+ "aria-valuenow": isNumber(value) ? value : void 0,
16194
+ "aria-valuetext": valueLabel,
16195
+ role: "progressbar",
16196
+ "data-state": getProgressState(value, max),
16197
+ "data-value": value ?? void 0,
16198
+ "data-max": max,
16199
+ ...progressProps,
16200
+ ref: forwardedRef
16201
+ }
16202
+ ) });
16203
+ }
16204
+ );
16205
+ Progress.displayName = PROGRESS_NAME;
16206
+ var INDICATOR_NAME = "ProgressIndicator";
16207
+ var ProgressIndicator = React__namespace.forwardRef(
16208
+ (props, forwardedRef) => {
16209
+ const { __scopeProgress, ...indicatorProps } = props;
16210
+ const context = useProgressContext(INDICATOR_NAME, __scopeProgress);
16211
+ return /* @__PURE__ */ jsxRuntime.jsx(
16212
+ Primitive.div,
16213
+ {
16214
+ "data-state": getProgressState(context.value, context.max),
16215
+ "data-value": context.value ?? void 0,
16216
+ "data-max": context.max,
16217
+ ...indicatorProps,
16218
+ ref: forwardedRef
16219
+ }
16220
+ );
16221
+ }
16222
+ );
16223
+ ProgressIndicator.displayName = INDICATOR_NAME;
16224
+ function defaultGetValueLabel(value, max) {
16225
+ return `${Math.round(value / max * 100)}%`;
16226
+ }
16227
+ function getProgressState(value, maxValue) {
16228
+ return value == null ? "indeterminate" : value === maxValue ? "complete" : "loading";
16229
+ }
16230
+ function isNumber(value) {
16231
+ return typeof value === "number";
16232
+ }
16233
+ function isValidMaxNumber(max) {
16234
+ return isNumber(max) && !isNaN(max) && max > 0;
16235
+ }
16236
+ function isValidValueNumber(value, max) {
16237
+ return isNumber(value) && !isNaN(value) && value <= max && value >= 0;
16238
+ }
16239
+ function getInvalidMaxError(propValue, componentName) {
16240
+ return `Invalid prop \`max\` of value \`${propValue}\` supplied to \`${componentName}\`. Only numbers greater than 0 are valid max values. Defaulting to \`${DEFAULT_MAX}\`.`;
16241
+ }
16242
+ function getInvalidValueError(propValue, componentName) {
16243
+ return `Invalid prop \`value\` of value \`${propValue}\` supplied to \`${componentName}\`. The \`value\` prop must be:
16244
+ - a positive number
16245
+ - less than the value passed to \`max\` (or ${DEFAULT_MAX} if no \`max\` prop is set)
16246
+ - \`null\` or \`undefined\` if the progress is indeterminate.
16247
+
16248
+ Defaulting to \`null\`.`;
16249
+ }
16250
+ var Root = Progress;
16251
+ var Indicator = ProgressIndicator;
16252
+
16253
+ const ProgressBar = ({ value, max = 100, label, extraClasses }) => {
16254
+ const tooltipData = getQTipData({ tooltip: label });
16255
+ const [progress, setProgress] = React.useState(0);
16256
+ React.useEffect(() => {
16257
+ const timer = setTimeout(() => setProgress(value), 500);
16258
+ return () => clearTimeout(timer);
16259
+ }, []);
16260
+ return (React.createElement("span", { ...tooltipData },
16261
+ React.createElement(Root, { className: "tw-relative tw-h-[18px] tw-w-full tw-overflow-hidden tw-rounded-[2.5px] tw-bg-sq-dark-gray dark:tw-bg-sq-dark-disabled-gray", max: max, value: value },
16262
+ React.createElement(Indicator, { className: `tw-ease-[cubic-bezier(0.65, 0, 0.35, 1)] tw-h-full tw-bg-sq-color-dark tw-transition-transform tw-duration-[660ms] ${extraClasses}`, style: { transform: `translateX(-${100 - progress}%)` } }))));
16263
+ };
16264
+
16323
16265
  exports.Accordion = Accordion;
16324
16266
  exports.Alert = Alert;
16325
16267
  exports.Button = Button;
@@ -16329,6 +16271,7 @@ exports.Checkbox = Checkbox;
16329
16271
  exports.Icon = Icon;
16330
16272
  exports.InputGroup = InputGroup;
16331
16273
  exports.Modal = Modal;
16274
+ exports.ProgressBar = ProgressBar;
16332
16275
  exports.QTip = QTip;
16333
16276
  exports.SeeqActionDropdown = SeeqActionDropdown;
16334
16277
  exports.Select = Select;