@zowe/cli 8.36.1 → 8.37.0

package/node_modules/js-yaml/lib/loader.js

@@ -371,19 +371,28 @@ function captureSegment (state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork (state) {
+  state.totalMergeKeys++
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
+  }
+}
+
 function mergeMappings (state, destination, source, overridableKeys) {
   if (!common.isObject(source)) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable')
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state)
+
   const sourceKeys = Object.keys(source)
 
   for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     const key = sourceKeys[index]
 
-    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
-    }
+    chargeMergeWork(state)
 
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key])
@@ -426,6 +435,10 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size')
+      }
+
       for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys)
       }

package/node_modules/js-yaml/package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-yaml",
-  "version": "4.3.1",
+  "version": "4.3.2",
   "description": "YAML 1.2 parser and serializer",
   "keywords": [
     "yaml",

package/node_modules/sanitize-html/README.md

@@ -696,6 +696,19 @@ And you can forbid the use of protocol-relative URLs (starting with `//`) to acc
 allowProtocolRelative: false
 ```
 
+### SVG animations of URL attributes are discarded
+
+For security reasons, if your `allowedTags` includes the SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform` and `set`), note that an animation which targets a URL attribute is always discarded:
+
+```html
+<!-- Discarded: this would set the link's href to javascript: after sanitization -->
+<animate attributeName="href" values="#safe;javascript:alert(1)" dur=".01s" fill="freeze">
+```
+
+An animation element carries no URL itself. It names the attribute it animates with `attributeName` and supplies the new value in `values`, `from`, `to` or `by`, which the browser copies into the target attribute after sanitization. Scheme checking those values is not sufficient, because `values` is a semicolon-separated *list* of destinations, so we discard the animation instead whenever `attributeName` selects `href`, `xlink:href` or any other attribute listed in `allowedSchemesAppliedToAttributes`.
+
+Animations of attributes that are not URLs, such as `fill` or `opacity`, are unaffected.
+
 ### Discarding the entire contents of a disallowed tag
 
 Normally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.

package/node_modules/sanitize-html/index.js

@@ -12,6 +12,17 @@ const mediaTags = [
 ];
 // Tags that are inherently vulnerable to being used in XSS attacks.
 const vulnerableTags = [ 'script', 'style' ];
+// SVG SMIL animation elements. These do not carry a URL themselves: they
+// retarget an attribute of another element, naming it with `attributeName`
+// and supplying the new value(s) in `values`, `from`, `to` and `by`.
+const svgAnimationTags = [
+  'animate', 'animatecolor', 'animatemotion', 'animatetransform', 'set'
+];
+// Attribute names that always name a URL sink, whatever
+// `allowedSchemesAppliedToAttributes` has been narrowed to. A namespace prefix
+// is ignored when matching, so `xlink:href` and any other prefixed spelling of
+// `href` are covered.
+const alwaysUrlAttributes = [ 'href' ];
 
 function each(obj, cb) {
   if (obj) {
@@ -272,7 +283,7 @@ function sanitizeHtml(html, options, _recursing) {
         }
       }
 
-      if (!tagAllowed(name) || (options.disallowedTagsMode === 'recursiveEscape' && !isEmptyObject(skipMap)) || (options.nestingLimit != null && depth >= options.nestingLimit)) {
+      if (!tagAllowed(name) || animatesUrlAttribute(name, attribs) || (options.disallowedTagsMode === 'recursiveEscape' && !isEmptyObject(skipMap)) || (options.nestingLimit != null && depth >= options.nestingLimit)) {
         skip = true;
         skipMap[depth] = true;
         if (options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') {
@@ -540,8 +551,13 @@ function sanitizeHtml(html, options, _recursing) {
         result += ' />';
       } else {
         result += '>';
-        if (frame.innerText && !hasText && !options.textFilter) {
-          result += escapeHtml(frame.innerText);
+        if (frame.innerText && !hasText) {
+          const escaped = escapeHtml(frame.innerText);
+          if (options.textFilter) {
+            result += options.textFilter(escaped, name);
+          } else {
+            result += escaped;
+          }
           addedText = true;
         }
       }
@@ -573,14 +589,39 @@ function sanitizeHtml(html, options, _recursing) {
         // which have their own collection of XSS vectors.
         result += text;
       } else if (tag && tagAllowed(tag) && (options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (tag === 'textarea' || tag === 'xmp')) {
-        // htmlparser2 treats <textarea> and <xmp> as raw text elements and
-        // does NOT decode entities inside them. The text is already properly
-        // encoded, so pass it through without additional escaping to avoid
-        // double-encoding. Other "nonTextTags" like <option> are not raw text
-        // elements in htmlparser2, so their contents are decoded and must be
-        // escaped below like any other text (important to prevent XSS via
-        // entity-encoded payloads such as <option>&lt;script&gt;...&lt;/script&gt;</option>).
-        result += text;
+        // <textarea> and <xmp> hold text that must not be re-emitted verbatim:
+        // if a raw `<` survives into the output it can reopen a tag when the
+        // result is re-parsed by a browser, smuggling non-allowlisted markup
+        // through the allowlist (mutation-XSS, GHSA-jxwj-j7wr-gfrw — e.g. the
+        // `</textarea/>` solidus mis-close). We therefore ALWAYS escape this
+        // content rather than passing it through. Escaping unconditionally also
+        // closes the related SVG/MathML foreign-content bypass (where the HTML5
+        // parser treats <textarea>/<xmp> as ordinary foreign elements and a
+        // browser re-parses their contents as live markup, e.g.
+        // `<svg><textarea><img src=x onerror=alert(1)></textarea></svg>`): since
+        // we never re-emit raw text for these tags, no namespace check is
+        // needed. The two tags need different escaping because htmlparser2
+        // tokenizes them differently:
+        if (tag === 'xmp') {
+          // <xmp> is a raw-text (CDATA) element: entities are NOT decoded, so
+          // its content reaches us as raw source that is already entity-encoded.
+          // Escape only the angle brackets so a literal `<` cannot reopen a tag,
+          // while leaving `&` untouched to avoid double-encoding entities that
+          // are already encoded in the source.
+          result += text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+        } else {
+          // <textarea> is an RCDATA element: htmlparser2 (>= 11) decodes
+          // entities inside it, so its content reaches us as plain decoded text.
+          // It must therefore be fully escaped like any other text — escaping
+          // `&` as well as `<`/`>` — so entities round-trip faithfully (no
+          // double-encoding, see the CVE-2026-40186 regression tests) and no
+          // `<` can reopen a tag.
+          result += escapeHtml(text, false);
+        }
+        // Other "nonTextTags" like <option> are not raw text elements in
+        // htmlparser2, so their contents are decoded and must be escaped below
+        // like any other text (important to prevent XSS via entity-encoded
+        // payloads such as <option>&lt;script&gt;...&lt;/script&gt;</option>).
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);
         if (options.textFilter) {
@@ -743,6 +784,39 @@ function sanitizeHtml(html, options, _recursing) {
     });
   }
 
+  // True if this is an SVG SMIL animation element that animates a URL-bearing
+  // attribute, e.g. `<animate attributeName="href" values="#safe;javascript:...">`.
+  //
+  // Such an element carries no URL of its own: the browser copies the animation
+  // values into the target attribute *after* sanitization, so a `javascript:`
+  // destination reaches a live link sink without ever being scheme checked.
+  // `values` compounds this, because it is a semicolon-separated LIST of
+  // destinations: checking it as one flat URL only validates its first entry, so
+  // a leading `#safe` fragment carries the rest of the list past the policy.
+  //
+  // Re-checking each entry of each value attribute would leave the safety of the
+  // output resting on our imitation of SMIL list parsing, so we reject the
+  // animation on the strength of its target instead. Animations of attributes
+  // that are not URL sinks, such as `fill` or `opacity`, are unaffected.
+  function animatesUrlAttribute(name, attribs) {
+    if (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {
+      return false;
+    }
+    const schemeCheckedAttributes = options.allowedSchemesAppliedToAttributes || [];
+    return Object.keys(attribs || {}).some(function(attributeName) {
+      if (attributeName.toLowerCase() !== 'attributename') {
+        return false;
+      }
+      const target = (attribs[attributeName] || '').trim().toLowerCase();
+      // The target may be namespace prefixed (`xlink:href`). Which prefixes are
+      // in scope depends on the document, so consider the local name too.
+      const localName = target.slice(target.lastIndexOf(':') + 1);
+      return alwaysUrlAttributes.indexOf(localName) !== -1 ||
+        schemeCheckedAttributes.indexOf(target) !== -1 ||
+        schemeCheckedAttributes.indexOf(localName) !== -1;
+    });
+  }
+
   function parseUrl(value) {
     value = value.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, '$1//');
     if (value.startsWith('relative:')) {
@@ -953,7 +1027,7 @@ sanitizeHtml.defaults = {
     'alt'
   ],
   // Lots of these won't come up by default because we don't allow them
-  selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
+  selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta', 'col' ],
   // URL schemes we permit
   allowedSchemes: [ 'http', 'https', 'ftp', 'mailto', 'tel' ],
   allowedSchemesByTag: {},

package/node_modules/sanitize-html/node_modules/dom-serializer/LICENSE

@@ -0,0 +1,7 @@
+Copyright © 2022 The Cheerio contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/{dom-serializer → sanitize-html/node_modules/dom-serializer}/README.md

@@ -1,4 +1,4 @@
-# dom-serializer [![Build Status](https://travis-ci.com/cheeriojs/dom-serializer.svg?branch=master)](https://travis-ci.com/cheeriojs/dom-serializer)
+# dom-serializer [![Node.js CI](https://github.com/cheeriojs/dom-serializer/actions/workflows/nodejs-test.yml/badge.svg)](https://github.com/cheeriojs/dom-serializer/actions/workflows/nodejs-test.yml)
 
 Renders a [domhandler](https://github.com/fb55/domhandler) DOM node or an array of domhandler DOM nodes to a string.
 
@@ -33,11 +33,13 @@ Can be thought of as the equivalent of the `outerHTML` of the passed node(s).
 
 ### `encodeEntities`
 
-• `Optional` **decodeEntities**: _boolean | "utf8"_
+• `Optional` **encodeEntities**: _boolean | "utf8"_
 
-Encode characters that are either reserved in HTML or XML.
+Encode characters reserved in HTML or XML in text and attribute values.
 
-If `xmlMode` is `true` or the value not `'utf8'`, characters outside of the utf8 range will be encoded as well.
+If `xmlMode` is `true` or the value is not `'utf8'`, characters outside of the ASCII range will be encoded as well.
+
+> **Security:** Setting this to `false` disables encoding of `<`, `>`, and `&` in text and attribute values. This is intended for the round-trip case where the DOM was parsed with `decodeEntities: false`, so markup characters only exist as entity references. If the DOM contains raw markup characters (e.g., from a default-decoded parse, or from programmatic manipulation), they will be emitted literally — do not use this option with untrusted input unless you have validated the DOM yourself.
 
 **`default`** `decodeEntities`
 
@@ -47,7 +49,7 @@ If `xmlMode` is `true` or the value not `'utf8'`, characters outside of the utf8
 
 • `Optional` **decodeEntities**: _boolean_
 
-Option inherited from parsing; will be used as the default value for `encodeEntities`.
+Default for `encodeEntities`. Named to match the parser option of the same name so a single options object can be threaded through parse and serialize. Despite the name, on the serializer this option controls *encoding* — setting it to `false` carries the same security caveat as `encodeEntities: false`.
 
 **`default`** true
 
@@ -71,13 +73,17 @@ Print an empty attribute's value.
 
 • `Optional` **selfClosingTags**: _boolean_
 
-Print self-closing tags for tags without contents.
+Print self-closing tags for tags without contents. If `xmlMode` is set, this
+will apply to all tags. Otherwise, only tags that are defined as self-closing
+in the HTML specification will be printed as such.
 
 **`default`** xmlMode
 
-**`example`** With <code>selfClosingTags: false</code>: <code>&lt;foo&gt;&lt;/foo&gt;</code>
+**`example`** With <code>selfClosingTags: false</code>: <code>&lt;foo&gt;&lt;/foo&gt;&lt;br&gt;&lt;/br&gt;</code>
+
+**`example`** With <code>xmlMode: true</code> and <code>selfClosingTags: true</code>: <code>&lt;foo/&gt;&lt;br/&gt;</code>
 
-**`example`** With <code>selfClosingTags: true</code>: <code>&lt;foo /&gt;</code>
+**`example`** With <code>xmlMode: false</code> and <code>selfClosingTags: true</code>: <code>&lt;foo&gt;&lt;/foo&gt;&lt;br /&gt;</code>
 
 ---
 

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/foreign-names.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Mixed-case SVG and MathML element names recognized in foreign content.
+ * @see https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inforeign
+ */
+export declare const elementNames: Map<string, string>;
+/**
+ * Mixed-case SVG and MathML attribute names recognized in foreign content.
+ * @see https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inforeign
+ */
+export declare const attributeNames: Map<string, string>;
+//# sourceMappingURL=foreign-names.d.ts.map

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/foreign-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreign-names.d.ts","sourceRoot":"","sources":["../src/foreign-names.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,YAAY,qBAIxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,qBAI1B,CAAC"}

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/foreign-names.js

@@ -0,0 +1,15 @@
+/**
+ * Mixed-case SVG and MathML element names recognized in foreign content.
+ * @see https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inforeign
+ */
+export const elementNames = new Map("altGlyph altGlyphDef altGlyphItem animateColor animateMotion animateTransform clipPath feBlend feColorMatrix feComponentTransfer feComposite feConvolveMatrix feDiffuseLighting feDisplacementMap feDistantLight feDropShadow feFlood feFuncA feFuncB feFuncG feFuncR feGaussianBlur feImage feMerge feMergeNode feMorphology feOffset fePointLight feSpecularLighting feSpotLight feTile feTurbulence foreignObject glyphRef linearGradient radialGradient textPath"
+    .split(" ")
+    .map((name) => [name.toLowerCase(), name]));
+/**
+ * Mixed-case SVG and MathML attribute names recognized in foreign content.
+ * @see https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inforeign
+ */
+export const attributeNames = new Map("definitionURL attributeName attributeType baseFrequency baseProfile calcMode clipPathUnits diffuseConstant edgeMode filterUnits glyphRef gradientTransform gradientUnits kernelMatrix kernelUnitLength keyPoints keySplines keyTimes lengthAdjust limitingConeAngle markerHeight markerUnits markerWidth maskContentUnits maskUnits numOctaves pathLength patternContentUnits patternTransform patternUnits pointsAtX pointsAtY pointsAtZ preserveAlpha preserveAspectRatio primitiveUnits refX refY repeatCount repeatDur requiredExtensions requiredFeatures specularConstant specularExponent spreadMethod startOffset stdDeviation stitchTiles surfaceScale systemLanguage tableValues targetX targetY textLength viewBox viewTarget xChannelSelector yChannelSelector zoomAndPan"
+    .split(" ")
+    .map((name) => [name.toLowerCase(), name]));
+//# sourceMappingURL=foreign-names.js.map

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/foreign-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreign-names.js","sourceRoot":"","sources":["../src/foreign-names.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CACjC,scAAsc;KACnc,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAC7C,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CACnC,uvBAAuvB;KACpvB,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAC7C,CAAC"}

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/index.d.ts

@@ -0,0 +1,72 @@
+import type { AnyNode } from "domhandler";
+/**
+ * Options for DOM serialization.
+ */
+export interface DomSerializerOptions {
+    /**
+     * Print an empty attribute's value.
+     * @default xmlMode
+     * @example With <code>emptyAttrs: false</code>: <code>&lt;input checked&gt;</code>
+     * @example With <code>emptyAttrs: true</code>: <code>&lt;input checked=""&gt;</code>
+     */
+    emptyAttrs?: boolean;
+    /**
+     * Print self-closing tags for tags without contents. If `xmlMode` is set,
+     * this will apply to all tags. Otherwise, only tags that are defined as
+     * self-closing in the HTML specification will be printed as such.
+     * @default xmlMode
+     * @example With <code>selfClosingTags: false</code>: <code>&lt;foo&gt;&lt;/foo&gt;&lt;br&gt;&lt;/br&gt;</code>
+     * @example With <code>xmlMode: true</code> and <code>selfClosingTags: true</code>: <code>&lt;foo/&gt;&lt;br/&gt;</code>
+     * @example With <code>xmlMode: false</code> and <code>selfClosingTags: true</code>: <code>&lt;foo&gt;&lt;/foo&gt;&lt;br /&gt;</code>
+     */
+    selfClosingTags?: boolean;
+    /**
+     * Treat the input as an XML document; enables the `emptyAttrs` and
+     * `selfClosingTags` options.
+     *
+     * If the value is `"foreign"`, it will try to correct mixed-case attribute
+     * names.
+     * @default false
+     */
+    xmlMode?: boolean | "foreign";
+    /**
+     * Encode characters reserved in HTML or XML in text and attribute values.
+     *
+     * If `xmlMode` is set or the value is not `'utf8'`, characters outside the
+     * ASCII range will also be encoded as numeric entities.
+     *
+     * **Security:** Setting this to `false` disables encoding of `<`, `>`, `&`,
+     * and (in attribute values) `'` — only `"` in attribute values is escaped.
+     * This is safe for the round-trip case (DOM was parsed with
+     * `decodeEntities: false`, so any markup characters in text or attribute
+     * values exist only as entity references), and unsafe otherwise. If text
+     * or attribute values in the DOM contain raw `<`, `>`, or `&`, those
+     * characters will appear literally in the output.
+     * @default `decodeEntities`
+     */
+    encodeEntities?: boolean | "utf8";
+    /**
+     * Default for `encodeEntities`. Named to match the parser option of the
+     * same name so a single options object can be threaded through parse and
+     * serialize for a faithful round-trip — for example, cheerio parses with
+     * `decodeEntities: false` to preserve entity references and passes the
+     * same option here so they are not re-encoded.
+     *
+     * Despite the name, on the serializer this option controls *encoding*.
+     * Setting it to `false` carries the same caveat as `encodeEntities: false`
+     * — see that option.
+     * @default true
+     */
+    decodeEntities?: boolean;
+}
+/**
+ * Renders a DOM node or an array of DOM nodes to a string.
+ *
+ * Can be thought of as the equivalent of the `outerHTML` of the passed
+ * node(s).
+ * @param node Node to be rendered.
+ * @param options Changes serialization behavior
+ */
+export declare function render(node: AnyNode | ArrayLike<AnyNode>, options?: DomSerializerOptions): string;
+export default render;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,OAAO,EAMR,MAAM,YAAY,CAAC;AAIpB;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA6BD;;;;;;;GAOG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,EAClC,OAAO,GAAE,oBAAyB,GACjC,MAAM,CAiBR;AAED,eAAe,MAAM,CAAC"}

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/index.js

@@ -0,0 +1,173 @@
+import * as ElementType from "domelementtype";
+import { encodeXML, escapeAttribute, escapeText } from "entities";
+import { attributeNames, elementNames } from "./foreign-names.js";
+// ── Constants ────────────────────────────────────────────────────────
+/** Elements whose text content is never entity-encoded. */
+const unencodedElements = new Set("style script xmp iframe noembed noframes plaintext noscript".split(" "));
+/** HTML void elements — they cannot have children. */
+const voidElements = new Set("area base basefont br col command embed frame hr img input isindex keygen link meta param source track wbr".split(" "));
+/** Elements that switch the parser into foreign (XML-like) mode. */
+const foreignElements = new Set(["svg", "math"]);
+/**
+ * Foreign-mode integration points: children of these elements are parsed
+ * as HTML again, not as foreign content.
+ */
+const foreignModeIntegrationPoints = new Set("mi mo mn ms mtext annotation-xml foreignObject desc title".split(" "));
+// ── Public API ───────────────────────────────────────────────────────
+/**
+ * Renders a DOM node or an array of DOM nodes to a string.
+ *
+ * Can be thought of as the equivalent of the `outerHTML` of the passed
+ * node(s).
+ * @param node Node to be rendered.
+ * @param options Changes serialization behavior
+ */
+export function render(node, options = {}) {
+    const nodes = "length" in node ? node : [node];
+    /*
+     * `xmlMode` is threaded as a separate argument through the internal
+     * functions so that foreign-mode transitions (svg/mathml ↔ html) can
+     * adjust it without copying the options object on every element.
+     */
+    const xmlMode = options.xmlMode ?? false;
+    let output = "";
+    // eslint-disable-next-line unicorn/no-for-loop
+    for (let index = 0; index < nodes.length; index++) {
+        output += renderNode(nodes[index], options, xmlMode);
+    }
+    return output;
+}
+export default render;
+// ── Internal rendering ───────────────────────────────────────────────
+/**
+ * Render an array of child nodes (skips the single-node wrapping in `render`).
+ * @param children The child nodes to render.
+ * @param options The serialization options.
+ * @param xmlMode The XML mode to use.
+ */
+function renderChildren(children, options, xmlMode) {
+    let output = "";
+    // eslint-disable-next-line unicorn/no-for-loop
+    for (let index = 0; index < children.length; index++) {
+        output += renderNode(children[index], options, xmlMode);
+    }
+    return output;
+}
+function renderNode(node, options, xmlMode) {
+    switch (node.type) {
+        case ElementType.Root: {
+            return renderChildren(node.children, options, xmlMode);
+        }
+        case ElementType.Directive: {
+            return `<${node.data}>`;
+        }
+        case ElementType.Comment: {
+            return `<!--${node.data}-->`;
+        }
+        case ElementType.CDATA: {
+            return `<![CDATA[${node.children[0].data}]]>`;
+        }
+        case ElementType.Script:
+        case ElementType.Style:
+        case ElementType.Tag: {
+            return renderTag(node, options, xmlMode);
+        }
+        case ElementType.Text: {
+            const element = node;
+            const data = element.data || "";
+            /*
+             * Skip encoding when entities weren't decoded on input, or when
+             * inside a raw-text element (script, style, etc.) in HTML mode.
+             */
+            if ((options.encodeEntities ?? options.decodeEntities) !== false &&
+                !(!xmlMode &&
+                    element.parent &&
+                    unencodedElements.has(element.parent.name))) {
+                // `xmlMode: "foreign"` is truthy
+                return xmlMode || options.encodeEntities !== "utf8"
+                    ? encodeXML(data)
+                    : escapeText(data);
+            }
+            return data;
+        }
+    }
+}
+function renderTag(element, options, xmlMode) {
+    if (xmlMode === "foreign") {
+        // Correct lowercase element names back to their canonical mixed-case form
+        element.name = elementNames.get(element.name) ?? element.name;
+        // Integration points exit foreign mode: their children are HTML
+        if (element.parent &&
+            foreignModeIntegrationPoints.has(element.parent.name)) {
+            xmlMode = false;
+        }
+    }
+    if (!xmlMode && foreignElements.has(element.name)) {
+        xmlMode = "foreign";
+    }
+    const { name, children } = element;
+    // Cache the void-element check — used for both self-closing and closing-tag logic
+    const isVoid = !xmlMode && voidElements.has(name);
+    let tag = `<${name}${formatAttributes(element.attribs, options, xmlMode)}`;
+    if (children.length === 0 &&
+        (xmlMode
+            ? options.selfClosingTags !== false
+            : options.selfClosingTags && isVoid)) {
+        // XML: `<br/>`, HTML: `<br />`
+        tag += xmlMode ? "/>" : " />";
+    }
+    else {
+        tag += ">";
+        if (children.length > 0) {
+            tag += renderChildren(children, options, xmlMode);
+        }
+        if (!isVoid) {
+            tag += `</${name}>`;
+        }
+    }
+    return tag;
+}
+// ── Attribute formatting ─────────────────────────────────────────────
+function replaceQuotes(value) {
+    return value.replaceAll('"', "&quot;");
+}
+/**
+ * Serialize an element's attribute map to a string.
+ *
+ * Returns a string with a leading space before each attribute, or an
+ * empty string if there are no attributes. This convention lets the
+ * caller unconditionally concatenate the result onto the tag name.
+ * @param attributes
+ * @param options
+ * @param xmlMode
+ */
+function formatAttributes(attributes, options, xmlMode) {
+    if (!attributes)
+        return "";
+    /*
+     * Pick the right encoder:
+     *  - Encoding disabled → only escape double-quotes (for valid attributes)
+     *  - XML / non-utf8    → full numeric entity encoding (encodeXML)
+     *  - HTML + utf8       → minimal escaping (escapeAttribute)
+     */
+    const encode = (options.encodeEntities ?? options.decodeEntities) === false
+        ? replaceQuotes
+        : xmlMode || options.encodeEntities !== "utf8"
+            ? encodeXML
+            : escapeAttribute;
+    const isForeign = xmlMode === "foreign";
+    const showEmpty = !!(options.emptyAttrs ?? xmlMode);
+    let result = "";
+    for (const key in attributes) {
+        if (!Object.hasOwn(attributes, key))
+            continue;
+        const value = attributes[key];
+        const k = isForeign ? (attributeNames.get(key) ?? key) : key;
+        result +=
+            !showEmpty && (value == null || value === "")
+                ? ` ${k}`
+                : ` ${k}="${encode(value == null ? "" : String(value))}"`;
+    }
+    return result;
+}
+//# sourceMappingURL=index.js.map

package/node_modules/sanitize-html/node_modules/dom-serializer/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,gBAAgB,CAAC;AAS9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+DlE,wEAAwE;AAExE,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,6DAA6D,CAAC,KAAK,CAAC,GAAG,CAAC,CACzE,CAAC;AAEF,sDAAsD;AACtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,4GAA4G,CAAC,KAAK,CAChH,GAAG,CACJ,CACF,CAAC;AAEF,oEAAoE;AACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjD;;;GAGG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,2DAA2D,CAAC,KAAK,CAAC,GAAG,CAAC,CACvE,CAAC;AAEF,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CACpB,IAAkC,EAClC,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAEzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,+CAA+C;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,eAAe,MAAM,CAAC;AAEtB,wEAAwE;AAExE;;;;;GAKG;AACH,SAAS,cAAc,CACrB,QAA4B,EAC5B,OAA6B,EAC7B,OAA4B;IAE5B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,+CAA+C;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CACjB,IAAa,EACb,OAA6B,EAC7B,OAA4B;IAE5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACtB,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,KAAK,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3B,OAAO,IAAK,IAA8B,CAAC,IAAI,GAAG,CAAC;QACrD,CAAC;QAED,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACzB,OAAO,OAAQ,IAAgB,CAAC,IAAI,KAAK,CAAC;QAC5C,CAAC;QAED,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACvB,OAAO,YAAc,IAAc,CAAC,QAAQ,CAAC,CAAC,CAAU,CAAC,IAAI,KAAK,CAAC;QACrE,CAAC;QAED,KAAK,WAAW,CAAC,MAAM,CAAC;QACxB,KAAK,WAAW,CAAC,KAAK,CAAC;QACvB,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,OAAO,SAAS,CAAC,IAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,IAAY,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAEhC;;;eAGG;YACH,IACE,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,KAAK,KAAK;gBAC5D,CAAC,CACC,CAAC,OAAO;oBACR,OAAO,CAAC,MAAM;oBACd,iBAAiB,CAAC,GAAG,CAAE,OAAO,CAAC,MAAkB,CAAC,IAAI,CAAC,CACxD,EACD,CAAC;gBACD,iCAAiC;gBACjC,OAAO,OAAO,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM;oBACjD,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;oBACjB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAgB,EAChB,OAA6B,EAC7B,OAA4B;IAE5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;QAE9D,gEAAgE;QAChE,IACE,OAAO,CAAC,MAAM;YACd,4BAA4B,CAAC,GAAG,CAAE,OAAO,CAAC,MAAkB,CAAC,IAAI,CAAC,EAClE,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEnC,kFAAkF;IAClF,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElD,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IAE3E,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,OAAO;YACN,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK;YACnC,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,EACtC,CAAC;QACD,+BAA+B;QAC/B,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,GAAG,IAAI,GAAG,CAAC;QAEX,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,IAAI,KAAK,IAAI,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AAExE,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,UAA+C,EAC/C,OAA6B,EAC7B,OAA4B;IAE5B,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B;;;;;OAKG;IACH,MAAM,MAAM,GACV,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,KAAK,KAAK;QAC1D,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM;YAC5C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,eAAe,CAAC;IAExB,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IAEpD,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC;YAAE,SAAS;QAE9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAE7D,MAAM;YACJ,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC3C,CAAC,CAAC,IAAI,CAAC,EAAE;gBACT,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/node_modules/sanitize-html/node_modules/dom-serializer/package.json

@@ -0,0 +1,69 @@
+{
+  "type": "module",
+  "name": "dom-serializer",
+  "version": "3.1.1",
+  "description": "render domhandler DOM nodes to a string",
+  "author": "Felix Boehm <me@feedic.com>",
+  "sideEffects": false,
+  "keywords": [
+    "html",
+    "xml",
+    "render"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/cheeriojs/dom-serializer.git"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "!**/*.spec.ts",
+    "!**/*.bench.ts"
+  ],
+  "dependencies": {
+    "domelementtype": "^3.0.0",
+    "domhandler": "^6.0.0",
+    "entities": "^8.0.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.14",
+    "@eslint/compat": "^2.0.5",
+    "@feedic/eslint-config": "^0.4.1",
+    "@types/node": "^25.6.0",
+    "cheerio": "^1.2.0",
+    "eslint": "^10.3.0",
+    "eslint-config-biome": "^2.1.3",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.59.1",
+    "vitest": "^4.1.5"
+  },
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "format": "npm run format:es && npm run format:biome",
+    "format:biome": "biome check --write .",
+    "format:es": "npm run lint:es -- --fix",
+    "lint": "npm run lint:es && npm run lint:ts && npm run lint:biome",
+    "lint:biome": "biome check .",
+    "lint:es": "eslint .",
+    "lint:ts": "tsc --noEmit -p tsconfig.eslint.json",
+    "prepare": "npm run build",
+    "test": "npm run test:vi && npm run lint",
+    "test:vi": "vitest run"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+  },
+  "license": "MIT"
+}