@tellescope/utilities 1.255.19 → 1.256.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/utils.d.ts +62 -0
- package/lib/cjs/utils.d.ts.map +1 -1
- package/lib/cjs/utils.js +164 -4
- package/lib/cjs/utils.js.map +1 -1
- package/lib/esm/utils.d.ts +62 -0
- package/lib/esm/utils.d.ts.map +1 -1
- package/lib/esm/utils.js +160 -1
- package/lib/esm/utils.js.map +1 -1
- package/lib/tsconfig.tsbuildinfo +1 -1
- package/package.json +4 -4
- package/src/utils.ts +176 -1
package/lib/esm/utils.d.ts
CHANGED
|
@@ -204,6 +204,58 @@ export declare const sanitize_html_for_cms: (html: string) => string;
|
|
|
204
204
|
* for that surface rather than loosening this shared function.
|
|
205
205
|
*/
|
|
206
206
|
export declare const sanitize_user_html: (html: string) => string;
|
|
207
|
+
/**
|
|
208
|
+
* Sandbox forced onto an `<iframe>` by {@link sanitize_user_html_with_iframes} when its author did
|
|
209
|
+
* not supply one.
|
|
210
|
+
*
|
|
211
|
+
* `allow-same-origin` is required in practice: without it the frame gets an opaque origin, where
|
|
212
|
+
* `localStorage` access throws and the embed's own CSP `'self'` matches nothing. Real embeds break —
|
|
213
|
+
* a Loom embed renders as a blank box, verified in Chrome. Since the sanitizer requires an absolute
|
|
214
|
+
* cross-origin `https` src, granting it gives the frame nothing an unsandboxed frame wouldn't have.
|
|
215
|
+
*
|
|
216
|
+
* What is deliberately withheld matters more than what is granted. Above all `allow-top-navigation`:
|
|
217
|
+
* a hostile embed cannot navigate the patient's page elsewhere. Also withheld: `allow-downloads`,
|
|
218
|
+
* `allow-modals`, `allow-pointer-lock`, `allow-orientation-lock`, `allow-top-navigation-by-user-activation`.
|
|
219
|
+
*/
|
|
220
|
+
export declare const DEFAULT_IFRAME_SANDBOX = "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-presentation";
|
|
221
|
+
/**
|
|
222
|
+
* Same as {@link sanitize_user_html}, but additionally permits `<iframe>` so authored content can
|
|
223
|
+
* embed video, scheduling widgets, etc. `sanitize_user_html` remains the default — only reach for
|
|
224
|
+
* this variant on a surface that specifically needs framing.
|
|
225
|
+
*
|
|
226
|
+
* Preconditions for any new caller:
|
|
227
|
+
* - **Admin/staff-authored HTML only.** Never use this for patient-authored content (form answers
|
|
228
|
+
* where `answerIsHTML`, chat messages, community posts) or for inbound email.
|
|
229
|
+
* - **Any patient-derived substring templated into the HTML must be entity-escaped first** — see
|
|
230
|
+
* `escapeHTMLValues` on {@link replace_form_field_template_values}. Otherwise "admin-authored"
|
|
231
|
+
* isn't actually true and a patient can inject a frame into an admin's description.
|
|
232
|
+
*
|
|
233
|
+
* How the frame is contained — the two controls work together, do not weaken either alone:
|
|
234
|
+
*
|
|
235
|
+
* 1. `src` must be an absolute `https://host` URL. Relative, protocol-relative (`//host`),
|
|
236
|
+
* `javascript:`, `data:` and `srcdoc` frames are dropped, so the frame is always cross-origin
|
|
237
|
+
* and the same-origin policy alone already prevents it from touching this document. Note that
|
|
238
|
+
* sanitize-html does NOT reject protocol-relative iframe srcs on its own when
|
|
239
|
+
* `allowProtocolRelative` is set, so that check lives in `transformTags` below.
|
|
240
|
+
* 2. {@link DEFAULT_IFRAME_SANDBOX} is forced when the author supplied none. Critically it withholds
|
|
241
|
+
* `allow-top-navigation`, so a hostile or compromised embed cannot redirect the patient's page to
|
|
242
|
+
* a phishing site — the realistic threat for an embed in a patient-facing form. It also withholds
|
|
243
|
+
* downloads, modals, pointer-lock, plugins and orientation-lock. It is therefore strictly more
|
|
244
|
+
* restrictive than rendering the same cross-origin iframe with no sandbox at all.
|
|
245
|
+
*
|
|
246
|
+
* It DOES grant `allow-same-origin`, which for a cross-origin `src` grants nothing a normal
|
|
247
|
+
* unsandboxed frame wouldn't already have (its own origin, its own storage) — see
|
|
248
|
+
* DEFAULT_IFRAME_SANDBOX for why that is necessary in practice. `allow-same-origin` would only be
|
|
249
|
+
* dangerous for a *same-origin* `src`, since such a frame could script this document; control 1 is
|
|
250
|
+
* what rules that out, which is why the src check must not be relaxed.
|
|
251
|
+
*
|
|
252
|
+
* An author-supplied `sandbox` is honored verbatim as an escape hatch (including `sandbox=""`, the
|
|
253
|
+
* most restrictive value), so a surface can tighten or loosen per embed.
|
|
254
|
+
*
|
|
255
|
+
* Current callers: the live form's field description (`Forms/forms.tsx`, `Forms/forms.v2.tsx`).
|
|
256
|
+
* The read-only submitted-response views intentionally stay on `sanitize_user_html`.
|
|
257
|
+
*/
|
|
258
|
+
export declare const sanitize_user_html_with_iframes: (html: string) => string;
|
|
207
259
|
export declare const query_string_for_object: (query: Indexable) => string;
|
|
208
260
|
export declare const PROD_API_URL = "https://api.tellescope.com";
|
|
209
261
|
export declare const STAGING_API_URL = "https://staging-api.tellescope.com";
|
|
@@ -363,6 +415,16 @@ export declare const replace_form_field_template_values: (s: string, options: {
|
|
|
363
415
|
enduser?: Partial<Enduser> | undefined;
|
|
364
416
|
responses?: FormResponseValue[] | undefined;
|
|
365
417
|
escapeNewlinesAsHTMLBreaks?: boolean | undefined;
|
|
418
|
+
/**
|
|
419
|
+
* Entity-escape the substituted `{{enduser.*}}` values. Set this whenever the result is
|
|
420
|
+
* rendered through a sanitizer that permits iframes ({@link sanitize_user_html_with_iframes}):
|
|
421
|
+
* these values come from the patient's own intake answers / enduser record, so without escaping
|
|
422
|
+
* a patient could inject a frame into an otherwise admin-authored description.
|
|
423
|
+
*
|
|
424
|
+
* Off by default because most callers substitute into plain text rendered by React (which
|
|
425
|
+
* escapes already), where escaping here would corrupt the output — e.g. a name containing `&`.
|
|
426
|
+
*/
|
|
427
|
+
escapeHTMLValues?: boolean | undefined;
|
|
366
428
|
}) => string;
|
|
367
429
|
export declare const replace_sms_template_values: (s: string, sms?: Omit<SMSMessage, 'id'> | null) => string;
|
|
368
430
|
export declare const get_secret_names: (s: string) => string[];
|
package/lib/esm/utils.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils.ts"],"names":[],"mappings":";AAAA,OAAO,EAAmB,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAA6B,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAiF,iBAAiB,EAAE,uBAAuB,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,EAAsB,YAAY,EAAE,gBAAgB,EAAW,QAAQ,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAsD,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGvsB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,CAAA;AAEnB,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAE7B,MAAM,MAAM,SAAS,CAAC,CAAC,GAAC,GAAG,IAAI;IAAE,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAA;CAAE,CAAA;AAErD,eAAO,MAAM,aAAa,MAAO;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,YAC1C,CAAA;AAKlE,eAAO,MAAM,kBAAkB,MAC1B;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,YAClD;IAAE,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,YAInD,CAAA;AAED,eAAO,MAAM,wBAAwB,wBAAmD,CAAA;AACxF,eAAO,MAAM,sBAAsB,wBAAmD,CAAA;AAEtF,eAAO,MAAM,eAAe,MAAQ,MAAM,YAA4D,CAAA;AAEtG,eAAO,MAAM,SAAS,OAAQ,GAAG,YAAQ,CAAA;AACzC,eAAO,MAAM,UAAU,OAAQ,GAAG,YAAoB,CAAA;AACtD,eAAO,MAAM,aAAa,wCADK,GAAG,+BAUjC,CAAA;AACD,eAAO,MAAM,SAAS,QAAS,GAAG,0BAA8D,CAAA;AAGhG,eAAO,MAAM,eAAe,WAAY,MAAM,EAAE,MAAM,SAAS,MAAM,SAAS,mBAQ7E,CAAA;AAGD,eAAO,MAAM,aAAa,yBAAoC,CAAA;AAE9D,eAAO,MAAM,aAAa,wBAAoD,CAAA;AAE9E,eAAO,MAAM,YAAY,0BAA4B,CAAA;AAErD,eAAO,MAAM,kBAAkB,QAAS,GAAG,OAAO,GAAG,YA4BpD,CAAA;AAED,eAAO,MAAM,iBAAiB;;;;;;;;+BAa7B,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AACD,eAAO,MAAM,cAAc,UAAW,gBAAgB,YAAY,eAAe,KAAG,kBAAkB,GAAG,IAgBxG,CAAA;AAED,eAAO,MAAM,cAAc,oCAM1B,CAAA;AAED,eAAO,MAAM,eAAe;;;YAW3B,CAAA;AAGD,eAAO,MAAM,mCAAmC,cAAe,MAAM,kBAAkB,MAAM,KAAG,MAe/F,CAAA;AAED,eAAO,MAAM,UAAU,0FAEtB,CAAA;AAGD,eAAO,MAAM,mBAAmB,SAAU,MAAM,cAAc,MAAM;;;QAoDnE,CAAA;AAaD,eAAO,MAAM,gBAAgB,SAAU,MAAM;;;;;;;;CA2C5C,CAAA;AAED,KAAK,gBAAgB,CAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAA;AAC/C,eAAO,MAAM,iBAAiB,EAAE,gBAAgB,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAuC,CAAA;AAC5H,eAAO,MAAM,sBAAsB,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAkD,CAAA;AAC3I,eAAO,MAAM,4BAA4B,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAwD,CAAA;AACvJ,eAAO,MAAM,sBAAsB,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAkD,CAAA;AAC3I,eAAO,MAAM,yBAAyB,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAoD,CAAA;AAChJ,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAqD,CAAA;AAElJ,eAAO,MAAM,eAAe,SAAW,MAAM,WAAiD,CAAA;AAE9F,eAAO,MAAM,gBAAgB,SAAU,MAAM,uBAI5C,CAAA;AAED,eAAO,MAAM,aAAa,MAAO,MAAM,UAAgB,CAAA;AAEvD,eAAO,MAAM,wBAAwB,WAAY,GAAG,EAAE,qBAAqB,GAAG,EAAE,KAAG,MAAM,GAAG,SAmC3F,CAAA;AAED,eAAO,MAAM,IAAI,OAAQ,QAAQ,IAAI,CAAC,+BAEpC,CAAA;AAEF,eAAO,MAAM,cAAc;eAA2B,MAAM,GAAG,IAAI;eAAa,MAAM,GAAG,IAAI;;;;;qBAmB5F,CAAA;AAED,eAAO,MAAM,WAAW,UAavB,CAAA;AAED,eAAO,MAAM,MAAM,UAalB,CAAA;AACD,eAAO,MAAM,eAAe,SAAU,IAAI,YAAY;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE;;;;;;;;;;CAkB3E,CAAA;AAED,eAAO,MAAM,cAAc,SAAU,IAAI,KAAG,MAa3C,CAAA;AAED,eAAO,MAAM,oBAAoB,UAAW,KAAK,aAAa,EAAE,eAAe,GAAG,mBAAmB,GAAG,OAAO,GAAE,UAAU,GAAG,aAAa,GAAG,oBAAoB,GAAG,cAAc,GAAG,qBAAqB,GAAG,kBAAkB,CAAC,WAUhO,CAAA;AAED,eAAO,MAAM,oBAAoB,SAAU,IAAI,WAG9C,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,MAGvC,CAAA;AACD,eAAO,MAAM,kBAAkB,SAAU,IAAI,KAAG,MAG/C,CAAA;AACD,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,MAGvC,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAAgB,MAAM,KAAG,QAAQ,GAAG,IAmBjE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,UAAW,IAAI,GAAG,MAAM,SAAS,IAAI,GAAG,MAAM,KAAG,MAqBzF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,YAAa,MAAM,kBAAkB,UAAU,GAAG,CAAC,KAAG,MAapF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yCAAyC,aAC1C,MAAM,YACN,MAAM,kBACA,UAAU,GAAG,CAAC,KAC7B,MAKF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,0BAC5B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,iBACpD,UAAU,GAAG,CAAC,GAAG,SAAS,aAC9B,MAAM,uBAEhB,MAAM,GAAG,EAsBX,CAAA;AAED,eAAO,MAAM,kBAAkB,SAAU,IAAI,KAAG,MAG/C,CAAA;AAED,eAAO,MAAM,uBAAuB,UAAW,KAAK,aAAa,EAAE,eAAe,GAAG,mBAAmB,CAAC,KAAG,MAO3G,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,MAAO,MAAM,WAA0D,CAAA;AACtG,eAAO,MAAM,iBAAiB,MAAO,MAAM,WAAwD,CAAA;AACnG,eAAO,MAAM,iBAAiB,MAAO,MAAM,WAAqC,CAAA;AAGhF,eAAO,MAAM,wBAAwB,SAAU,MAAM,WAqCjD,CAAA;AAIJ,eAAO,MAAM,qBAAqB,SAAU,MAAM,WA4C9C,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,SAAU,MAAM,WAkE9C,CAAA;AAED,eAAO,MAAM,uBAAuB,UAAW,SAAS,WAWvD,CAAA;AAED,eAAO,MAAM,YAAY,+BAA+B,CAAA;AACxD,eAAO,MAAM,eAAe,uCAAuC,CAAA;AACnE,eAAO,MAAM,YAAY,0BAA0B,CAAA;AAEnD,eAAO,MAAM,cAAc,mCAM1B,CAAA;AACD,eAAO,MAAM,SAAS,qGAMrB,CAAA;AACD,eAAO,MAAM,iBAAiB,4OAS7B,CAAA;AACD,eAAO,MAAM,qBAAqB,yIASjC,CAAA;AAGD,eAAO,MAAM,wBAAwB;UAAwC,MAAM,GAAG,SAAS;;YAE9F,CAAA;AACD,eAAO,MAAM,qBAAqB;QAAsE,MAAM;gBAAc,MAAM;;;;YAEjI,CAAA;AACD,eAAO,MAAM,wBAAwB;QAAyE,MAAM;gBAAc,MAAM;;;;YAEvI,CAAA;AAED,eAAO,MAAM,gBAAgB;gBAA0D,MAAM;UAAQ,MAAM;;;YAO1G,CAAA;AAED,eAAO,MAAM,mBAAmB;eAAiC,MAAM;YAOtE,CAAA;AAED,eAAO,MAAM,oBAAoB,UAAW;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAG,CAAA;CAAE,WAAW;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAG,CAAA;CAAE,YAgBxK,CAAA;AAED,eAAO,MAAM,kBAAkB;YAAkC,MAAM,EAAE;WAAS,MAAM,EAAE;aAKzF,CAAA;AAQD,eAAO,MAAM,sBAAsB,SAAU,IAAI,UAAU;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAG,CAAC;IAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;CAAE,KAAG,OAgBtJ,CAAA;AAED,eAAO,MAAM,uBAAuB,MAAO,GAAG,4BAE7C,CAAA;AAED,eAAO,MAAM,6BAA6B,UAAW,uBAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,YAAY;IAAE,cAAc,CAAC,EAAE,OAAO,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAuFpN,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,YAAY,UAAU,MAAM,YAI/E,CAAA;AAED,eAAO,MAAM,oBAAoB,QAAS,MAAM,SAAS,MAAM,SAI9D,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,QAI7C,CAAA;AAED,eAAO,MAAM,sBAAsB,MAAO,QAAQ,CAAC,MAAM,CAAC,KAAG,MAM5D,CAAA;AAED,eAAO,MAAM,aAAa,OAAQ,MAAM,QAQvC,CAAA;AAED,eAAO,MAAM,oBAAoB,MAAO,KAAK,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,k4UAQ1E,CAAA;AAED,eAAO,MAAM,aAAa,MAAO,MAAM,WAAgE,CAAA;AAEvG,eAAO,MAAM,oCAAoC,WAAY,KAAK,oBAAoB,EAAE,MAAM,GAAG,QAAQ,CAAC,kBA8BzG,CAAA;AAGD,eAAO,MAAM,sBAAsB,yBAKlC,CAAA;AAED,eAAO,MAAM,0BAA0B,oEAAqE,MAAM,eAAe,OAAO,KAAG,OA+B1I,CAAA;AAED,eAAO,MAAM,gCAAgC,eAC/B,MAAM,GAAG,SAAS,GAAG,IAAI,YAC3B,MAAM,GAAG,OAAO,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,KAC5C,OAaF,CAAA;AAED,eAAO,MAAM,+CAA+C,UACnD,MAAM,cACD,eAAe,OAAO,CAAC,KAClC,OAEF,CAAA;AAED,eAAO,MAAM,4BAA4B,uDAAsD,GAAG,EAkBjG,CAAA;AAED,eAAO,MAAM,iCAAiC,8BAA+B,GAAG,KAAK,GAAG,MAkBvF,CAAA;AAyBD,eAAO,MAAM,oBAAoB,aAAc,MAAM,gBAcpD,CAAA;AAED,eAAO,MAAM,+BAA+B,YAAa,KAAK,OAAO,EAAE,IAAI,CAAC,OAAO,MAAM,QA0DxF,CAAA;AAED,KAAK,oBAAoB,GAAG;IAC1B,eAAe,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,YAAY,CAAC,EAAE,CAAA;CACxE,CAAA;AAED,eAAO,MAAM,wBAAwB,uBAAuB,CAAA;AAE5D,eAAO,MAAM,6CAA6C,YAAa,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,oBAAoB,cAAc,OAAO,MAAM,EAAE,GAAG,CAAC,MAAM;IACtJ,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,YAiPA,CAAA;AAED,eAAO,MAAM,2BAA2B,uBAAwB,MAAM,KAAG,OAexE,CAAA;AAmBD,eAAO,MAAM,gBAAgB,y3UAAqE,CAAA;AAElG,eAAO,MAAM,wBAAwB,aAAc,MAAM,+BAKxD,CAAA;AAED,eAAO,MAAM,wBAAwB,aAAc,MAAM,+BAGxD,CAAA;AAED,eAAO,MAAM,0BAA0B,MAAO,OAAO,qBAuBpD,CAAA;AAED,eAAO,MAAM,sCAAsC,MAAO,OAAO,qBAiBhE,CAAA;AAqWD,eAAO,MAAM,cAAc,YAAa,MAAM,YAAY,OAAO,WAuBhE,CAAA;AAOD,eAAO,MAAM,wBAAwB,YAC1B,MAAM;;YAIhB,CAAA;AAED,eAAO,MAAM,cAAc,MAAO;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;CAAE,YAEtD,CAAA;AAED,eAAO,MAAM,2BAA2B,wDAA6D,KAAK,aAAa,EAAE,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC,KAAG,MAoBvK,CAAA;AAED,eAAO,MAAM,oBAAoB,eAOhC,CAAA;AAED,eAAO,MAAM,WAAW,wBAAyB,MAAM,UActD,CAAA;AAED,eAAO,MAAM,sBAAsB;cAIvB,KAAK,YAAY,EAAE,WAAW,CAAC;UACnC,KAAK,IAAI,EAAE,SAAS,CAAC;;WAgCO,MAAM;WAAS,MAAM;eASxD,CAAA;AAGD,eAAO,MAAM,4BAA4B,UAAiF,CAAA;AAC1H,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAE7D,eAAO,MAAM,aAAa,MAAO,KAAK,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC,WAOlE,CAAA;AAED,eAAO,MAAM,4BAA4B,cAAe,iBAAiB,EAAE,KAAG,MAAM,GAAG,SAsBtF,CAAA;AAgCD,eAAO,MAAM,4BAA4B,cAAe,iBAAiB,EAAE,cAAc,eAAe,MAAM,CAAC,YAAY;IACzH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACvC,KAAG,OA4MH,CAAA;AAED,eAAO,MAAM,oBAAoB;iBAClB,wBAAwB,EAAE;WAChC,KAAK,IAAI,EAAE,IAAI,GAAG,0BAA0B,CAAC,EAAE;MACpD,CAAC;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAyDzB,CAAA;AAED,eAAO,MAAM,kCAAkC,YAAa,KAAK,OAAO,EAAE,WAAW,CAAC,2OAWrF,CAAA;AAED,eAAO,MAAM,gCAAgC,kBAAmB,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,mbAW9F,CAAA;AACD,eAAO,MAAM,4BAA4B,UAAW,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,2HAK1E,CAAA;AACD,eAAO,MAAM,2BAA2B,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,qSAW/E,CAAA;AAED,eAAO,MAAM,iBAAiB,MAAO,MAAM,WAI1C,CAAA;AAED,eAAO,MAAM,yBAAyB,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,iPAU7E,CAAA;AAED,eAAO,MAAM,gCAAgC,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,2NASpF,CAAA;AAED,eAAO,MAAM,8BAA8B,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,gYAqBlF,CAAA;AAED,eAAO,MAAM,gCAAgC,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,sSAepF,CAAA;AAED,eAAO,MAAM,mCAAmC,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,kBAAkB,MAAM,mbA2B/G,CAAA;AACD,eAAO,MAAM,gCAAgC,UAAW,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,gHAM9E,CAAA;AACD,eAAO,MAAM,wCAAwC,kBAAmB,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,yUAQtG,CAAA;AAGD,eAAO,MAAM,SAAS;SAAqB,MAAM;QAAS,MAAM,aAY/D,CAAA;AAED,eAAO,MAAM,qBAAqB,sBAAwB,KAAK,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,YAO5F,CAAA;AACD,eAAO,MAAM,oBAAoB,sBAAwB,KAAK,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,YAK3F,CAAA;AAED,eAAO,MAAM,0BAA0B,eAAgB,eAAe,SAAS,MAAM,YAMpF,CAAA;AAED,eAAO,MAAM,wBAAwB,UAA8D,CAAA;AAEnG,eAAO,MAAM,wBAAwB,MAAO,KAAK,kBAAkB,EAAE,aAAa,GAAG,iBAAiB,CAAC,kBAAkB,kBAAkB,EAAE,WAW5I,CAAA;AAGD,eAAO,MAAM,wBAAwB,MAAO,MAAM,cAAc,MAAM,uBASrE,CAAA;AAED,eAAO,MAAM,gBAAgB,WACnB,KAAK,iBAAiB,EAAE,sCAAsC,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,QAAQ,CAAC,EAAE,88UAqCjI,CAAA;AAED,eAAO,MAAM,cAAc,sBAW1B,CAAA;AAED,eAAO,MAAM,yBAAyB,cAAe,MAAM,WA8B1D,CAAA;AAGD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;CACzC,CAAA;AAED,eAAO,MAAM,uCAAuC,SAAU,MAAM,EAAE,WAAW,KAAK,OAAO,EAAE,IAAI,CAAC,wCAqCnG,CAAA;AAGD,eAAO,MAAM,gCAAgC,MAAO,MAAM,aAAa,KAAK,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,WAsCjG,CAAA;AAED,eAAO,MAAM,sCAAsC,MAC9C,MAAM,UACD,CAAC,KAAK,aAAa,EAAE,OAAO,GAAG,eAAe,GAAG,mBAAmB,GACxE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,GACjF,cAAc,GAAG,UAAU,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,GAAG,IAAI,YAC/C,kBAAkB,WAwD5B,CAAA;AAED,eAAO,MAAM,kCAAkC,MAAO,MAAM,eAAe,KAAK,iBAAiB,EAAE,IAAI,CAAC,GAAG,IAAI,WAoC9G,CAAA;AAED,eAAO,MAAM,6BAA6B,MAAO,MAAM,UAAU,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,WAqD/F,CAAA;AAED,eAAO,MAAM,kCAAkC,MAC1C,MAAM;;;;YA0HV,CAAA;AAgCD,eAAO,MAAM,2BAA2B,MAAO,MAAM,QAAQ,KAAK,UAAU,EAAE,IAAI,CAAC,GAAG,IAAI,WAWzF,CAAA;AAED,eAAO,MAAM,gBAAgB,MAAO,MAAM,aAYzC,CAAA;AACD,eAAO,MAAM,qBAAqB,MAAO,MAAM,iBAAiB,KAAK,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,EAAE,WAQ9G,CAAA;AAED,eAAO,MAAM,+BAA+B,MAAO,MAAM,YAAY,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,yCA+B9F,CAAA;AAED,eAAO,MAAM,wBAAwB,aAAc,MAAM,WAMxD,CAAA;AAGD,eAAO,MAAM,4BAA4B,MAAO,MAAM,KAAG,IAAI,GAAG,SAgB/D,CAAA;AAED,eAAO,MAAM,uBAAuB,YAAa,MAAM,EAAE,oBAAoB,MAAM,uBAclF,CAAA;AAED,eAAO,MAAM,oBAAoB;;;;;kBAAkJ,MAAM,EAuCxL,CAAA;AAED,eAAO,MAAM,oBAAoB,MAAO,GAAG,OAAO,MAAM,MAAM;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,GAYzF,CAAA;AAID,eAAO,MAAM,wBAAwB,YAAa,OAAO,GAAG,EAAE,GAAG,CAAC,SAAS,MAAM,SAAS,GAAG,SAe5F,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,aAAa,EAStD,CAAA;AAED,eAAO,MAAM,0BAA0B,WAAY,SAAS,EAAE,WAAW,OAAO,sBAAsB,iBAAiB,EAAE;;;;;;;;;GAiExH,CAAA;AAED,eAAO,MAAM,YAAY,SAAU,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM;;;;UAoBrE,CAAA;AAED,eAAO,MAAM,WAAW,UAAW,GAAG,+3UAA4F,CAAA;AAElI,eAAO,MAAM,sBAAsB,MAAO,OAAO,WAEhD,CAAA;AACD,eAAO,MAAM,wBAAwB,OAAQ,gBAAgB,WAE5D,CAAA;AAED,eAAO,MAAM,kDAAkD,OAAQ,YAAY,GAAG;IAAE,SAAS,EAAE,GAAG,CAAA;CAAE,YAOvG,CAAA;AAED,eAAO,MAAM,aAAa,MAAO,KAAK,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC,uBAIrF,CAAA;AAED,eAAO,MAAM,8BAA8B,WAAY,MAAM,WAU5D,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,MAAM,MAAM,OAAO,WAQvD,CAAA;AAED,eAAO,MAAM,8BAA8B,WAAY,GAAG,oBASzD,CAAA;AAED,eAAO,MAAM,qBAAqB,MAAO,KAAK,OAAO,EAAE,YAAY,GAAG,iBAAiB,CAAC,uBAOvF,CAAA;AAED,eAAO,MAAM,cAAc;WAA0C,MAAM;UAgB1E,CAAA;AAGD,eAAO,MAAM,gBAAgB,MAAO,MAAM,aAuBzC,CAAA;AAGD,eAAO,MAAM,+BAA+B,MAAO,MAAM,aAAa;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,WAqBrG,CAAA;AAED,eAAO,MAAM,sBAAsB,MAAO,KAAK,OAAO,EAAE,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC,oBAAoB,MAAM,uBAExH,CAAA;AAGD,eAAO,MAAM,qCAAqC,MAAO,MAAM,iBAAiB,KAAK,YAAY,EAAE,WAAW,CAAC,GAAG,IAAI,WAiCrH,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;uBAQ3B,MAAM;gBACb,MAAM;YACV,MAAM;;;uBAEyB,MAAM;;mBAAkC,MAAM;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;;cAC1F,MAAM;MACd,OAmFH,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,eAC/B,OAAO,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,eACrC,IAAI,MAAM,CAAC,KACvB,MAAM,EA2DR,CAAA;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE;IAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,EAAE,EACrE,QAAQ,CAAC,EAAE,IAAI,GACd,MAAM,CAmBR;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CASjD;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAE7D"}
|
|
1
|
+
{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils.ts"],"names":[],"mappings":";AAAA,OAAO,EAAmB,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAA6B,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAiF,iBAAiB,EAAE,uBAAuB,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,EAAsB,YAAY,EAAE,gBAAgB,EAAW,QAAQ,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAsD,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGvsB,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,CAAA;AAEnB,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAE7B,MAAM,MAAM,SAAS,CAAC,CAAC,GAAC,GAAG,IAAI;IAAE,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAA;CAAE,CAAA;AAErD,eAAO,MAAM,aAAa,MAAO;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,YAC1C,CAAA;AAKlE,eAAO,MAAM,kBAAkB,MAC1B;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,YAClD;IAAE,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,YAInD,CAAA;AAED,eAAO,MAAM,wBAAwB,wBAAmD,CAAA;AACxF,eAAO,MAAM,sBAAsB,wBAAmD,CAAA;AAEtF,eAAO,MAAM,eAAe,MAAQ,MAAM,YAA4D,CAAA;AAEtG,eAAO,MAAM,SAAS,OAAQ,GAAG,YAAQ,CAAA;AACzC,eAAO,MAAM,UAAU,OAAQ,GAAG,YAAoB,CAAA;AACtD,eAAO,MAAM,aAAa,wCADK,GAAG,+BAUjC,CAAA;AACD,eAAO,MAAM,SAAS,QAAS,GAAG,0BAA8D,CAAA;AAGhG,eAAO,MAAM,eAAe,WAAY,MAAM,EAAE,MAAM,SAAS,MAAM,SAAS,mBAQ7E,CAAA;AAGD,eAAO,MAAM,aAAa,yBAAoC,CAAA;AAE9D,eAAO,MAAM,aAAa,wBAAoD,CAAA;AAE9E,eAAO,MAAM,YAAY,0BAA4B,CAAA;AAErD,eAAO,MAAM,kBAAkB,QAAS,GAAG,OAAO,GAAG,YA4BpD,CAAA;AAED,eAAO,MAAM,iBAAiB;;;;;;;;+BAa7B,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AACD,eAAO,MAAM,cAAc,UAAW,gBAAgB,YAAY,eAAe,KAAG,kBAAkB,GAAG,IAgBxG,CAAA;AAED,eAAO,MAAM,cAAc,oCAM1B,CAAA;AAED,eAAO,MAAM,eAAe;;;YAW3B,CAAA;AAGD,eAAO,MAAM,mCAAmC,cAAe,MAAM,kBAAkB,MAAM,KAAG,MAe/F,CAAA;AAED,eAAO,MAAM,UAAU,0FAEtB,CAAA;AAGD,eAAO,MAAM,mBAAmB,SAAU,MAAM,cAAc,MAAM;;;QAoDnE,CAAA;AAaD,eAAO,MAAM,gBAAgB,SAAU,MAAM;;;;;;;;CA2C5C,CAAA;AAED,KAAK,gBAAgB,CAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAA;AAC/C,eAAO,MAAM,iBAAiB,EAAE,gBAAgB,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAuC,CAAA;AAC5H,eAAO,MAAM,sBAAsB,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAkD,CAAA;AAC3I,eAAO,MAAM,4BAA4B,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAwD,CAAA;AACvJ,eAAO,MAAM,sBAAsB,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAkD,CAAA;AAC3I,eAAO,MAAM,yBAAyB,EAAE,gBAAgB,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAoD,CAAA;AAChJ,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAqD,CAAA;AAElJ,eAAO,MAAM,eAAe,SAAW,MAAM,WAAiD,CAAA;AAE9F,eAAO,MAAM,gBAAgB,SAAU,MAAM,uBAI5C,CAAA;AAED,eAAO,MAAM,aAAa,MAAO,MAAM,UAAgB,CAAA;AAEvD,eAAO,MAAM,wBAAwB,WAAY,GAAG,EAAE,qBAAqB,GAAG,EAAE,KAAG,MAAM,GAAG,SAmC3F,CAAA;AAED,eAAO,MAAM,IAAI,OAAQ,QAAQ,IAAI,CAAC,+BAEpC,CAAA;AAEF,eAAO,MAAM,cAAc;eAA2B,MAAM,GAAG,IAAI;eAAa,MAAM,GAAG,IAAI;;;;;qBAmB5F,CAAA;AAED,eAAO,MAAM,WAAW,UAavB,CAAA;AAED,eAAO,MAAM,MAAM,UAalB,CAAA;AACD,eAAO,MAAM,eAAe,SAAU,IAAI,YAAY;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE;;;;;;;;;;CAkB3E,CAAA;AAED,eAAO,MAAM,cAAc,SAAU,IAAI,KAAG,MAa3C,CAAA;AAED,eAAO,MAAM,oBAAoB,UAAW,KAAK,aAAa,EAAE,eAAe,GAAG,mBAAmB,GAAG,OAAO,GAAE,UAAU,GAAG,aAAa,GAAG,oBAAoB,GAAG,cAAc,GAAG,qBAAqB,GAAG,kBAAkB,CAAC,WAUhO,CAAA;AAED,eAAO,MAAM,oBAAoB,SAAU,IAAI,WAG9C,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,MAGvC,CAAA;AACD,eAAO,MAAM,kBAAkB,SAAU,IAAI,KAAG,MAG/C,CAAA;AACD,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,MAGvC,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAAgB,MAAM,KAAG,QAAQ,GAAG,IAmBjE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,UAAW,IAAI,GAAG,MAAM,SAAS,IAAI,GAAG,MAAM,KAAG,MAqBzF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,YAAa,MAAM,kBAAkB,UAAU,GAAG,CAAC,KAAG,MAapF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yCAAyC,aAC1C,MAAM,YACN,MAAM,kBACA,UAAU,GAAG,CAAC,KAC7B,MAKF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,0BAC5B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,iBACpD,UAAU,GAAG,CAAC,GAAG,SAAS,aAC9B,MAAM,uBAEhB,MAAM,GAAG,EAsBX,CAAA;AAED,eAAO,MAAM,kBAAkB,SAAU,IAAI,KAAG,MAG/C,CAAA;AAED,eAAO,MAAM,uBAAuB,UAAW,KAAK,aAAa,EAAE,eAAe,GAAG,mBAAmB,CAAC,KAAG,MAO3G,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,MAAO,MAAM,WAA0D,CAAA;AACtG,eAAO,MAAM,iBAAiB,MAAO,MAAM,WAAwD,CAAA;AACnG,eAAO,MAAM,iBAAiB,MAAO,MAAM,WAAqC,CAAA;AAGhF,eAAO,MAAM,wBAAwB,SAAU,MAAM,WAqCjD,CAAA;AAIJ,eAAO,MAAM,qBAAqB,SAAU,MAAM,WA4C9C,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,SAAU,MAAM,WAkE9C,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,+GAC2E,CAAA;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,+BAA+B,SAAU,MAAM,WAiG3D,CAAA;AAED,eAAO,MAAM,uBAAuB,UAAW,SAAS,WAWvD,CAAA;AAED,eAAO,MAAM,YAAY,+BAA+B,CAAA;AACxD,eAAO,MAAM,eAAe,uCAAuC,CAAA;AACnE,eAAO,MAAM,YAAY,0BAA0B,CAAA;AAEnD,eAAO,MAAM,cAAc,mCAM1B,CAAA;AACD,eAAO,MAAM,SAAS,qGAMrB,CAAA;AACD,eAAO,MAAM,iBAAiB,4OAS7B,CAAA;AACD,eAAO,MAAM,qBAAqB,yIASjC,CAAA;AAGD,eAAO,MAAM,wBAAwB;UAAwC,MAAM,GAAG,SAAS;;YAE9F,CAAA;AACD,eAAO,MAAM,qBAAqB;QAAsE,MAAM;gBAAc,MAAM;;;;YAEjI,CAAA;AACD,eAAO,MAAM,wBAAwB;QAAyE,MAAM;gBAAc,MAAM;;;;YAEvI,CAAA;AAED,eAAO,MAAM,gBAAgB;gBAA0D,MAAM;UAAQ,MAAM;;;YAO1G,CAAA;AAED,eAAO,MAAM,mBAAmB;eAAiC,MAAM;YAOtE,CAAA;AAED,eAAO,MAAM,oBAAoB,UAAW;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAG,CAAA;CAAE,WAAW;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAG,CAAA;CAAE,YAgBxK,CAAA;AAED,eAAO,MAAM,kBAAkB;YAAkC,MAAM,EAAE;WAAS,MAAM,EAAE;aAKzF,CAAA;AAQD,eAAO,MAAM,sBAAsB,SAAU,IAAI,UAAU;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAG,CAAC;IAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;CAAE,KAAG,OAgBtJ,CAAA;AAED,eAAO,MAAM,uBAAuB,MAAO,GAAG,4BAE7C,CAAA;AAED,eAAO,MAAM,6BAA6B,UAAW,uBAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,YAAY;IAAE,cAAc,CAAC,EAAE,OAAO,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAuFpN,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,YAAY,UAAU,MAAM,YAI/E,CAAA;AAED,eAAO,MAAM,oBAAoB,QAAS,MAAM,SAAS,MAAM,SAI9D,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,QAI7C,CAAA;AAED,eAAO,MAAM,sBAAsB,MAAO,QAAQ,CAAC,MAAM,CAAC,KAAG,MAM5D,CAAA;AAED,eAAO,MAAM,aAAa,OAAQ,MAAM,QAQvC,CAAA;AAED,eAAO,MAAM,oBAAoB,MAAO,KAAK,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,k4UAQ1E,CAAA;AAED,eAAO,MAAM,aAAa,MAAO,MAAM,WAAgE,CAAA;AAEvG,eAAO,MAAM,oCAAoC,WAAY,KAAK,oBAAoB,EAAE,MAAM,GAAG,QAAQ,CAAC,kBA8BzG,CAAA;AAGD,eAAO,MAAM,sBAAsB,yBAKlC,CAAA;AAED,eAAO,MAAM,0BAA0B,oEAAqE,MAAM,eAAe,OAAO,KAAG,OA+B1I,CAAA;AAED,eAAO,MAAM,gCAAgC,eAC/B,MAAM,GAAG,SAAS,GAAG,IAAI,YAC3B,MAAM,GAAG,OAAO,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,KAC5C,OAaF,CAAA;AAED,eAAO,MAAM,+CAA+C,UACnD,MAAM,cACD,eAAe,OAAO,CAAC,KAClC,OAEF,CAAA;AAED,eAAO,MAAM,4BAA4B,uDAAsD,GAAG,EAkBjG,CAAA;AAED,eAAO,MAAM,iCAAiC,8BAA+B,GAAG,KAAK,GAAG,MAkBvF,CAAA;AAyBD,eAAO,MAAM,oBAAoB,aAAc,MAAM,gBAcpD,CAAA;AAED,eAAO,MAAM,+BAA+B,YAAa,KAAK,OAAO,EAAE,IAAI,CAAC,OAAO,MAAM,QA0DxF,CAAA;AAED,KAAK,oBAAoB,GAAG;IAC1B,eAAe,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,YAAY,CAAC,EAAE,CAAA;CACxE,CAAA;AAED,eAAO,MAAM,wBAAwB,uBAAuB,CAAA;AAE5D,eAAO,MAAM,6CAA6C,YAAa,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,oBAAoB,cAAc,OAAO,MAAM,EAAE,GAAG,CAAC,MAAM;IACtJ,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,YAiPA,CAAA;AAED,eAAO,MAAM,2BAA2B,uBAAwB,MAAM,KAAG,OAexE,CAAA;AAmBD,eAAO,MAAM,gBAAgB,y3UAAqE,CAAA;AAElG,eAAO,MAAM,wBAAwB,aAAc,MAAM,+BAKxD,CAAA;AAED,eAAO,MAAM,wBAAwB,aAAc,MAAM,+BAGxD,CAAA;AAED,eAAO,MAAM,0BAA0B,MAAO,OAAO,qBAuBpD,CAAA;AAED,eAAO,MAAM,sCAAsC,MAAO,OAAO,qBAiBhE,CAAA;AAqWD,eAAO,MAAM,cAAc,YAAa,MAAM,YAAY,OAAO,WAuBhE,CAAA;AAOD,eAAO,MAAM,wBAAwB,YAC1B,MAAM;;YAIhB,CAAA;AAED,eAAO,MAAM,cAAc,MAAO;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;CAAE,YAEtD,CAAA;AAED,eAAO,MAAM,2BAA2B,wDAA6D,KAAK,aAAa,EAAE,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC,KAAG,MAoBvK,CAAA;AAED,eAAO,MAAM,oBAAoB,eAOhC,CAAA;AAED,eAAO,MAAM,WAAW,wBAAyB,MAAM,UActD,CAAA;AAED,eAAO,MAAM,sBAAsB;cAIvB,KAAK,YAAY,EAAE,WAAW,CAAC;UACnC,KAAK,IAAI,EAAE,SAAS,CAAC;;WAgCO,MAAM;WAAS,MAAM;eASxD,CAAA;AAGD,eAAO,MAAM,4BAA4B,UAAiF,CAAA;AAC1H,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAE7D,eAAO,MAAM,aAAa,MAAO,KAAK,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC,WAOlE,CAAA;AAED,eAAO,MAAM,4BAA4B,cAAe,iBAAiB,EAAE,KAAG,MAAM,GAAG,SAsBtF,CAAA;AAgCD,eAAO,MAAM,4BAA4B,cAAe,iBAAiB,EAAE,cAAc,eAAe,MAAM,CAAC,YAAY;IACzH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACvC,KAAG,OA4MH,CAAA;AAED,eAAO,MAAM,oBAAoB;iBAClB,wBAAwB,EAAE;WAChC,KAAK,IAAI,EAAE,IAAI,GAAG,0BAA0B,CAAC,EAAE;MACpD,CAAC;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAyDzB,CAAA;AAED,eAAO,MAAM,kCAAkC,YAAa,KAAK,OAAO,EAAE,WAAW,CAAC,2OAWrF,CAAA;AAED,eAAO,MAAM,gCAAgC,kBAAmB,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,mbAW9F,CAAA;AACD,eAAO,MAAM,4BAA4B,UAAW,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,2HAK1E,CAAA;AACD,eAAO,MAAM,2BAA2B,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,qSAW/E,CAAA;AAED,eAAO,MAAM,iBAAiB,MAAO,MAAM,WAI1C,CAAA;AAED,eAAO,MAAM,yBAAyB,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,iPAU7E,CAAA;AAED,eAAO,MAAM,gCAAgC,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,2NASpF,CAAA;AAED,eAAO,MAAM,8BAA8B,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,gYAqBlF,CAAA;AAED,eAAO,MAAM,gCAAgC,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,sSAepF,CAAA;AAED,eAAO,MAAM,mCAAmC,aAAc,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,kBAAkB,MAAM,mbA2B/G,CAAA;AACD,eAAO,MAAM,gCAAgC,UAAW,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,gHAM9E,CAAA;AACD,eAAO,MAAM,wCAAwC,kBAAmB,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,yUAQtG,CAAA;AAGD,eAAO,MAAM,SAAS;SAAqB,MAAM;QAAS,MAAM,aAY/D,CAAA;AAED,eAAO,MAAM,qBAAqB,sBAAwB,KAAK,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,YAO5F,CAAA;AACD,eAAO,MAAM,oBAAoB,sBAAwB,KAAK,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,YAK3F,CAAA;AAED,eAAO,MAAM,0BAA0B,eAAgB,eAAe,SAAS,MAAM,YAMpF,CAAA;AAED,eAAO,MAAM,wBAAwB,UAA8D,CAAA;AAEnG,eAAO,MAAM,wBAAwB,MAAO,KAAK,kBAAkB,EAAE,aAAa,GAAG,iBAAiB,CAAC,kBAAkB,kBAAkB,EAAE,WAW5I,CAAA;AAGD,eAAO,MAAM,wBAAwB,MAAO,MAAM,cAAc,MAAM,uBASrE,CAAA;AAED,eAAO,MAAM,gBAAgB,WACnB,KAAK,iBAAiB,EAAE,sCAAsC,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,QAAQ,CAAC,EAAE,88UAqCjI,CAAA;AAED,eAAO,MAAM,cAAc,sBAW1B,CAAA;AAED,eAAO,MAAM,yBAAyB,cAAe,MAAM,WA8B1D,CAAA;AAGD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;CACzC,CAAA;AAED,eAAO,MAAM,uCAAuC,SAAU,MAAM,EAAE,WAAW,KAAK,OAAO,EAAE,IAAI,CAAC,wCAqCnG,CAAA;AAGD,eAAO,MAAM,gCAAgC,MAAO,MAAM,aAAa,KAAK,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,WAsCjG,CAAA;AAED,eAAO,MAAM,sCAAsC,MAC9C,MAAM,UACD,CAAC,KAAK,aAAa,EAAE,OAAO,GAAG,eAAe,GAAG,mBAAmB,GACxE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,GACjF,cAAc,GAAG,UAAU,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,GAAG,IAAI,YAC/C,kBAAkB,WAwD5B,CAAA;AAED,eAAO,MAAM,kCAAkC,MAAO,MAAM,eAAe,KAAK,iBAAiB,EAAE,IAAI,CAAC,GAAG,IAAI,WAoC9G,CAAA;AAED,eAAO,MAAM,6BAA6B,MAAO,MAAM,UAAU,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,WAqD/F,CAAA;AAUD,eAAO,MAAM,kCAAkC,MAC1C,MAAM;;;;IAKP;;;;;;;;OAQG;;YA4HN,CAAA;AAgCD,eAAO,MAAM,2BAA2B,MAAO,MAAM,QAAQ,KAAK,UAAU,EAAE,IAAI,CAAC,GAAG,IAAI,WAWzF,CAAA;AAED,eAAO,MAAM,gBAAgB,MAAO,MAAM,aAYzC,CAAA;AACD,eAAO,MAAM,qBAAqB,MAAO,MAAM,iBAAiB,KAAK,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,EAAE,WAQ9G,CAAA;AAED,eAAO,MAAM,+BAA+B,MAAO,MAAM,YAAY,KAAK,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,yCA+B9F,CAAA;AAED,eAAO,MAAM,wBAAwB,aAAc,MAAM,WAMxD,CAAA;AAGD,eAAO,MAAM,4BAA4B,MAAO,MAAM,KAAG,IAAI,GAAG,SAgB/D,CAAA;AAED,eAAO,MAAM,uBAAuB,YAAa,MAAM,EAAE,oBAAoB,MAAM,uBAclF,CAAA;AAED,eAAO,MAAM,oBAAoB;;;;;kBAAkJ,MAAM,EAuCxL,CAAA;AAED,eAAO,MAAM,oBAAoB,MAAO,GAAG,OAAO,MAAM,MAAM;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,GAYzF,CAAA;AAID,eAAO,MAAM,wBAAwB,YAAa,OAAO,GAAG,EAAE,GAAG,CAAC,SAAS,MAAM,SAAS,GAAG,SAe5F,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,aAAa,EAStD,CAAA;AAED,eAAO,MAAM,0BAA0B,WAAY,SAAS,EAAE,WAAW,OAAO,sBAAsB,iBAAiB,EAAE;;;;;;;;;GAiExH,CAAA;AAED,eAAO,MAAM,YAAY,SAAU,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM;;;;UAoBrE,CAAA;AAED,eAAO,MAAM,WAAW,UAAW,GAAG,+3UAA4F,CAAA;AAElI,eAAO,MAAM,sBAAsB,MAAO,OAAO,WAEhD,CAAA;AACD,eAAO,MAAM,wBAAwB,OAAQ,gBAAgB,WAE5D,CAAA;AAED,eAAO,MAAM,kDAAkD,OAAQ,YAAY,GAAG;IAAE,SAAS,EAAE,GAAG,CAAA;CAAE,YAOvG,CAAA;AAED,eAAO,MAAM,aAAa,MAAO,KAAK,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC,uBAIrF,CAAA;AAED,eAAO,MAAM,8BAA8B,WAAY,MAAM,WAU5D,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,MAAM,MAAM,OAAO,WAQvD,CAAA;AAED,eAAO,MAAM,8BAA8B,WAAY,GAAG,oBASzD,CAAA;AAED,eAAO,MAAM,qBAAqB,MAAO,KAAK,OAAO,EAAE,YAAY,GAAG,iBAAiB,CAAC,uBAOvF,CAAA;AAED,eAAO,MAAM,cAAc;WAA0C,MAAM;UAgB1E,CAAA;AAGD,eAAO,MAAM,gBAAgB,MAAO,MAAM,aAuBzC,CAAA;AAGD,eAAO,MAAM,+BAA+B,MAAO,MAAM,aAAa;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,WAqBrG,CAAA;AAED,eAAO,MAAM,sBAAsB,MAAO,KAAK,OAAO,EAAE,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC,oBAAoB,MAAM,uBAExH,CAAA;AAGD,eAAO,MAAM,qCAAqC,MAAO,MAAM,iBAAiB,KAAK,YAAY,EAAE,WAAW,CAAC,GAAG,IAAI,WAiCrH,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;uBAQ3B,MAAM;gBACb,MAAM;YACV,MAAM;;;uBAEyB,MAAM;;mBAAkC,MAAM;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;;cAC1F,MAAM;MACd,OAmFH,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,eAC/B,OAAO,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,eACrC,IAAI,MAAM,CAAC,KACvB,MAAM,EA2DR,CAAA;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE;IAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,EAAE,EACrE,QAAQ,CAAC,EAAE,IAAI,GACd,MAAM,CAmBR;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CASjD;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAE7D"}
|
package/lib/esm/utils.js
CHANGED
|
@@ -755,6 +755,153 @@ export var sanitize_user_html = function (html) {
|
|
|
755
755
|
},
|
|
756
756
|
});
|
|
757
757
|
};
|
|
758
|
+
/**
|
|
759
|
+
* Sandbox forced onto an `<iframe>` by {@link sanitize_user_html_with_iframes} when its author did
|
|
760
|
+
* not supply one.
|
|
761
|
+
*
|
|
762
|
+
* `allow-same-origin` is required in practice: without it the frame gets an opaque origin, where
|
|
763
|
+
* `localStorage` access throws and the embed's own CSP `'self'` matches nothing. Real embeds break —
|
|
764
|
+
* a Loom embed renders as a blank box, verified in Chrome. Since the sanitizer requires an absolute
|
|
765
|
+
* cross-origin `https` src, granting it gives the frame nothing an unsandboxed frame wouldn't have.
|
|
766
|
+
*
|
|
767
|
+
* What is deliberately withheld matters more than what is granted. Above all `allow-top-navigation`:
|
|
768
|
+
* a hostile embed cannot navigate the patient's page elsewhere. Also withheld: `allow-downloads`,
|
|
769
|
+
* `allow-modals`, `allow-pointer-lock`, `allow-orientation-lock`, `allow-top-navigation-by-user-activation`.
|
|
770
|
+
*/
|
|
771
|
+
export var DEFAULT_IFRAME_SANDBOX = 'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-presentation';
|
|
772
|
+
/**
|
|
773
|
+
* Same as {@link sanitize_user_html}, but additionally permits `<iframe>` so authored content can
|
|
774
|
+
* embed video, scheduling widgets, etc. `sanitize_user_html` remains the default — only reach for
|
|
775
|
+
* this variant on a surface that specifically needs framing.
|
|
776
|
+
*
|
|
777
|
+
* Preconditions for any new caller:
|
|
778
|
+
* - **Admin/staff-authored HTML only.** Never use this for patient-authored content (form answers
|
|
779
|
+
* where `answerIsHTML`, chat messages, community posts) or for inbound email.
|
|
780
|
+
* - **Any patient-derived substring templated into the HTML must be entity-escaped first** — see
|
|
781
|
+
* `escapeHTMLValues` on {@link replace_form_field_template_values}. Otherwise "admin-authored"
|
|
782
|
+
* isn't actually true and a patient can inject a frame into an admin's description.
|
|
783
|
+
*
|
|
784
|
+
* How the frame is contained — the two controls work together, do not weaken either alone:
|
|
785
|
+
*
|
|
786
|
+
* 1. `src` must be an absolute `https://host` URL. Relative, protocol-relative (`//host`),
|
|
787
|
+
* `javascript:`, `data:` and `srcdoc` frames are dropped, so the frame is always cross-origin
|
|
788
|
+
* and the same-origin policy alone already prevents it from touching this document. Note that
|
|
789
|
+
* sanitize-html does NOT reject protocol-relative iframe srcs on its own when
|
|
790
|
+
* `allowProtocolRelative` is set, so that check lives in `transformTags` below.
|
|
791
|
+
* 2. {@link DEFAULT_IFRAME_SANDBOX} is forced when the author supplied none. Critically it withholds
|
|
792
|
+
* `allow-top-navigation`, so a hostile or compromised embed cannot redirect the patient's page to
|
|
793
|
+
* a phishing site — the realistic threat for an embed in a patient-facing form. It also withholds
|
|
794
|
+
* downloads, modals, pointer-lock, plugins and orientation-lock. It is therefore strictly more
|
|
795
|
+
* restrictive than rendering the same cross-origin iframe with no sandbox at all.
|
|
796
|
+
*
|
|
797
|
+
* It DOES grant `allow-same-origin`, which for a cross-origin `src` grants nothing a normal
|
|
798
|
+
* unsandboxed frame wouldn't already have (its own origin, its own storage) — see
|
|
799
|
+
* DEFAULT_IFRAME_SANDBOX for why that is necessary in practice. `allow-same-origin` would only be
|
|
800
|
+
* dangerous for a *same-origin* `src`, since such a frame could script this document; control 1 is
|
|
801
|
+
* what rules that out, which is why the src check must not be relaxed.
|
|
802
|
+
*
|
|
803
|
+
* An author-supplied `sandbox` is honored verbatim as an escape hatch (including `sandbox=""`, the
|
|
804
|
+
* most restrictive value), so a surface can tighten or loosen per embed.
|
|
805
|
+
*
|
|
806
|
+
* Current callers: the live form's field description (`Forms/forms.tsx`, `Forms/forms.v2.tsx`).
|
|
807
|
+
* The read-only submitted-response views intentionally stay on `sanitize_user_html`.
|
|
808
|
+
*/
|
|
809
|
+
export var sanitize_user_html_with_iframes = function (html) {
|
|
810
|
+
if (typeof html !== 'string' || !html)
|
|
811
|
+
return '';
|
|
812
|
+
return sanitizeHtml(html, {
|
|
813
|
+
allowedTags: [
|
|
814
|
+
// text & inline
|
|
815
|
+
'a', 'abbr', 'b', 'bdi', 'bdo', 'br', 'cite', 'code', 'data', 'dfn', 'em', 'i', 'kbd',
|
|
816
|
+
'mark', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'small', 'span', 'strong', 'sub', 'sup',
|
|
817
|
+
'time', 'u', 'var', 'wbr', 'del', 'ins', 'abbr',
|
|
818
|
+
// block & structure
|
|
819
|
+
'address', 'article', 'aside', 'blockquote', 'caption', 'details', 'summary', 'div',
|
|
820
|
+
'figcaption', 'figure', 'footer', 'header', 'hgroup', 'hr', 'main', 'nav', 'p', 'pre',
|
|
821
|
+
'section',
|
|
822
|
+
// headings
|
|
823
|
+
'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
|
|
824
|
+
// lists
|
|
825
|
+
'dd', 'dl', 'dt', 'li', 'ol', 'ul',
|
|
826
|
+
// tables
|
|
827
|
+
'col', 'colgroup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr',
|
|
828
|
+
// media (still no object/embed — those can execute arbitrary plugin content)
|
|
829
|
+
'img', 'audio', 'video', 'source', 'picture', 'track',
|
|
830
|
+
'iframe',
|
|
831
|
+
],
|
|
832
|
+
allowedAttributes: {
|
|
833
|
+
// NOTE: `id`/`name` are intentionally omitted — caller-controlled id/name enable DOM
|
|
834
|
+
// clobbering (shadowing document/global properties) and duplicate-id breakage, with no
|
|
835
|
+
// legitimate need in rendered user content.
|
|
836
|
+
'*': [
|
|
837
|
+
'style', 'class', 'title', 'dir', 'lang', 'align', 'valign', 'width', 'height',
|
|
838
|
+
'color', 'bgcolor', 'aria-*', 'data-*', 'role',
|
|
839
|
+
],
|
|
840
|
+
a: ['href', 'target', 'rel'],
|
|
841
|
+
img: ['src', 'srcset', 'sizes', 'alt', 'loading', 'decoding'],
|
|
842
|
+
audio: ['controls', 'src', 'preload', 'loop', 'muted'],
|
|
843
|
+
video: ['controls', 'src', 'poster', 'preload', 'loop', 'muted', 'playsinline'],
|
|
844
|
+
source: ['src', 'srcset', 'type', 'media', 'sizes'],
|
|
845
|
+
track: ['src', 'kind', 'srclang', 'label', 'default'],
|
|
846
|
+
// No `srcdoc` (an inline document is arbitrary markup) and no `name` (named-window
|
|
847
|
+
// clobbering). `sandbox`/`referrerpolicy` MUST be listed here: transformTags runs BEFORE
|
|
848
|
+
// attribute filtering, so the values forced below are filtered too and would be dropped.
|
|
849
|
+
iframe: [
|
|
850
|
+
'src', 'sandbox', 'referrerpolicy', 'allow', 'allowfullscreen', 'frameborder', 'loading',
|
|
851
|
+
],
|
|
852
|
+
col: ['span'],
|
|
853
|
+
colgroup: ['span'],
|
|
854
|
+
td: ['colspan', 'rowspan', 'headers'],
|
|
855
|
+
th: ['colspan', 'rowspan', 'headers', 'scope'],
|
|
856
|
+
ol: ['start', 'reversed', 'type'],
|
|
857
|
+
time: ['datetime'],
|
|
858
|
+
data: ['value'],
|
|
859
|
+
del: ['datetime'],
|
|
860
|
+
ins: ['datetime'],
|
|
861
|
+
},
|
|
862
|
+
// Only safe protocols. javascript:/vbscript: are not listed and are stripped.
|
|
863
|
+
allowedSchemes: ['http', 'https', 'mailto', 'tel'],
|
|
864
|
+
allowedSchemesByTag: {
|
|
865
|
+
img: ['http', 'https', 'data'],
|
|
866
|
+
source: ['http', 'https', 'data'],
|
|
867
|
+
video: ['http', 'https', 'data'],
|
|
868
|
+
audio: ['http', 'https', 'data'],
|
|
869
|
+
iframe: ['https'],
|
|
870
|
+
},
|
|
871
|
+
allowedSchemesAppliedToAttributes: ['href', 'src', 'srcset'],
|
|
872
|
+
allowProtocolRelative: true,
|
|
873
|
+
allowIframeRelativeUrls: false,
|
|
874
|
+
transformTags: {
|
|
875
|
+
// Harden external links against reverse-tabnabbing.
|
|
876
|
+
a: function (tagName, attribs) {
|
|
877
|
+
var href = attribs.href || '';
|
|
878
|
+
if (href.startsWith('http://') || href.startsWith('https://')) {
|
|
879
|
+
return { tagName: tagName, attribs: __assign(__assign({}, attribs), { target: '_blank', rel: 'noopener noreferrer' }) };
|
|
880
|
+
}
|
|
881
|
+
return { tagName: tagName, attribs: attribs };
|
|
882
|
+
},
|
|
883
|
+
iframe: function (tagName, attribs) {
|
|
884
|
+
var _a;
|
|
885
|
+
// Strip the characters browsers ignore in URLs, matching sanitize-html's own naughtyHref.
|
|
886
|
+
var src = (attribs.src || '').replace(/[\x00-\x20]+/g, '');
|
|
887
|
+
// Absolute https with a non-empty host, only. Dropping `src` hands the element to
|
|
888
|
+
// exclusiveFilter below, which removes it along with its fallback content.
|
|
889
|
+
if (!/^https:\/\/[^\s/?#\\]+/i.test(src))
|
|
890
|
+
return { tagName: tagName, attribs: {} };
|
|
891
|
+
return {
|
|
892
|
+
tagName: tagName,
|
|
893
|
+
attribs: __assign(__assign({}, attribs), { src: src,
|
|
894
|
+
// `??` rather than `||`: sandbox="" serializes as a bare `sandbox`, which is the MOST
|
|
895
|
+
// restrictive value, so an explicit empty string must be honored rather than replaced.
|
|
896
|
+
sandbox: (_a = attribs.sandbox) !== null && _a !== void 0 ? _a : DEFAULT_IFRAME_SANDBOX, referrerpolicy: attribs.referrerpolicy || 'strict-origin-when-cross-origin' }),
|
|
897
|
+
};
|
|
898
|
+
},
|
|
899
|
+
},
|
|
900
|
+
// Removes src-less iframes AND their fallback content. Returning a non-allowlisted tagName from
|
|
901
|
+
// transformTags does NOT do this — sanitize-html drops the tag but emits the text inside it.
|
|
902
|
+
exclusiveFilter: function (frame) { return frame.tag === 'iframe' && !frame.attribs.src; },
|
|
903
|
+
});
|
|
904
|
+
};
|
|
758
905
|
export var query_string_for_object = function (query) {
|
|
759
906
|
var queryString = '';
|
|
760
907
|
if (query && !object_is_empty(query)) {
|
|
@@ -2845,13 +2992,20 @@ export var replace_order_template_values = function (s, order) {
|
|
|
2845
2992
|
}
|
|
2846
2993
|
return replaced;
|
|
2847
2994
|
};
|
|
2995
|
+
// Entity-escapes a value being spliced into an HTML string. `&` must be replaced first.
|
|
2996
|
+
var escape_html_text = function (s) { return s
|
|
2997
|
+
.replace(/&/g, '&')
|
|
2998
|
+
.replace(/</g, '<')
|
|
2999
|
+
.replace(/>/g, '>')
|
|
3000
|
+
.replace(/"/g, '"')
|
|
3001
|
+
.replace(/'/g, '''); };
|
|
2848
3002
|
export var replace_form_field_template_values = function (s, options) {
|
|
2849
3003
|
var _a, _b, _d, _e, _f, _g, _h, _j;
|
|
2850
3004
|
if (!s)
|
|
2851
3005
|
return s;
|
|
2852
3006
|
if (typeof s !== 'string')
|
|
2853
3007
|
return s;
|
|
2854
|
-
var enduser = options.enduser, _k = options.responses, responses = _k === void 0 ? [] : _k, escapeNewlinesAsHTMLBreaks = options.escapeNewlinesAsHTMLBreaks;
|
|
3008
|
+
var enduser = options.enduser, _k = options.responses, responses = _k === void 0 ? [] : _k, escapeNewlinesAsHTMLBreaks = options.escapeNewlinesAsHTMLBreaks, escapeHTMLValues = options.escapeHTMLValues;
|
|
2855
3009
|
var i = 0;
|
|
2856
3010
|
var start = 0;
|
|
2857
3011
|
var templates = [];
|
|
@@ -2934,6 +3088,11 @@ export var replace_form_field_template_values = function (s, options) {
|
|
|
2934
3088
|
replacement = value;
|
|
2935
3089
|
}
|
|
2936
3090
|
}
|
|
3091
|
+
// Must run before the newline conversion below, or the injected breaks are escaped too
|
|
3092
|
+
// and render as literal '<br />'.
|
|
3093
|
+
if (escapeHTMLValues) {
|
|
3094
|
+
replacement = escape_html_text(replacement);
|
|
3095
|
+
}
|
|
2937
3096
|
if (escapeNewlinesAsHTMLBreaks) {
|
|
2938
3097
|
replacement = replacement.replace(/\r\n|\r|\n|\\n/g, '<br />');
|
|
2939
3098
|
}
|