@toast-ui/editor 3.0.3 → 3.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (60) hide show
  1. package/README.md +4 -4
  2. package/dist/esm/i18n/ar.js +1 -1
  3. package/dist/esm/i18n/cs-cz.js +1 -1
  4. package/dist/esm/i18n/de-de.js +1 -1
  5. package/dist/esm/i18n/en-us.js +1 -1
  6. package/dist/esm/i18n/es-es.js +1 -1
  7. package/dist/esm/i18n/fi-fi.js +1 -1
  8. package/dist/esm/i18n/fr-fr.js +1 -1
  9. package/dist/esm/i18n/gl-es.js +1 -1
  10. package/dist/esm/i18n/hr-hr.js +1 -1
  11. package/dist/esm/i18n/i18n.js +10 -7
  12. package/dist/esm/i18n/it-it.js +1 -1
  13. package/dist/esm/i18n/ja-jp.js +1 -1
  14. package/dist/esm/i18n/ko-kr.js +1 -1
  15. package/dist/esm/i18n/nb-no.js +1 -1
  16. package/dist/esm/i18n/nl-nl.js +1 -1
  17. package/dist/esm/i18n/pl-pl.js +1 -1
  18. package/dist/esm/i18n/pt-br.js +1 -1
  19. package/dist/esm/i18n/ru-ru.js +1 -1
  20. package/dist/esm/i18n/sv-se.js +1 -1
  21. package/dist/esm/i18n/tr-tr.js +1 -1
  22. package/dist/esm/i18n/uk-ua.js +1 -1
  23. package/dist/esm/i18n/zh-cn.js +1 -1
  24. package/dist/esm/i18n/zh-tw.js +1 -1
  25. package/dist/esm/index.js +2587 -887
  26. package/dist/esm/indexViewer.js +1674 -306
  27. package/dist/i18n/ar.js +5 -5
  28. package/dist/i18n/cs-cz.js +5 -5
  29. package/dist/i18n/de-de.js +5 -5
  30. package/dist/i18n/es-es.js +5 -5
  31. package/dist/i18n/fi-fi.js +5 -5
  32. package/dist/i18n/fr-fr.js +5 -5
  33. package/dist/i18n/gl-es.js +5 -5
  34. package/dist/i18n/hr-hr.js +5 -5
  35. package/dist/i18n/it-it.js +5 -5
  36. package/dist/i18n/ja-jp.js +5 -5
  37. package/dist/i18n/ko-kr.js +5 -5
  38. package/dist/i18n/nb-no.js +5 -5
  39. package/dist/i18n/nl-nl.js +5 -5
  40. package/dist/i18n/pl-pl.js +5 -5
  41. package/dist/i18n/pt-br.js +5 -5
  42. package/dist/i18n/ru-ru.js +5 -5
  43. package/dist/i18n/sv-se.js +5 -5
  44. package/dist/i18n/tr-tr.js +5 -5
  45. package/dist/i18n/uk-ua.js +5 -5
  46. package/dist/i18n/zh-cn.js +5 -5
  47. package/dist/i18n/zh-tw.js +5 -5
  48. package/dist/toastui-editor-only.css +1 -1
  49. package/dist/toastui-editor-viewer.css +6 -6
  50. package/dist/toastui-editor-viewer.js +1855 -395
  51. package/dist/toastui-editor.css +6 -6
  52. package/dist/toastui-editor.js +2486 -704
  53. package/package.json +5 -1
  54. package/types/editor.d.ts +6 -4
  55. package/types/event.d.ts +2 -0
  56. package/types/index.d.ts +4 -3
  57. package/types/spec.d.ts +1 -1
  58. package/types/toastui-editor-viewer.d.ts +39 -0
  59. package/types/ui.d.ts +22 -20
  60. package/types/wysiwyg.d.ts +2 -1
@@ -1,6 +1,6 @@
1
1
  /**
2
2
  * @toast-ui/editor : viewer
3
- * @version 3.0.3 | Tue Aug 17 2021
3
+ * @version 3.1.3 | Thu Feb 10 2022
4
4
  * @author NHN FE Development Lab <dl_javascript@nhn.com>
5
5
  * @license MIT
6
6
  */
@@ -35,10 +35,14 @@ var __assign$1 = function() {
35
35
  return __assign$1.apply(this, arguments);
36
36
  };
37
37
 
38
- function __spreadArray$1(to, from) {
39
- for (var i = 0, il = from.length, j = to.length; i < il; i++, j++)
40
- to[j] = from[i];
41
- return to;
38
+ function __spreadArray$1(to, from, pack) {
39
+ if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
40
+ if (ar || !(i in from)) {
41
+ if (!ar) ar = Array.prototype.slice.call(from, 0, i);
42
+ ar[i] = from[i];
43
+ }
44
+ }
45
+ return to.concat(ar || Array.prototype.slice.call(from));
42
46
  }
43
47
 
44
48
  /*! *****************************************************************************
@@ -83,10 +87,14 @@ var __assign = function() {
83
87
  return __assign.apply(this, arguments);
84
88
  };
85
89
 
86
- function __spreadArray(to, from) {
87
- for (var i = 0, il = from.length, j = to.length; i < il; i++, j++)
88
- to[j] = from[i];
89
- return to;
90
+ function __spreadArray(to, from, pack) {
91
+ if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
92
+ if (ar || !(i in from)) {
93
+ if (!ar) ar = Array.prototype.slice.call(from, 0, i);
94
+ ar[i] = from[i];
95
+ }
96
+ }
97
+ return to.concat(ar || Array.prototype.slice.call(from));
90
98
  }
91
99
 
92
100
  var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
@@ -5419,7 +5427,7 @@ function isCustomBlock(node) {
5419
5427
  function isCustomInline(node) {
5420
5428
  return node.type === 'customInline';
5421
5429
  }
5422
- function text(s, sourcepos) {
5430
+ function text$1(s, sourcepos) {
5423
5431
  var node = createNode('text', sourcepos);
5424
5432
  node.literal = s;
5425
5433
  return node;
@@ -5595,17 +5603,17 @@ function convertExtAutoLinks(walker, autolinkParser) {
5595
5603
  for (var _i = 0, linkInfos_1 = linkInfos; _i < linkInfos_1.length; _i++) {
5596
5604
  var _b = linkInfos_1[_i], range = _b.range, url = _b.url, linkText = _b.text;
5597
5605
  if (range[0] > lastIdx) {
5598
- newNodes.push(text(literal.substring(lastIdx, range[0]), sourcepos(lastIdx, range[0] - 1)));
5606
+ newNodes.push(text$1(literal.substring(lastIdx, range[0]), sourcepos(lastIdx, range[0] - 1)));
5599
5607
  }
5600
5608
  var linkNode = createNode('link', sourcepos.apply(void 0, range));
5601
- linkNode.appendChild(text(linkText, sourcepos.apply(void 0, range)));
5609
+ linkNode.appendChild(text$1(linkText, sourcepos.apply(void 0, range)));
5602
5610
  linkNode.destination = url;
5603
5611
  linkNode.extendedAutolink = true;
5604
5612
  newNodes.push(linkNode);
5605
5613
  lastIdx = range[1] + 1;
5606
5614
  }
5607
5615
  if (lastIdx < literal.length) {
5608
- newNodes.push(text(literal.substring(lastIdx), sourcepos(lastIdx, literal.length - 1)));
5616
+ newNodes.push(text$1(literal.substring(lastIdx), sourcepos(lastIdx, literal.length - 1)));
5609
5617
  }
5610
5618
  for (var _c = 0, newNodes_1 = newNodes; _c < newNodes_1.length; _c++) {
5611
5619
  var newNode = newNodes_1[_c];
@@ -5796,7 +5804,7 @@ var InlineParser = /** @class */ (function () {
5796
5804
  }
5797
5805
  // If we got here, we didn't match a closing backtick sequence.
5798
5806
  this.pos = afterOpenTicks;
5799
- block.appendChild(text(ticks, this.sourcepos(startpos, this.pos - 1)));
5807
+ block.appendChild(text$1(ticks, this.sourcepos(startpos, this.pos - 1)));
5800
5808
  return true;
5801
5809
  };
5802
5810
  // Parse a backslash-escaped special character, adding either the escaped
@@ -5815,11 +5823,11 @@ var InlineParser = /** @class */ (function () {
5815
5823
  this.nextLine();
5816
5824
  }
5817
5825
  else if (reEscapable.test(subj.charAt(this.pos))) {
5818
- block.appendChild(text(subj.charAt(this.pos), this.sourcepos(startpos, this.pos)));
5826
+ block.appendChild(text$1(subj.charAt(this.pos), this.sourcepos(startpos, this.pos)));
5819
5827
  this.pos += 1;
5820
5828
  }
5821
5829
  else {
5822
- block.appendChild(text('\\', this.sourcepos(startpos, startpos)));
5830
+ block.appendChild(text$1('\\', this.sourcepos(startpos, startpos)));
5823
5831
  }
5824
5832
  return true;
5825
5833
  };
@@ -5834,7 +5842,7 @@ var InlineParser = /** @class */ (function () {
5834
5842
  node = createNode('link', this.sourcepos(startpos, this.pos));
5835
5843
  node.destination = normalizeURI("mailto:" + dest);
5836
5844
  node.title = '';
5837
- node.appendChild(text(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5845
+ node.appendChild(text$1(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5838
5846
  block.appendChild(node);
5839
5847
  return true;
5840
5848
  }
@@ -5843,7 +5851,7 @@ var InlineParser = /** @class */ (function () {
5843
5851
  node = createNode('link', this.sourcepos(startpos, this.pos));
5844
5852
  node.destination = normalizeURI(dest);
5845
5853
  node.title = '';
5846
- node.appendChild(text(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5854
+ node.appendChild(text$1(dest, this.sourcepos(startpos + 1, this.pos - 1)));
5847
5855
  block.appendChild(node);
5848
5856
  return true;
5849
5857
  }
@@ -5937,7 +5945,7 @@ var InlineParser = /** @class */ (function () {
5937
5945
  else {
5938
5946
  contents = this.subject.slice(startpos - 1, this.pos);
5939
5947
  }
5940
- var node = text(contents, this.sourcepos(startpos, this.pos));
5948
+ var node = text$1(contents, this.sourcepos(startpos, this.pos));
5941
5949
  block.appendChild(node);
5942
5950
  // Add entry to stack for this opener
5943
5951
  if ((res.canOpen || res.canClose) &&
@@ -6076,7 +6084,7 @@ var InlineParser = /** @class */ (function () {
6076
6084
  var literal = textNode.literal || '';
6077
6085
  var info = literal.split(/\s/)[0];
6078
6086
  newNode.info = info;
6079
- if (literal.length === info.length + 1) {
6087
+ if (literal.length <= info.length) {
6080
6088
  textNode.unlink();
6081
6089
  }
6082
6090
  else {
@@ -6208,7 +6216,7 @@ var InlineParser = /** @class */ (function () {
6208
6216
  InlineParser.prototype.parseOpenBracket = function (block) {
6209
6217
  var startpos = this.pos;
6210
6218
  this.pos += 1;
6211
- var node = text('[', this.sourcepos(this.pos, this.pos));
6219
+ var node = text$1('[', this.sourcepos(this.pos, this.pos));
6212
6220
  block.appendChild(node);
6213
6221
  // Add entry to stack for this opener
6214
6222
  this.addBracket(node, startpos, false);
@@ -6221,13 +6229,13 @@ var InlineParser = /** @class */ (function () {
6221
6229
  this.pos += 1;
6222
6230
  if (this.peek() === C_OPEN_BRACKET$1) {
6223
6231
  this.pos += 1;
6224
- var node = text('![', this.sourcepos(this.pos - 1, this.pos));
6232
+ var node = text$1('![', this.sourcepos(this.pos - 1, this.pos));
6225
6233
  block.appendChild(node);
6226
6234
  // Add entry to stack for this opener
6227
6235
  this.addBracket(node, startpos + 1, true);
6228
6236
  }
6229
6237
  else {
6230
- var node = text('!', this.sourcepos(this.pos, this.pos));
6238
+ var node = text$1('!', this.sourcepos(this.pos, this.pos));
6231
6239
  block.appendChild(node);
6232
6240
  }
6233
6241
  return true;
@@ -6246,12 +6254,12 @@ var InlineParser = /** @class */ (function () {
6246
6254
  var opener = this.brackets;
6247
6255
  if (opener === null) {
6248
6256
  // no matched opener, just return a literal
6249
- block.appendChild(text(']', this.sourcepos(startpos, startpos)));
6257
+ block.appendChild(text$1(']', this.sourcepos(startpos, startpos)));
6250
6258
  return true;
6251
6259
  }
6252
6260
  if (!opener.active) {
6253
6261
  // no matched opener, just return a literal
6254
- block.appendChild(text(']', this.sourcepos(startpos, startpos)));
6262
+ block.appendChild(text$1(']', this.sourcepos(startpos, startpos)));
6255
6263
  // take opener off brackets stack
6256
6264
  this.removeBracket();
6257
6265
  return true;
@@ -6343,7 +6351,7 @@ var InlineParser = /** @class */ (function () {
6343
6351
  } // no match
6344
6352
  this.removeBracket(); // remove this opener from stack
6345
6353
  this.pos = startpos;
6346
- block.appendChild(text(']', this.sourcepos(startpos, startpos)));
6354
+ block.appendChild(text$1(']', this.sourcepos(startpos, startpos)));
6347
6355
  if (this.options.referenceDefinition) {
6348
6356
  this.refLinkCandidateMap[block.id] = { node: block, refLabel: refLabel };
6349
6357
  }
@@ -6373,7 +6381,7 @@ var InlineParser = /** @class */ (function () {
6373
6381
  var m;
6374
6382
  var startpos = this.pos + 1;
6375
6383
  if ((m = this.match(reEntityHere))) {
6376
- block.appendChild(text(lib.decodeHTML(m), this.sourcepos(startpos, this.pos)));
6384
+ block.appendChild(text$1(lib.decodeHTML(m), this.sourcepos(startpos, this.pos)));
6377
6385
  return true;
6378
6386
  }
6379
6387
  return false;
@@ -6408,10 +6416,10 @@ var InlineParser = /** @class */ (function () {
6408
6416
  }
6409
6417
  return repeat('\u2014', emCount) + repeat('\u2013', enCount);
6410
6418
  });
6411
- block.appendChild(text(lit, this.sourcepos(startpos, this.pos)));
6419
+ block.appendChild(text$1(lit, this.sourcepos(startpos, this.pos)));
6412
6420
  }
6413
6421
  else {
6414
- var node = text(m, this.sourcepos(startpos, this.pos));
6422
+ var node = text$1(m, this.sourcepos(startpos, this.pos));
6415
6423
  block.appendChild(node);
6416
6424
  }
6417
6425
  return true;
@@ -6634,7 +6642,7 @@ var InlineParser = /** @class */ (function () {
6634
6642
  }
6635
6643
  if (!res) {
6636
6644
  this.pos += 1;
6637
- block.appendChild(text(fromCodePoint$1(c), this.sourcepos(this.pos, this.pos + 1)));
6645
+ block.appendChild(text$1(fromCodePoint$1(c), this.sourcepos(this.pos, this.pos + 1)));
6638
6646
  }
6639
6647
  return true;
6640
6648
  };
@@ -8687,7 +8695,7 @@ var baseConvertors$1 = {
8687
8695
  return customConvertor(node, context);
8688
8696
  }
8689
8697
  catch (e) {
8690
- console.warn(e);
8698
+ console.warn("[@toast-ui/editor] - The error occurred when " + info + " block node was parsed in markdown renderer: " + e);
8691
8699
  }
8692
8700
  }
8693
8701
  return [
@@ -8710,15 +8718,27 @@ var baseConvertors$1 = {
8710
8718
  ];
8711
8719
  },
8712
8720
  customInline: function (node, context, convertors) {
8713
- var info = node.info.trim().toLowerCase();
8714
- var customConvertor = convertors[info];
8721
+ var _a = node, info = _a.info, firstChild = _a.firstChild;
8722
+ var nomalizedInfo = info.trim().toLowerCase();
8723
+ var customConvertor = convertors[nomalizedInfo];
8724
+ var entering = context.entering;
8715
8725
  if (customConvertor) {
8716
- return customConvertor(node, context);
8726
+ try {
8727
+ return customConvertor(node, context);
8728
+ }
8729
+ catch (e) {
8730
+ console.warn("[@toast-ui/editor] - The error occurred when " + nomalizedInfo + " inline node was parsed in markdown renderer: " + e);
8731
+ }
8717
8732
  }
8718
- return {
8719
- type: context.entering ? 'openTag' : 'closeTag',
8720
- tagName: 'span',
8721
- };
8733
+ return entering
8734
+ ? [
8735
+ { type: 'openTag', tagName: 'span' },
8736
+ { type: 'text', content: "$$" + info + (firstChild ? ' ' : '') },
8737
+ ]
8738
+ : [
8739
+ { type: 'text', content: '$$' },
8740
+ { type: 'closeTag', tagName: 'span' },
8741
+ ];
8722
8742
  },
8723
8743
  };
8724
8744
 
@@ -8883,8 +8903,8 @@ var Renderer = /** @class */ (function () {
8883
8903
  ? nodeType.toLowerCase()
8884
8904
  : nodeType;
8885
8905
  if (orgConvertor) {
8886
- convertors[convertorType] = function (node, context) {
8887
- context.origin = function () { return orgConvertor(node, context); };
8906
+ convertors[convertorType] = function (node, context, convertors) {
8907
+ context.origin = function () { return orgConvertor(node, context, convertors); };
8888
8908
  return convertor(node, context);
8889
8909
  };
8890
8910
  }
@@ -9046,12 +9066,16 @@ var Renderer = /** @class */ (function () {
9046
9066
  * @param {Object} [context] Context(this) of callback function
9047
9067
  * @memberof module:collection
9048
9068
  * @example
9049
- * var forEachOwnProperties = require('tui-code-snippet/collection/forEachOwnProperties'); // node, commonjs
9069
+ * // ES6
9070
+ * import forEachOwnProperties from 'tui-code-snippet/collection/forEachOwnProperties';
9071
+ *
9072
+ * // CommonJS
9073
+ * const forEachOwnProperties = require('tui-code-snippet/collection/forEachOwnProperties');
9050
9074
  *
9051
- * var sum = 0;
9075
+ * let sum = 0;
9052
9076
  *
9053
9077
  * forEachOwnProperties({a:1,b:2,c:3}, function(value){
9054
- * sum += value;
9078
+ * sum += value;
9055
9079
  * });
9056
9080
  * alert(sum); // 6
9057
9081
  */
@@ -9159,12 +9183,16 @@ var isArray_1 = isArray$3;
9159
9183
  * @param {Object} [context] Context(this) of callback function
9160
9184
  * @memberof module:collection
9161
9185
  * @example
9162
- * var forEachArray = require('tui-code-snippet/collection/forEachArray'); // node, commonjs
9186
+ * // ES6
9187
+ * import forEachArray from 'tui-code-snippet/collection/forEachArray';
9188
+ *
9189
+ * // CommonJS
9190
+ * const forEachArray = require('tui-code-snippet/collection/forEachArray');
9163
9191
  *
9164
- * var sum = 0;
9192
+ * let sum = 0;
9165
9193
  *
9166
9194
  * forEachArray([1,2,3], function(value){
9167
- * sum += value;
9195
+ * sum += value;
9168
9196
  * });
9169
9197
  * alert(sum); // 6
9170
9198
  */
@@ -9209,19 +9237,23 @@ var forEachOwnProperties = forEachOwnProperties_1;
9209
9237
  * @param {Object} [context] Context(this) of callback function
9210
9238
  * @memberof module:collection
9211
9239
  * @example
9212
- * var forEach = require('tui-code-snippet/collection/forEach'); // node, commonjs
9240
+ * // ES6
9241
+ * import forEach from 'tui-code-snippet/collection/forEach';
9242
+ *
9243
+ * // CommonJS
9244
+ * const forEach = require('tui-code-snippet/collection/forEach');
9213
9245
  *
9214
- * var sum = 0;
9246
+ * let sum = 0;
9215
9247
  *
9216
9248
  * forEach([1,2,3], function(value){
9217
- * sum += value;
9249
+ * sum += value;
9218
9250
  * });
9219
9251
  * alert(sum); // 6
9220
9252
  *
9221
9253
  * // In case of Array-like object
9222
- * var array = Array.prototype.slice.call(arrayLike); // change to array
9254
+ * const array = Array.prototype.slice.call(arrayLike); // change to array
9223
9255
  * forEach(array, function(value){
9224
- * sum += value;
9256
+ * sum += value;
9225
9257
  * });
9226
9258
  */
9227
9259
  function forEach$4(obj, iteratee, context) {
@@ -9284,7 +9316,7 @@ var safeEvent$1 = _safeEvent;
9284
9316
  * @param {object} [context] context - context for handler method.
9285
9317
  * @memberof module:domEvent
9286
9318
  * @example
9287
- * var div = document.querySelector('div');
9319
+ * const div = document.querySelector('div');
9288
9320
  *
9289
9321
  * // Bind one event to an element.
9290
9322
  * on(div, 'click', toggle);
@@ -9301,10 +9333,10 @@ var safeEvent$1 = _safeEvent;
9301
9333
  * });
9302
9334
  *
9303
9335
  * // Set a context for handler method.
9304
- * var name = 'global';
9305
- * var repository = {name: 'CodeSnippet'};
9336
+ * const name = 'global';
9337
+ * const repository = {name: 'CodeSnippet'};
9306
9338
  * on(div, 'drag', function() {
9307
- * console.log(this.name);
9339
+ * console.log(this.name);
9308
9340
  * }, repository);
9309
9341
  * // Result when you drag a div: "CodeSnippet"
9310
9342
  */
@@ -9498,11 +9530,15 @@ var isArray$1 = isArray_1;
9498
9530
  * @returns {number} the First index at which a given element, or -1 if it is not present
9499
9531
  * @memberof module:array
9500
9532
  * @example
9501
- * var inArray = require('tui-code-snippet/array/inArray'); // node, commonjs
9533
+ * // ES6
9534
+ * import inArray from 'tui-code-snippet/array/inArray';
9535
+ *
9536
+ * // CommonJS
9537
+ * const inArray = require('tui-code-snippet/array/inArray');
9502
9538
  *
9503
- * var arr = ['one', 'two', 'three', 'four'];
9504
- * var idx1 = inArray('one', arr, 3); // -1
9505
- * var idx2 = inArray('one', arr); // 0
9539
+ * const arr = ['one', 'two', 'three', 'four'];
9540
+ * const idx1 = inArray('one', arr, 3); // -1
9541
+ * const idx2 = inArray('one', arr); // 0
9506
9542
  */
9507
9543
  function inArray$3(searchElement, array, startIndex) {
9508
9544
  var i;
@@ -9743,16 +9779,20 @@ var forEachArray = forEachArray_1;
9743
9779
  * @returns {Array} Array
9744
9780
  * @memberof module:collection
9745
9781
  * @example
9746
- * var toArray = require('tui-code-snippet/collection/toArray'); // node, commonjs
9782
+ * // ES6
9783
+ * import toArray from 'tui-code-snippet/collection/toArray';
9784
+ *
9785
+ * // CommonJS
9786
+ * const toArray = require('tui-code-snippet/collection/toArray');
9747
9787
  *
9748
- * var arrayLike = {
9749
- * 0: 'one',
9750
- * 1: 'two',
9751
- * 2: 'three',
9752
- * 3: 'four',
9753
- * length: 4
9788
+ * const arrayLike = {
9789
+ * 0: 'one',
9790
+ * 1: 'two',
9791
+ * 2: 'three',
9792
+ * 3: 'four',
9793
+ * length: 4
9754
9794
  * };
9755
- * var result = toArray(arrayLike);
9795
+ * const result = toArray(arrayLike);
9756
9796
  *
9757
9797
  * alert(result instanceof Array); // true
9758
9798
  * alert(result); // one,two,three,four
@@ -9815,103 +9855,6 @@ var CLOSE_TAG = "</(" + TAG_NAME + ")\\s*[>]";
9815
9855
  var HTML_TAG = "(?:" + OPEN_TAG + "|" + CLOSE_TAG + ")";
9816
9856
  var reHTMLTag = new RegExp("^" + HTML_TAG, 'i');
9817
9857
 
9818
- function isPositionInBox(style, offsetX, offsetY) {
9819
- var left = parseInt(style.left, 10);
9820
- var top = parseInt(style.top, 10);
9821
- var width = parseInt(style.width, 10) + parseInt(style.paddingLeft, 10) + parseInt(style.paddingRight, 10);
9822
- var height = parseInt(style.height, 10) + parseInt(style.paddingTop, 10) + parseInt(style.paddingBottom, 10);
9823
- return offsetX >= left && offsetX <= left + width && offsetY >= top && offsetY <= top + height;
9824
- }
9825
- var CLS_PREFIX = 'toastui-editor-';
9826
- function cls() {
9827
- var names = [];
9828
- for (var _i = 0; _i < arguments.length; _i++) {
9829
- names[_i] = arguments[_i];
9830
- }
9831
- var result = [];
9832
- for (var _a = 0, names_1 = names; _a < names_1.length; _a++) {
9833
- var name_1 = names_1[_a];
9834
- var className = void 0;
9835
- if (Array.isArray(name_1)) {
9836
- className = name_1[0] ? name_1[1] : null;
9837
- }
9838
- else {
9839
- className = name_1;
9840
- }
9841
- if (className) {
9842
- result.push("" + CLS_PREFIX + className);
9843
- }
9844
- }
9845
- return result.join(' ');
9846
- }
9847
- function findNodes(element, selector) {
9848
- var nodeList = toArray_1(element.querySelectorAll(selector));
9849
- if (nodeList.length) {
9850
- return nodeList;
9851
- }
9852
- return [];
9853
- }
9854
- function removeNode(node) {
9855
- if (node.parentNode) {
9856
- node.parentNode.removeChild(node);
9857
- }
9858
- }
9859
- function toggleClass(element, className, state) {
9860
- if (isUndefined_1(state)) {
9861
- state = !hasClass_1(element, className);
9862
- }
9863
- var toggleFn = state ? addClass_1 : removeClass_1;
9864
- toggleFn(element, className);
9865
- }
9866
- function createElementWith(contents, target) {
9867
- var container = document.createElement('div');
9868
- if (isString_1(contents)) {
9869
- container.innerHTML = contents;
9870
- }
9871
- else {
9872
- container.appendChild(contents);
9873
- }
9874
- var firstChild = container.firstChild;
9875
- if (target) {
9876
- target.appendChild(firstChild);
9877
- }
9878
- return firstChild;
9879
- }
9880
- function finalizeHtml(html, needHtmlText) {
9881
- var result;
9882
- if (needHtmlText) {
9883
- result = html.innerHTML;
9884
- }
9885
- else {
9886
- var frag = document.createDocumentFragment();
9887
- var childNodes = toArray_1(html.childNodes);
9888
- var length_1 = childNodes.length;
9889
- for (var i = 0; i < length_1; i += 1) {
9890
- frag.appendChild(childNodes[i]);
9891
- }
9892
- result = frag;
9893
- }
9894
- return result;
9895
- }
9896
-
9897
- /**
9898
- * @fileoverview Check whether the given variable is a function or not.
9899
- * @author NHN FE Development Lab <dl_javascript@nhn.com>
9900
- */
9901
-
9902
- /**
9903
- * Check whether the given variable is a function or not.
9904
- * If the given variable is a function, return true.
9905
- * @param {*} obj - Target for checking
9906
- * @returns {boolean} Is function?
9907
- * @memberof module:type
9908
- */
9909
- function isFunction(obj) {
9910
- return obj instanceof Function;
9911
- }
9912
-
9913
- var isFunction_1 = isFunction;
9914
-
9915
9858
  /**
9916
9859
  * @fileoverview Check whether the given variable is null or not.
9917
9860
  * @author NHN FE Development Lab <dl_javascript@nhn.com>
@@ -10019,6 +9962,80 @@ function getSortedNumPair(valueA, valueB) {
10019
9962
  return valueA > valueB ? [valueB, valueA] : [valueA, valueB];
10020
9963
  }
10021
9964
 
9965
+ function isPositionInBox(style, offsetX, offsetY) {
9966
+ var left = parseInt(style.left, 10);
9967
+ var top = parseInt(style.top, 10);
9968
+ var width = parseInt(style.width, 10) + parseInt(style.paddingLeft, 10) + parseInt(style.paddingRight, 10);
9969
+ var height = parseInt(style.height, 10) + parseInt(style.paddingTop, 10) + parseInt(style.paddingBottom, 10);
9970
+ return offsetX >= left && offsetX <= left + width && offsetY >= top && offsetY <= top + height;
9971
+ }
9972
+ var CLS_PREFIX = 'toastui-editor-';
9973
+ function cls() {
9974
+ var names = [];
9975
+ for (var _i = 0; _i < arguments.length; _i++) {
9976
+ names[_i] = arguments[_i];
9977
+ }
9978
+ var result = [];
9979
+ for (var _a = 0, names_1 = names; _a < names_1.length; _a++) {
9980
+ var name_1 = names_1[_a];
9981
+ var className = void 0;
9982
+ if (Array.isArray(name_1)) {
9983
+ className = name_1[0] ? name_1[1] : null;
9984
+ }
9985
+ else {
9986
+ className = name_1;
9987
+ }
9988
+ if (className) {
9989
+ result.push("" + CLS_PREFIX + className);
9990
+ }
9991
+ }
9992
+ return result.join(' ');
9993
+ }
9994
+ function removeNode(node) {
9995
+ if (node.parentNode) {
9996
+ node.parentNode.removeChild(node);
9997
+ }
9998
+ }
9999
+ function toggleClass(element, className, state) {
10000
+ if (isUndefined_1(state)) {
10001
+ state = !hasClass_1(element, className);
10002
+ }
10003
+ var toggleFn = state ? addClass_1 : removeClass_1;
10004
+ toggleFn(element, className);
10005
+ }
10006
+ function createElementWith(contents, target) {
10007
+ var container = document.createElement('div');
10008
+ if (isString_1(contents)) {
10009
+ container.innerHTML = contents;
10010
+ }
10011
+ else {
10012
+ container.appendChild(contents);
10013
+ }
10014
+ var firstChild = container.firstChild;
10015
+ if (target) {
10016
+ target.appendChild(firstChild);
10017
+ }
10018
+ return firstChild;
10019
+ }
10020
+
10021
+ /**
10022
+ * @fileoverview Check whether the given variable is a function or not.
10023
+ * @author NHN FE Development Lab <dl_javascript@nhn.com>
10024
+ */
10025
+
10026
+ /**
10027
+ * Check whether the given variable is a function or not.
10028
+ * If the given variable is a function, return true.
10029
+ * @param {*} obj - Target for checking
10030
+ * @returns {boolean} Is function?
10031
+ * @memberof module:type
10032
+ */
10033
+ function isFunction(obj) {
10034
+ return obj instanceof Function;
10035
+ }
10036
+
10037
+ var isFunction_1 = isFunction;
10038
+
10022
10039
  function getMdStartCh(mdNode) {
10023
10040
  return mdNode.sourcepos[0][1];
10024
10041
  }
@@ -10111,152 +10128,1476 @@ function getWidgetContent(widgetNode) {
10111
10128
  return text;
10112
10129
  }
10113
10130
 
10114
- var reHTMLAttr = new RegExp('^(abbr|align|alt|axis|bgcolor|border|cellpadding|cellspacing|class|clear|' +
10115
- 'color|cols|compact|coords|dir|face|headers|height|hreflang|hspace|' +
10116
- 'ismap|lang|language|nohref|nowrap|rel|rev|rows|rules|' +
10117
- 'scope|scrolling|shape|size|span|start|summary|tabindex|target|title|type|' +
10118
- 'valign|value|vspace|width|checked|mathvariant|encoding|id|name|' +
10119
- 'background|cite|href|longdesc|src|usemap|xlink:href|data-+|checked|style)', 'g');
10120
- var reSvgAttr = new RegExp('^(accent-height|accumulate|additive|alphabetic|arabic-form|ascent|' +
10121
- 'baseProfile|bbox|begin|by|calcMode|cap-height|class|color|color-rendering|content|' +
10122
- 'cx|cy|d|dx|dy|descent|display|dur|end|fill|fill-rule|font-family|font-size|font-stretch|' +
10123
- 'font-style|font-variant|font-weight|from|fx|fy|g1|g2|glyph-name|gradientUnits|hanging|' +
10124
- 'height|horiz-adv-x|horiz-origin-x|ideographic|k|keyPoints|keySplines|keyTimes|lang|' +
10125
- 'marker-end|marker-mid|marker-start|markerHeight|markerUnits|markerWidth|mathematical|' +
10126
- 'max|min|offset|opacity|orient|origin|overline-position|overline-thickness|panose-1|' +
10127
- 'path|pathLength|points|preserveAspectRatio|r|refX|refY|repeatCount|repeatDur|' +
10128
- 'requiredExtensions|requiredFeatures|restart|rotate|rx|ry|slope|stemh|stemv|stop-color|' +
10129
- 'stop-opacity|strikethrough-position|strikethrough-thickness|stroke|stroke-dasharray|' +
10130
- 'stroke-dashoffset|stroke-linecap|stroke-linejoin|stroke-miterlimit|stroke-opacity|' +
10131
- 'stroke-width|systemLanguage|target|text-anchor|to|transform|type|u1|u2|underline-position|' +
10132
- 'underline-thickness|unicode|unicode-range|units-per-em|values|version|viewBox|visibility|' +
10133
- 'width|widths|x|x-height|x1|x2|xlink:actuate|xlink:arcrole|xlink:role|xlink:show|xlink:title|' +
10134
- 'xlink:type|xml:base|xml:lang|xml:space|xmlns|xmlns:xlink|y|y1|y2|zoomAndPan)', 'g');
10135
- var reXSSAttr = /href|src|background/i;
10136
- var reXSSAttrValue = /((java|vb|live)script|x):/i;
10137
- var reOnEvent = /^on\S+/i;
10138
- var reXSSOnload = new RegExp("(<" + TAG_NAME + "[^>]*)(onload\\s*=)", 'ig');
10139
- var reComment = /<!--[\s\S]*?-->/g;
10140
- var reWhitespace = /[ \t\r\n]/g;
10141
- var DEFAULT_TAG_BLACK_LIST = [
10142
- 'script',
10143
- 'iframe',
10144
- 'textarea',
10145
- 'form',
10146
- 'button',
10147
- 'select',
10148
- 'input',
10149
- 'meta',
10150
- 'style',
10151
- 'link',
10152
- 'title',
10153
- 'embed',
10154
- 'object',
10155
- 'details',
10156
- 'summary',
10157
- 'base',
10158
- ];
10159
- var tagBlacklist = __spreadArray$1([], DEFAULT_TAG_BLACK_LIST);
10160
- function sanitizeHTML(html) {
10161
- var root = document.createElement('div');
10162
- if (isString_1(html)) {
10163
- html = html.replace(reComment, '').replace(reXSSOnload, '$1');
10164
- root.innerHTML = html;
10165
- }
10166
- removeUnnecessaryTags(root);
10167
- leaveOnlyWhitelistAttribute(root);
10168
- return finalizeHtml(root, true);
10169
- }
10170
- function removeUnnecessaryTags(html) {
10171
- var removedTags = findNodes(html, tagBlacklist.join(','));
10172
- removedTags.forEach(function (node) {
10173
- removeNode(node);
10174
- });
10131
+ /*! @license DOMPurify 2.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.3/LICENSE */
10132
+
10133
+ function _toConsumableArray(arr) { if (Array.isArray(arr)) { for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) { arr2[i] = arr[i]; } return arr2; } else { return Array.from(arr); } }
10134
+
10135
+ var hasOwnProperty = Object.hasOwnProperty,
10136
+ setPrototypeOf = Object.setPrototypeOf,
10137
+ isFrozen = Object.isFrozen,
10138
+ getPrototypeOf = Object.getPrototypeOf,
10139
+ getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
10140
+ var freeze = Object.freeze,
10141
+ seal = Object.seal,
10142
+ create = Object.create; // eslint-disable-line import/no-mutable-exports
10143
+
10144
+ var _ref = typeof Reflect !== 'undefined' && Reflect,
10145
+ apply = _ref.apply,
10146
+ construct = _ref.construct;
10147
+
10148
+ if (!apply) {
10149
+ apply = function apply(fun, thisValue, args) {
10150
+ return fun.apply(thisValue, args);
10151
+ };
10175
10152
  }
10176
- function isXSSAttribute(attrName, attrValue) {
10177
- return attrName.match(reXSSAttr) && attrValue.replace(reWhitespace, '').match(reXSSAttrValue);
10153
+
10154
+ if (!freeze) {
10155
+ freeze = function freeze(x) {
10156
+ return x;
10157
+ };
10178
10158
  }
10179
- function removeBlacklistAttributes(node, blacklistAttrs) {
10180
- blacklistAttrs.forEach(function (_a) {
10181
- var name = _a.name;
10182
- if (reOnEvent.test(name)) {
10183
- node[name] = null;
10184
- }
10185
- node.removeAttribute(name);
10186
- });
10159
+
10160
+ if (!seal) {
10161
+ seal = function seal(x) {
10162
+ return x;
10163
+ };
10187
10164
  }
10188
- function leaveOnlyWhitelistAttribute(html) {
10189
- findNodes(html, '*').forEach(function (node) {
10190
- var attributes = node.attributes;
10191
- var blacklist = toArray_1(attributes).filter(function (attr) {
10192
- var name = attr.name, value = attr.value;
10193
- var htmlAttr = name.match(reHTMLAttr);
10194
- var svgAttr = name.match(reSvgAttr);
10195
- var xssAttr = htmlAttr && isXSSAttribute(name, value);
10196
- return (!htmlAttr && !svgAttr) || xssAttr;
10197
- });
10198
- removeBlacklistAttributes(node, blacklist);
10199
- });
10165
+
10166
+ if (!construct) {
10167
+ construct = function construct(Func, args) {
10168
+ return new (Function.prototype.bind.apply(Func, [null].concat(_toConsumableArray(args))))();
10169
+ };
10200
10170
  }
10201
10171
 
10202
- function getChildrenHTML(node, typeName) {
10203
- return node
10204
- .literal.replace(new RegExp("(<\\s*" + typeName + "[^>]+?>)|(</" + typeName + "\\s*[>])", 'ig'), '')
10205
- .trim();
10172
+ var arrayForEach = unapply(Array.prototype.forEach);
10173
+ var arrayPop = unapply(Array.prototype.pop);
10174
+ var arrayPush = unapply(Array.prototype.push);
10175
+
10176
+ var stringToLowerCase = unapply(String.prototype.toLowerCase);
10177
+ var stringMatch = unapply(String.prototype.match);
10178
+ var stringReplace = unapply(String.prototype.replace);
10179
+ var stringIndexOf = unapply(String.prototype.indexOf);
10180
+ var stringTrim = unapply(String.prototype.trim);
10181
+
10182
+ var regExpTest = unapply(RegExp.prototype.test);
10183
+
10184
+ var typeErrorCreate = unconstruct(TypeError);
10185
+
10186
+ function unapply(func) {
10187
+ return function (thisArg) {
10188
+ for (var _len = arguments.length, args = Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
10189
+ args[_key - 1] = arguments[_key];
10190
+ }
10191
+
10192
+ return apply(func, thisArg, args);
10193
+ };
10206
10194
  }
10207
- function getHTMLAttrsByHTMLString(html) {
10208
- html = html.match(reHTMLTag)[0];
10209
- var attrs = html.match(new RegExp(ATTRIBUTE, 'g'));
10210
- return attrs
10211
- ? attrs.reduce(function (acc, attr) {
10212
- var _a = attr.trim().split('='), name = _a[0], values = _a.slice(1);
10213
- if (values.length) {
10214
- acc[name] = values.join('=').replace(/'|"/g, '').trim();
10215
- }
10216
- return acc;
10217
- }, {})
10218
- : {};
10195
+
10196
+ function unconstruct(func) {
10197
+ return function () {
10198
+ for (var _len2 = arguments.length, args = Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
10199
+ args[_key2] = arguments[_key2];
10200
+ }
10201
+
10202
+ return construct(func, args);
10203
+ };
10219
10204
  }
10220
10205
 
10221
- var reCloseTag = /^\s*<\s*\//;
10222
- var baseConvertors = {
10223
- paragraph: function (_, _a) {
10224
- var entering = _a.entering, origin = _a.origin, options = _a.options;
10225
- if (options.nodeId) {
10226
- return {
10227
- type: entering ? 'openTag' : 'closeTag',
10228
- outerNewLine: true,
10229
- tagName: 'p',
10230
- };
10206
+ /* Add properties to a lookup table */
10207
+ function addToSet(set, array) {
10208
+ if (setPrototypeOf) {
10209
+ // Make 'in' and truthy checks like Boolean(set.constructor)
10210
+ // independent of any properties defined on Object.prototype.
10211
+ // Prevent prototype setters from intercepting set as a this value.
10212
+ setPrototypeOf(set, null);
10213
+ }
10214
+
10215
+ var l = array.length;
10216
+ while (l--) {
10217
+ var element = array[l];
10218
+ if (typeof element === 'string') {
10219
+ var lcElement = stringToLowerCase(element);
10220
+ if (lcElement !== element) {
10221
+ // Config presets (e.g. tags.js, attrs.js) are immutable.
10222
+ if (!isFrozen(array)) {
10223
+ array[l] = lcElement;
10231
10224
  }
10232
- return origin();
10233
- },
10234
- softbreak: function (node) {
10235
- var isPrevNodeHTML = node.prev && node.prev.type === 'htmlInline';
10236
- var isPrevBR = isPrevNodeHTML && /<br ?\/?>/.test(node.prev.literal);
10237
- var content = isPrevBR ? '\n' : '<br>\n';
10238
- return { type: 'html', content: content };
10239
- },
10240
- item: function (node, _a) {
10241
- var entering = _a.entering;
10242
- if (entering) {
10243
- var attributes = {};
10244
- var classNames = [];
10245
- if (node.listData.task) {
10246
- attributes['data-task'] = '';
10247
- classNames.push('task-list-item');
10248
- if (node.listData.checked) {
10249
- classNames.push('checked');
10250
- attributes['data-task-checked'] = '';
10251
- }
10252
- }
10253
- return {
10254
- type: 'openTag',
10255
- tagName: 'li',
10256
- classNames: classNames,
10257
- attributes: attributes,
10258
- outerNewLine: true,
10259
- };
10225
+
10226
+ element = lcElement;
10227
+ }
10228
+ }
10229
+
10230
+ set[element] = true;
10231
+ }
10232
+
10233
+ return set;
10234
+ }
10235
+
10236
+ /* Shallow clone an object */
10237
+ function clone(object) {
10238
+ var newObject = create(null);
10239
+
10240
+ var property = void 0;
10241
+ for (property in object) {
10242
+ if (apply(hasOwnProperty, object, [property])) {
10243
+ newObject[property] = object[property];
10244
+ }
10245
+ }
10246
+
10247
+ return newObject;
10248
+ }
10249
+
10250
+ /* IE10 doesn't support __lookupGetter__ so lets'
10251
+ * simulate it. It also automatically checks
10252
+ * if the prop is function or getter and behaves
10253
+ * accordingly. */
10254
+ function lookupGetter(object, prop) {
10255
+ while (object !== null) {
10256
+ var desc = getOwnPropertyDescriptor(object, prop);
10257
+ if (desc) {
10258
+ if (desc.get) {
10259
+ return unapply(desc.get);
10260
+ }
10261
+
10262
+ if (typeof desc.value === 'function') {
10263
+ return unapply(desc.value);
10264
+ }
10265
+ }
10266
+
10267
+ object = getPrototypeOf(object);
10268
+ }
10269
+
10270
+ function fallbackValue(element) {
10271
+ console.warn('fallback value for', element);
10272
+ return null;
10273
+ }
10274
+
10275
+ return fallbackValue;
10276
+ }
10277
+
10278
+ var html = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
10279
+
10280
+ // SVG
10281
+ var svg = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
10282
+
10283
+ var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
10284
+
10285
+ // List of SVG elements that are disallowed by default.
10286
+ // We still need to know them so that we can do namespace
10287
+ // checks properly in case one wants to add them to
10288
+ // allow-list.
10289
+ var svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'fedropshadow', 'feimage', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
10290
+
10291
+ var mathMl = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover']);
10292
+
10293
+ // Similarly to SVG, we want to know all MathML elements,
10294
+ // even those that we disallow by default.
10295
+ var mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
10296
+
10297
+ var text = freeze(['#text']);
10298
+
10299
+ var html$1 = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
10300
+
10301
+ var svg$1 = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
10302
+
10303
+ var mathMl$1 = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
10304
+
10305
+ var xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
10306
+
10307
+ // eslint-disable-next-line unicorn/better-regex
10308
+ var MUSTACHE_EXPR = seal(/\{\{[\s\S]*|[\s\S]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
10309
+ var ERB_EXPR = seal(/<%[\s\S]*|[\s\S]*%>/gm);
10310
+ var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
10311
+ var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
10312
+ var IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
10313
+ );
10314
+ var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
10315
+ var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
10316
+ );
10317
+
10318
+ var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };
10319
+
10320
+ function _toConsumableArray$1(arr) { if (Array.isArray(arr)) { for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) { arr2[i] = arr[i]; } return arr2; } else { return Array.from(arr); } }
10321
+
10322
+ var getGlobal = function getGlobal() {
10323
+ return typeof window === 'undefined' ? null : window;
10324
+ };
10325
+
10326
+ /**
10327
+ * Creates a no-op policy for internal use only.
10328
+ * Don't export this function outside this module!
10329
+ * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
10330
+ * @param {Document} document The document object (to determine policy name suffix)
10331
+ * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
10332
+ * are not supported).
10333
+ */
10334
+ var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, document) {
10335
+ if ((typeof trustedTypes === 'undefined' ? 'undefined' : _typeof(trustedTypes)) !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
10336
+ return null;
10337
+ }
10338
+
10339
+ // Allow the callers to control the unique policy name
10340
+ // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
10341
+ // Policy creation with duplicate names throws in Trusted Types.
10342
+ var suffix = null;
10343
+ var ATTR_NAME = 'data-tt-policy-suffix';
10344
+ if (document.currentScript && document.currentScript.hasAttribute(ATTR_NAME)) {
10345
+ suffix = document.currentScript.getAttribute(ATTR_NAME);
10346
+ }
10347
+
10348
+ var policyName = 'dompurify' + (suffix ? '#' + suffix : '');
10349
+
10350
+ try {
10351
+ return trustedTypes.createPolicy(policyName, {
10352
+ createHTML: function createHTML(html$$1) {
10353
+ return html$$1;
10354
+ }
10355
+ });
10356
+ } catch (_) {
10357
+ // Policy creation failed (most likely another DOMPurify script has
10358
+ // already run). Skip creating the policy, as this will only cause errors
10359
+ // if TT are enforced.
10360
+ console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
10361
+ return null;
10362
+ }
10363
+ };
10364
+
10365
+ function createDOMPurify() {
10366
+ var window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
10367
+
10368
+ var DOMPurify = function DOMPurify(root) {
10369
+ return createDOMPurify(root);
10370
+ };
10371
+
10372
+ /**
10373
+ * Version label, exposed for easier checks
10374
+ * if DOMPurify is up to date or not
10375
+ */
10376
+ DOMPurify.version = '2.3.3';
10377
+
10378
+ /**
10379
+ * Array of elements that DOMPurify removed during sanitation.
10380
+ * Empty if nothing was removed.
10381
+ */
10382
+ DOMPurify.removed = [];
10383
+
10384
+ if (!window || !window.document || window.document.nodeType !== 9) {
10385
+ // Not running in a browser, provide a factory function
10386
+ // so that you can pass your own Window
10387
+ DOMPurify.isSupported = false;
10388
+
10389
+ return DOMPurify;
10390
+ }
10391
+
10392
+ var originalDocument = window.document;
10393
+
10394
+ var document = window.document;
10395
+ var DocumentFragment = window.DocumentFragment,
10396
+ HTMLTemplateElement = window.HTMLTemplateElement,
10397
+ Node = window.Node,
10398
+ Element = window.Element,
10399
+ NodeFilter = window.NodeFilter,
10400
+ _window$NamedNodeMap = window.NamedNodeMap,
10401
+ NamedNodeMap = _window$NamedNodeMap === undefined ? window.NamedNodeMap || window.MozNamedAttrMap : _window$NamedNodeMap,
10402
+ Text = window.Text,
10403
+ Comment = window.Comment,
10404
+ DOMParser = window.DOMParser,
10405
+ trustedTypes = window.trustedTypes;
10406
+
10407
+
10408
+ var ElementPrototype = Element.prototype;
10409
+
10410
+ var cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
10411
+ var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
10412
+ var getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
10413
+ var getParentNode = lookupGetter(ElementPrototype, 'parentNode');
10414
+
10415
+ // As per issue #47, the web-components registry is inherited by a
10416
+ // new document created via createHTMLDocument. As per the spec
10417
+ // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
10418
+ // a new empty registry is used when creating a template contents owner
10419
+ // document, so we use that as our parent document to ensure nothing
10420
+ // is inherited.
10421
+ if (typeof HTMLTemplateElement === 'function') {
10422
+ var template = document.createElement('template');
10423
+ if (template.content && template.content.ownerDocument) {
10424
+ document = template.content.ownerDocument;
10425
+ }
10426
+ }
10427
+
10428
+ var trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, originalDocument);
10429
+ var emptyHTML = trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML('') : '';
10430
+
10431
+ var _document = document,
10432
+ implementation = _document.implementation,
10433
+ createNodeIterator = _document.createNodeIterator,
10434
+ createDocumentFragment = _document.createDocumentFragment,
10435
+ getElementsByTagName = _document.getElementsByTagName;
10436
+ var importNode = originalDocument.importNode;
10437
+
10438
+
10439
+ var documentMode = {};
10440
+ try {
10441
+ documentMode = clone(document).documentMode ? document.documentMode : {};
10442
+ } catch (_) {}
10443
+
10444
+ var hooks = {};
10445
+
10446
+ /**
10447
+ * Expose whether this browser supports running the full DOMPurify.
10448
+ */
10449
+ DOMPurify.isSupported = typeof getParentNode === 'function' && implementation && typeof implementation.createHTMLDocument !== 'undefined' && documentMode !== 9;
10450
+
10451
+ var MUSTACHE_EXPR$$1 = MUSTACHE_EXPR,
10452
+ ERB_EXPR$$1 = ERB_EXPR,
10453
+ DATA_ATTR$$1 = DATA_ATTR,
10454
+ ARIA_ATTR$$1 = ARIA_ATTR,
10455
+ IS_SCRIPT_OR_DATA$$1 = IS_SCRIPT_OR_DATA,
10456
+ ATTR_WHITESPACE$$1 = ATTR_WHITESPACE;
10457
+ var IS_ALLOWED_URI$$1 = IS_ALLOWED_URI;
10458
+
10459
+ /**
10460
+ * We consider the elements and attributes below to be safe. Ideally
10461
+ * don't add any new ones but feel free to remove unwanted ones.
10462
+ */
10463
+
10464
+ /* allowed element names */
10465
+
10466
+ var ALLOWED_TAGS = null;
10467
+ var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(html), _toConsumableArray$1(svg), _toConsumableArray$1(svgFilters), _toConsumableArray$1(mathMl), _toConsumableArray$1(text)));
10468
+
10469
+ /* Allowed attribute names */
10470
+ var ALLOWED_ATTR = null;
10471
+ var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(_toConsumableArray$1(html$1), _toConsumableArray$1(svg$1), _toConsumableArray$1(mathMl$1), _toConsumableArray$1(xml)));
10472
+
10473
+ /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
10474
+ var FORBID_TAGS = null;
10475
+
10476
+ /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
10477
+ var FORBID_ATTR = null;
10478
+
10479
+ /* Decide if ARIA attributes are okay */
10480
+ var ALLOW_ARIA_ATTR = true;
10481
+
10482
+ /* Decide if custom data attributes are okay */
10483
+ var ALLOW_DATA_ATTR = true;
10484
+
10485
+ /* Decide if unknown protocols are okay */
10486
+ var ALLOW_UNKNOWN_PROTOCOLS = false;
10487
+
10488
+ /* Output should be safe for common template engines.
10489
+ * This means, DOMPurify removes data attributes, mustaches and ERB
10490
+ */
10491
+ var SAFE_FOR_TEMPLATES = false;
10492
+
10493
+ /* Decide if document with <html>... should be returned */
10494
+ var WHOLE_DOCUMENT = false;
10495
+
10496
+ /* Track whether config is already set on this instance of DOMPurify. */
10497
+ var SET_CONFIG = false;
10498
+
10499
+ /* Decide if all elements (e.g. style, script) must be children of
10500
+ * document.body. By default, browsers might move them to document.head */
10501
+ var FORCE_BODY = false;
10502
+
10503
+ /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
10504
+ * string (or a TrustedHTML object if Trusted Types are supported).
10505
+ * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
10506
+ */
10507
+ var RETURN_DOM = false;
10508
+
10509
+ /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
10510
+ * string (or a TrustedHTML object if Trusted Types are supported) */
10511
+ var RETURN_DOM_FRAGMENT = false;
10512
+
10513
+ /* If `RETURN_DOM` or `RETURN_DOM_FRAGMENT` is enabled, decide if the returned DOM
10514
+ * `Node` is imported into the current `Document`. If this flag is not enabled the
10515
+ * `Node` will belong (its ownerDocument) to a fresh `HTMLDocument`, created by
10516
+ * DOMPurify.
10517
+ *
10518
+ * This defaults to `true` starting DOMPurify 2.2.0. Note that setting it to `false`
10519
+ * might cause XSS from attacks hidden in closed shadowroots in case the browser
10520
+ * supports Declarative Shadow: DOM https://web.dev/declarative-shadow-dom/
10521
+ */
10522
+ var RETURN_DOM_IMPORT = true;
10523
+
10524
+ /* Try to return a Trusted Type object instead of a string, return a string in
10525
+ * case Trusted Types are not supported */
10526
+ var RETURN_TRUSTED_TYPE = false;
10527
+
10528
+ /* Output should be free from DOM clobbering attacks? */
10529
+ var SANITIZE_DOM = true;
10530
+
10531
+ /* Keep element content when removing element? */
10532
+ var KEEP_CONTENT = true;
10533
+
10534
+ /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
10535
+ * of importing it into a new Document and returning a sanitized copy */
10536
+ var IN_PLACE = false;
10537
+
10538
+ /* Allow usage of profiles like html, svg and mathMl */
10539
+ var USE_PROFILES = {};
10540
+
10541
+ /* Tags to ignore content of when KEEP_CONTENT is true */
10542
+ var FORBID_CONTENTS = null;
10543
+ var DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
10544
+
10545
+ /* Tags that are safe for data: URIs */
10546
+ var DATA_URI_TAGS = null;
10547
+ var DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
10548
+
10549
+ /* Attributes safe for values like "javascript:" */
10550
+ var URI_SAFE_ATTRIBUTES = null;
10551
+ var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
10552
+
10553
+ var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
10554
+ var SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
10555
+ var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
10556
+ /* Document namespace */
10557
+ var NAMESPACE = HTML_NAMESPACE;
10558
+ var IS_EMPTY_INPUT = false;
10559
+
10560
+ /* Parsing of strict XHTML documents */
10561
+ var PARSER_MEDIA_TYPE = void 0;
10562
+ var SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
10563
+ var DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
10564
+ var transformCaseFunc = void 0;
10565
+
10566
+ /* Keep a reference to config to pass to hooks */
10567
+ var CONFIG = null;
10568
+
10569
+ /* Ideally, do not touch anything below this line */
10570
+ /* ______________________________________________ */
10571
+
10572
+ var formElement = document.createElement('form');
10573
+
10574
+ /**
10575
+ * _parseConfig
10576
+ *
10577
+ * @param {Object} cfg optional config literal
10578
+ */
10579
+ // eslint-disable-next-line complexity
10580
+ var _parseConfig = function _parseConfig(cfg) {
10581
+ if (CONFIG && CONFIG === cfg) {
10582
+ return;
10583
+ }
10584
+
10585
+ /* Shield configuration object from tampering */
10586
+ if (!cfg || (typeof cfg === 'undefined' ? 'undefined' : _typeof(cfg)) !== 'object') {
10587
+ cfg = {};
10588
+ }
10589
+
10590
+ /* Shield configuration object from prototype pollution */
10591
+ cfg = clone(cfg);
10592
+
10593
+ /* Set configuration parameters */
10594
+ ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS) : DEFAULT_ALLOWED_TAGS;
10595
+ ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR) : DEFAULT_ALLOWED_ATTR;
10596
+ URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR) : DEFAULT_URI_SAFE_ATTRIBUTES;
10597
+ DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS) : DEFAULT_DATA_URI_TAGS;
10598
+ FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS) : DEFAULT_FORBID_CONTENTS;
10599
+ FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS) : {};
10600
+ FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR) : {};
10601
+ USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
10602
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
10603
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
10604
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
10605
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
10606
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
10607
+ RETURN_DOM = cfg.RETURN_DOM || false; // Default false
10608
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
10609
+ RETURN_DOM_IMPORT = cfg.RETURN_DOM_IMPORT !== false; // Default true
10610
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
10611
+ FORCE_BODY = cfg.FORCE_BODY || false; // Default false
10612
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
10613
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
10614
+ IN_PLACE = cfg.IN_PLACE || false; // Default false
10615
+ IS_ALLOWED_URI$$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$$1;
10616
+ NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
10617
+
10618
+ PARSER_MEDIA_TYPE =
10619
+ // eslint-disable-next-line unicorn/prefer-includes
10620
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE;
10621
+
10622
+ // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
10623
+ transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? function (x) {
10624
+ return x;
10625
+ } : stringToLowerCase;
10626
+
10627
+ if (SAFE_FOR_TEMPLATES) {
10628
+ ALLOW_DATA_ATTR = false;
10629
+ }
10630
+
10631
+ if (RETURN_DOM_FRAGMENT) {
10632
+ RETURN_DOM = true;
10633
+ }
10634
+
10635
+ /* Parse profile info */
10636
+ if (USE_PROFILES) {
10637
+ ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(text)));
10638
+ ALLOWED_ATTR = [];
10639
+ if (USE_PROFILES.html === true) {
10640
+ addToSet(ALLOWED_TAGS, html);
10641
+ addToSet(ALLOWED_ATTR, html$1);
10642
+ }
10643
+
10644
+ if (USE_PROFILES.svg === true) {
10645
+ addToSet(ALLOWED_TAGS, svg);
10646
+ addToSet(ALLOWED_ATTR, svg$1);
10647
+ addToSet(ALLOWED_ATTR, xml);
10648
+ }
10649
+
10650
+ if (USE_PROFILES.svgFilters === true) {
10651
+ addToSet(ALLOWED_TAGS, svgFilters);
10652
+ addToSet(ALLOWED_ATTR, svg$1);
10653
+ addToSet(ALLOWED_ATTR, xml);
10654
+ }
10655
+
10656
+ if (USE_PROFILES.mathMl === true) {
10657
+ addToSet(ALLOWED_TAGS, mathMl);
10658
+ addToSet(ALLOWED_ATTR, mathMl$1);
10659
+ addToSet(ALLOWED_ATTR, xml);
10660
+ }
10661
+ }
10662
+
10663
+ /* Merge configuration parameters */
10664
+ if (cfg.ADD_TAGS) {
10665
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
10666
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
10667
+ }
10668
+
10669
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS);
10670
+ }
10671
+
10672
+ if (cfg.ADD_ATTR) {
10673
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
10674
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
10675
+ }
10676
+
10677
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR);
10678
+ }
10679
+
10680
+ if (cfg.ADD_URI_SAFE_ATTR) {
10681
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR);
10682
+ }
10683
+
10684
+ if (cfg.FORBID_CONTENTS) {
10685
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
10686
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
10687
+ }
10688
+
10689
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS);
10690
+ }
10691
+
10692
+ /* Add #text in case KEEP_CONTENT is set to true */
10693
+ if (KEEP_CONTENT) {
10694
+ ALLOWED_TAGS['#text'] = true;
10695
+ }
10696
+
10697
+ /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
10698
+ if (WHOLE_DOCUMENT) {
10699
+ addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
10700
+ }
10701
+
10702
+ /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
10703
+ if (ALLOWED_TAGS.table) {
10704
+ addToSet(ALLOWED_TAGS, ['tbody']);
10705
+ delete FORBID_TAGS.tbody;
10706
+ }
10707
+
10708
+ // Prevent further manipulation of configuration.
10709
+ // Not available in IE8, Safari 5, etc.
10710
+ if (freeze) {
10711
+ freeze(cfg);
10712
+ }
10713
+
10714
+ CONFIG = cfg;
10715
+ };
10716
+
10717
+ var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
10718
+
10719
+ var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']);
10720
+
10721
+ /* Keep track of all possible SVG and MathML tags
10722
+ * so that we can perform the namespace checks
10723
+ * correctly. */
10724
+ var ALL_SVG_TAGS = addToSet({}, svg);
10725
+ addToSet(ALL_SVG_TAGS, svgFilters);
10726
+ addToSet(ALL_SVG_TAGS, svgDisallowed);
10727
+
10728
+ var ALL_MATHML_TAGS = addToSet({}, mathMl);
10729
+ addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
10730
+
10731
+ /**
10732
+ *
10733
+ *
10734
+ * @param {Element} element a DOM element whose namespace is being checked
10735
+ * @returns {boolean} Return false if the element has a
10736
+ * namespace that a spec-compliant parser would never
10737
+ * return. Return true otherwise.
10738
+ */
10739
+ var _checkValidNamespace = function _checkValidNamespace(element) {
10740
+ var parent = getParentNode(element);
10741
+
10742
+ // In JSDOM, if we're inside shadow DOM, then parentNode
10743
+ // can be null. We just simulate parent in this case.
10744
+ if (!parent || !parent.tagName) {
10745
+ parent = {
10746
+ namespaceURI: HTML_NAMESPACE,
10747
+ tagName: 'template'
10748
+ };
10749
+ }
10750
+
10751
+ var tagName = stringToLowerCase(element.tagName);
10752
+ var parentTagName = stringToLowerCase(parent.tagName);
10753
+
10754
+ if (element.namespaceURI === SVG_NAMESPACE) {
10755
+ // The only way to switch from HTML namespace to SVG
10756
+ // is via <svg>. If it happens via any other tag, then
10757
+ // it should be killed.
10758
+ if (parent.namespaceURI === HTML_NAMESPACE) {
10759
+ return tagName === 'svg';
10760
+ }
10761
+
10762
+ // The only way to switch from MathML to SVG is via
10763
+ // svg if parent is either <annotation-xml> or MathML
10764
+ // text integration points.
10765
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
10766
+ return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
10767
+ }
10768
+
10769
+ // We only allow elements that are defined in SVG
10770
+ // spec. All others are disallowed in SVG namespace.
10771
+ return Boolean(ALL_SVG_TAGS[tagName]);
10772
+ }
10773
+
10774
+ if (element.namespaceURI === MATHML_NAMESPACE) {
10775
+ // The only way to switch from HTML namespace to MathML
10776
+ // is via <math>. If it happens via any other tag, then
10777
+ // it should be killed.
10778
+ if (parent.namespaceURI === HTML_NAMESPACE) {
10779
+ return tagName === 'math';
10780
+ }
10781
+
10782
+ // The only way to switch from SVG to MathML is via
10783
+ // <math> and HTML integration points
10784
+ if (parent.namespaceURI === SVG_NAMESPACE) {
10785
+ return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
10786
+ }
10787
+
10788
+ // We only allow elements that are defined in MathML
10789
+ // spec. All others are disallowed in MathML namespace.
10790
+ return Boolean(ALL_MATHML_TAGS[tagName]);
10791
+ }
10792
+
10793
+ if (element.namespaceURI === HTML_NAMESPACE) {
10794
+ // The only way to switch from SVG to HTML is via
10795
+ // HTML integration points, and from MathML to HTML
10796
+ // is via MathML text integration points
10797
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
10798
+ return false;
10799
+ }
10800
+
10801
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
10802
+ return false;
10803
+ }
10804
+
10805
+ // Certain elements are allowed in both SVG and HTML
10806
+ // namespace. We need to specify them explicitly
10807
+ // so that they don't get erronously deleted from
10808
+ // HTML namespace.
10809
+ var commonSvgAndHTMLElements = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
10810
+
10811
+ // We disallow tags that are specific for MathML
10812
+ // or SVG and should never appear in HTML namespace
10813
+ return !ALL_MATHML_TAGS[tagName] && (commonSvgAndHTMLElements[tagName] || !ALL_SVG_TAGS[tagName]);
10814
+ }
10815
+
10816
+ // The code should never reach this place (this means
10817
+ // that the element somehow got namespace that is not
10818
+ // HTML, SVG or MathML). Return false just in case.
10819
+ return false;
10820
+ };
10821
+
10822
+ /**
10823
+ * _forceRemove
10824
+ *
10825
+ * @param {Node} node a DOM node
10826
+ */
10827
+ var _forceRemove = function _forceRemove(node) {
10828
+ arrayPush(DOMPurify.removed, { element: node });
10829
+ try {
10830
+ // eslint-disable-next-line unicorn/prefer-dom-node-remove
10831
+ node.parentNode.removeChild(node);
10832
+ } catch (_) {
10833
+ try {
10834
+ node.outerHTML = emptyHTML;
10835
+ } catch (_) {
10836
+ node.remove();
10837
+ }
10838
+ }
10839
+ };
10840
+
10841
+ /**
10842
+ * _removeAttribute
10843
+ *
10844
+ * @param {String} name an Attribute name
10845
+ * @param {Node} node a DOM node
10846
+ */
10847
+ var _removeAttribute = function _removeAttribute(name, node) {
10848
+ try {
10849
+ arrayPush(DOMPurify.removed, {
10850
+ attribute: node.getAttributeNode(name),
10851
+ from: node
10852
+ });
10853
+ } catch (_) {
10854
+ arrayPush(DOMPurify.removed, {
10855
+ attribute: null,
10856
+ from: node
10857
+ });
10858
+ }
10859
+
10860
+ node.removeAttribute(name);
10861
+
10862
+ // We void attribute values for unremovable "is"" attributes
10863
+ if (name === 'is' && !ALLOWED_ATTR[name]) {
10864
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
10865
+ try {
10866
+ _forceRemove(node);
10867
+ } catch (_) {}
10868
+ } else {
10869
+ try {
10870
+ node.setAttribute(name, '');
10871
+ } catch (_) {}
10872
+ }
10873
+ }
10874
+ };
10875
+
10876
+ /**
10877
+ * _initDocument
10878
+ *
10879
+ * @param {String} dirty a string of dirty markup
10880
+ * @return {Document} a DOM, filled with the dirty markup
10881
+ */
10882
+ var _initDocument = function _initDocument(dirty) {
10883
+ /* Create a HTML document */
10884
+ var doc = void 0;
10885
+ var leadingWhitespace = void 0;
10886
+
10887
+ if (FORCE_BODY) {
10888
+ dirty = '<remove></remove>' + dirty;
10889
+ } else {
10890
+ /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
10891
+ var matches = stringMatch(dirty, /^[\r\n\t ]+/);
10892
+ leadingWhitespace = matches && matches[0];
10893
+ }
10894
+
10895
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml') {
10896
+ // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
10897
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
10898
+ }
10899
+
10900
+ var dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
10901
+ /*
10902
+ * Use the DOMParser API by default, fallback later if needs be
10903
+ * DOMParser not work for svg when has multiple root element.
10904
+ */
10905
+ if (NAMESPACE === HTML_NAMESPACE) {
10906
+ try {
10907
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
10908
+ } catch (_) {}
10909
+ }
10910
+
10911
+ /* Use createHTMLDocument in case DOMParser is not available */
10912
+ if (!doc || !doc.documentElement) {
10913
+ doc = implementation.createDocument(NAMESPACE, 'template', null);
10914
+ try {
10915
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload;
10916
+ } catch (_) {
10917
+ // Syntax error if dirtyPayload is invalid xml
10918
+ }
10919
+ }
10920
+
10921
+ var body = doc.body || doc.documentElement;
10922
+
10923
+ if (dirty && leadingWhitespace) {
10924
+ body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
10925
+ }
10926
+
10927
+ /* Work on whole document or just its body */
10928
+ if (NAMESPACE === HTML_NAMESPACE) {
10929
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
10930
+ }
10931
+
10932
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
10933
+ };
10934
+
10935
+ /**
10936
+ * _createIterator
10937
+ *
10938
+ * @param {Document} root document/fragment to create iterator for
10939
+ * @return {Iterator} iterator instance
10940
+ */
10941
+ var _createIterator = function _createIterator(root) {
10942
+ return createNodeIterator.call(root.ownerDocument || root, root, NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
10943
+ };
10944
+
10945
+ /**
10946
+ * _isClobbered
10947
+ *
10948
+ * @param {Node} elm element to check for clobbering attacks
10949
+ * @return {Boolean} true if clobbered, false if safe
10950
+ */
10951
+ var _isClobbered = function _isClobbered(elm) {
10952
+ if (elm instanceof Text || elm instanceof Comment) {
10953
+ return false;
10954
+ }
10955
+
10956
+ if (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function') {
10957
+ return true;
10958
+ }
10959
+
10960
+ return false;
10961
+ };
10962
+
10963
+ /**
10964
+ * _isNode
10965
+ *
10966
+ * @param {Node} obj object to check whether it's a DOM node
10967
+ * @return {Boolean} true is object is a DOM node
10968
+ */
10969
+ var _isNode = function _isNode(object) {
10970
+ return (typeof Node === 'undefined' ? 'undefined' : _typeof(Node)) === 'object' ? object instanceof Node : object && (typeof object === 'undefined' ? 'undefined' : _typeof(object)) === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
10971
+ };
10972
+
10973
+ /**
10974
+ * _executeHook
10975
+ * Execute user configurable hooks
10976
+ *
10977
+ * @param {String} entryPoint Name of the hook's entry point
10978
+ * @param {Node} currentNode node to work on with the hook
10979
+ * @param {Object} data additional hook parameters
10980
+ */
10981
+ var _executeHook = function _executeHook(entryPoint, currentNode, data) {
10982
+ if (!hooks[entryPoint]) {
10983
+ return;
10984
+ }
10985
+
10986
+ arrayForEach(hooks[entryPoint], function (hook) {
10987
+ hook.call(DOMPurify, currentNode, data, CONFIG);
10988
+ });
10989
+ };
10990
+
10991
+ /**
10992
+ * _sanitizeElements
10993
+ *
10994
+ * @protect nodeName
10995
+ * @protect textContent
10996
+ * @protect removeChild
10997
+ *
10998
+ * @param {Node} currentNode to check for permission to exist
10999
+ * @return {Boolean} true if node was killed, false if left alive
11000
+ */
11001
+ var _sanitizeElements = function _sanitizeElements(currentNode) {
11002
+ var content = void 0;
11003
+
11004
+ /* Execute a hook if present */
11005
+ _executeHook('beforeSanitizeElements', currentNode, null);
11006
+
11007
+ /* Check if element is clobbered or can clobber */
11008
+ if (_isClobbered(currentNode)) {
11009
+ _forceRemove(currentNode);
11010
+ return true;
11011
+ }
11012
+
11013
+ /* Check if tagname contains Unicode */
11014
+ if (stringMatch(currentNode.nodeName, /[\u0080-\uFFFF]/)) {
11015
+ _forceRemove(currentNode);
11016
+ return true;
11017
+ }
11018
+
11019
+ /* Now let's check the element's type and name */
11020
+ var tagName = transformCaseFunc(currentNode.nodeName);
11021
+
11022
+ /* Execute a hook if present */
11023
+ _executeHook('uponSanitizeElement', currentNode, {
11024
+ tagName: tagName,
11025
+ allowedTags: ALLOWED_TAGS
11026
+ });
11027
+
11028
+ /* Detect mXSS attempts abusing namespace confusion */
11029
+ if (!_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
11030
+ _forceRemove(currentNode);
11031
+ return true;
11032
+ }
11033
+
11034
+ /* Mitigate a problem with templates inside select */
11035
+ if (tagName === 'select' && regExpTest(/<template/i, currentNode.innerHTML)) {
11036
+ _forceRemove(currentNode);
11037
+ return true;
11038
+ }
11039
+
11040
+ /* Remove element if anything forbids its presence */
11041
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
11042
+ /* Keep content except for bad-listed elements */
11043
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
11044
+ var parentNode = getParentNode(currentNode) || currentNode.parentNode;
11045
+ var childNodes = getChildNodes(currentNode) || currentNode.childNodes;
11046
+
11047
+ if (childNodes && parentNode) {
11048
+ var childCount = childNodes.length;
11049
+
11050
+ for (var i = childCount - 1; i >= 0; --i) {
11051
+ parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
11052
+ }
11053
+ }
11054
+ }
11055
+
11056
+ _forceRemove(currentNode);
11057
+ return true;
11058
+ }
11059
+
11060
+ /* Check whether element has a valid namespace */
11061
+ if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
11062
+ _forceRemove(currentNode);
11063
+ return true;
11064
+ }
11065
+
11066
+ if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
11067
+ _forceRemove(currentNode);
11068
+ return true;
11069
+ }
11070
+
11071
+ /* Sanitize element content to be template-safe */
11072
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
11073
+ /* Get the element's text content */
11074
+ content = currentNode.textContent;
11075
+ content = stringReplace(content, MUSTACHE_EXPR$$1, ' ');
11076
+ content = stringReplace(content, ERB_EXPR$$1, ' ');
11077
+ if (currentNode.textContent !== content) {
11078
+ arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });
11079
+ currentNode.textContent = content;
11080
+ }
11081
+ }
11082
+
11083
+ /* Execute a hook if present */
11084
+ _executeHook('afterSanitizeElements', currentNode, null);
11085
+
11086
+ return false;
11087
+ };
11088
+
11089
+ /**
11090
+ * _isValidAttribute
11091
+ *
11092
+ * @param {string} lcTag Lowercase tag name of containing element.
11093
+ * @param {string} lcName Lowercase attribute name.
11094
+ * @param {string} value Attribute value.
11095
+ * @return {Boolean} Returns true if `value` is valid, otherwise false.
11096
+ */
11097
+ // eslint-disable-next-line complexity
11098
+ var _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
11099
+ /* Make sure attribute cannot clobber */
11100
+ if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
11101
+ return false;
11102
+ }
11103
+
11104
+ /* Allow valid data-* attributes: At least one character after "-"
11105
+ (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
11106
+ XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
11107
+ We don't need to check the value; it's always URI safe. */
11108
+ if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$$1, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$$1, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
11109
+ return false;
11110
+
11111
+ /* Check value is safe. First, is attr inert? If so, is safe */
11112
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$$1, stringReplace(value, ATTR_WHITESPACE$$1, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$$1, stringReplace(value, ATTR_WHITESPACE$$1, ''))) ; else if (!value) ; else {
11113
+ return false;
11114
+ }
11115
+
11116
+ return true;
11117
+ };
11118
+
11119
+ /**
11120
+ * _sanitizeAttributes
11121
+ *
11122
+ * @protect attributes
11123
+ * @protect nodeName
11124
+ * @protect removeAttribute
11125
+ * @protect setAttribute
11126
+ *
11127
+ * @param {Node} currentNode to sanitize
11128
+ */
11129
+ var _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
11130
+ var attr = void 0;
11131
+ var value = void 0;
11132
+ var lcName = void 0;
11133
+ var l = void 0;
11134
+ /* Execute a hook if present */
11135
+ _executeHook('beforeSanitizeAttributes', currentNode, null);
11136
+
11137
+ var attributes = currentNode.attributes;
11138
+
11139
+ /* Check if we have attributes; if not we might have a text node */
11140
+
11141
+ if (!attributes) {
11142
+ return;
11143
+ }
11144
+
11145
+ var hookEvent = {
11146
+ attrName: '',
11147
+ attrValue: '',
11148
+ keepAttr: true,
11149
+ allowedAttributes: ALLOWED_ATTR
11150
+ };
11151
+ l = attributes.length;
11152
+
11153
+ /* Go backwards over all attributes; safely remove bad ones */
11154
+ while (l--) {
11155
+ attr = attributes[l];
11156
+ var _attr = attr,
11157
+ name = _attr.name,
11158
+ namespaceURI = _attr.namespaceURI;
11159
+
11160
+ value = stringTrim(attr.value);
11161
+ lcName = transformCaseFunc(name);
11162
+
11163
+ /* Execute a hook if present */
11164
+ hookEvent.attrName = lcName;
11165
+ hookEvent.attrValue = value;
11166
+ hookEvent.keepAttr = true;
11167
+ hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
11168
+ _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
11169
+ value = hookEvent.attrValue;
11170
+ /* Did the hooks approve of the attribute? */
11171
+ if (hookEvent.forceKeepAttr) {
11172
+ continue;
11173
+ }
11174
+
11175
+ /* Remove attribute */
11176
+ _removeAttribute(name, currentNode);
11177
+
11178
+ /* Did the hooks approve of the attribute? */
11179
+ if (!hookEvent.keepAttr) {
11180
+ continue;
11181
+ }
11182
+
11183
+ /* Work around a security issue in jQuery 3.0 */
11184
+ if (regExpTest(/\/>/i, value)) {
11185
+ _removeAttribute(name, currentNode);
11186
+ continue;
11187
+ }
11188
+
11189
+ /* Sanitize attribute content to be template-safe */
11190
+ if (SAFE_FOR_TEMPLATES) {
11191
+ value = stringReplace(value, MUSTACHE_EXPR$$1, ' ');
11192
+ value = stringReplace(value, ERB_EXPR$$1, ' ');
11193
+ }
11194
+
11195
+ /* Is `value` valid for this attribute? */
11196
+ var lcTag = transformCaseFunc(currentNode.nodeName);
11197
+ if (!_isValidAttribute(lcTag, lcName, value)) {
11198
+ continue;
11199
+ }
11200
+
11201
+ /* Handle invalid data-* attribute set by try-catching it */
11202
+ try {
11203
+ if (namespaceURI) {
11204
+ currentNode.setAttributeNS(namespaceURI, name, value);
11205
+ } else {
11206
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
11207
+ currentNode.setAttribute(name, value);
11208
+ }
11209
+
11210
+ arrayPop(DOMPurify.removed);
11211
+ } catch (_) {}
11212
+ }
11213
+
11214
+ /* Execute a hook if present */
11215
+ _executeHook('afterSanitizeAttributes', currentNode, null);
11216
+ };
11217
+
11218
+ /**
11219
+ * _sanitizeShadowDOM
11220
+ *
11221
+ * @param {DocumentFragment} fragment to iterate over recursively
11222
+ */
11223
+ var _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
11224
+ var shadowNode = void 0;
11225
+ var shadowIterator = _createIterator(fragment);
11226
+
11227
+ /* Execute a hook if present */
11228
+ _executeHook('beforeSanitizeShadowDOM', fragment, null);
11229
+
11230
+ while (shadowNode = shadowIterator.nextNode()) {
11231
+ /* Execute a hook if present */
11232
+ _executeHook('uponSanitizeShadowNode', shadowNode, null);
11233
+
11234
+ /* Sanitize tags and elements */
11235
+ if (_sanitizeElements(shadowNode)) {
11236
+ continue;
11237
+ }
11238
+
11239
+ /* Deep shadow DOM detected */
11240
+ if (shadowNode.content instanceof DocumentFragment) {
11241
+ _sanitizeShadowDOM(shadowNode.content);
11242
+ }
11243
+
11244
+ /* Check attributes, sanitize if necessary */
11245
+ _sanitizeAttributes(shadowNode);
11246
+ }
11247
+
11248
+ /* Execute a hook if present */
11249
+ _executeHook('afterSanitizeShadowDOM', fragment, null);
11250
+ };
11251
+
11252
+ /**
11253
+ * Sanitize
11254
+ * Public method providing core sanitation functionality
11255
+ *
11256
+ * @param {String|Node} dirty string or DOM node
11257
+ * @param {Object} configuration object
11258
+ */
11259
+ // eslint-disable-next-line complexity
11260
+ DOMPurify.sanitize = function (dirty, cfg) {
11261
+ var body = void 0;
11262
+ var importedNode = void 0;
11263
+ var currentNode = void 0;
11264
+ var oldNode = void 0;
11265
+ var returnNode = void 0;
11266
+ /* Make sure we have a string to sanitize.
11267
+ DO NOT return early, as this will return the wrong type if
11268
+ the user has requested a DOM object rather than a string */
11269
+ IS_EMPTY_INPUT = !dirty;
11270
+ if (IS_EMPTY_INPUT) {
11271
+ dirty = '<!-->';
11272
+ }
11273
+
11274
+ /* Stringify, in case dirty is an object */
11275
+ if (typeof dirty !== 'string' && !_isNode(dirty)) {
11276
+ // eslint-disable-next-line no-negated-condition
11277
+ if (typeof dirty.toString !== 'function') {
11278
+ throw typeErrorCreate('toString is not a function');
11279
+ } else {
11280
+ dirty = dirty.toString();
11281
+ if (typeof dirty !== 'string') {
11282
+ throw typeErrorCreate('dirty is not a string, aborting');
11283
+ }
11284
+ }
11285
+ }
11286
+
11287
+ /* Check we can run. Otherwise fall back or ignore */
11288
+ if (!DOMPurify.isSupported) {
11289
+ if (_typeof(window.toStaticHTML) === 'object' || typeof window.toStaticHTML === 'function') {
11290
+ if (typeof dirty === 'string') {
11291
+ return window.toStaticHTML(dirty);
11292
+ }
11293
+
11294
+ if (_isNode(dirty)) {
11295
+ return window.toStaticHTML(dirty.outerHTML);
11296
+ }
11297
+ }
11298
+
11299
+ return dirty;
11300
+ }
11301
+
11302
+ /* Assign config vars */
11303
+ if (!SET_CONFIG) {
11304
+ _parseConfig(cfg);
11305
+ }
11306
+
11307
+ /* Clean up removed elements */
11308
+ DOMPurify.removed = [];
11309
+
11310
+ /* Check if dirty is correctly typed for IN_PLACE */
11311
+ if (typeof dirty === 'string') {
11312
+ IN_PLACE = false;
11313
+ }
11314
+
11315
+ if (IN_PLACE) ; else if (dirty instanceof Node) {
11316
+ /* If dirty is a DOM element, append to an empty document to avoid
11317
+ elements being stripped by the parser */
11318
+ body = _initDocument('<!---->');
11319
+ importedNode = body.ownerDocument.importNode(dirty, true);
11320
+ if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
11321
+ /* Node is already a body, use as is */
11322
+ body = importedNode;
11323
+ } else if (importedNode.nodeName === 'HTML') {
11324
+ body = importedNode;
11325
+ } else {
11326
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
11327
+ body.appendChild(importedNode);
11328
+ }
11329
+ } else {
11330
+ /* Exit directly if we have nothing to do */
11331
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
11332
+ // eslint-disable-next-line unicorn/prefer-includes
11333
+ dirty.indexOf('<') === -1) {
11334
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
11335
+ }
11336
+
11337
+ /* Initialize the document to work on */
11338
+ body = _initDocument(dirty);
11339
+
11340
+ /* Check we have a DOM node from the data */
11341
+ if (!body) {
11342
+ return RETURN_DOM ? null : emptyHTML;
11343
+ }
11344
+ }
11345
+
11346
+ /* Remove first element node (ours) if FORCE_BODY is set */
11347
+ if (body && FORCE_BODY) {
11348
+ _forceRemove(body.firstChild);
11349
+ }
11350
+
11351
+ /* Get node iterator */
11352
+ var nodeIterator = _createIterator(IN_PLACE ? dirty : body);
11353
+
11354
+ /* Now start iterating over the created document */
11355
+ while (currentNode = nodeIterator.nextNode()) {
11356
+ /* Fix IE's strange behavior with manipulated textNodes #89 */
11357
+ if (currentNode.nodeType === 3 && currentNode === oldNode) {
11358
+ continue;
11359
+ }
11360
+
11361
+ /* Sanitize tags and elements */
11362
+ if (_sanitizeElements(currentNode)) {
11363
+ continue;
11364
+ }
11365
+
11366
+ /* Shadow DOM detected, sanitize it */
11367
+ if (currentNode.content instanceof DocumentFragment) {
11368
+ _sanitizeShadowDOM(currentNode.content);
11369
+ }
11370
+
11371
+ /* Check attributes, sanitize if necessary */
11372
+ _sanitizeAttributes(currentNode);
11373
+
11374
+ oldNode = currentNode;
11375
+ }
11376
+
11377
+ oldNode = null;
11378
+
11379
+ /* If we sanitized `dirty` in-place, return it. */
11380
+ if (IN_PLACE) {
11381
+ return dirty;
11382
+ }
11383
+
11384
+ /* Return sanitized string or DOM */
11385
+ if (RETURN_DOM) {
11386
+ if (RETURN_DOM_FRAGMENT) {
11387
+ returnNode = createDocumentFragment.call(body.ownerDocument);
11388
+
11389
+ while (body.firstChild) {
11390
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
11391
+ returnNode.appendChild(body.firstChild);
11392
+ }
11393
+ } else {
11394
+ returnNode = body;
11395
+ }
11396
+
11397
+ if (RETURN_DOM_IMPORT) {
11398
+ /*
11399
+ AdoptNode() is not used because internal state is not reset
11400
+ (e.g. the past names map of a HTMLFormElement), this is safe
11401
+ in theory but we would rather not risk another attack vector.
11402
+ The state that is cloned by importNode() is explicitly defined
11403
+ by the specs.
11404
+ */
11405
+ returnNode = importNode.call(originalDocument, returnNode, true);
11406
+ }
11407
+
11408
+ return returnNode;
11409
+ }
11410
+
11411
+ var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
11412
+
11413
+ /* Sanitize final string template-safe */
11414
+ if (SAFE_FOR_TEMPLATES) {
11415
+ serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR$$1, ' ');
11416
+ serializedHTML = stringReplace(serializedHTML, ERB_EXPR$$1, ' ');
11417
+ }
11418
+
11419
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
11420
+ };
11421
+
11422
+ /**
11423
+ * Public method to set the configuration once
11424
+ * setConfig
11425
+ *
11426
+ * @param {Object} cfg configuration object
11427
+ */
11428
+ DOMPurify.setConfig = function (cfg) {
11429
+ _parseConfig(cfg);
11430
+ SET_CONFIG = true;
11431
+ };
11432
+
11433
+ /**
11434
+ * Public method to remove the configuration
11435
+ * clearConfig
11436
+ *
11437
+ */
11438
+ DOMPurify.clearConfig = function () {
11439
+ CONFIG = null;
11440
+ SET_CONFIG = false;
11441
+ };
11442
+
11443
+ /**
11444
+ * Public method to check if an attribute value is valid.
11445
+ * Uses last set config, if any. Otherwise, uses config defaults.
11446
+ * isValidAttribute
11447
+ *
11448
+ * @param {string} tag Tag name of containing element.
11449
+ * @param {string} attr Attribute name.
11450
+ * @param {string} value Attribute value.
11451
+ * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
11452
+ */
11453
+ DOMPurify.isValidAttribute = function (tag, attr, value) {
11454
+ /* Initialize shared config vars if necessary. */
11455
+ if (!CONFIG) {
11456
+ _parseConfig({});
11457
+ }
11458
+
11459
+ var lcTag = transformCaseFunc(tag);
11460
+ var lcName = transformCaseFunc(attr);
11461
+ return _isValidAttribute(lcTag, lcName, value);
11462
+ };
11463
+
11464
+ /**
11465
+ * AddHook
11466
+ * Public method to add DOMPurify hooks
11467
+ *
11468
+ * @param {String} entryPoint entry point for the hook to add
11469
+ * @param {Function} hookFunction function to execute
11470
+ */
11471
+ DOMPurify.addHook = function (entryPoint, hookFunction) {
11472
+ if (typeof hookFunction !== 'function') {
11473
+ return;
11474
+ }
11475
+
11476
+ hooks[entryPoint] = hooks[entryPoint] || [];
11477
+ arrayPush(hooks[entryPoint], hookFunction);
11478
+ };
11479
+
11480
+ /**
11481
+ * RemoveHook
11482
+ * Public method to remove a DOMPurify hook at a given entryPoint
11483
+ * (pops it from the stack of hooks if more are present)
11484
+ *
11485
+ * @param {String} entryPoint entry point for the hook to remove
11486
+ */
11487
+ DOMPurify.removeHook = function (entryPoint) {
11488
+ if (hooks[entryPoint]) {
11489
+ arrayPop(hooks[entryPoint]);
11490
+ }
11491
+ };
11492
+
11493
+ /**
11494
+ * RemoveHooks
11495
+ * Public method to remove all DOMPurify hooks at a given entryPoint
11496
+ *
11497
+ * @param {String} entryPoint entry point for the hooks to remove
11498
+ */
11499
+ DOMPurify.removeHooks = function (entryPoint) {
11500
+ if (hooks[entryPoint]) {
11501
+ hooks[entryPoint] = [];
11502
+ }
11503
+ };
11504
+
11505
+ /**
11506
+ * RemoveAllHooks
11507
+ * Public method to remove all DOMPurify hooks
11508
+ *
11509
+ */
11510
+ DOMPurify.removeAllHooks = function () {
11511
+ hooks = {};
11512
+ };
11513
+
11514
+ return DOMPurify;
11515
+ }
11516
+
11517
+ var purify = createDOMPurify();
11518
+
11519
+ var CAN_BE_WHITE_TAG_LIST = ['iframe', 'embed'];
11520
+ var whiteTagList = [];
11521
+ function registerTagWhitelistIfPossible(tagName) {
11522
+ if (includes(CAN_BE_WHITE_TAG_LIST, tagName)) {
11523
+ whiteTagList.push(tagName.toLowerCase());
11524
+ }
11525
+ }
11526
+ function sanitizeHTML(html, options) {
11527
+ return purify.sanitize(html, __assign$1({ ADD_TAGS: whiteTagList, ADD_ATTR: ['rel', 'target', 'hreflang', 'type'], FORBID_TAGS: [
11528
+ 'input',
11529
+ 'script',
11530
+ 'textarea',
11531
+ 'form',
11532
+ 'button',
11533
+ 'select',
11534
+ 'meta',
11535
+ 'style',
11536
+ 'link',
11537
+ 'title',
11538
+ 'object',
11539
+ 'base',
11540
+ ] }, options));
11541
+ }
11542
+
11543
+ function getChildrenHTML(node, typeName) {
11544
+ return node
11545
+ .literal.replace(new RegExp("(<\\s*" + typeName + "[^>]*>)|(</" + typeName + "\\s*[>])", 'ig'), '')
11546
+ .trim();
11547
+ }
11548
+ function getHTMLAttrsByHTMLString(html) {
11549
+ html = html.match(reHTMLTag)[0];
11550
+ var attrs = html.match(new RegExp(ATTRIBUTE, 'g'));
11551
+ return attrs
11552
+ ? attrs.reduce(function (acc, attr) {
11553
+ var _a = attr.trim().split('='), name = _a[0], values = _a.slice(1);
11554
+ if (values.length) {
11555
+ acc[name] = values.join('=').replace(/'|"/g, '').trim();
11556
+ }
11557
+ return acc;
11558
+ }, {})
11559
+ : {};
11560
+ }
11561
+
11562
+ var reCloseTag = /^\s*<\s*\//;
11563
+ var baseConvertors = {
11564
+ paragraph: function (_, _a) {
11565
+ var entering = _a.entering, origin = _a.origin, options = _a.options;
11566
+ if (options.nodeId) {
11567
+ return {
11568
+ type: entering ? 'openTag' : 'closeTag',
11569
+ outerNewLine: true,
11570
+ tagName: 'p',
11571
+ };
11572
+ }
11573
+ return origin();
11574
+ },
11575
+ softbreak: function (node) {
11576
+ var isPrevNodeHTML = node.prev && node.prev.type === 'htmlInline';
11577
+ var isPrevBR = isPrevNodeHTML && /<br ?\/?>/.test(node.prev.literal);
11578
+ var content = isPrevBR ? '\n' : '<br>\n';
11579
+ return { type: 'html', content: content };
11580
+ },
11581
+ item: function (node, _a) {
11582
+ var entering = _a.entering;
11583
+ if (entering) {
11584
+ var attributes = {};
11585
+ var classNames = [];
11586
+ if (node.listData.task) {
11587
+ attributes['data-task'] = '';
11588
+ classNames.push('task-list-item');
11589
+ if (node.listData.checked) {
11590
+ classNames.push('checked');
11591
+ attributes['data-task-checked'] = '';
11592
+ }
11593
+ }
11594
+ return {
11595
+ type: 'openTag',
11596
+ tagName: 'li',
11597
+ classNames: classNames,
11598
+ attributes: attributes,
11599
+ outerNewLine: true,
11600
+ };
10260
11601
  }
10261
11602
  return {
10262
11603
  type: 'closeTag',
@@ -10447,10 +11788,16 @@ var MarkdownPreview = /** @class */ (function () {
10447
11788
  this.sanitizer = sanitizer;
10448
11789
  this.initEvent(highlight);
10449
11790
  this.initContentSection();
11791
+ // To prevent overflowing contents in the viewer
11792
+ if (this.isViewer) {
11793
+ this.previewContent.style.overflowWrap = 'break-word';
11794
+ }
10450
11795
  }
10451
11796
  MarkdownPreview.prototype.initContentSection = function () {
10452
11797
  this.previewContent = createElementWith("<div class=\"" + cls('contents') + "\"></div>");
10453
- this.el.appendChild(this.previewContent);
11798
+ if (!this.isViewer) {
11799
+ this.el.appendChild(this.previewContent);
11800
+ }
10454
11801
  };
10455
11802
  MarkdownPreview.prototype.toggleActive = function (active) {
10456
11803
  toggleClass(this.el, 'active', active);
@@ -10458,6 +11805,9 @@ var MarkdownPreview = /** @class */ (function () {
10458
11805
  MarkdownPreview.prototype.initEvent = function (highlight) {
10459
11806
  var _this = this;
10460
11807
  this.eventEmitter.listen('updatePreview', this.update.bind(this));
11808
+ if (this.isViewer) {
11809
+ return;
11810
+ }
10461
11811
  if (highlight) {
10462
11812
  this.eventEmitter.listen('changeToolbarState', function (_a) {
10463
11813
  var mdNode = _a.mdNode, cursorPos = _a.cursorPos;
@@ -10774,7 +12124,10 @@ var TableOffsetMap = /** @class */ (function () {
10774
12124
  };
10775
12125
  TableOffsetMap.prototype.getNodeAndPos = function (rowIdx, colIdx) {
10776
12126
  var cellInfo = this.rowInfo[rowIdx][colIdx];
10777
- return { node: this.table.nodeAt(cellInfo.offset - 1), pos: cellInfo.offset };
12127
+ return {
12128
+ node: this.table.nodeAt(cellInfo.offset - this.tableStartOffset),
12129
+ pos: cellInfo.offset,
12130
+ };
10778
12131
  };
10779
12132
  TableOffsetMap.prototype.extendedRowspan = function (rowIdx, colIdx) {
10780
12133
  return false;
@@ -10940,7 +12293,11 @@ var isNull = isNull_1;
10940
12293
  * @returns {boolean} Is existy?
10941
12294
  * @memberof module:type
10942
12295
  * @example
10943
- * var isExisty = require('tui-code-snippet/type/isExisty'); // node, commonjs
12296
+ * // ES6
12297
+ * import isExisty from 'tui-code-snippet/type/isExisty');
12298
+ *
12299
+ * // CommonJS
12300
+ * const isExisty = require('tui-code-snippet/type/isExisty');
10944
12301
  *
10945
12302
  * isExisty(''); //true
10946
12303
  * isExisty(0); //true
@@ -11015,6 +12372,7 @@ var eventTypeList = [
11015
12372
  'mixinTableOffsetMapPrototype',
11016
12373
  'setFocusedNode',
11017
12374
  'removePopupWidget',
12375
+ 'query',
11018
12376
  // provide event for user
11019
12377
  'openPopup',
11020
12378
  'closePopup',
@@ -11022,6 +12380,7 @@ var eventTypeList = [
11022
12380
  'beforePreviewRender',
11023
12381
  'beforeConvertWysiwygToMarkdown',
11024
12382
  'load',
12383
+ 'loadUI',
11025
12384
  'change',
11026
12385
  'caretChange',
11027
12386
  'destroy',
@@ -11212,6 +12571,14 @@ var EventEmitter = /** @class */ (function () {
11212
12571
  var TASK_ATTR_NAME = 'data-task';
11213
12572
  var DISABLED_TASK_ATTR_NAME = 'data-task-disabled';
11214
12573
  var TASK_CHECKED_CLASS_NAME = 'checked';
12574
+ function registerHTMLTagToWhitelist(convertorMap) {
12575
+ ['htmlBlock', 'htmlInline'].forEach(function (htmlType) {
12576
+ if (convertorMap[htmlType]) {
12577
+ // register tag white list for preventing to remove the html in sanitizer
12578
+ Object.keys(convertorMap[htmlType]).forEach(function (type) { return registerTagWhitelistIfPossible(type); });
12579
+ }
12580
+ });
12581
+ }
11215
12582
  /**
11216
12583
  * Class ToastUIEditorViewer
11217
12584
  * @param {object} options Option object
@@ -11257,6 +12624,7 @@ var ToastUIEditorViewer = /** @class */ (function () {
11257
12624
  frontMatter: frontMatter,
11258
12625
  sanitizer: customHTMLSanitizer || sanitizeHTML,
11259
12626
  };
12627
+ registerHTMLTagToWhitelist(rendererOptions.customHTMLRenderer);
11260
12628
  if (this.options.events) {
11261
12629
  forEachOwnProperties_1(this.options.events, function (fn, key) {
11262
12630
  _this.on(key, fn);
@@ -11277,7 +12645,7 @@ var ToastUIEditorViewer = /** @class */ (function () {
11277
12645
  customParser: markdownParsers,
11278
12646
  });
11279
12647
  this.preview = new MarkdownPreview(this.eventEmitter, __assign$1(__assign$1({}, rendererOptions), { isViewer: true }));
11280
- on_1(this.preview.el, 'mousedown', this.toggleTask.bind(this));
12648
+ on_1(this.preview.previewContent, 'mousedown', this.toggleTask.bind(this));
11281
12649
  if (initialValue) {
11282
12650
  this.setMarkdown(initialValue);
11283
12651
  }
@@ -11369,4 +12737,4 @@ var ToastUIEditorViewer = /** @class */ (function () {
11369
12737
  return ToastUIEditorViewer;
11370
12738
  }());
11371
12739
 
11372
- export default ToastUIEditorViewer;
12740
+ export { ToastUIEditorViewer as default };