dompurify 0.9.0 → 1.0.3

package/src/purify.js

@@ -1,1004 +0,0 @@
-;(function(factory) {
-    'use strict';
-    /* global window: false, define: false, module: false */
-    var root = typeof window === 'undefined' ? null : window;
-
-    if (typeof define === 'function' && define.amd) {
-        define(function(){ return factory(root); });
-    } else if (typeof module !== 'undefined') {
-        module.exports = factory(root);
-    } else {
-        root.DOMPurify = factory(root);
-    }
-}(function factory(window) {
-    'use strict';
-
-    var DOMPurify = function(window) {
-        return factory(window);
-    };
-
-    /**
-     * Version label, exposed for easier checks
-     * if DOMPurify is up to date or not
-     */
-    DOMPurify.version = '0.9.0';
-
-    /**
-     * Array of elements that DOMPurify removed during sanitation.
-     * Empty if nothing was removed.
-     */
-    DOMPurify.removed = [];
-
-    if (!window || !window.document || window.document.nodeType !== 9) {
-        // not running in a browser, provide a factory function
-        // so that you can pass your own Window
-        DOMPurify.isSupported = false;
-        return DOMPurify;
-    }
-
-    var document = window.document;
-    var originalDocument = document;
-    var DocumentFragment = window.DocumentFragment;
-    var HTMLTemplateElement = window.HTMLTemplateElement;
-    var Node = window.Node;
-    var NodeFilter = window.NodeFilter;
-    var NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap;
-    var Text = window.Text;
-    var Comment = window.Comment;
-    var DOMParser = window.DOMParser;
-    var XMLHttpRequest = window.XMLHttpRequest;
-    var encodeURI = window.encodeURI;
-    var useXHR = false;
-    var useDOMParser = false; // See comment below
-    
-    // As per issue #47, the web-components registry is inherited by a
-    // new document created via createHTMLDocument. As per the spec
-    // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
-    // a new empty registry is used when creating a template contents owner
-    // document, so we use that as our parent document to ensure nothing
-    // is inherited.
-    if (typeof HTMLTemplateElement === 'function') {
-        var template = document.createElement('template');
-        if (template.content && template.content.ownerDocument) {
-            document = template.content.ownerDocument;
-        }
-    }
-    var implementation = document.implementation;
-    var createNodeIterator = document.createNodeIterator;
-    var getElementsByTagName = document.getElementsByTagName;
-    var createDocumentFragment = document.createDocumentFragment;
-    var importNode = originalDocument.importNode;
-
-    var hooks = {};
-
-    /**
-     * Expose whether this browser supports running the full DOMPurify.
-     */
-    DOMPurify.isSupported =
-        typeof implementation.createHTMLDocument !== 'undefined' &&
-        document.documentMode !== 9;
-
-    /* Add properties to a lookup table */
-    var _addToSet = function(set, array) {
-        var l = array.length;
-        while (l--) {
-            if (typeof array[l] === 'string') {
-                array[l] = array[l].toLowerCase();
-            }
-            set[array[l]] = true;
-        }
-        return set;
-    };
-
-    /* Shallow clone an object */
-    var _cloneObj = function(object) {
-        var newObject = {};
-        var property;
-        for (property in object) {
-            if (object.hasOwnProperty(property)) {
-                newObject[property] = object[property];
-            }
-        }
-        return newObject;
-    };
-
-    /**
-     * We consider the elements and attributes below to be safe. Ideally
-     * don't add any new ones but feel free to remove unwanted ones.
-     */
-
-    /* allowed element names */
-    var ALLOWED_TAGS = null;
-    var DEFAULT_ALLOWED_TAGS = _addToSet({}, [
-
-        // HTML
-        'a','abbr','acronym','address','area','article','aside','audio','b',
-        'bdi','bdo','big','blink','blockquote','body','br','button','canvas',
-        'caption','center','cite','code','col','colgroup','content','data',
-        'datalist','dd','decorator','del','details','dfn','dir','div','dl','dt',
-        'element','em','fieldset','figcaption','figure','font','footer','form',
-        'h1','h2','h3','h4','h5','h6','head','header','hgroup','hr','html','i',
-        'img','input','ins','kbd','label','legend','li','main','map','mark',
-        'marquee','menu','menuitem','meter','nav','nobr','ol','optgroup',
-        'option','output','p','pre','progress','q','rp','rt','ruby','s','samp',
-        'section','select','shadow','small','source','spacer','span','strike',
-        'strong','style','sub','summary','sup','table','tbody','td','template',
-        'textarea','tfoot','th','thead','time','tr','track','tt','u','ul','var',
-        'video','wbr',
-
-        // SVG
-        'svg','altglyph','altglyphdef','altglyphitem','animatecolor',
-        'animatemotion','animatetransform','circle','clippath','defs','desc',
-        'ellipse','filter','font','g','glyph','glyphref','hkern','image','line',
-        'lineargradient','marker','mask','metadata','mpath','path','pattern',
-        'polygon','polyline','radialgradient','rect','stop','switch','symbol',
-        'text','textpath','title','tref','tspan','view','vkern',
-
-        // SVG Filters
-        'feBlend','feColorMatrix','feComponentTransfer','feComposite',
-        'feConvolveMatrix','feDiffuseLighting','feDisplacementMap',
-        'feFlood','feFuncA','feFuncB','feFuncG','feFuncR','feGaussianBlur',
-        'feMerge','feMergeNode','feMorphology','feOffset',
-        'feSpecularLighting','feTile','feTurbulence',
-
-        //MathML
-        'math','menclose','merror','mfenced','mfrac','mglyph','mi','mlabeledtr',
-        'mmuliscripts','mn','mo','mover','mpadded','mphantom','mroot','mrow',
-        'ms','mpspace','msqrt','mystyle','msub','msup','msubsup','mtable','mtd',
-        'mtext','mtr','munder','munderover',
-
-        //Text
-        '#text'
-    ]);
-
-    /* Allowed attribute names */
-    var ALLOWED_ATTR = null;
-    var DEFAULT_ALLOWED_ATTR = _addToSet({}, [
-
-        // HTML
-        'accept','action','align','alt','autocomplete','background','bgcolor',
-        'border','cellpadding','cellspacing','checked','cite','class','clear','color',
-        'cols','colspan','coords','datetime','default','dir','disabled',
-        'download','enctype','face','for','headers','height','hidden','high','href',
-        'hreflang','id','ismap','label','lang','list','loop', 'low','max',
-        'maxlength','media','method','min','multiple','name','noshade','novalidate',
-        'nowrap','open','optimum','pattern','placeholder','poster','preload','pubdate',
-        'radiogroup','readonly','rel','required','rev','reversed','role','rows',
-        'rowspan','spellcheck','scope','selected','shape','size','span',
-        'srclang','start','src','step','style','summary','tabindex','title',
-        'type','usemap','valign','value','width','xmlns',
-
-        // SVG
-        'accent-height','accumulate','additivive','alignment-baseline',
-        'ascent','attributename','attributetype','azimuth','basefrequency',
-        'baseline-shift','begin','bias','by','clip','clip-path','clip-rule',
-        'color','color-interpolation','color-interpolation-filters','color-profile',
-        'color-rendering','cx','cy','d','dx','dy','diffuseconstant','direction',
-        'display','divisor','dur','edgemode','elevation','end','fill','fill-opacity',
-        'fill-rule','filter','flood-color','flood-opacity','font-family','font-size',
-        'font-size-adjust','font-stretch','font-style','font-variant','font-weight',
-        'fx', 'fy','g1','g2','glyph-name','glyphref','gradientunits','gradienttransform',
-        'image-rendering','in','in2','k','k1','k2','k3','k4','kerning','keypoints',
-        'keysplines','keytimes','lengthadjust','letter-spacing','kernelmatrix',
-        'kernelunitlength','lighting-color','local','marker-end','marker-mid',
-        'marker-start','markerheight','markerunits','markerwidth','maskcontentunits',
-        'maskunits','max','mask','mode','min','numoctaves','offset','operator',
-        'opacity','order','orient','orientation','origin','overflow','paint-order',
-        'path','pathlength','patterncontentunits','patterntransform','patternunits',
-        'points','preservealpha','r','rx','ry','radius','refx','refy','repeatcount',
-        'repeatdur','restart','result','rotate','scale','seed','shape-rendering',
-        'specularconstant','specularexponent','spreadmethod','stddeviation','stitchtiles',
-        'stop-color','stop-opacity','stroke-dasharray','stroke-dashoffset','stroke-linecap',
-        'stroke-linejoin','stroke-miterlimit','stroke-opacity','stroke','stroke-width',
-        'surfacescale','targetx','targety','transform','text-anchor','text-decoration',
-        'text-rendering','textlength','u1','u2','unicode','values','viewbox',
-        'visibility','vert-adv-y','vert-origin-x','vert-origin-y','word-spacing',
-        'wrap','writing-mode','xchannelselector','ychannelselector','x','x1','x2',
-        'y','y1','y2','z','zoomandpan',
-
-        // MathML
-        'accent','accentunder','bevelled','close','columnsalign','columnlines',
-        'columnspan','denomalign','depth','display','displaystyle','fence',
-        'frame','largeop','length','linethickness','lspace','lquote',
-        'mathbackground','mathcolor','mathsize','mathvariant','maxsize',
-        'minsize','movablelimits','notation','numalign','open','rowalign',
-        'rowlines','rowspacing','rowspan','rspace','rquote','scriptlevel',
-        'scriptminsize','scriptsizemultiplier','selection','separator',
-        'separators','stretchy','subscriptshift','supscriptshift','symmetric',
-        'voffset',
-
-        // XML
-        'xlink:href','xml:id','xlink:title','xml:space','xmlns:xlink'
-    ]);
-
-    /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
-    var FORBID_TAGS = null;
-
-    /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
-    var FORBID_ATTR = null;
-
-    /* Decide if ARIA attributes are okay */
-    var ALLOW_ARIA_ATTR = true;
-
-    /* Decide if custom data attributes are okay */
-    var ALLOW_DATA_ATTR = true;
-
-    /* Decide if unknown protocols are okay */
-    var ALLOW_UNKNOWN_PROTOCOLS = false;
-
-    /* Output should be safe for jQuery's $() factory? */
-    var SAFE_FOR_JQUERY = false;
-
-    /* Output should be safe for common template engines.
-     * This means, DOMPurify removes data attributes, mustaches and ERB
-     */
-    var SAFE_FOR_TEMPLATES = false;
-
-    /* Specify template detection regex for SAFE_FOR_TEMPLATES mode */
-    var MUSTACHE_EXPR = /\{\{[\s\S]*|[\s\S]*\}\}/gm;
-    var ERB_EXPR = /<%[\s\S]*|[\s\S]*%>/gm;
-
-    /* Decide if document with <html>... should be returned */
-    var WHOLE_DOCUMENT = false;
-
-    /* Track whether config is already set on this instance of DOMPurify. */
-    var SET_CONFIG = false;
-
-    /* Decide if all elements (e.g. style, script) must be children of
-     * document.body. By default, browsers might move them to document.head */
-    var FORCE_BODY = false;
-
-    /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html string.
-     * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
-     */
-    var RETURN_DOM = false;
-
-    /* Decide if a DOM `DocumentFragment` should be returned, instead of a html string */
-    var RETURN_DOM_FRAGMENT = false;
-
-    /* If `RETURN_DOM` or `RETURN_DOM_FRAGMENT` is enabled, decide if the returned DOM
-     * `Node` is imported into the current `Document`. If this flag is not enabled the
-     * `Node` will belong (its ownerDocument) to a fresh `HTMLDocument`, created by
-     * DOMPurify. */
-    var RETURN_DOM_IMPORT = false;
-
-    /* Output should be free from DOM clobbering attacks? */
-    var SANITIZE_DOM = true;
-
-    /* Keep element content when removing element? */
-    var KEEP_CONTENT = true;
-
-    /* Tags to ignore content of when KEEP_CONTENT is true */
-    var FORBID_CONTENTS = _addToSet({}, [
-        'audio', 'head', 'math', 'script', 'style', 'template', 'svg', 'video'
-    ]);
-
-    /* Tags that are safe for data: URIs */
-    var DATA_URI_TAGS = _addToSet({}, [
-        'audio', 'video', 'img', 'source', 'image'
-    ]);
-
-    /* Attributes safe for values like "javascript:" */
-    var URI_SAFE_ATTRIBUTES = _addToSet({}, [
-        'alt','class','for','id','label','name','pattern','placeholder',
-        'summary','title','value','style','xmlns'
-    ]);
-
-    /* Keep a reference to config to pass to hooks */
-    var CONFIG = null;
-
-    /* Ideally, do not touch anything below this line */
-    /* ______________________________________________ */
-
-    var formElement = document.createElement('form');
-
-    /**
-     * _parseConfig
-     *
-     * @param  optional config literal
-     */
-    var _parseConfig = function(cfg) {
-        /* Shield configuration object from tampering */
-        if (typeof cfg !== 'object') {
-            cfg = {};
-        }
-
-        /* Set configuration parameters */
-        ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ?
-            _addToSet({}, cfg.ALLOWED_TAGS) : DEFAULT_ALLOWED_TAGS;
-        ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ?
-            _addToSet({}, cfg.ALLOWED_ATTR) : DEFAULT_ALLOWED_ATTR;
-        FORBID_TAGS = 'FORBID_TAGS' in cfg ?
-            _addToSet({}, cfg.FORBID_TAGS) : {};
-        FORBID_ATTR = 'FORBID_ATTR' in cfg ?
-            _addToSet({}, cfg.FORBID_ATTR) : {};
-        ALLOW_ARIA_ATTR     = cfg.ALLOW_ARIA_ATTR     !== false; // Default true
-        ALLOW_DATA_ATTR     = cfg.ALLOW_DATA_ATTR     !== false; // Default true
-        ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
-        SAFE_FOR_JQUERY     = cfg.SAFE_FOR_JQUERY     ||  false; // Default false
-        SAFE_FOR_TEMPLATES  = cfg.SAFE_FOR_TEMPLATES  ||  false; // Default false
-        WHOLE_DOCUMENT      = cfg.WHOLE_DOCUMENT      ||  false; // Default false
-        RETURN_DOM          = cfg.RETURN_DOM          ||  false; // Default false
-        RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT ||  false; // Default false
-        RETURN_DOM_IMPORT   = cfg.RETURN_DOM_IMPORT   ||  false; // Default false
-        FORCE_BODY          = cfg.FORCE_BODY          ||  false; // Default false
-        SANITIZE_DOM        = cfg.SANITIZE_DOM        !== false; // Default true
-        KEEP_CONTENT        = cfg.KEEP_CONTENT        !== false; // Default true
-
-        if (SAFE_FOR_TEMPLATES) {
-            ALLOW_DATA_ATTR = false;
-        }
-
-        if (RETURN_DOM_FRAGMENT) {
-            RETURN_DOM = true;
-        }
-
-        /* Merge configuration parameters */
-        if (cfg.ADD_TAGS) {
-            if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
-                ALLOWED_TAGS = _cloneObj(ALLOWED_TAGS);
-            }
-            _addToSet(ALLOWED_TAGS, cfg.ADD_TAGS);
-        }
-        if (cfg.ADD_ATTR) {
-            if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
-                ALLOWED_ATTR = _cloneObj(ALLOWED_ATTR);
-            }
-            _addToSet(ALLOWED_ATTR, cfg.ADD_ATTR);
-        }
-        if (cfg.ADD_URI_SAFE_ATTR) {
-            _addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR);
-        }
-
-        /* Add #text in case KEEP_CONTENT is set to true */
-        if (KEEP_CONTENT) { ALLOWED_TAGS['#text'] = true; }
-
-        // Prevent further manipulation of configuration.
-        // Not available in IE8, Safari 5, etc.
-        if (Object && 'freeze' in Object) { Object.freeze(cfg); }
-
-        CONFIG = cfg;
-    };
-
-   /**
-     * _forceRemove
-     *
-     * @param  a DOM node
-     */
-    var _forceRemove = function(node) {
-        DOMPurify.removed.push({element: node});
-        try {
-            node.parentNode.removeChild(node);
-        } catch (e) {
-            node.outerHTML = '';
-        }
-    };
-
-   /**
-     * _removeAttribute
-     *
-     * @param  an Attribute name
-     * @param  a DOM node
-     */
-    var _removeAttribute = function(name, node) {
-        DOMPurify.removed.push({
-            attribute: node.getAttributeNode(name),
-            from: node
-        });
-        node.removeAttribute(name);
-    };
-
-   /**
-     * _initDocument
-     *
-     * @param  a string of dirty markup
-     * @return a DOM, filled with the dirty markup
-     */
-    var _initDocument = function(dirty) {
-        /* Create a HTML document */
-        var doc, body;
-
-        /* Fill body with bogus element */
-        if (FORCE_BODY) {
-            dirty = '<remove></remove>' + dirty;
-        }
-
-        /* Use XHR if necessary because Safari 10.1 and newer are buggy */
-        if (useXHR) {
-            try {
-                dirty = encodeURI(dirty);
-            } catch (e) {}
-            var xhr = new XMLHttpRequest();
-            xhr.responseType = 'document';
-            xhr.open('GET', 'data:text/html;charset=utf-8,' + dirty, false);
-            xhr.send(null);
-            doc = xhr.response;
-        }
-
-        /* Use DOMParser to workaround Firefox bug (see comment below) */
-        if (useDOMParser) {
-            try {
-                doc = new DOMParser().parseFromString(dirty, 'text/html');
-            } catch (e) {}
-        }
-
-        /* Otherwise use createHTMLDocument, because DOMParser is unsafe in
-           Safari (see comment below) */
-        if (!doc || !doc.documentElement) {
-            doc = implementation.createHTMLDocument('');
-            body = doc.body;
-            body.parentNode.removeChild(body.parentNode.firstElementChild);
-            body.outerHTML = dirty;
-        }
-
-        /* Work on whole document or just its body */
-        return getElementsByTagName.call(doc,
-            WHOLE_DOCUMENT ? 'html' : 'body')[0];
-    };
-
-    // Safari 10.1+ (unfixed as of time of writing) has a catastrophic bug in
-    // its implementation of DOMParser such that the following executes the
-    // JavaScript:
-    //
-    // new DOMParser()
-    //   .parseFromString('<svg onload=alert(document.domain)>', 'text/html');
-    //
-    // Later, it was also noticed that even more assumed benign and inert ways
-    // of creating a document are now insecure thanks to Safari. So we work 
-    // around that with a feature test and use XHR to create the document in 
-    // case we really have to. That one seems safe for now.
-    //
-    // However, Firefox uses a different parser for innerHTML rather than
-    // DOMParser (see https://bugzilla.mozilla.org/show_bug.cgi?id=1205631)
-    // which means that you *must* use DOMParser, otherwise the output may
-    // not be safe if used in a document.write context later.
-    //
-    // So we feature detect the Firefox bug and use the DOMParser if necessary.
-    if (DOMPurify.isSupported) {
-        (function () {
-            var doc  = _initDocument('<svg><g onload="this.parentNode.remove()"></g></svg>');
-            if (!doc.querySelector('svg')) {
-                useXHR = true;
-            }
-            doc = _initDocument('<svg><p><style><img src="</style><img src=x onerror=alert(1)//">');
-            if (doc.querySelector('svg img')) {
-                useDOMParser = true;
-            }
-        }());
-    }
-
-    /**
-     * _createIterator
-     *
-     * @param  document/fragment to create iterator for
-     * @return iterator instance
-     */
-    var _createIterator = function(root) {
-        return createNodeIterator.call(root.ownerDocument || root,
-            root,
-            NodeFilter.SHOW_ELEMENT
-            | NodeFilter.SHOW_COMMENT
-            | NodeFilter.SHOW_TEXT,
-            function() { return NodeFilter.FILTER_ACCEPT; },
-            false
-        );
-    };
-
-    /**
-     * _isClobbered
-     *
-     * @param  element to check for clobbering attacks
-     * @return true if clobbered, false if safe
-     */
-    var _isClobbered = function(elm) {
-        if (elm instanceof Text || elm instanceof Comment) {
-            return false;
-        }
-        if (  typeof elm.nodeName !== 'string'
-           || typeof elm.textContent !== 'string'
-           || typeof elm.removeChild !== 'function'
-           || !(elm.attributes instanceof NamedNodeMap)
-           || typeof elm.removeAttribute !== 'function'
-           || typeof elm.setAttribute !== 'function'
-        ) {
-            return true;
-        }
-        return false;
-    };
-
-    /**
-     * _isNode
-     *
-     * @param object to check whether it's a DOM node
-     * @return true is object is a DOM node
-     */
-    var _isNode = function(obj) {
-        return (
-            typeof Node === "object" ? obj instanceof Node : obj
-                && typeof obj === "object" && typeof obj.nodeType === "number"
-                && typeof obj.nodeName==="string"
-        );
-    };
-
-    /**
-     * _sanitizeElements
-     *
-     * @protect nodeName
-     * @protect textContent
-     * @protect removeChild
-     *
-     * @param   node to check for permission to exist
-     * @return  true if node was killed, false if left alive
-     */
-    var _sanitizeElements = function(currentNode) {
-        var tagName, content;
-
-        /* Execute a hook if present */
-        _executeHook('beforeSanitizeElements', currentNode, null);
-
-        /* Check if element is clobbered or can clobber */
-        if (_isClobbered(currentNode)) {
-            _forceRemove(currentNode);
-            return true;
-        }
-
-        /* Now let's check the element's type and name */
-        tagName = currentNode.nodeName.toLowerCase();
-
-        /* Execute a hook if present */
-        _executeHook('uponSanitizeElement', currentNode, {
-            tagName: tagName,
-            allowedTags: ALLOWED_TAGS
-        });
-
-        /* Remove element if anything forbids its presence */
-        if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
-            /* Keep content except for black-listed elements */
-            if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]
-                    && typeof currentNode.insertAdjacentHTML === 'function') {
-                try {
-                    currentNode.insertAdjacentHTML('AfterEnd', currentNode.innerHTML);
-                } catch (e) {}
-            }
-            _forceRemove(currentNode);
-            return true;
-        }
-
-        /* Convert markup to cover jQuery behavior */
-        if (SAFE_FOR_JQUERY && !currentNode.firstElementChild &&
-                (!currentNode.content || !currentNode.content.firstElementChild) &&
-                /</g.test(currentNode.textContent)) {
-            DOMPurify.removed.push({element: currentNode.cloneNode()});
-            currentNode.innerHTML = currentNode.textContent.replace(/</g, '&lt;');
-        }
-
-        /* Sanitize element content to be template-safe */
-        if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
-            /* Get the element's text content */
-            content = currentNode.textContent;
-            content = content.replace(MUSTACHE_EXPR, ' ');
-            content = content.replace(ERB_EXPR, ' ');
-            if (currentNode.textContent !== content) {
-                DOMPurify.removed.push({element: currentNode.cloneNode()});
-                currentNode.textContent = content;
-            }
-        }
-
-        /* Execute a hook if present */
-        _executeHook('afterSanitizeElements', currentNode, null);
-
-        return false;
-    };
-
-    var DATA_ATTR = /^data-[\-\w.\u00B7-\uFFFF]/;
-    var ARIA_ATTR = /^aria-[\-\w]+$/;
-    var IS_ALLOWED_URI = /^(?:(?:(?:f|ht)tps?|mailto|tel):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
-    var IS_SCRIPT_OR_DATA = /^(?:\w+script|data):/i;
-    /* This needs to be extensive thanks to Webkit/Blink's behavior */
-    var ATTR_WHITESPACE = /[\x00-\x20\xA0\u1680\u180E\u2000-\u2029\u205f\u3000]/g;
-
-    /**
-     * _sanitizeAttributes
-     *
-     * @protect attributes
-     * @protect nodeName
-     * @protect removeAttribute
-     * @protect setAttribute
-     *
-     * @param   node to sanitize
-     * @return  void
-     */
-    var _sanitizeAttributes = function(currentNode) {
-        var attr, name, value, lcName, idAttr, attributes, hookEvent, l;
-        /* Execute a hook if present */
-        _executeHook('beforeSanitizeAttributes', currentNode, null);
-
-        attributes = currentNode.attributes;
-
-        /* Check if we have attributes; if not we might have a text node */
-        if (!attributes) { return; }
-
-        hookEvent = {
-            attrName: '',
-            attrValue: '',
-            keepAttr: true,
-            allowedAttributes: ALLOWED_ATTR
-        };
-        l = attributes.length;
-
-        /* Go backwards over all attributes; safely remove bad ones */
-        while (l--) {
-            attr = attributes[l];
-            name = attr.name;
-            value = attr.value.trim();
-            lcName = name.toLowerCase();
-
-            /* Execute a hook if present */
-            hookEvent.attrName = lcName;
-            hookEvent.attrValue = value;
-            hookEvent.keepAttr = true;
-            _executeHook('uponSanitizeAttribute', currentNode, hookEvent );
-            value = hookEvent.attrValue;
-
-            /* Remove attribute */
-            // Safari (iOS + Mac), last tested v8.0.5, crashes if you try to
-            // remove a "name" attribute from an <img> tag that has an "id"
-            // attribute at the time.
-            if (lcName === 'name'  &&
-                    currentNode.nodeName === 'IMG' && attributes.id) {
-                idAttr = attributes.id;
-                attributes = Array.prototype.slice.apply(attributes);
-                _removeAttribute('id', currentNode);
-                _removeAttribute(name, currentNode);
-                if (attributes.indexOf(idAttr) > l) {
-                    currentNode.setAttribute('id', idAttr.value);
-                }
-            } else if (
-                  // This works around a bug in Safari, where input[type=file]
-                  // cannot be dynamically set after type has been removed
-                  currentNode.nodeName === 'INPUT' && lcName === 'type' &&
-                  value === 'file' && (ALLOWED_ATTR[lcName] || !FORBID_ATTR[lcName])) {
-                  continue;
-            } else {
-                // This avoids a crash in Safari v9.0 with double-ids.
-                // The trick is to first set the id to be empty and then to
-                // remove the attribute
-                if (name === 'id') {
-                    currentNode.setAttribute(name, '');
-                }
-                _removeAttribute(name, currentNode);
-            }
-
-            /* Did the hooks approve of the attribute? */
-            if (!hookEvent.keepAttr) {
-                continue;
-            }
-
-            /* Make sure attribute cannot clobber */
-            if (SANITIZE_DOM &&
-                    (lcName === 'id' || lcName === 'name') &&
-                    (value in window || value in document || value in formElement)) {
-                continue;
-            }
-
-            /* Sanitize attribute content to be template-safe */
-            if (SAFE_FOR_TEMPLATES) {
-                value = value.replace(MUSTACHE_EXPR, ' ');
-                value = value.replace(ERB_EXPR, ' ');
-            }
-
-            /* Allow valid data-* attributes: At least one character after "-"
-               (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
-               XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
-               We don't need to check the value; it's always URI safe. */
-            if (ALLOW_DATA_ATTR && DATA_ATTR.test(lcName)) {
-                // This attribute is safe
-            }
-            else if (ALLOW_ARIA_ATTR && ARIA_ATTR.test(lcName)) {
-                // This attribute is safe
-            }
-            /* Otherwise, check the name is permitted */
-            else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
-                continue;
-            }
-            /* Check value is safe. First, is attr inert? If so, is safe */
-            else if (URI_SAFE_ATTRIBUTES[lcName]) {
-                // This attribute is safe
-            }
-            /* Check no script, data or unknown possibly unsafe URI
-               unless we know URI values are safe for that attribute */
-            else if (IS_ALLOWED_URI.test(value.replace(ATTR_WHITESPACE,''))) {
-                // This attribute is safe
-            }
-            /* Keep image data URIs alive if src/xlink:href is allowed */
-            else if (
-                (lcName === 'src' || lcName === 'xlink:href') &&
-                value.indexOf('data:') === 0 &&
-                DATA_URI_TAGS[currentNode.nodeName.toLowerCase()]) {
-                // This attribute is safe
-            }
-            /* Allow unknown protocols: This provides support for links that
-               are handled by protocol handlers which may be unknown ahead of
-               time, e.g. fb:, spotify: */
-            else if (
-                ALLOW_UNKNOWN_PROTOCOLS &&
-                !IS_SCRIPT_OR_DATA.test(value.replace(ATTR_WHITESPACE,''))) {
-                // This attribute is safe
-            }
-            /* Check for binary attributes */
-            else if (!value) {
-                // binary attributes are safe at this point
-            }
-            /* Anything else, presume unsafe, do not add it back */
-            else {
-                continue;
-            }
-
-            /* Handle invalid data-* attribute set by try-catching it */
-            try {
-                currentNode.setAttribute(name, value);
-                DOMPurify.removed.pop();
-            } catch (e) {}
-        }
-
-        /* Execute a hook if present */
-        _executeHook('afterSanitizeAttributes', currentNode, null);
-    };
-
-    /**
-     * _sanitizeShadowDOM
-     *
-     * @param  fragment to iterate over recursively
-     * @return void
-     */
-    var _sanitizeShadowDOM = function(fragment) {
-        var shadowNode;
-        var shadowIterator = _createIterator(fragment);
-
-        /* Execute a hook if present */
-        _executeHook('beforeSanitizeShadowDOM', fragment, null);
-
-        while ( (shadowNode = shadowIterator.nextNode()) ) {
-            /* Execute a hook if present */
-            _executeHook('uponSanitizeShadowNode', shadowNode, null);
-
-            /* Sanitize tags and elements */
-            if (_sanitizeElements(shadowNode)) {
-                continue;
-            }
-
-            /* Deep shadow DOM detected */
-            if (shadowNode.content instanceof DocumentFragment) {
-                _sanitizeShadowDOM(shadowNode.content);
-            }
-
-            /* Check attributes, sanitize if necessary */
-            _sanitizeAttributes(shadowNode);
-        }
-
-        /* Execute a hook if present */
-        _executeHook('afterSanitizeShadowDOM', fragment, null);
-    };
-
-    /**
-     * _executeHook
-     * Execute user configurable hooks
-     *
-     * @param  {String} entryPoint  Name of the hook's entry point
-     * @param  {Node} currentNode
-     */
-    var _executeHook = function(entryPoint, currentNode, data) {
-        if (!hooks[entryPoint]) { return; }
-
-        hooks[entryPoint].forEach(function(hook) {
-            hook.call(DOMPurify, currentNode, data, CONFIG);
-        });
-    };
-
-    /**
-     * sanitize
-     * Public method providing core sanitation functionality
-     *
-     * @param {String|Node} dirty string or DOM node
-     * @param {Object} configuration object
-     */
-    DOMPurify.sanitize = function(dirty, cfg) {
-        var body, importedNode, currentNode, oldNode, nodeIterator, returnNode;
-        /* Make sure we have a string to sanitize.
-           DO NOT return early, as this will return the wrong type if
-           the user has requested a DOM object rather than a string */
-        if (!dirty) {
-            dirty = '<!-->';
-        }
-
-        /* Stringify, in case dirty is an object */
-        if (typeof dirty !== 'string' && !_isNode(dirty)) {
-            if (typeof dirty.toString !== 'function') {
-                throw new TypeError('toString is not a function');
-            } else {
-                dirty = dirty.toString();
-            }
-        }
-
-        /* Check we can run. Otherwise fall back or ignore */
-        if (!DOMPurify.isSupported) {
-            if (typeof window.toStaticHTML === 'object'
-                || typeof window.toStaticHTML === 'function') {
-                if (typeof dirty === 'string') {
-                    return window.toStaticHTML(dirty);
-                } else if (_isNode(dirty)) {
-                    return window.toStaticHTML(dirty.outerHTML);
-                }
-            }
-            return dirty;
-        }
-
-        /* Assign config vars */
-        if (!SET_CONFIG) {
-            _parseConfig(cfg);
-        }
-
-        /* Clean up removed elements */
-        DOMPurify.removed = [];
-
-        if (dirty instanceof Node) {
-            /* If dirty is a DOM element, append to an empty document to avoid
-               elements being stripped by the parser */
-            body = _initDocument('<!-->');
-            importedNode = body.ownerDocument.importNode(dirty, true);
-            if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
-                /* Node is already a body, use as is */
-                body = importedNode;
-            } else {
-                body.appendChild(importedNode);
-            }
-        } else {
-            /* Exit directly if we have nothing to do */
-            if (!RETURN_DOM && !WHOLE_DOCUMENT && dirty.indexOf('<') === -1) {
-                return dirty;
-            }
-
-            /* Initialize the document to work on */
-            body = _initDocument(dirty);
-
-            /* Check we have a DOM node from the data */
-            if (!body) {
-                return RETURN_DOM ? null : '';
-            }
-        }
-
-        /* Remove first element node (ours) if FORCE_BODY is set */
-        if (FORCE_BODY) {
-            _forceRemove(body.firstChild);
-        }
-
-        /* Get node iterator */
-        nodeIterator = _createIterator(body);
-
-        /* Now start iterating over the created document */
-        while ( (currentNode = nodeIterator.nextNode()) ) {
-
-            /* Fix IE's strange behavior with manipulated textNodes #89 */
-            if (currentNode.nodeType === 3 && currentNode === oldNode) {
-                continue;
-            }
-
-            /* Sanitize tags and elements */
-            if (_sanitizeElements(currentNode)) {
-                continue;
-            }
-
-            /* Shadow DOM detected, sanitize it */
-            if (currentNode.content instanceof DocumentFragment) {
-                _sanitizeShadowDOM(currentNode.content);
-            }
-
-            /* Check attributes, sanitize if necessary */
-            _sanitizeAttributes(currentNode);
-
-            oldNode = currentNode;
-        }
-
-        /* Return sanitized string or DOM */
-        if (RETURN_DOM) {
-
-            if (RETURN_DOM_FRAGMENT) {
-                returnNode = createDocumentFragment.call(body.ownerDocument);
-
-                while (body.firstChild) {
-                    returnNode.appendChild(body.firstChild);
-                }
-            } else {
-                returnNode = body;
-            }
-
-            if (RETURN_DOM_IMPORT) {
-                /* adoptNode() is not used because internal state is not reset
-                   (e.g. the past names map of a HTMLFormElement), this is safe
-                   in theory but we would rather not risk another attack vector.
-                   The state that is cloned by importNode() is explicitly defined
-                   by the specs. */
-                returnNode = importNode.call(originalDocument, returnNode, true);
-            }
-
-            return returnNode;
-        }
-
-        return WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
-    };
-
-    /**
-     * setConfig
-     * Public method to set the configuration once
-     *
-     * @param {Object} configuration object
-     * @return void
-     */
-    DOMPurify.setConfig = function(cfg) {
-        _parseConfig(cfg);
-        SET_CONFIG = true;
-    };
-
-    /**
-     * clearConfig
-     * Public method to remove the configuration
-     *
-     * @return void
-     */
-    DOMPurify.clearConfig = function() {
-        CONFIG = null;
-        SET_CONFIG = false;
-    };
-
-    /**
-     * addHook
-     * Public method to add DOMPurify hooks
-     *
-     * @param {String} entryPoint
-     * @param {Function} hookFunction
-     */
-    DOMPurify.addHook = function(entryPoint, hookFunction) {
-        if (typeof hookFunction !== 'function') { return; }
-        hooks[entryPoint] = hooks[entryPoint] || [];
-        hooks[entryPoint].push(hookFunction);
-    };
-
-    /**
-     * removeHook
-     * Public method to remove a DOMPurify hook at a given entryPoint
-     * (pops it from the stack of hooks if more are present)
-     *
-     * @param {String} entryPoint
-     * @return void
-     */
-    DOMPurify.removeHook = function(entryPoint) {
-        if (hooks[entryPoint]) {
-            hooks[entryPoint].pop();
-        }
-    };
-
-    /**
-     * removeHooks
-     * Public method to remove all DOMPurify hooks at a given entryPoint
-     *
-     * @param  {String} entryPoint
-     * @return void
-     */
-    DOMPurify.removeHooks = function(entryPoint) {
-        if (hooks[entryPoint]) {
-            hooks[entryPoint] = [];
-        }
-    };
-
-    /**
-     * removeAllHooks
-     * Public method to remove all DOMPurify hooks
-     *
-     * @return void
-     */
-    DOMPurify.removeAllHooks = function() {
-        hooks = {};
-    };
-
-    return DOMPurify;
-}));