@vaadin/bundles 25.2.1 → 25.3.0-alpha2

package/vendors-node_modules_vaadin_markdown_node_modules_dompurify_dist_purify_es_mjs.js

@@ -10,7 +10,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   "default": () => (/* binding */ purify)
 /* harmony export */ });
-/*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE */
+/*! @license DOMPurify 3.4.10 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.10/LICENSE */
 
 function _arrayLikeToArray(r, a) {
   (null == a || a > r.length) && (a = r.length);
@@ -347,6 +347,7 @@ const COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
 const FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
 const SELF_CLOSING_TAG = seal(/\/>/i);
 
+/* eslint-disable @typescript-eslint/indent */
 // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
 const NODE_TYPE = {
   element: 1,
@@ -436,7 +437,7 @@ const _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options
 function createDOMPurify() {
   let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
   const DOMPurify = root => createDOMPurify(root);
-  DOMPurify.version = '3.4.11';
+  DOMPurify.version = '3.4.10';
   DOMPurify.removed = [];
   if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
     // Not running in a browser, provide a factory function
@@ -625,13 +626,6 @@ function createDOMPurify() {
   let WHOLE_DOCUMENT = false;
   /* Track whether config is already set on this instance of DOMPurify. */
   let SET_CONFIG = false;
-  /* Pristine allowlist bindings captured at setConfig() time. On the
-   * persistent-config path sanitize() restores the sets from these before
-   * the per-walk hook clone-guard, so a hook's in-call widening cannot
-   * carry across calls. Null until setConfig() is called; reset by
-   * clearConfig(). */
-  let SET_CONFIG_ALLOWED_TAGS = null;
-  let SET_CONFIG_ALLOWED_ATTR = null;
   /* Decide if all elements (e.g. style, script) must be children of
    * document.body. By default, browsers might move them to document.head */
   let FORCE_BODY = false;
@@ -941,6 +935,21 @@ function createDOMPurify() {
         emptyHTML = _createTrustedHTML('');
       }
     }
+    /*
+     * Mirror the clone-before-mutate pattern already applied above for
+     * cfg.ADD_TAGS / cfg.ADD_ATTR: if any uponSanitize* hook is
+     * registered AND the set still points at the default constant,
+     * clone it. The hook then mutates the clone (in-call widening
+     * still works exactly as documented) and the next default-cfg
+     * call rebinds to the untouched original via the reassignment at
+     * the top of this function.
+     */
+    if ((hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) && ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
+      ALLOWED_TAGS = clone(ALLOWED_TAGS);
+    }
+    if (hooks.uponSanitizeAttribute.length > 0 && ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
+      ALLOWED_ATTR = clone(ALLOWED_ATTR);
+    }
     // Prevent further manipulation of configuration.
     // Not available in IE8, Safari 5, etc.
     if (freeze) {
@@ -1997,31 +2006,9 @@ function createDOMPurify() {
       return dirty;
     }
     /* Assign config vars */
-    if (SET_CONFIG) {
-      /* Persistent setConfig() path: _parseConfig is skipped, so the sets are
-       * not re-derived per call. Restore them from the pristine bindings
-       * captured at setConfig() time so a previous call's hook clone (mutated
-       * below) does not carry over. */
-      ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
-      ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
-    } else {
+    if (!SET_CONFIG) {
       _parseConfig(cfg);
     }
-    /* Clone the hook-mutable allowlists before the walk whenever an
-     * uponSanitize* hook is registered. The hook event exposes ALLOWED_TAGS
-     * and ALLOWED_ATTR by reference (as allowedTags / allowedAttributes), so
-     * a hook that widens them would otherwise mutate the shared set
-     * permanently: across later calls and across every element. Cloning per
-     * walk keeps documented in-call widening working while scoping it to the
-     * call. A single guard for both config paths - the per-call path rebinds
-     * the sets in _parseConfig each call, the persistent path restores them
-     * from the captured bindings just above - so the two cannot diverge. */
-    if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) {
-      ALLOWED_TAGS = clone(ALLOWED_TAGS);
-    }
-    if (hooks.uponSanitizeAttribute.length > 0) {
-      ALLOWED_ATTR = clone(ALLOWED_ATTR);
-    }
     /* Clean up removed elements */
     DOMPurify.removed = [];
     /* Resolve IN_PLACE for this call without mutating persistent config.
@@ -2197,14 +2184,10 @@ function createDOMPurify() {
     let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
     _parseConfig(cfg);
     SET_CONFIG = true;
-    SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
-    SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
   };
   DOMPurify.clearConfig = function () {
     CONFIG = null;
     SET_CONFIG = false;
-    SET_CONFIG_ALLOWED_TAGS = null;
-    SET_CONFIG_ALLOWED_ATTR = null;
     // Drop any caller-supplied Trusted Types policy so it cannot poison later
     // `RETURN_TRUSTED_TYPE` output. The internal default policy (cached, and
     // never recreated — Trusted Types throws on duplicate names) is restored by
@@ -2225,19 +2208,9 @@ function createDOMPurify() {
     if (typeof hookFunction !== 'function') {
       return;
     }
-    /* Reject unknown entry points. Without this, a non-hook key (e.g.
-     * '__proto__') indexes off the prototype chain rather than a real
-     * hook array, and arrayPush then writes to Object.prototype. Guard
-     * with an own-property check against the known hook names. */
-    if (!objectHasOwnProperty(hooks, entryPoint)) {
-      return;
-    }
     arrayPush(hooks[entryPoint], hookFunction);
   };
   DOMPurify.removeHook = function (entryPoint, hookFunction) {
-    if (!objectHasOwnProperty(hooks, entryPoint)) {
-      return undefined;
-    }
     if (hookFunction !== undefined) {
       const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
       return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
@@ -2245,9 +2218,6 @@ function createDOMPurify() {
     return arrayPop(hooks[entryPoint]);
   };
   DOMPurify.removeHooks = function (entryPoint) {
-    if (!objectHasOwnProperty(hooks, entryPoint)) {
-      return;
-    }
     hooks[entryPoint] = [];
   };
   DOMPurify.removeAllHooks = function () {