@toast-ui/editor 3.0.1 → 3.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/README.md +4 -4
  2. package/dist/esm/i18n/ar.js +63 -0
  3. package/dist/esm/i18n/cs-cz.js +63 -0
  4. package/dist/esm/i18n/de-de.js +63 -0
  5. package/dist/esm/i18n/en-us.js +63 -0
  6. package/dist/esm/i18n/es-es.js +63 -0
  7. package/dist/esm/i18n/fi-fi.js +63 -0
  8. package/dist/esm/i18n/fr-fr.js +63 -0
  9. package/dist/esm/i18n/gl-es.js +63 -0
  10. package/dist/esm/i18n/hr-hr.js +63 -0
  11. package/dist/esm/i18n/i18n.js +223 -0
  12. package/dist/esm/i18n/it-it.js +63 -0
  13. package/dist/esm/i18n/ja-jp.js +63 -0
  14. package/dist/esm/i18n/ko-kr.js +63 -0
  15. package/dist/esm/i18n/nb-no.js +63 -0
  16. package/dist/esm/i18n/nl-nl.js +63 -0
  17. package/dist/esm/i18n/pl-pl.js +63 -0
  18. package/dist/esm/i18n/pt-br.js +63 -0
  19. package/dist/esm/i18n/ru-ru.js +64 -0
  20. package/dist/esm/i18n/sv-se.js +63 -0
  21. package/dist/esm/i18n/tr-tr.js +63 -0
  22. package/dist/esm/i18n/uk-ua.js +63 -0
  23. package/dist/esm/i18n/zh-cn.js +63 -0
  24. package/dist/esm/i18n/zh-tw.js +63 -0
  25. package/dist/esm/index.js +2887 -441
  26. package/dist/esm/indexViewer.js +1659 -293
  27. package/dist/i18n/ar.js +1 -1
  28. package/dist/i18n/cs-cz.js +1 -1
  29. package/dist/i18n/de-de.js +1 -1
  30. package/dist/i18n/es-es.js +1 -1
  31. package/dist/i18n/fi-fi.js +1 -1
  32. package/dist/i18n/fr-fr.js +1 -1
  33. package/dist/i18n/gl-es.js +1 -1
  34. package/dist/i18n/hr-hr.js +1 -1
  35. package/dist/i18n/it-it.js +1 -1
  36. package/dist/i18n/ja-jp.js +1 -1
  37. package/dist/i18n/ko-kr.js +1 -1
  38. package/dist/i18n/nb-no.js +1 -1
  39. package/dist/i18n/nl-nl.js +1 -1
  40. package/dist/i18n/pl-pl.js +1 -1
  41. package/dist/i18n/pt-br.js +1 -1
  42. package/dist/i18n/ru-ru.js +15 -14
  43. package/dist/i18n/sv-se.js +1 -1
  44. package/dist/i18n/tr-tr.js +1 -1
  45. package/dist/i18n/uk-ua.js +1 -1
  46. package/dist/i18n/zh-cn.js +1 -1
  47. package/dist/i18n/zh-tw.js +1 -1
  48. package/dist/toastui-editor-only.css +27 -19
  49. package/dist/toastui-editor-viewer.css +10 -2
  50. package/dist/toastui-editor-viewer.js +1849 -386
  51. package/dist/toastui-editor.css +36 -20
  52. package/dist/toastui-editor.js +2841 -318
  53. package/package.json +10 -1
  54. package/types/editor.d.ts +6 -4
  55. package/types/index.d.ts +4 -3
  56. package/types/toastui-editor-viewer.d.ts +39 -0
@@ -1,3 +1,10 @@
1
+ /**
2
+ * @toast-ui/editor : viewer
3
+ * @version 3.1.1 | Wed Oct 27 2021
4
+ * @author NHN FE Development Lab <dl_javascript@nhn.com>
5
+ * @license MIT
6
+ */
7
+
1
8
  import { Plugin, Selection, TextSelection } from 'prosemirror-state';
2
9
  import { Decoration, DecorationSet } from 'prosemirror-view';
3
10
  import { Fragment } from 'prosemirror-model';
@@ -28,10 +35,14 @@ var __assign$1 = function() {
28
35
  return __assign$1.apply(this, arguments);
29
36
  };
30
37
 
31
- function __spreadArray$1(to, from) {
32
- for (var i = 0, il = from.length, j = to.length; i < il; i++, j++)
33
- to[j] = from[i];
34
- return to;
38
+ function __spreadArray$1(to, from, pack) {
39
+ if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
40
+ if (ar || !(i in from)) {
41
+ if (!ar) ar = Array.prototype.slice.call(from, 0, i);
42
+ ar[i] = from[i];
43
+ }
44
+ }
45
+ return to.concat(ar || Array.prototype.slice.call(from));
35
46
  }
36
47
 
37
48
  /*! *****************************************************************************
@@ -76,10 +87,14 @@ var __assign = function() {
76
87
  return __assign.apply(this, arguments);
77
88
  };
78
89
 
79
- function __spreadArray(to, from) {
80
- for (var i = 0, il = from.length, j = to.length; i < il; i++, j++)
81
- to[j] = from[i];
82
- return to;
90
+ function __spreadArray(to, from, pack) {
91
+ if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
92
+ if (ar || !(i in from)) {
93
+ if (!ar) ar = Array.prototype.slice.call(from, 0, i);
94
+ ar[i] = from[i];
95
+ }
96
+ }
97
+ return to.concat(ar || Array.prototype.slice.call(from));
83
98
  }
84
99
 
85
100
  var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
@@ -5412,7 +5427,7 @@ function isCustomBlock(node) {
5412
5427
  function isCustomInline(node) {
5413
5428
  return node.type === 'customInline';
5414
5429
  }
5415
- function text(s, sourcepos) {
5430
+ function text$1(s, sourcepos) {
5416
5431
  var node = createNode('text', sourcepos);
5417
5432
  node.literal = s;
5418
5433
  return node;
@@ -5588,17 +5603,17 @@ function convertExtAutoLinks(walker, autolinkParser) {
5588
5603
  for (var _i = 0, linkInfos_1 = linkInfos; _i < linkInfos_1.length; _i++) {
5589
5604
  var _b = linkInfos_1[_i], range = _b.range, url = _b.url, linkText = _b.text;
5590
5605
  if (range[0] > lastIdx) {
5591
- newNodes.push(text(literal.substring(lastIdx, range[0]), sourcepos(lastIdx, range[0] - 1)));
5606
+ newNodes.push(text$1(literal.substring(lastIdx, range[0]), sourcepos(lastIdx, range[0] - 1)));
5592
5607
  }
5593
5608
  var linkNode = createNode('link', sourcepos.apply(void 0, range));
5594
- linkNode.appendChild(text(linkText, sourcepos.apply(void 0, range)));
5609
+ linkNode.appendChild(text$1(linkText, sourcepos.apply(void 0, range)));
5595
5610
  linkNode.destination = url;
5596
5611
  linkNode.extendedAutolink = true;
5597
5612
  newNodes.push(linkNode);
5598
5613
  lastIdx = range[1] + 1;
5599
5614
  }
5600
5615
  if (lastIdx < literal.length) {
5601
- newNodes.push(text(literal.substring(lastIdx), sourcepos(lastIdx, literal.length - 1)));
5616
+ newNodes.push(text$1(literal.substring(lastIdx), sourcepos(lastIdx, literal.length - 1)));
5602
5617
  }
5603
5618
  for (var _c = 0, newNodes_1 = newNodes; _c < newNodes_1.length; _c++) {
5604
5619
  var newNode = newNodes_1[_c];
@@ -5789,7 +5804,7 @@ var InlineParser = /** @class */ (function () {
5789
5804
  }
5790
5805
  // If we got here, we didn't match a closing backtick sequence.
5791
5806
  this.pos = afterOpenTicks;
5792
- block.appendChild(text(ticks, this.sourcepos(startpos, this.pos - 1)));
5807
+ block.appendChild(text$1(ticks, this.sourcepos(startpos, this.pos - 1)));
5793
5808
  return true;
5794
5809
  };
5795
5810
  // Parse a backslash-escaped special character, adding either the escaped
@@ -5808,11 +5823,11 @@ var InlineParser = /** @class */ (function () {
5808
5823
  this.nextLine();
5809
5824
  }
5810
5825
  else if (reEscapable.test(subj.charAt(this.pos))) {
5811
- block.appendChild(text(subj.charAt(this.pos), this.sourcepos(startpos, this.pos)));
5826
+ block.appendChild(text$1(subj.charAt(this.pos), this.sourcepos(startpos, this.pos)));
5812
5827
  this.pos += 1;
5813
5828
  }
5814
5829
  else {
5815
- block.appendChild(text('\\', this.sourcepos(startpos, startpos)));
5830
+ block.appendChild(text$1('\\', this.sourcepos(startpos, startpos)));
5816
5831
  }
5817
5832
  return true;
5818
5833
  };
@@ -5827,7 +5842,7 @@ var InlineParser = /** @class */ (function () {
5827
5842
  node = createNode('link', this.sourcepos(startpos, this.pos));
5828
5843
  node.destination = normalizeURI("mailto:" + dest);
5829
5844
  node.title = '';
5830
- node.appendChild(text(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5845
+ node.appendChild(text$1(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5831
5846
  block.appendChild(node);
5832
5847
  return true;
5833
5848
  }
@@ -5836,7 +5851,7 @@ var InlineParser = /** @class */ (function () {
5836
5851
  node = createNode('link', this.sourcepos(startpos, this.pos));
5837
5852
  node.destination = normalizeURI(dest);
5838
5853
  node.title = '';
5839
- node.appendChild(text(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5854
+ node.appendChild(text$1(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5840
5855
  block.appendChild(node);
5841
5856
  return true;
5842
5857
  }
@@ -5930,7 +5945,7 @@ var InlineParser = /** @class */ (function () {
5930
5945
  else {
5931
5946
  contents = this.subject.slice(startpos - 1, this.pos);
5932
5947
  }
5933
- var node = text(contents, this.sourcepos(startpos, this.pos));
5948
+ var node = text$1(contents, this.sourcepos(startpos, this.pos));
5934
5949
  block.appendChild(node);
5935
5950
  // Add entry to stack for this opener
5936
5951
  if ((res.canOpen || res.canClose) &&
@@ -6201,7 +6216,7 @@ var InlineParser = /** @class */ (function () {
6201
6216
  InlineParser.prototype.parseOpenBracket = function (block) {
6202
6217
  var startpos = this.pos;
6203
6218
  this.pos += 1;
6204
- var node = text('[', this.sourcepos(this.pos, this.pos));
6219
+ var node = text$1('[', this.sourcepos(this.pos, this.pos));
6205
6220
  block.appendChild(node);
6206
6221
  // Add entry to stack for this opener
6207
6222
  this.addBracket(node, startpos, false);
@@ -6214,13 +6229,13 @@ var InlineParser = /** @class */ (function () {
6214
6229
  this.pos += 1;
6215
6230
  if (this.peek() === C_OPEN_BRACKET$1) {
6216
6231
  this.pos += 1;
6217
- var node = text('![', this.sourcepos(this.pos - 1, this.pos));
6232
+ var node = text$1('![', this.sourcepos(this.pos - 1, this.pos));
6218
6233
  block.appendChild(node);
6219
6234
  // Add entry to stack for this opener
6220
6235
  this.addBracket(node, startpos + 1, true);
6221
6236
  }
6222
6237
  else {
6223
- var node = text('!', this.sourcepos(this.pos, this.pos));
6238
+ var node = text$1('!', this.sourcepos(this.pos, this.pos));
6224
6239
  block.appendChild(node);
6225
6240
  }
6226
6241
  return true;
@@ -6239,12 +6254,12 @@ var InlineParser = /** @class */ (function () {
6239
6254
  var opener = this.brackets;
6240
6255
  if (opener === null) {
6241
6256
  // no matched opener, just return a literal
6242
- block.appendChild(text(']', this.sourcepos(startpos, startpos)));
6257
+ block.appendChild(text$1(']', this.sourcepos(startpos, startpos)));
6243
6258
  return true;
6244
6259
  }
6245
6260
  if (!opener.active) {
6246
6261
  // no matched opener, just return a literal
6247
- block.appendChild(text(']', this.sourcepos(startpos, startpos)));
6262
+ block.appendChild(text$1(']', this.sourcepos(startpos, startpos)));
6248
6263
  // take opener off brackets stack
6249
6264
  this.removeBracket();
6250
6265
  return true;
@@ -6336,7 +6351,7 @@ var InlineParser = /** @class */ (function () {
6336
6351
  } // no match
6337
6352
  this.removeBracket(); // remove this opener from stack
6338
6353
  this.pos = startpos;
6339
- block.appendChild(text(']', this.sourcepos(startpos, startpos)));
6354
+ block.appendChild(text$1(']', this.sourcepos(startpos, startpos)));
6340
6355
  if (this.options.referenceDefinition) {
6341
6356
  this.refLinkCandidateMap[block.id] = { node: block, refLabel: refLabel };
6342
6357
  }
@@ -6366,7 +6381,7 @@ var InlineParser = /** @class */ (function () {
6366
6381
  var m;
6367
6382
  var startpos = this.pos + 1;
6368
6383
  if ((m = this.match(reEntityHere))) {
6369
- block.appendChild(text(lib.decodeHTML(m), this.sourcepos(startpos, this.pos)));
6384
+ block.appendChild(text$1(lib.decodeHTML(m), this.sourcepos(startpos, this.pos)));
6370
6385
  return true;
6371
6386
  }
6372
6387
  return false;
@@ -6401,10 +6416,10 @@ var InlineParser = /** @class */ (function () {
6401
6416
  }
6402
6417
  return repeat('\u2014', emCount) + repeat('\u2013', enCount);
6403
6418
  });
6404
- block.appendChild(text(lit, this.sourcepos(startpos, this.pos)));
6419
+ block.appendChild(text$1(lit, this.sourcepos(startpos, this.pos)));
6405
6420
  }
6406
6421
  else {
6407
- var node = text(m, this.sourcepos(startpos, this.pos));
6422
+ var node = text$1(m, this.sourcepos(startpos, this.pos));
6408
6423
  block.appendChild(node);
6409
6424
  }
6410
6425
  return true;
@@ -6627,7 +6642,7 @@ var InlineParser = /** @class */ (function () {
6627
6642
  }
6628
6643
  if (!res) {
6629
6644
  this.pos += 1;
6630
- block.appendChild(text(fromCodePoint$1(c), this.sourcepos(this.pos, this.pos + 1)));
6645
+ block.appendChild(text$1(fromCodePoint$1(c), this.sourcepos(this.pos, this.pos + 1)));
6631
6646
  }
6632
6647
  return true;
6633
6648
  };
@@ -8513,6 +8528,7 @@ function filterDisallowedTags(str) {
8513
8528
  return str;
8514
8529
  }
8515
8530
 
8531
+ var CUSTOM_SYNTAX_LENGTH = 4;
8516
8532
  var baseConvertors$1 = {
8517
8533
  heading: function (node, _a) {
8518
8534
  var entering = _a.entering;
@@ -8680,7 +8696,7 @@ var baseConvertors$1 = {
8680
8696
  return customConvertor(node, context);
8681
8697
  }
8682
8698
  catch (e) {
8683
- console.warn(e);
8699
+ console.warn("[@toast-ui/editor] - The error occurred when " + info + " block node was parsed in markdown renderer: " + e);
8684
8700
  }
8685
8701
  }
8686
8702
  return [
@@ -8703,15 +8719,30 @@ var baseConvertors$1 = {
8703
8719
  ];
8704
8720
  },
8705
8721
  customInline: function (node, context, convertors) {
8706
- var info = node.info.trim().toLowerCase();
8707
- var customConvertor = convertors[info];
8722
+ var _a = node, sourcepos = _a.sourcepos, info = _a.info;
8723
+ var nomalizedInfo = info.trim().toLowerCase();
8724
+ var customConvertor = convertors[nomalizedInfo];
8725
+ var entering = context.entering;
8708
8726
  if (customConvertor) {
8709
- return customConvertor(node, context);
8727
+ try {
8728
+ return customConvertor(node, context);
8729
+ }
8730
+ catch (e) {
8731
+ console.warn("[@toast-ui/editor] - The error occurred when " + nomalizedInfo + " inline node was parsed in markdown renderer: " + e);
8732
+ }
8710
8733
  }
8711
- return {
8712
- type: context.entering ? 'openTag' : 'closeTag',
8713
- tagName: 'span',
8714
- };
8734
+ var text = sourcepos[1][1] - sourcepos[0][1] + 1 === info.length + CUSTOM_SYNTAX_LENGTH
8735
+ ? ''
8736
+ : info + " ";
8737
+ return entering
8738
+ ? [
8739
+ { type: 'openTag', tagName: 'span' },
8740
+ { type: 'text', content: "$$" + text },
8741
+ ]
8742
+ : [
8743
+ { type: 'text', content: '$$' },
8744
+ { type: 'closeTag', tagName: 'span' },
8745
+ ];
8715
8746
  },
8716
8747
  };
8717
8748
 
@@ -8876,8 +8907,8 @@ var Renderer = /** @class */ (function () {
8876
8907
  ? nodeType.toLowerCase()
8877
8908
  : nodeType;
8878
8909
  if (orgConvertor) {
8879
- convertors[convertorType] = function (node, context) {
8880
- context.origin = function () { return orgConvertor(node, context); };
8910
+ convertors[convertorType] = function (node, context, convertors) {
8911
+ context.origin = function () { return orgConvertor(node, context, convertors); };
8881
8912
  return convertor(node, context);
8882
8913
  };
8883
8914
  }
@@ -9039,12 +9070,16 @@ var Renderer = /** @class */ (function () {
9039
9070
  * @param {Object} [context] Context(this) of callback function
9040
9071
  * @memberof module:collection
9041
9072
  * @example
9042
- * var forEachOwnProperties = require('tui-code-snippet/collection/forEachOwnProperties'); // node, commonjs
9073
+ * // ES6
9074
+ * import forEachOwnProperties from 'tui-code-snippet/collection/forEachOwnProperties';
9075
+ *
9076
+ * // CommonJS
9077
+ * const forEachOwnProperties = require('tui-code-snippet/collection/forEachOwnProperties');
9043
9078
  *
9044
- * var sum = 0;
9079
+ * let sum = 0;
9045
9080
  *
9046
9081
  * forEachOwnProperties({a:1,b:2,c:3}, function(value){
9047
- * sum += value;
9082
+ * sum += value;
9048
9083
  * });
9049
9084
  * alert(sum); // 6
9050
9085
  */
@@ -9152,12 +9187,16 @@ var isArray_1 = isArray$3;
9152
9187
  * @param {Object} [context] Context(this) of callback function
9153
9188
  * @memberof module:collection
9154
9189
  * @example
9155
- * var forEachArray = require('tui-code-snippet/collection/forEachArray'); // node, commonjs
9190
+ * // ES6
9191
+ * import forEachArray from 'tui-code-snippet/collection/forEachArray';
9192
+ *
9193
+ * // CommonJS
9194
+ * const forEachArray = require('tui-code-snippet/collection/forEachArray');
9156
9195
  *
9157
- * var sum = 0;
9196
+ * let sum = 0;
9158
9197
  *
9159
9198
  * forEachArray([1,2,3], function(value){
9160
- * sum += value;
9199
+ * sum += value;
9161
9200
  * });
9162
9201
  * alert(sum); // 6
9163
9202
  */
@@ -9202,19 +9241,23 @@ var forEachOwnProperties = forEachOwnProperties_1;
9202
9241
  * @param {Object} [context] Context(this) of callback function
9203
9242
  * @memberof module:collection
9204
9243
  * @example
9205
- * var forEach = require('tui-code-snippet/collection/forEach'); // node, commonjs
9244
+ * // ES6
9245
+ * import forEach from 'tui-code-snippet/collection/forEach';
9246
+ *
9247
+ * // CommonJS
9248
+ * const forEach = require('tui-code-snippet/collection/forEach');
9206
9249
  *
9207
- * var sum = 0;
9250
+ * let sum = 0;
9208
9251
  *
9209
9252
  * forEach([1,2,3], function(value){
9210
- * sum += value;
9253
+ * sum += value;
9211
9254
  * });
9212
9255
  * alert(sum); // 6
9213
9256
  *
9214
9257
  * // In case of Array-like object
9215
- * var array = Array.prototype.slice.call(arrayLike); // change to array
9258
+ * const array = Array.prototype.slice.call(arrayLike); // change to array
9216
9259
  * forEach(array, function(value){
9217
- * sum += value;
9260
+ * sum += value;
9218
9261
  * });
9219
9262
  */
9220
9263
  function forEach$4(obj, iteratee, context) {
@@ -9277,7 +9320,7 @@ var safeEvent$1 = _safeEvent;
9277
9320
  * @param {object} [context] context - context for handler method.
9278
9321
  * @memberof module:domEvent
9279
9322
  * @example
9280
- * var div = document.querySelector('div');
9323
+ * const div = document.querySelector('div');
9281
9324
  *
9282
9325
  * // Bind one event to an element.
9283
9326
  * on(div, 'click', toggle);
@@ -9294,10 +9337,10 @@ var safeEvent$1 = _safeEvent;
9294
9337
  * });
9295
9338
  *
9296
9339
  * // Set a context for handler method.
9297
- * var name = 'global';
9298
- * var repository = {name: 'CodeSnippet'};
9340
+ * const name = 'global';
9341
+ * const repository = {name: 'CodeSnippet'};
9299
9342
  * on(div, 'drag', function() {
9300
- * console.log(this.name);
9343
+ * console.log(this.name);
9301
9344
  * }, repository);
9302
9345
  * // Result when you drag a div: "CodeSnippet"
9303
9346
  */
@@ -9491,11 +9534,15 @@ var isArray$1 = isArray_1;
9491
9534
  * @returns {number} the First index at which a given element, or -1 if it is not present
9492
9535
  * @memberof module:array
9493
9536
  * @example
9494
- * var inArray = require('tui-code-snippet/array/inArray'); // node, commonjs
9537
+ * // ES6
9538
+ * import inArray from 'tui-code-snippet/array/inArray';
9539
+ *
9540
+ * // CommonJS
9541
+ * const inArray = require('tui-code-snippet/array/inArray');
9495
9542
  *
9496
- * var arr = ['one', 'two', 'three', 'four'];
9497
- * var idx1 = inArray('one', arr, 3); // -1
9498
- * var idx2 = inArray('one', arr); // 0
9543
+ * const arr = ['one', 'two', 'three', 'four'];
9544
+ * const idx1 = inArray('one', arr, 3); // -1
9545
+ * const idx2 = inArray('one', arr); // 0
9499
9546
  */
9500
9547
  function inArray$3(searchElement, array, startIndex) {
9501
9548
  var i;
@@ -9736,16 +9783,20 @@ var forEachArray = forEachArray_1;
9736
9783
  * @returns {Array} Array
9737
9784
  * @memberof module:collection
9738
9785
  * @example
9739
- * var toArray = require('tui-code-snippet/collection/toArray'); // node, commonjs
9786
+ * // ES6
9787
+ * import toArray from 'tui-code-snippet/collection/toArray';
9788
+ *
9789
+ * // CommonJS
9790
+ * const toArray = require('tui-code-snippet/collection/toArray');
9740
9791
  *
9741
- * var arrayLike = {
9742
- * 0: 'one',
9743
- * 1: 'two',
9744
- * 2: 'three',
9745
- * 3: 'four',
9746
- * length: 4
9792
+ * const arrayLike = {
9793
+ * 0: 'one',
9794
+ * 1: 'two',
9795
+ * 2: 'three',
9796
+ * 3: 'four',
9797
+ * length: 4
9747
9798
  * };
9748
- * var result = toArray(arrayLike);
9799
+ * const result = toArray(arrayLike);
9749
9800
  *
9750
9801
  * alert(result instanceof Array); // true
9751
9802
  * alert(result); // one,two,three,four
@@ -9808,103 +9859,6 @@ var CLOSE_TAG = "</(" + TAG_NAME + ")\\s*[>]";
9808
9859
  var HTML_TAG = "(?:" + OPEN_TAG + "|" + CLOSE_TAG + ")";
9809
9860
  var reHTMLTag = new RegExp("^" + HTML_TAG, 'i');
9810
9861
 
9811
- function isPositionInBox(style, offsetX, offsetY) {
9812
- var left = parseInt(style.left, 10);
9813
- var top = parseInt(style.top, 10);
9814
- var width = parseInt(style.width, 10) + parseInt(style.paddingLeft, 10) + parseInt(style.paddingRight, 10);
9815
- var height = parseInt(style.height, 10) + parseInt(style.paddingTop, 10) + parseInt(style.paddingBottom, 10);
9816
- return offsetX >= left && offsetX <= left + width && offsetY >= top && offsetY <= top + height;
9817
- }
9818
- var CLS_PREFIX = 'toastui-editor-';
9819
- function cls() {
9820
- var names = [];
9821
- for (var _i = 0; _i < arguments.length; _i++) {
9822
- names[_i] = arguments[_i];
9823
- }
9824
- var result = [];
9825
- for (var _a = 0, names_1 = names; _a < names_1.length; _a++) {
9826
- var name_1 = names_1[_a];
9827
- var className = void 0;
9828
- if (Array.isArray(name_1)) {
9829
- className = name_1[0] ? name_1[1] : null;
9830
- }
9831
- else {
9832
- className = name_1;
9833
- }
9834
- if (className) {
9835
- result.push("" + CLS_PREFIX + className);
9836
- }
9837
- }
9838
- return result.join(' ');
9839
- }
9840
- function findNodes(element, selector) {
9841
- var nodeList = toArray_1(element.querySelectorAll(selector));
9842
- if (nodeList.length) {
9843
- return nodeList;
9844
- }
9845
- return [];
9846
- }
9847
- function removeNode(node) {
9848
- if (node.parentNode) {
9849
- node.parentNode.removeChild(node);
9850
- }
9851
- }
9852
- function toggleClass(element, className, state) {
9853
- if (isUndefined_1(state)) {
9854
- state = !hasClass_1(element, className);
9855
- }
9856
- var toggleFn = state ? addClass_1 : removeClass_1;
9857
- toggleFn(element, className);
9858
- }
9859
- function createElementWith(contents, target) {
9860
- var container = document.createElement('div');
9861
- if (isString_1(contents)) {
9862
- container.innerHTML = contents;
9863
- }
9864
- else {
9865
- container.appendChild(contents);
9866
- }
9867
- var firstChild = container.firstChild;
9868
- if (target) {
9869
- target.appendChild(firstChild);
9870
- }
9871
- return firstChild;
9872
- }
9873
- function finalizeHtml(html, needHtmlText) {
9874
- var result;
9875
- if (needHtmlText) {
9876
- result = html.innerHTML;
9877
- }
9878
- else {
9879
- var frag = document.createDocumentFragment();
9880
- var childNodes = toArray_1(html.childNodes);
9881
- var length_1 = childNodes.length;
9882
- for (var i = 0; i < length_1; i += 1) {
9883
- frag.appendChild(childNodes[i]);
9884
- }
9885
- result = frag;
9886
- }
9887
- return result;
9888
- }
9889
-
9890
- /**
9891
- * @fileoverview Check whether the given variable is a function or not.
9892
- * @author NHN FE Development Lab <dl_javascript@nhn.com>
9893
- */
9894
-
9895
- /**
9896
- * Check whether the given variable is a function or not.
9897
- * If the given variable is a function, return true.
9898
- * @param {*} obj - Target for checking
9899
- * @returns {boolean} Is function?
9900
- * @memberof module:type
9901
- */
9902
- function isFunction(obj) {
9903
- return obj instanceof Function;
9904
- }
9905
-
9906
- var isFunction_1 = isFunction;
9907
-
9908
9862
  /**
9909
9863
  * @fileoverview Check whether the given variable is null or not.
9910
9864
  * @author NHN FE Development Lab <dl_javascript@nhn.com>
@@ -10012,6 +9966,80 @@ function getSortedNumPair(valueA, valueB) {
10012
9966
  return valueA > valueB ? [valueB, valueA] : [valueA, valueB];
10013
9967
  }
10014
9968
 
9969
+ function isPositionInBox(style, offsetX, offsetY) {
9970
+ var left = parseInt(style.left, 10);
9971
+ var top = parseInt(style.top, 10);
9972
+ var width = parseInt(style.width, 10) + parseInt(style.paddingLeft, 10) + parseInt(style.paddingRight, 10);
9973
+ var height = parseInt(style.height, 10) + parseInt(style.paddingTop, 10) + parseInt(style.paddingBottom, 10);
9974
+ return offsetX >= left && offsetX <= left + width && offsetY >= top && offsetY <= top + height;
9975
+ }
9976
+ var CLS_PREFIX = 'toastui-editor-';
9977
+ function cls() {
9978
+ var names = [];
9979
+ for (var _i = 0; _i < arguments.length; _i++) {
9980
+ names[_i] = arguments[_i];
9981
+ }
9982
+ var result = [];
9983
+ for (var _a = 0, names_1 = names; _a < names_1.length; _a++) {
9984
+ var name_1 = names_1[_a];
9985
+ var className = void 0;
9986
+ if (Array.isArray(name_1)) {
9987
+ className = name_1[0] ? name_1[1] : null;
9988
+ }
9989
+ else {
9990
+ className = name_1;
9991
+ }
9992
+ if (className) {
9993
+ result.push("" + CLS_PREFIX + className);
9994
+ }
9995
+ }
9996
+ return result.join(' ');
9997
+ }
9998
+ function removeNode(node) {
9999
+ if (node.parentNode) {
10000
+ node.parentNode.removeChild(node);
10001
+ }
10002
+ }
10003
+ function toggleClass(element, className, state) {
10004
+ if (isUndefined_1(state)) {
10005
+ state = !hasClass_1(element, className);
10006
+ }
10007
+ var toggleFn = state ? addClass_1 : removeClass_1;
10008
+ toggleFn(element, className);
10009
+ }
10010
+ function createElementWith(contents, target) {
10011
+ var container = document.createElement('div');
10012
+ if (isString_1(contents)) {
10013
+ container.innerHTML = contents;
10014
+ }
10015
+ else {
10016
+ container.appendChild(contents);
10017
+ }
10018
+ var firstChild = container.firstChild;
10019
+ if (target) {
10020
+ target.appendChild(firstChild);
10021
+ }
10022
+ return firstChild;
10023
+ }
10024
+
10025
+ /**
10026
+ * @fileoverview Check whether the given variable is a function or not.
10027
+ * @author NHN FE Development Lab <dl_javascript@nhn.com>
10028
+ */
10029
+
10030
+ /**
10031
+ * Check whether the given variable is a function or not.
10032
+ * If the given variable is a function, return true.
10033
+ * @param {*} obj - Target for checking
10034
+ * @returns {boolean} Is function?
10035
+ * @memberof module:type
10036
+ */
10037
+ function isFunction(obj) {
10038
+ return obj instanceof Function;
10039
+ }
10040
+
10041
+ var isFunction_1 = isFunction;
10042
+
10015
10043
  function getMdStartCh(mdNode) {
10016
10044
  return mdNode.sourcepos[0][1];
10017
10045
  }
@@ -10104,145 +10132,1470 @@ function getWidgetContent(widgetNode) {
10104
10132
  return text;
10105
10133
  }
10106
10134
 
10107
- var reXSSHtmlAttr = new RegExp('^(abbr|align|alt|axis|bgcolor|border|cellpadding|cellspacing|class|clear|' +
10108
- 'color|cols|compact|coords|dir|face|headers|height|hreflang|hspace|' +
10109
- 'ismap|lang|language|nohref|nowrap|rel|rev|rows|rules|' +
10110
- 'scope|scrolling|shape|size|span|start|summary|tabindex|target|title|type|' +
10111
- 'valign|value|vspace|width|checked|mathvariant|encoding|id|name|' +
10112
- 'background|cite|href|longdesc|src|usemap|xlink:href|data-+|checked|style)', 'g');
10113
- var reXSSSvgAttr = new RegExp('^(accent-height|accumulate|additive|alphabetic|arabic-form|ascent|' +
10114
- 'baseProfile|bbox|begin|by|calcMode|cap-height|class|color|color-rendering|content|' +
10115
- 'cx|cy|d|dx|dy|descent|display|dur|end|fill|fill-rule|font-family|font-size|font-stretch|' +
10116
- 'font-style|font-variant|font-weight|from|fx|fy|g1|g2|glyph-name|gradientUnits|hanging|' +
10117
- 'height|horiz-adv-x|horiz-origin-x|ideographic|k|keyPoints|keySplines|keyTimes|lang|' +
10118
- 'marker-end|marker-mid|marker-start|markerHeight|markerUnits|markerWidth|mathematical|' +
10119
- 'max|min|offset|opacity|orient|origin|overline-position|overline-thickness|panose-1|' +
10120
- 'path|pathLength|points|preserveAspectRatio|r|refX|refY|repeatCount|repeatDur|' +
10121
- 'requiredExtensions|requiredFeatures|restart|rotate|rx|ry|slope|stemh|stemv|stop-color|' +
10122
- 'stop-opacity|strikethrough-position|strikethrough-thickness|stroke|stroke-dasharray|' +
10123
- 'stroke-dashoffset|stroke-linecap|stroke-linejoin|stroke-miterlimit|stroke-opacity|' +
10124
- 'stroke-width|systemLanguage|target|text-anchor|to|transform|type|u1|u2|underline-position|' +
10125
- 'underline-thickness|unicode|unicode-range|units-per-em|values|version|viewBox|visibility|' +
10126
- 'width|widths|x|x-height|x1|x2|xlink:actuate|xlink:arcrole|xlink:role|xlink:show|xlink:title|' +
10127
- 'xlink:type|xml:base|xml:lang|xml:space|xmlns|xmlns:xlink|y|y1|y2|zoomAndPan)', 'g');
10128
- var reXSSAttr = /href|src|background/i;
10129
- var reXSSAttrValue = /((java|vb|live)script|x):/i;
10130
- var reOnEvent = /^on\S+/i;
10131
- var reComment = /<!--[\s\S]*?-->/g;
10132
- var DEFAULT_TAG_BLACK_LIST = [
10133
- 'script',
10134
- 'iframe',
10135
- 'textarea',
10136
- 'form',
10137
- 'button',
10138
- 'select',
10139
- 'input',
10140
- 'meta',
10141
- 'style',
10142
- 'link',
10143
- 'title',
10144
- 'embed',
10145
- 'object',
10146
- 'details',
10147
- 'summary',
10148
- ];
10149
- var tagBlacklist = __spreadArray$1([], DEFAULT_TAG_BLACK_LIST);
10150
- function sanitizeHTML(html) {
10151
- var root = document.createElement('div');
10152
- if (isString_1(html)) {
10153
- html = html.replace(reComment, '');
10154
- root.innerHTML = html;
10155
- }
10156
- removeUnnecessaryTags(root);
10157
- leaveOnlyWhitelistAttribute(root);
10158
- return finalizeHtml(root, true);
10159
- }
10160
- function removeUnnecessaryTags(html) {
10161
- var removedTags = findNodes(html, tagBlacklist.join(','));
10162
- removedTags.forEach(function (node) {
10163
- removeNode(node);
10164
- });
10135
+ /*! @license DOMPurify 2.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.3/LICENSE */
10136
+
10137
+ function _toConsumableArray(arr) { if (Array.isArray(arr)) { for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) { arr2[i] = arr[i]; } return arr2; } else { return Array.from(arr); } }
10138
+
10139
+ var hasOwnProperty = Object.hasOwnProperty,
10140
+ setPrototypeOf = Object.setPrototypeOf,
10141
+ isFrozen = Object.isFrozen,
10142
+ getPrototypeOf = Object.getPrototypeOf,
10143
+ getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
10144
+ var freeze = Object.freeze,
10145
+ seal = Object.seal,
10146
+ create = Object.create; // eslint-disable-line import/no-mutable-exports
10147
+
10148
+ var _ref = typeof Reflect !== 'undefined' && Reflect,
10149
+ apply = _ref.apply,
10150
+ construct = _ref.construct;
10151
+
10152
+ if (!apply) {
10153
+ apply = function apply(fun, thisValue, args) {
10154
+ return fun.apply(thisValue, args);
10155
+ };
10165
10156
  }
10166
- function isXSSAttribute(attrName, attrValue) {
10167
- return attrName.match(reXSSAttr) && attrValue.match(reXSSAttrValue);
10157
+
10158
+ if (!freeze) {
10159
+ freeze = function freeze(x) {
10160
+ return x;
10161
+ };
10168
10162
  }
10169
- function removeBlacklistAttributes(node, blacklistAttrs) {
10170
- blacklistAttrs.forEach(function (_a) {
10171
- var name = _a.name;
10172
- if (reOnEvent.test(name)) {
10173
- node[name] = null;
10174
- }
10175
- if (node.getAttribute(name)) {
10176
- node.removeAttribute(name);
10177
- }
10178
- });
10163
+
10164
+ if (!seal) {
10165
+ seal = function seal(x) {
10166
+ return x;
10167
+ };
10179
10168
  }
10180
- function leaveOnlyWhitelistAttribute(html) {
10181
- findNodes(html, '*').forEach(function (node) {
10182
- var attributes = node.attributes;
10183
- var blacklist = toArray_1(attributes).filter(function (attr) {
10184
- var name = attr.name, value = attr.value;
10185
- var htmlAttr = name.match(reXSSHtmlAttr);
10186
- var svgAttr = name.match(reXSSSvgAttr);
10187
- var xssAttr = htmlAttr && isXSSAttribute(name, value);
10188
- return (!htmlAttr && !svgAttr) || xssAttr;
10189
- });
10190
- removeBlacklistAttributes(node, blacklist);
10191
- });
10169
+
10170
+ if (!construct) {
10171
+ construct = function construct(Func, args) {
10172
+ return new (Function.prototype.bind.apply(Func, [null].concat(_toConsumableArray(args))))();
10173
+ };
10192
10174
  }
10193
10175
 
10194
- function getChildrenHTML(node, typeName) {
10195
- return node
10196
- .literal.replace(new RegExp("(<\\s*" + typeName + "[^>]+?>)|(</" + typeName + "\\s*[>])", 'ig'), '')
10197
- .trim();
10176
+ var arrayForEach = unapply(Array.prototype.forEach);
10177
+ var arrayPop = unapply(Array.prototype.pop);
10178
+ var arrayPush = unapply(Array.prototype.push);
10179
+
10180
+ var stringToLowerCase = unapply(String.prototype.toLowerCase);
10181
+ var stringMatch = unapply(String.prototype.match);
10182
+ var stringReplace = unapply(String.prototype.replace);
10183
+ var stringIndexOf = unapply(String.prototype.indexOf);
10184
+ var stringTrim = unapply(String.prototype.trim);
10185
+
10186
+ var regExpTest = unapply(RegExp.prototype.test);
10187
+
10188
+ var typeErrorCreate = unconstruct(TypeError);
10189
+
10190
+ function unapply(func) {
10191
+ return function (thisArg) {
10192
+ for (var _len = arguments.length, args = Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
10193
+ args[_key - 1] = arguments[_key];
10194
+ }
10195
+
10196
+ return apply(func, thisArg, args);
10197
+ };
10198
10198
  }
10199
- function getHTMLAttrsByHTMLString(html) {
10200
- html = html.match(reHTMLTag)[0];
10201
- var attrs = html.match(new RegExp(ATTRIBUTE, 'g'));
10202
- return attrs
10203
- ? attrs.reduce(function (acc, attr) {
10204
- var _a = attr.trim().split('='), name = _a[0], values = _a.slice(1);
10205
- if (values.length) {
10206
- acc[name] = values.join('=').replace(/'|"/g, '').trim();
10207
- }
10208
- return acc;
10209
- }, {})
10210
- : {};
10199
+
10200
+ function unconstruct(func) {
10201
+ return function () {
10202
+ for (var _len2 = arguments.length, args = Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
10203
+ args[_key2] = arguments[_key2];
10204
+ }
10205
+
10206
+ return construct(func, args);
10207
+ };
10211
10208
  }
10212
10209
 
10213
- var reCloseTag = /^\s*<\s*\//;
10214
- var baseConvertors = {
10215
- paragraph: function (_, _a) {
10216
- var entering = _a.entering, origin = _a.origin, options = _a.options;
10217
- if (options.nodeId) {
10218
- return {
10219
- type: entering ? 'openTag' : 'closeTag',
10220
- outerNewLine: true,
10221
- tagName: 'p',
10222
- };
10210
+ /* Add properties to a lookup table */
10211
+ function addToSet(set, array) {
10212
+ if (setPrototypeOf) {
10213
+ // Make 'in' and truthy checks like Boolean(set.constructor)
10214
+ // independent of any properties defined on Object.prototype.
10215
+ // Prevent prototype setters from intercepting set as a this value.
10216
+ setPrototypeOf(set, null);
10217
+ }
10218
+
10219
+ var l = array.length;
10220
+ while (l--) {
10221
+ var element = array[l];
10222
+ if (typeof element === 'string') {
10223
+ var lcElement = stringToLowerCase(element);
10224
+ if (lcElement !== element) {
10225
+ // Config presets (e.g. tags.js, attrs.js) are immutable.
10226
+ if (!isFrozen(array)) {
10227
+ array[l] = lcElement;
10223
10228
  }
10224
- return origin();
10225
- },
10226
- softbreak: function (node) {
10227
- var isPrevNodeHTML = node.prev && node.prev.type === 'htmlInline';
10228
- var isPrevBR = isPrevNodeHTML && /<br ?\/?>/.test(node.prev.literal);
10229
- var content = isPrevBR ? '\n' : '<br>\n';
10230
- return { type: 'html', content: content };
10231
- },
10232
- item: function (node, _a) {
10233
- var entering = _a.entering;
10234
- if (entering) {
10235
- var attributes = {};
10236
- var classNames = [];
10237
- if (node.listData.task) {
10238
- attributes['data-task'] = '';
10239
- classNames.push('task-list-item');
10240
- if (node.listData.checked) {
10241
- classNames.push('checked');
10242
- attributes['data-task-checked'] = '';
10243
- }
10244
- }
10245
- return {
10229
+
10230
+ element = lcElement;
10231
+ }
10232
+ }
10233
+
10234
+ set[element] = true;
10235
+ }
10236
+
10237
+ return set;
10238
+ }
10239
+
10240
+ /* Shallow clone an object */
10241
+ function clone(object) {
10242
+ var newObject = create(null);
10243
+
10244
+ var property = void 0;
10245
+ for (property in object) {
10246
+ if (apply(hasOwnProperty, object, [property])) {
10247
+ newObject[property] = object[property];
10248
+ }
10249
+ }
10250
+
10251
+ return newObject;
10252
+ }
10253
+
10254
+ /* IE10 doesn't support __lookupGetter__ so lets'
10255
+ * simulate it. It also automatically checks
10256
+ * if the prop is function or getter and behaves
10257
+ * accordingly. */
10258
+ function lookupGetter(object, prop) {
10259
+ while (object !== null) {
10260
+ var desc = getOwnPropertyDescriptor(object, prop);
10261
+ if (desc) {
10262
+ if (desc.get) {
10263
+ return unapply(desc.get);
10264
+ }
10265
+
10266
+ if (typeof desc.value === 'function') {
10267
+ return unapply(desc.value);
10268
+ }
10269
+ }
10270
+
10271
+ object = getPrototypeOf(object);
10272
+ }
10273
+
10274
+ function fallbackValue(element) {
10275
+ console.warn('fallback value for', element);
10276
+ return null;
10277
+ }
10278
+
10279
+ return fallbackValue;
10280
+ }
10281
+
10282
+ var html = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
10283
+
10284
+ // SVG
10285
+ var svg = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
10286
+
10287
+ var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
10288
+
10289
+ // List of SVG elements that are disallowed by default.
10290
+ // We still need to know them so that we can do namespace
10291
+ // checks properly in case one wants to add them to
10292
+ // allow-list.
10293
+ var svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'fedropshadow', 'feimage', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
10294
+
10295
+ var mathMl = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover']);
10296
+
10297
+ // Similarly to SVG, we want to know all MathML elements,
10298
+ // even those that we disallow by default.
10299
+ var mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
10300
+
10301
+ var text = freeze(['#text']);
10302
+
10303
+ var html$1 = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
10304
+
10305
+ var svg$1 = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
10306
+
10307
+ var mathMl$1 = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
10308
+
10309
+ var xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
10310
+
10311
+ // eslint-disable-next-line unicorn/better-regex
10312
+ var MUSTACHE_EXPR = seal(/\{\{[\s\S]*|[\s\S]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
10313
+ var ERB_EXPR = seal(/<%[\s\S]*|[\s\S]*%>/gm);
10314
+ var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
10315
+ var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
10316
+ var IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
10317
+ );
10318
+ var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
10319
+ var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
10320
+ );
10321
+
10322
+ var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };
10323
+
10324
+ function _toConsumableArray$1(arr) { if (Array.isArray(arr)) { for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) { arr2[i] = arr[i]; } return arr2; } else { return Array.from(arr); } }
10325
+
10326
+ var getGlobal = function getGlobal() {
10327
+ return typeof window === 'undefined' ? null : window;
10328
+ };
10329
+
10330
+ /**
10331
+ * Creates a no-op policy for internal use only.
10332
+ * Don't export this function outside this module!
10333
+ * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
10334
+ * @param {Document} document The document object (to determine policy name suffix)
10335
+ * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
10336
+ * are not supported).
10337
+ */
10338
+ var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, document) {
10339
+ if ((typeof trustedTypes === 'undefined' ? 'undefined' : _typeof(trustedTypes)) !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
10340
+ return null;
10341
+ }
10342
+
10343
+ // Allow the callers to control the unique policy name
10344
+ // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
10345
+ // Policy creation with duplicate names throws in Trusted Types.
10346
+ var suffix = null;
10347
+ var ATTR_NAME = 'data-tt-policy-suffix';
10348
+ if (document.currentScript && document.currentScript.hasAttribute(ATTR_NAME)) {
10349
+ suffix = document.currentScript.getAttribute(ATTR_NAME);
10350
+ }
10351
+
10352
+ var policyName = 'dompurify' + (suffix ? '#' + suffix : '');
10353
+
10354
+ try {
10355
+ return trustedTypes.createPolicy(policyName, {
10356
+ createHTML: function createHTML(html$$1) {
10357
+ return html$$1;
10358
+ }
10359
+ });
10360
+ } catch (_) {
10361
+ // Policy creation failed (most likely another DOMPurify script has
10362
+ // already run). Skip creating the policy, as this will only cause errors
10363
+ // if TT are enforced.
10364
+ console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
10365
+ return null;
10366
+ }
10367
+ };
10368
+
10369
+ function createDOMPurify() {
10370
+ var window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
10371
+
10372
+ var DOMPurify = function DOMPurify(root) {
10373
+ return createDOMPurify(root);
10374
+ };
10375
+
10376
+ /**
10377
+ * Version label, exposed for easier checks
10378
+ * if DOMPurify is up to date or not
10379
+ */
10380
+ DOMPurify.version = '2.3.3';
10381
+
10382
+ /**
10383
+ * Array of elements that DOMPurify removed during sanitation.
10384
+ * Empty if nothing was removed.
10385
+ */
10386
+ DOMPurify.removed = [];
10387
+
10388
+ if (!window || !window.document || window.document.nodeType !== 9) {
10389
+ // Not running in a browser, provide a factory function
10390
+ // so that you can pass your own Window
10391
+ DOMPurify.isSupported = false;
10392
+
10393
+ return DOMPurify;
10394
+ }
10395
+
10396
+ var originalDocument = window.document;
10397
+
10398
+ var document = window.document;
10399
+ var DocumentFragment = window.DocumentFragment,
10400
+ HTMLTemplateElement = window.HTMLTemplateElement,
10401
+ Node = window.Node,
10402
+ Element = window.Element,
10403
+ NodeFilter = window.NodeFilter,
10404
+ _window$NamedNodeMap = window.NamedNodeMap,
10405
+ NamedNodeMap = _window$NamedNodeMap === undefined ? window.NamedNodeMap || window.MozNamedAttrMap : _window$NamedNodeMap,
10406
+ Text = window.Text,
10407
+ Comment = window.Comment,
10408
+ DOMParser = window.DOMParser,
10409
+ trustedTypes = window.trustedTypes;
10410
+
10411
+
10412
+ var ElementPrototype = Element.prototype;
10413
+
10414
+ var cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
10415
+ var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
10416
+ var getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
10417
+ var getParentNode = lookupGetter(ElementPrototype, 'parentNode');
10418
+
10419
+ // As per issue #47, the web-components registry is inherited by a
10420
+ // new document created via createHTMLDocument. As per the spec
10421
+ // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
10422
+ // a new empty registry is used when creating a template contents owner
10423
+ // document, so we use that as our parent document to ensure nothing
10424
+ // is inherited.
10425
+ if (typeof HTMLTemplateElement === 'function') {
10426
+ var template = document.createElement('template');
10427
+ if (template.content && template.content.ownerDocument) {
10428
+ document = template.content.ownerDocument;
10429
+ }
10430
+ }
10431
+
10432
+ var trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, originalDocument);
10433
+ var emptyHTML = trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML('') : '';
10434
+
10435
+ var _document = document,
10436
+ implementation = _document.implementation,
10437
+ createNodeIterator = _document.createNodeIterator,
10438
+ createDocumentFragment = _document.createDocumentFragment,
10439
+ getElementsByTagName = _document.getElementsByTagName;
10440
+ var importNode = originalDocument.importNode;
10441
+
10442
+
10443
+ var documentMode = {};
10444
+ try {
10445
+ documentMode = clone(document).documentMode ? document.documentMode : {};
10446
+ } catch (_) {}
10447
+
10448
+ var hooks = {};
10449
+
10450
+ /**
10451
+ * Expose whether this browser supports running the full DOMPurify.
10452
+ */
10453
+ DOMPurify.isSupported = typeof getParentNode === 'function' && implementation && typeof implementation.createHTMLDocument !== 'undefined' && documentMode !== 9;
10454
+
10455
+ var MUSTACHE_EXPR$$1 = MUSTACHE_EXPR,
10456
+ ERB_EXPR$$1 = ERB_EXPR,
10457
+ DATA_ATTR$$1 = DATA_ATTR,
10458
+ ARIA_ATTR$$1 = ARIA_ATTR,
10459
+ IS_SCRIPT_OR_DATA$$1 = IS_SCRIPT_OR_DATA,
10460
+ ATTR_WHITESPACE$$1 = ATTR_WHITESPACE;
10461
+ var IS_ALLOWED_URI$$1 = IS_ALLOWED_URI;
10462
+
10463
+ /**
10464
+ * We consider the elements and attributes below to be safe. Ideally
10465
+ * don't add any new ones but feel free to remove unwanted ones.
10466
+ */
10467
+
10468
+ /* allowed element names */
10469
+
10470
+ var ALLOWED_TAGS = null;
10471
+ var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(html), _toConsumableArray$1(svg), _toConsumableArray$1(svgFilters), _toConsumableArray$1(mathMl), _toConsumableArray$1(text)));
10472
+
10473
+ /* Allowed attribute names */
10474
+ var ALLOWED_ATTR = null;
10475
+ var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(_toConsumableArray$1(html$1), _toConsumableArray$1(svg$1), _toConsumableArray$1(mathMl$1), _toConsumableArray$1(xml)));
10476
+
10477
+ /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
10478
+ var FORBID_TAGS = null;
10479
+
10480
+ /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
10481
+ var FORBID_ATTR = null;
10482
+
10483
+ /* Decide if ARIA attributes are okay */
10484
+ var ALLOW_ARIA_ATTR = true;
10485
+
10486
+ /* Decide if custom data attributes are okay */
10487
+ var ALLOW_DATA_ATTR = true;
10488
+
10489
+ /* Decide if unknown protocols are okay */
10490
+ var ALLOW_UNKNOWN_PROTOCOLS = false;
10491
+
10492
+ /* Output should be safe for common template engines.
10493
+ * This means, DOMPurify removes data attributes, mustaches and ERB
10494
+ */
10495
+ var SAFE_FOR_TEMPLATES = false;
10496
+
10497
+ /* Decide if document with <html>... should be returned */
10498
+ var WHOLE_DOCUMENT = false;
10499
+
10500
+ /* Track whether config is already set on this instance of DOMPurify. */
10501
+ var SET_CONFIG = false;
10502
+
10503
+ /* Decide if all elements (e.g. style, script) must be children of
10504
+ * document.body. By default, browsers might move them to document.head */
10505
+ var FORCE_BODY = false;
10506
+
10507
+ /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
10508
+ * string (or a TrustedHTML object if Trusted Types are supported).
10509
+ * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
10510
+ */
10511
+ var RETURN_DOM = false;
10512
+
10513
+ /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
10514
+ * string (or a TrustedHTML object if Trusted Types are supported) */
10515
+ var RETURN_DOM_FRAGMENT = false;
10516
+
10517
+ /* If `RETURN_DOM` or `RETURN_DOM_FRAGMENT` is enabled, decide if the returned DOM
10518
+ * `Node` is imported into the current `Document`. If this flag is not enabled the
10519
+ * `Node` will belong (its ownerDocument) to a fresh `HTMLDocument`, created by
10520
+ * DOMPurify.
10521
+ *
10522
+ * This defaults to `true` starting DOMPurify 2.2.0. Note that setting it to `false`
10523
+ * might cause XSS from attacks hidden in closed shadowroots in case the browser
10524
+ * supports Declarative Shadow: DOM https://web.dev/declarative-shadow-dom/
10525
+ */
10526
+ var RETURN_DOM_IMPORT = true;
10527
+
10528
+ /* Try to return a Trusted Type object instead of a string, return a string in
10529
+ * case Trusted Types are not supported */
10530
+ var RETURN_TRUSTED_TYPE = false;
10531
+
10532
+ /* Output should be free from DOM clobbering attacks? */
10533
+ var SANITIZE_DOM = true;
10534
+
10535
+ /* Keep element content when removing element? */
10536
+ var KEEP_CONTENT = true;
10537
+
10538
+ /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
10539
+ * of importing it into a new Document and returning a sanitized copy */
10540
+ var IN_PLACE = false;
10541
+
10542
+ /* Allow usage of profiles like html, svg and mathMl */
10543
+ var USE_PROFILES = {};
10544
+
10545
+ /* Tags to ignore content of when KEEP_CONTENT is true */
10546
+ var FORBID_CONTENTS = null;
10547
+ var DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
10548
+
10549
+ /* Tags that are safe for data: URIs */
10550
+ var DATA_URI_TAGS = null;
10551
+ var DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
10552
+
10553
+ /* Attributes safe for values like "javascript:" */
10554
+ var URI_SAFE_ATTRIBUTES = null;
10555
+ var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
10556
+
10557
+ var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
10558
+ var SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
10559
+ var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
10560
+ /* Document namespace */
10561
+ var NAMESPACE = HTML_NAMESPACE;
10562
+ var IS_EMPTY_INPUT = false;
10563
+
10564
+ /* Parsing of strict XHTML documents */
10565
+ var PARSER_MEDIA_TYPE = void 0;
10566
+ var SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
10567
+ var DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
10568
+ var transformCaseFunc = void 0;
10569
+
10570
+ /* Keep a reference to config to pass to hooks */
10571
+ var CONFIG = null;
10572
+
10573
+ /* Ideally, do not touch anything below this line */
10574
+ /* ______________________________________________ */
10575
+
10576
+ var formElement = document.createElement('form');
10577
+
10578
+ /**
10579
+ * _parseConfig
10580
+ *
10581
+ * @param {Object} cfg optional config literal
10582
+ */
10583
+ // eslint-disable-next-line complexity
10584
+ var _parseConfig = function _parseConfig(cfg) {
10585
+ if (CONFIG && CONFIG === cfg) {
10586
+ return;
10587
+ }
10588
+
10589
+ /* Shield configuration object from tampering */
10590
+ if (!cfg || (typeof cfg === 'undefined' ? 'undefined' : _typeof(cfg)) !== 'object') {
10591
+ cfg = {};
10592
+ }
10593
+
10594
+ /* Shield configuration object from prototype pollution */
10595
+ cfg = clone(cfg);
10596
+
10597
+ /* Set configuration parameters */
10598
+ ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS) : DEFAULT_ALLOWED_TAGS;
10599
+ ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR) : DEFAULT_ALLOWED_ATTR;
10600
+ URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR) : DEFAULT_URI_SAFE_ATTRIBUTES;
10601
+ DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS) : DEFAULT_DATA_URI_TAGS;
10602
+ FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS) : DEFAULT_FORBID_CONTENTS;
10603
+ FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS) : {};
10604
+ FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR) : {};
10605
+ USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
10606
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
10607
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
10608
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
10609
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
10610
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
10611
+ RETURN_DOM = cfg.RETURN_DOM || false; // Default false
10612
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
10613
+ RETURN_DOM_IMPORT = cfg.RETURN_DOM_IMPORT !== false; // Default true
10614
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
10615
+ FORCE_BODY = cfg.FORCE_BODY || false; // Default false
10616
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
10617
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
10618
+ IN_PLACE = cfg.IN_PLACE || false; // Default false
10619
+ IS_ALLOWED_URI$$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$$1;
10620
+ NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
10621
+
10622
+ PARSER_MEDIA_TYPE =
10623
+ // eslint-disable-next-line unicorn/prefer-includes
10624
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE;
10625
+
10626
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
10627
+ transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? function (x) {
10628
+ return x;
10629
+ } : stringToLowerCase;
10630
+
10631
+ if (SAFE_FOR_TEMPLATES) {
10632
+ ALLOW_DATA_ATTR = false;
10633
+ }
10634
+
10635
+ if (RETURN_DOM_FRAGMENT) {
10636
+ RETURN_DOM = true;
10637
+ }
10638
+
10639
+ /* Parse profile info */
10640
+ if (USE_PROFILES) {
10641
+ ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(text)));
10642
+ ALLOWED_ATTR = [];
10643
+ if (USE_PROFILES.html === true) {
10644
+ addToSet(ALLOWED_TAGS, html);
10645
+ addToSet(ALLOWED_ATTR, html$1);
10646
+ }
10647
+
10648
+ if (USE_PROFILES.svg === true) {
10649
+ addToSet(ALLOWED_TAGS, svg);
10650
+ addToSet(ALLOWED_ATTR, svg$1);
10651
+ addToSet(ALLOWED_ATTR, xml);
10652
+ }
10653
+
10654
+ if (USE_PROFILES.svgFilters === true) {
10655
+ addToSet(ALLOWED_TAGS, svgFilters);
10656
+ addToSet(ALLOWED_ATTR, svg$1);
10657
+ addToSet(ALLOWED_ATTR, xml);
10658
+ }
10659
+
10660
+ if (USE_PROFILES.mathMl === true) {
10661
+ addToSet(ALLOWED_TAGS, mathMl);
10662
+ addToSet(ALLOWED_ATTR, mathMl$1);
10663
+ addToSet(ALLOWED_ATTR, xml);
10664
+ }
10665
+ }
10666
+
10667
+ /* Merge configuration parameters */
10668
+ if (cfg.ADD_TAGS) {
10669
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
10670
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
10671
+ }
10672
+
10673
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS);
10674
+ }
10675
+
10676
+ if (cfg.ADD_ATTR) {
10677
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
10678
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
10679
+ }
10680
+
10681
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR);
10682
+ }
10683
+
10684
+ if (cfg.ADD_URI_SAFE_ATTR) {
10685
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR);
10686
+ }
10687
+
10688
+ if (cfg.FORBID_CONTENTS) {
10689
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
10690
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
10691
+ }
10692
+
10693
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS);
10694
+ }
10695
+
10696
+ /* Add #text in case KEEP_CONTENT is set to true */
10697
+ if (KEEP_CONTENT) {
10698
+ ALLOWED_TAGS['#text'] = true;
10699
+ }
10700
+
10701
+ /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
10702
+ if (WHOLE_DOCUMENT) {
10703
+ addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
10704
+ }
10705
+
10706
+ /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
10707
+ if (ALLOWED_TAGS.table) {
10708
+ addToSet(ALLOWED_TAGS, ['tbody']);
10709
+ delete FORBID_TAGS.tbody;
10710
+ }
10711
+
10712
+ // Prevent further manipulation of configuration.
10713
+ // Not available in IE8, Safari 5, etc.
10714
+ if (freeze) {
10715
+ freeze(cfg);
10716
+ }
10717
+
10718
+ CONFIG = cfg;
10719
+ };
10720
+
10721
+ var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
10722
+
10723
+ var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']);
10724
+
10725
+ /* Keep track of all possible SVG and MathML tags
10726
+ * so that we can perform the namespace checks
10727
+ * correctly. */
10728
+ var ALL_SVG_TAGS = addToSet({}, svg);
10729
+ addToSet(ALL_SVG_TAGS, svgFilters);
10730
+ addToSet(ALL_SVG_TAGS, svgDisallowed);
10731
+
10732
+ var ALL_MATHML_TAGS = addToSet({}, mathMl);
10733
+ addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
10734
+
10735
+ /**
10736
+ *
10737
+ *
10738
+ * @param {Element} element a DOM element whose namespace is being checked
10739
+ * @returns {boolean} Return false if the element has a
10740
+ * namespace that a spec-compliant parser would never
10741
+ * return. Return true otherwise.
10742
+ */
10743
+ var _checkValidNamespace = function _checkValidNamespace(element) {
10744
+ var parent = getParentNode(element);
10745
+
10746
+ // In JSDOM, if we're inside shadow DOM, then parentNode
10747
+ // can be null. We just simulate parent in this case.
10748
+ if (!parent || !parent.tagName) {
10749
+ parent = {
10750
+ namespaceURI: HTML_NAMESPACE,
10751
+ tagName: 'template'
10752
+ };
10753
+ }
10754
+
10755
+ var tagName = stringToLowerCase(element.tagName);
10756
+ var parentTagName = stringToLowerCase(parent.tagName);
10757
+
10758
+ if (element.namespaceURI === SVG_NAMESPACE) {
10759
+ // The only way to switch from HTML namespace to SVG
10760
+ // is via <svg>. If it happens via any other tag, then
10761
+ // it should be killed.
10762
+ if (parent.namespaceURI === HTML_NAMESPACE) {
10763
+ return tagName === 'svg';
10764
+ }
10765
+
10766
+ // The only way to switch from MathML to SVG is via
10767
+ // svg if parent is either <annotation-xml> or MathML
10768
+ // text integration points.
10769
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
10770
+ return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
10771
+ }
10772
+
10773
+ // We only allow elements that are defined in SVG
10774
+ // spec. All others are disallowed in SVG namespace.
10775
+ return Boolean(ALL_SVG_TAGS[tagName]);
10776
+ }
10777
+
10778
+ if (element.namespaceURI === MATHML_NAMESPACE) {
10779
+ // The only way to switch from HTML namespace to MathML
10780
+ // is via <math>. If it happens via any other tag, then
10781
+ // it should be killed.
10782
+ if (parent.namespaceURI === HTML_NAMESPACE) {
10783
+ return tagName === 'math';
10784
+ }
10785
+
10786
+ // The only way to switch from SVG to MathML is via
10787
+ // <math> and HTML integration points
10788
+ if (parent.namespaceURI === SVG_NAMESPACE) {
10789
+ return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
10790
+ }
10791
+
10792
+ // We only allow elements that are defined in MathML
10793
+ // spec. All others are disallowed in MathML namespace.
10794
+ return Boolean(ALL_MATHML_TAGS[tagName]);
10795
+ }
10796
+
10797
+ if (element.namespaceURI === HTML_NAMESPACE) {
10798
+ // The only way to switch from SVG to HTML is via
10799
+ // HTML integration points, and from MathML to HTML
10800
+ // is via MathML text integration points
10801
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
10802
+ return false;
10803
+ }
10804
+
10805
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
10806
+ return false;
10807
+ }
10808
+
10809
+ // Certain elements are allowed in both SVG and HTML
10810
+ // namespace. We need to specify them explicitly
10811
+ // so that they don't get erronously deleted from
10812
+ // HTML namespace.
10813
+ var commonSvgAndHTMLElements = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
10814
+
10815
+ // We disallow tags that are specific for MathML
10816
+ // or SVG and should never appear in HTML namespace
10817
+ return !ALL_MATHML_TAGS[tagName] && (commonSvgAndHTMLElements[tagName] || !ALL_SVG_TAGS[tagName]);
10818
+ }
10819
+
10820
+ // The code should never reach this place (this means
10821
+ // that the element somehow got namespace that is not
10822
+ // HTML, SVG or MathML). Return false just in case.
10823
+ return false;
10824
+ };
10825
+
10826
+ /**
10827
+ * _forceRemove
10828
+ *
10829
+ * @param {Node} node a DOM node
10830
+ */
10831
+ var _forceRemove = function _forceRemove(node) {
10832
+ arrayPush(DOMPurify.removed, { element: node });
10833
+ try {
10834
+ // eslint-disable-next-line unicorn/prefer-dom-node-remove
10835
+ node.parentNode.removeChild(node);
10836
+ } catch (_) {
10837
+ try {
10838
+ node.outerHTML = emptyHTML;
10839
+ } catch (_) {
10840
+ node.remove();
10841
+ }
10842
+ }
10843
+ };
10844
+
10845
+ /**
10846
+ * _removeAttribute
10847
+ *
10848
+ * @param {String} name an Attribute name
10849
+ * @param {Node} node a DOM node
10850
+ */
10851
+ var _removeAttribute = function _removeAttribute(name, node) {
10852
+ try {
10853
+ arrayPush(DOMPurify.removed, {
10854
+ attribute: node.getAttributeNode(name),
10855
+ from: node
10856
+ });
10857
+ } catch (_) {
10858
+ arrayPush(DOMPurify.removed, {
10859
+ attribute: null,
10860
+ from: node
10861
+ });
10862
+ }
10863
+
10864
+ node.removeAttribute(name);
10865
+
10866
+ // We void attribute values for unremovable "is"" attributes
10867
+ if (name === 'is' && !ALLOWED_ATTR[name]) {
10868
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
10869
+ try {
10870
+ _forceRemove(node);
10871
+ } catch (_) {}
10872
+ } else {
10873
+ try {
10874
+ node.setAttribute(name, '');
10875
+ } catch (_) {}
10876
+ }
10877
+ }
10878
+ };
10879
+
10880
+ /**
10881
+ * _initDocument
10882
+ *
10883
+ * @param {String} dirty a string of dirty markup
10884
+ * @return {Document} a DOM, filled with the dirty markup
10885
+ */
10886
+ var _initDocument = function _initDocument(dirty) {
10887
+ /* Create a HTML document */
10888
+ var doc = void 0;
10889
+ var leadingWhitespace = void 0;
10890
+
10891
+ if (FORCE_BODY) {
10892
+ dirty = '<remove></remove>' + dirty;
10893
+ } else {
10894
+ /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
10895
+ var matches = stringMatch(dirty, /^[\r\n\t ]+/);
10896
+ leadingWhitespace = matches && matches[0];
10897
+ }
10898
+
10899
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml') {
10900
+ // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
10901
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
10902
+ }
10903
+
10904
+ var dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
10905
+ /*
10906
+ * Use the DOMParser API by default, fallback later if needs be
10907
+ * DOMParser not work for svg when has multiple root element.
10908
+ */
10909
+ if (NAMESPACE === HTML_NAMESPACE) {
10910
+ try {
10911
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
10912
+ } catch (_) {}
10913
+ }
10914
+
10915
+ /* Use createHTMLDocument in case DOMParser is not available */
10916
+ if (!doc || !doc.documentElement) {
10917
+ doc = implementation.createDocument(NAMESPACE, 'template', null);
10918
+ try {
10919
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload;
10920
+ } catch (_) {
10921
+ // Syntax error if dirtyPayload is invalid xml
10922
+ }
10923
+ }
10924
+
10925
+ var body = doc.body || doc.documentElement;
10926
+
10927
+ if (dirty && leadingWhitespace) {
10928
+ body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
10929
+ }
10930
+
10931
+ /* Work on whole document or just its body */
10932
+ if (NAMESPACE === HTML_NAMESPACE) {
10933
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
10934
+ }
10935
+
10936
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
10937
+ };
10938
+
10939
+ /**
10940
+ * _createIterator
10941
+ *
10942
+ * @param {Document} root document/fragment to create iterator for
10943
+ * @return {Iterator} iterator instance
10944
+ */
10945
+ var _createIterator = function _createIterator(root) {
10946
+ return createNodeIterator.call(root.ownerDocument || root, root, NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
10947
+ };
10948
+
10949
+ /**
10950
+ * _isClobbered
10951
+ *
10952
+ * @param {Node} elm element to check for clobbering attacks
10953
+ * @return {Boolean} true if clobbered, false if safe
10954
+ */
10955
+ var _isClobbered = function _isClobbered(elm) {
10956
+ if (elm instanceof Text || elm instanceof Comment) {
10957
+ return false;
10958
+ }
10959
+
10960
+ if (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function') {
10961
+ return true;
10962
+ }
10963
+
10964
+ return false;
10965
+ };
10966
+
10967
+ /**
10968
+ * _isNode
10969
+ *
10970
+ * @param {Node} obj object to check whether it's a DOM node
10971
+ * @return {Boolean} true is object is a DOM node
10972
+ */
10973
+ var _isNode = function _isNode(object) {
10974
+ return (typeof Node === 'undefined' ? 'undefined' : _typeof(Node)) === 'object' ? object instanceof Node : object && (typeof object === 'undefined' ? 'undefined' : _typeof(object)) === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
10975
+ };
10976
+
10977
+ /**
10978
+ * _executeHook
10979
+ * Execute user configurable hooks
10980
+ *
10981
+ * @param {String} entryPoint Name of the hook's entry point
10982
+ * @param {Node} currentNode node to work on with the hook
10983
+ * @param {Object} data additional hook parameters
10984
+ */
10985
+ var _executeHook = function _executeHook(entryPoint, currentNode, data) {
10986
+ if (!hooks[entryPoint]) {
10987
+ return;
10988
+ }
10989
+
10990
+ arrayForEach(hooks[entryPoint], function (hook) {
10991
+ hook.call(DOMPurify, currentNode, data, CONFIG);
10992
+ });
10993
+ };
10994
+
10995
+ /**
10996
+ * _sanitizeElements
10997
+ *
10998
+ * @protect nodeName
10999
+ * @protect textContent
11000
+ * @protect removeChild
11001
+ *
11002
+ * @param {Node} currentNode to check for permission to exist
11003
+ * @return {Boolean} true if node was killed, false if left alive
11004
+ */
11005
+ var _sanitizeElements = function _sanitizeElements(currentNode) {
11006
+ var content = void 0;
11007
+
11008
+ /* Execute a hook if present */
11009
+ _executeHook('beforeSanitizeElements', currentNode, null);
11010
+
11011
+ /* Check if element is clobbered or can clobber */
11012
+ if (_isClobbered(currentNode)) {
11013
+ _forceRemove(currentNode);
11014
+ return true;
11015
+ }
11016
+
11017
+ /* Check if tagname contains Unicode */
11018
+ if (stringMatch(currentNode.nodeName, /[\u0080-\uFFFF]/)) {
11019
+ _forceRemove(currentNode);
11020
+ return true;
11021
+ }
11022
+
11023
+ /* Now let's check the element's type and name */
11024
+ var tagName = transformCaseFunc(currentNode.nodeName);
11025
+
11026
+ /* Execute a hook if present */
11027
+ _executeHook('uponSanitizeElement', currentNode, {
11028
+ tagName: tagName,
11029
+ allowedTags: ALLOWED_TAGS
11030
+ });
11031
+
11032
+ /* Detect mXSS attempts abusing namespace confusion */
11033
+ if (!_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
11034
+ _forceRemove(currentNode);
11035
+ return true;
11036
+ }
11037
+
11038
+ /* Mitigate a problem with templates inside select */
11039
+ if (tagName === 'select' && regExpTest(/<template/i, currentNode.innerHTML)) {
11040
+ _forceRemove(currentNode);
11041
+ return true;
11042
+ }
11043
+
11044
+ /* Remove element if anything forbids its presence */
11045
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
11046
+ /* Keep content except for bad-listed elements */
11047
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
11048
+ var parentNode = getParentNode(currentNode) || currentNode.parentNode;
11049
+ var childNodes = getChildNodes(currentNode) || currentNode.childNodes;
11050
+
11051
+ if (childNodes && parentNode) {
11052
+ var childCount = childNodes.length;
11053
+
11054
+ for (var i = childCount - 1; i >= 0; --i) {
11055
+ parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
11056
+ }
11057
+ }
11058
+ }
11059
+
11060
+ _forceRemove(currentNode);
11061
+ return true;
11062
+ }
11063
+
11064
+ /* Check whether element has a valid namespace */
11065
+ if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
11066
+ _forceRemove(currentNode);
11067
+ return true;
11068
+ }
11069
+
11070
+ if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
11071
+ _forceRemove(currentNode);
11072
+ return true;
11073
+ }
11074
+
11075
+ /* Sanitize element content to be template-safe */
11076
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
11077
+ /* Get the element's text content */
11078
+ content = currentNode.textContent;
11079
+ content = stringReplace(content, MUSTACHE_EXPR$$1, ' ');
11080
+ content = stringReplace(content, ERB_EXPR$$1, ' ');
11081
+ if (currentNode.textContent !== content) {
11082
+ arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });
11083
+ currentNode.textContent = content;
11084
+ }
11085
+ }
11086
+
11087
+ /* Execute a hook if present */
11088
+ _executeHook('afterSanitizeElements', currentNode, null);
11089
+
11090
+ return false;
11091
+ };
11092
+
11093
+ /**
11094
+ * _isValidAttribute
11095
+ *
11096
+ * @param {string} lcTag Lowercase tag name of containing element.
11097
+ * @param {string} lcName Lowercase attribute name.
11098
+ * @param {string} value Attribute value.
11099
+ * @return {Boolean} Returns true if `value` is valid, otherwise false.
11100
+ */
11101
+ // eslint-disable-next-line complexity
11102
+ var _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
11103
+ /* Make sure attribute cannot clobber */
11104
+ if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
11105
+ return false;
11106
+ }
11107
+
11108
+ /* Allow valid data-* attributes: At least one character after "-"
11109
+ (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
11110
+ XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
11111
+ We don't need to check the value; it's always URI safe. */
11112
+ if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$$1, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$$1, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
11113
+ return false;
11114
+
11115
+ /* Check value is safe. First, is attr inert? If so, is safe */
11116
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$$1, stringReplace(value, ATTR_WHITESPACE$$1, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$$1, stringReplace(value, ATTR_WHITESPACE$$1, ''))) ; else if (!value) ; else {
11117
+ return false;
11118
+ }
11119
+
11120
+ return true;
11121
+ };
11122
+
11123
+ /**
11124
+ * _sanitizeAttributes
11125
+ *
11126
+ * @protect attributes
11127
+ * @protect nodeName
11128
+ * @protect removeAttribute
11129
+ * @protect setAttribute
11130
+ *
11131
+ * @param {Node} currentNode to sanitize
11132
+ */
11133
+ var _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
11134
+ var attr = void 0;
11135
+ var value = void 0;
11136
+ var lcName = void 0;
11137
+ var l = void 0;
11138
+ /* Execute a hook if present */
11139
+ _executeHook('beforeSanitizeAttributes', currentNode, null);
11140
+
11141
+ var attributes = currentNode.attributes;
11142
+
11143
+ /* Check if we have attributes; if not we might have a text node */
11144
+
11145
+ if (!attributes) {
11146
+ return;
11147
+ }
11148
+
11149
+ var hookEvent = {
11150
+ attrName: '',
11151
+ attrValue: '',
11152
+ keepAttr: true,
11153
+ allowedAttributes: ALLOWED_ATTR
11154
+ };
11155
+ l = attributes.length;
11156
+
11157
+ /* Go backwards over all attributes; safely remove bad ones */
11158
+ while (l--) {
11159
+ attr = attributes[l];
11160
+ var _attr = attr,
11161
+ name = _attr.name,
11162
+ namespaceURI = _attr.namespaceURI;
11163
+
11164
+ value = stringTrim(attr.value);
11165
+ lcName = transformCaseFunc(name);
11166
+
11167
+ /* Execute a hook if present */
11168
+ hookEvent.attrName = lcName;
11169
+ hookEvent.attrValue = value;
11170
+ hookEvent.keepAttr = true;
11171
+ hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
11172
+ _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
11173
+ value = hookEvent.attrValue;
11174
+ /* Did the hooks approve of the attribute? */
11175
+ if (hookEvent.forceKeepAttr) {
11176
+ continue;
11177
+ }
11178
+
11179
+ /* Remove attribute */
11180
+ _removeAttribute(name, currentNode);
11181
+
11182
+ /* Did the hooks approve of the attribute? */
11183
+ if (!hookEvent.keepAttr) {
11184
+ continue;
11185
+ }
11186
+
11187
+ /* Work around a security issue in jQuery 3.0 */
11188
+ if (regExpTest(/\/>/i, value)) {
11189
+ _removeAttribute(name, currentNode);
11190
+ continue;
11191
+ }
11192
+
11193
+ /* Sanitize attribute content to be template-safe */
11194
+ if (SAFE_FOR_TEMPLATES) {
11195
+ value = stringReplace(value, MUSTACHE_EXPR$$1, ' ');
11196
+ value = stringReplace(value, ERB_EXPR$$1, ' ');
11197
+ }
11198
+
11199
+ /* Is `value` valid for this attribute? */
11200
+ var lcTag = transformCaseFunc(currentNode.nodeName);
11201
+ if (!_isValidAttribute(lcTag, lcName, value)) {
11202
+ continue;
11203
+ }
11204
+
11205
+ /* Handle invalid data-* attribute set by try-catching it */
11206
+ try {
11207
+ if (namespaceURI) {
11208
+ currentNode.setAttributeNS(namespaceURI, name, value);
11209
+ } else {
11210
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
11211
+ currentNode.setAttribute(name, value);
11212
+ }
11213
+
11214
+ arrayPop(DOMPurify.removed);
11215
+ } catch (_) {}
11216
+ }
11217
+
11218
+ /* Execute a hook if present */
11219
+ _executeHook('afterSanitizeAttributes', currentNode, null);
11220
+ };
11221
+
11222
+ /**
11223
+ * _sanitizeShadowDOM
11224
+ *
11225
+ * @param {DocumentFragment} fragment to iterate over recursively
11226
+ */
11227
+ var _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
11228
+ var shadowNode = void 0;
11229
+ var shadowIterator = _createIterator(fragment);
11230
+
11231
+ /* Execute a hook if present */
11232
+ _executeHook('beforeSanitizeShadowDOM', fragment, null);
11233
+
11234
+ while (shadowNode = shadowIterator.nextNode()) {
11235
+ /* Execute a hook if present */
11236
+ _executeHook('uponSanitizeShadowNode', shadowNode, null);
11237
+
11238
+ /* Sanitize tags and elements */
11239
+ if (_sanitizeElements(shadowNode)) {
11240
+ continue;
11241
+ }
11242
+
11243
+ /* Deep shadow DOM detected */
11244
+ if (shadowNode.content instanceof DocumentFragment) {
11245
+ _sanitizeShadowDOM(shadowNode.content);
11246
+ }
11247
+
11248
+ /* Check attributes, sanitize if necessary */
11249
+ _sanitizeAttributes(shadowNode);
11250
+ }
11251
+
11252
+ /* Execute a hook if present */
11253
+ _executeHook('afterSanitizeShadowDOM', fragment, null);
11254
+ };
11255
+
11256
+ /**
11257
+ * Sanitize
11258
+ * Public method providing core sanitation functionality
11259
+ *
11260
+ * @param {String|Node} dirty string or DOM node
11261
+ * @param {Object} configuration object
11262
+ */
11263
+ // eslint-disable-next-line complexity
11264
+ DOMPurify.sanitize = function (dirty, cfg) {
11265
+ var body = void 0;
11266
+ var importedNode = void 0;
11267
+ var currentNode = void 0;
11268
+ var oldNode = void 0;
11269
+ var returnNode = void 0;
11270
+ /* Make sure we have a string to sanitize.
11271
+ DO NOT return early, as this will return the wrong type if
11272
+ the user has requested a DOM object rather than a string */
11273
+ IS_EMPTY_INPUT = !dirty;
11274
+ if (IS_EMPTY_INPUT) {
11275
+ dirty = '<!-->';
11276
+ }
11277
+
11278
+ /* Stringify, in case dirty is an object */
11279
+ if (typeof dirty !== 'string' && !_isNode(dirty)) {
11280
+ // eslint-disable-next-line no-negated-condition
11281
+ if (typeof dirty.toString !== 'function') {
11282
+ throw typeErrorCreate('toString is not a function');
11283
+ } else {
11284
+ dirty = dirty.toString();
11285
+ if (typeof dirty !== 'string') {
11286
+ throw typeErrorCreate('dirty is not a string, aborting');
11287
+ }
11288
+ }
11289
+ }
11290
+
11291
+ /* Check we can run. Otherwise fall back or ignore */
11292
+ if (!DOMPurify.isSupported) {
11293
+ if (_typeof(window.toStaticHTML) === 'object' || typeof window.toStaticHTML === 'function') {
11294
+ if (typeof dirty === 'string') {
11295
+ return window.toStaticHTML(dirty);
11296
+ }
11297
+
11298
+ if (_isNode(dirty)) {
11299
+ return window.toStaticHTML(dirty.outerHTML);
11300
+ }
11301
+ }
11302
+
11303
+ return dirty;
11304
+ }
11305
+
11306
+ /* Assign config vars */
11307
+ if (!SET_CONFIG) {
11308
+ _parseConfig(cfg);
11309
+ }
11310
+
11311
+ /* Clean up removed elements */
11312
+ DOMPurify.removed = [];
11313
+
11314
+ /* Check if dirty is correctly typed for IN_PLACE */
11315
+ if (typeof dirty === 'string') {
11316
+ IN_PLACE = false;
11317
+ }
11318
+
11319
+ if (IN_PLACE) ; else if (dirty instanceof Node) {
11320
+ /* If dirty is a DOM element, append to an empty document to avoid
11321
+ elements being stripped by the parser */
11322
+ body = _initDocument('<!---->');
11323
+ importedNode = body.ownerDocument.importNode(dirty, true);
11324
+ if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
11325
+ /* Node is already a body, use as is */
11326
+ body = importedNode;
11327
+ } else if (importedNode.nodeName === 'HTML') {
11328
+ body = importedNode;
11329
+ } else {
11330
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
11331
+ body.appendChild(importedNode);
11332
+ }
11333
+ } else {
11334
+ /* Exit directly if we have nothing to do */
11335
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
11336
+ // eslint-disable-next-line unicorn/prefer-includes
11337
+ dirty.indexOf('<') === -1) {
11338
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
11339
+ }
11340
+
11341
+ /* Initialize the document to work on */
11342
+ body = _initDocument(dirty);
11343
+
11344
+ /* Check we have a DOM node from the data */
11345
+ if (!body) {
11346
+ return RETURN_DOM ? null : emptyHTML;
11347
+ }
11348
+ }
11349
+
11350
+ /* Remove first element node (ours) if FORCE_BODY is set */
11351
+ if (body && FORCE_BODY) {
11352
+ _forceRemove(body.firstChild);
11353
+ }
11354
+
11355
+ /* Get node iterator */
11356
+ var nodeIterator = _createIterator(IN_PLACE ? dirty : body);
11357
+
11358
+ /* Now start iterating over the created document */
11359
+ while (currentNode = nodeIterator.nextNode()) {
11360
+ /* Fix IE's strange behavior with manipulated textNodes #89 */
11361
+ if (currentNode.nodeType === 3 && currentNode === oldNode) {
11362
+ continue;
11363
+ }
11364
+
11365
+ /* Sanitize tags and elements */
11366
+ if (_sanitizeElements(currentNode)) {
11367
+ continue;
11368
+ }
11369
+
11370
+ /* Shadow DOM detected, sanitize it */
11371
+ if (currentNode.content instanceof DocumentFragment) {
11372
+ _sanitizeShadowDOM(currentNode.content);
11373
+ }
11374
+
11375
+ /* Check attributes, sanitize if necessary */
11376
+ _sanitizeAttributes(currentNode);
11377
+
11378
+ oldNode = currentNode;
11379
+ }
11380
+
11381
+ oldNode = null;
11382
+
11383
+ /* If we sanitized `dirty` in-place, return it. */
11384
+ if (IN_PLACE) {
11385
+ return dirty;
11386
+ }
11387
+
11388
+ /* Return sanitized string or DOM */
11389
+ if (RETURN_DOM) {
11390
+ if (RETURN_DOM_FRAGMENT) {
11391
+ returnNode = createDocumentFragment.call(body.ownerDocument);
11392
+
11393
+ while (body.firstChild) {
11394
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
11395
+ returnNode.appendChild(body.firstChild);
11396
+ }
11397
+ } else {
11398
+ returnNode = body;
11399
+ }
11400
+
11401
+ if (RETURN_DOM_IMPORT) {
11402
+ /*
11403
+ AdoptNode() is not used because internal state is not reset
11404
+ (e.g. the past names map of a HTMLFormElement), this is safe
11405
+ in theory but we would rather not risk another attack vector.
11406
+ The state that is cloned by importNode() is explicitly defined
11407
+ by the specs.
11408
+ */
11409
+ returnNode = importNode.call(originalDocument, returnNode, true);
11410
+ }
11411
+
11412
+ return returnNode;
11413
+ }
11414
+
11415
+ var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
11416
+
11417
+ /* Sanitize final string template-safe */
11418
+ if (SAFE_FOR_TEMPLATES) {
11419
+ serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR$$1, ' ');
11420
+ serializedHTML = stringReplace(serializedHTML, ERB_EXPR$$1, ' ');
11421
+ }
11422
+
11423
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
11424
+ };
11425
+
11426
+ /**
11427
+ * Public method to set the configuration once
11428
+ * setConfig
11429
+ *
11430
+ * @param {Object} cfg configuration object
11431
+ */
11432
+ DOMPurify.setConfig = function (cfg) {
11433
+ _parseConfig(cfg);
11434
+ SET_CONFIG = true;
11435
+ };
11436
+
11437
+ /**
11438
+ * Public method to remove the configuration
11439
+ * clearConfig
11440
+ *
11441
+ */
11442
+ DOMPurify.clearConfig = function () {
11443
+ CONFIG = null;
11444
+ SET_CONFIG = false;
11445
+ };
11446
+
11447
+ /**
11448
+ * Public method to check if an attribute value is valid.
11449
+ * Uses last set config, if any. Otherwise, uses config defaults.
11450
+ * isValidAttribute
11451
+ *
11452
+ * @param {string} tag Tag name of containing element.
11453
+ * @param {string} attr Attribute name.
11454
+ * @param {string} value Attribute value.
11455
+ * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
11456
+ */
11457
+ DOMPurify.isValidAttribute = function (tag, attr, value) {
11458
+ /* Initialize shared config vars if necessary. */
11459
+ if (!CONFIG) {
11460
+ _parseConfig({});
11461
+ }
11462
+
11463
+ var lcTag = transformCaseFunc(tag);
11464
+ var lcName = transformCaseFunc(attr);
11465
+ return _isValidAttribute(lcTag, lcName, value);
11466
+ };
11467
+
11468
+ /**
11469
+ * AddHook
11470
+ * Public method to add DOMPurify hooks
11471
+ *
11472
+ * @param {String} entryPoint entry point for the hook to add
11473
+ * @param {Function} hookFunction function to execute
11474
+ */
11475
+ DOMPurify.addHook = function (entryPoint, hookFunction) {
11476
+ if (typeof hookFunction !== 'function') {
11477
+ return;
11478
+ }
11479
+
11480
+ hooks[entryPoint] = hooks[entryPoint] || [];
11481
+ arrayPush(hooks[entryPoint], hookFunction);
11482
+ };
11483
+
11484
+ /**
11485
+ * RemoveHook
11486
+ * Public method to remove a DOMPurify hook at a given entryPoint
11487
+ * (pops it from the stack of hooks if more are present)
11488
+ *
11489
+ * @param {String} entryPoint entry point for the hook to remove
11490
+ */
11491
+ DOMPurify.removeHook = function (entryPoint) {
11492
+ if (hooks[entryPoint]) {
11493
+ arrayPop(hooks[entryPoint]);
11494
+ }
11495
+ };
11496
+
11497
+ /**
11498
+ * RemoveHooks
11499
+ * Public method to remove all DOMPurify hooks at a given entryPoint
11500
+ *
11501
+ * @param {String} entryPoint entry point for the hooks to remove
11502
+ */
11503
+ DOMPurify.removeHooks = function (entryPoint) {
11504
+ if (hooks[entryPoint]) {
11505
+ hooks[entryPoint] = [];
11506
+ }
11507
+ };
11508
+
11509
+ /**
11510
+ * RemoveAllHooks
11511
+ * Public method to remove all DOMPurify hooks
11512
+ *
11513
+ */
11514
+ DOMPurify.removeAllHooks = function () {
11515
+ hooks = {};
11516
+ };
11517
+
11518
+ return DOMPurify;
11519
+ }
11520
+
11521
+ var purify = createDOMPurify();
11522
+
11523
+ var CAN_BE_WHITE_TAG_LIST = ['iframe', 'embed'];
11524
+ var whiteTagList = [];
11525
+ function registerTagWhitelistIfPossible(tagName) {
11526
+ if (includes(CAN_BE_WHITE_TAG_LIST, tagName)) {
11527
+ whiteTagList.push(tagName.toLowerCase());
11528
+ }
11529
+ }
11530
+ function sanitizeHTML(html, options) {
11531
+ return purify.sanitize(html, __assign$1({ ADD_TAGS: whiteTagList, ADD_ATTR: ['rel', 'target', 'hreflang', 'type'], FORBID_TAGS: [
11532
+ 'input',
11533
+ 'script',
11534
+ 'textarea',
11535
+ 'form',
11536
+ 'button',
11537
+ 'select',
11538
+ 'meta',
11539
+ 'style',
11540
+ 'link',
11541
+ 'title',
11542
+ 'object',
11543
+ 'base',
11544
+ ] }, options));
11545
+ }
11546
+
11547
+ function getChildrenHTML(node, typeName) {
11548
+ return node
11549
+ .literal.replace(new RegExp("(<\\s*" + typeName + "[^>]+?>)|(</" + typeName + "\\s*[>])", 'ig'), '')
11550
+ .trim();
11551
+ }
11552
+ function getHTMLAttrsByHTMLString(html) {
11553
+ html = html.match(reHTMLTag)[0];
11554
+ var attrs = html.match(new RegExp(ATTRIBUTE, 'g'));
11555
+ return attrs
11556
+ ? attrs.reduce(function (acc, attr) {
11557
+ var _a = attr.trim().split('='), name = _a[0], values = _a.slice(1);
11558
+ if (values.length) {
11559
+ acc[name] = values.join('=').replace(/'|"/g, '').trim();
11560
+ }
11561
+ return acc;
11562
+ }, {})
11563
+ : {};
11564
+ }
11565
+
11566
+ var reCloseTag = /^\s*<\s*\//;
11567
+ var baseConvertors = {
11568
+ paragraph: function (_, _a) {
11569
+ var entering = _a.entering, origin = _a.origin, options = _a.options;
11570
+ if (options.nodeId) {
11571
+ return {
11572
+ type: entering ? 'openTag' : 'closeTag',
11573
+ outerNewLine: true,
11574
+ tagName: 'p',
11575
+ };
11576
+ }
11577
+ return origin();
11578
+ },
11579
+ softbreak: function (node) {
11580
+ var isPrevNodeHTML = node.prev && node.prev.type === 'htmlInline';
11581
+ var isPrevBR = isPrevNodeHTML && /<br ?\/?>/.test(node.prev.literal);
11582
+ var content = isPrevBR ? '\n' : '<br>\n';
11583
+ return { type: 'html', content: content };
11584
+ },
11585
+ item: function (node, _a) {
11586
+ var entering = _a.entering;
11587
+ if (entering) {
11588
+ var attributes = {};
11589
+ var classNames = [];
11590
+ if (node.listData.task) {
11591
+ attributes['data-task'] = '';
11592
+ classNames.push('task-list-item');
11593
+ if (node.listData.checked) {
11594
+ classNames.push('checked');
11595
+ attributes['data-task-checked'] = '';
11596
+ }
11597
+ }
11598
+ return {
10246
11599
  type: 'openTag',
10247
11600
  tagName: 'li',
10248
11601
  classNames: classNames,
@@ -10932,7 +12285,11 @@ var isNull = isNull_1;
10932
12285
  * @returns {boolean} Is existy?
10933
12286
  * @memberof module:type
10934
12287
  * @example
10935
- * var isExisty = require('tui-code-snippet/type/isExisty'); // node, commonjs
12288
+ * // ES6
12289
+ * import isExisty from 'tui-code-snippet/type/isExisty');
12290
+ *
12291
+ * // CommonJS
12292
+ * const isExisty = require('tui-code-snippet/type/isExisty');
10936
12293
  *
10937
12294
  * isExisty(''); //true
10938
12295
  * isExisty(0); //true
@@ -11204,6 +12561,14 @@ var EventEmitter = /** @class */ (function () {
11204
12561
  var TASK_ATTR_NAME = 'data-task';
11205
12562
  var DISABLED_TASK_ATTR_NAME = 'data-task-disabled';
11206
12563
  var TASK_CHECKED_CLASS_NAME = 'checked';
12564
+ function registerHTMLTagToWhitelist(convertorMap) {
12565
+ ['htmlBlock', 'htmlInline'].forEach(function (htmlType) {
12566
+ if (convertorMap[htmlType]) {
12567
+ // register tag white list for preventing to remove the html in sanitizer
12568
+ Object.keys(convertorMap[htmlType]).forEach(function (type) { return registerTagWhitelistIfPossible(type); });
12569
+ }
12570
+ });
12571
+ }
11207
12572
  /**
11208
12573
  * Class ToastUIEditorViewer
11209
12574
  * @param {object} options Option object
@@ -11249,6 +12614,7 @@ var ToastUIEditorViewer = /** @class */ (function () {
11249
12614
  frontMatter: frontMatter,
11250
12615
  sanitizer: customHTMLSanitizer || sanitizeHTML,
11251
12616
  };
12617
+ registerHTMLTagToWhitelist(rendererOptions.customHTMLRenderer);
11252
12618
  if (this.options.events) {
11253
12619
  forEachOwnProperties_1(this.options.events, function (fn, key) {
11254
12620
  _this.on(key, fn);