dompurify 2.4.6 → 2.4.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -12
- package/README.md +1 -1
- package/dist/purify.cjs.js +2 -2
- package/dist/purify.es.js +2 -2
- package/dist/purify.js +2 -2
- package/dist/purify.min.js +2 -2
- package/dist/purify.min.js.map +1 -1
- package/package.json +1 -1
package/LICENSE
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
DOMPurify
|
|
2
|
-
Copyright
|
|
2
|
+
Copyright 2023 Dr.-Ing. Mario Heiderich, Cure53
|
|
3
3
|
|
|
4
4
|
DOMPurify is free software; you can redistribute it and/or modify it under the
|
|
5
5
|
terms of either:
|
|
@@ -9,17 +9,207 @@ b) the Mozilla Public License Version 2.0
|
|
|
9
9
|
|
|
10
10
|
-----------------------------------------------------------------------------
|
|
11
11
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
12
|
+
Apache License
|
|
13
|
+
Version 2.0, January 2004
|
|
14
|
+
http://www.apache.org/licenses/
|
|
15
|
+
|
|
16
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
17
|
+
|
|
18
|
+
1. Definitions.
|
|
19
|
+
|
|
20
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
21
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
22
|
+
|
|
23
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
24
|
+
the copyright owner that is granting the License.
|
|
25
|
+
|
|
26
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
27
|
+
other entities that control, are controlled by, or are under common
|
|
28
|
+
control with that entity. For the purposes of this definition,
|
|
29
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
30
|
+
direction or management of such entity, whether by contract or
|
|
31
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
32
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
33
|
+
|
|
34
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
35
|
+
exercising permissions granted by this License.
|
|
36
|
+
|
|
37
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
38
|
+
including but not limited to software source code, documentation
|
|
39
|
+
source, and configuration files.
|
|
40
|
+
|
|
41
|
+
"Object" form shall mean any form resulting from mechanical
|
|
42
|
+
transformation or translation of a Source form, including but
|
|
43
|
+
not limited to compiled object code, generated documentation,
|
|
44
|
+
and conversions to other media types.
|
|
45
|
+
|
|
46
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
47
|
+
Object form, made available under the License, as indicated by a
|
|
48
|
+
copyright notice that is included in or attached to the work
|
|
49
|
+
(an example is provided in the Appendix below).
|
|
50
|
+
|
|
51
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
52
|
+
form, that is based on (or derived from) the Work and for which the
|
|
53
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
54
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
55
|
+
of this License, Derivative Works shall not include works that remain
|
|
56
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
57
|
+
the Work and Derivative Works thereof.
|
|
58
|
+
|
|
59
|
+
"Contribution" shall mean any work of authorship, including
|
|
60
|
+
the original version of the Work and any modifications or additions
|
|
61
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
62
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
63
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
64
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
65
|
+
means any form of electronic, verbal, or written communication sent
|
|
66
|
+
to the Licensor or its representatives, including but not limited to
|
|
67
|
+
communication on electronic mailing lists, source code control systems,
|
|
68
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
69
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
70
|
+
excluding communication that is conspicuously marked or otherwise
|
|
71
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
72
|
+
|
|
73
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
74
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
75
|
+
subsequently incorporated within the Work.
|
|
76
|
+
|
|
77
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
78
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
79
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
80
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
81
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
82
|
+
Work and such Derivative Works in Source or Object form.
|
|
83
|
+
|
|
84
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
85
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
86
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
87
|
+
(except as stated in this section) patent license to make, have made,
|
|
88
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
89
|
+
where such license applies only to those patent claims licensable
|
|
90
|
+
by such Contributor that are necessarily infringed by their
|
|
91
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
92
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
93
|
+
institute patent litigation against any entity (including a
|
|
94
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
95
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
96
|
+
or contributory patent infringement, then any patent licenses
|
|
97
|
+
granted to You under this License for that Work shall terminate
|
|
98
|
+
as of the date such litigation is filed.
|
|
99
|
+
|
|
100
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
101
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
102
|
+
modifications, and in Source or Object form, provided that You
|
|
103
|
+
meet the following conditions:
|
|
104
|
+
|
|
105
|
+
(a) You must give any other recipients of the Work or
|
|
106
|
+
Derivative Works a copy of this License; and
|
|
107
|
+
|
|
108
|
+
(b) You must cause any modified files to carry prominent notices
|
|
109
|
+
stating that You changed the files; and
|
|
110
|
+
|
|
111
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
112
|
+
that You distribute, all copyright, patent, trademark, and
|
|
113
|
+
attribution notices from the Source form of the Work,
|
|
114
|
+
excluding those notices that do not pertain to any part of
|
|
115
|
+
the Derivative Works; and
|
|
116
|
+
|
|
117
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
118
|
+
distribution, then any Derivative Works that You distribute must
|
|
119
|
+
include a readable copy of the attribution notices contained
|
|
120
|
+
within such NOTICE file, excluding those notices that do not
|
|
121
|
+
pertain to any part of the Derivative Works, in at least one
|
|
122
|
+
of the following places: within a NOTICE text file distributed
|
|
123
|
+
as part of the Derivative Works; within the Source form or
|
|
124
|
+
documentation, if provided along with the Derivative Works; or,
|
|
125
|
+
within a display generated by the Derivative Works, if and
|
|
126
|
+
wherever such third-party notices normally appear. The contents
|
|
127
|
+
of the NOTICE file are for informational purposes only and
|
|
128
|
+
do not modify the License. You may add Your own attribution
|
|
129
|
+
notices within Derivative Works that You distribute, alongside
|
|
130
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
131
|
+
that such additional attribution notices cannot be construed
|
|
132
|
+
as modifying the License.
|
|
133
|
+
|
|
134
|
+
You may add Your own copyright statement to Your modifications and
|
|
135
|
+
may provide additional or different license terms and conditions
|
|
136
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
137
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
138
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
139
|
+
the conditions stated in this License.
|
|
140
|
+
|
|
141
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
142
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
143
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
144
|
+
this License, without any additional terms or conditions.
|
|
145
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
146
|
+
the terms of any separate license agreement you may have executed
|
|
147
|
+
with Licensor regarding such Contributions.
|
|
148
|
+
|
|
149
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
150
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
151
|
+
except as required for reasonable and customary use in describing the
|
|
152
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
153
|
+
|
|
154
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
155
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
156
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
157
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
158
|
+
implied, including, without limitation, any warranties or conditions
|
|
159
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
160
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
161
|
+
appropriateness of using or redistributing the Work and assume any
|
|
162
|
+
risks associated with Your exercise of permissions under this License.
|
|
163
|
+
|
|
164
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
165
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
166
|
+
unless required by applicable law (such as deliberate and grossly
|
|
167
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
168
|
+
liable to You for damages, including any direct, indirect, special,
|
|
169
|
+
incidental, or consequential damages of any character arising as a
|
|
170
|
+
result of this License or out of the use or inability to use the
|
|
171
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
172
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
173
|
+
other commercial damages or losses), even if such Contributor
|
|
174
|
+
has been advised of the possibility of such damages.
|
|
175
|
+
|
|
176
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
177
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
178
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
179
|
+
or other liability obligations and/or rights consistent with this
|
|
180
|
+
License. However, in accepting such obligations, You may act only
|
|
181
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
182
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
183
|
+
defend, and hold each Contributor harmless for any liability
|
|
184
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
185
|
+
of your accepting any such warranty or additional liability.
|
|
186
|
+
|
|
187
|
+
END OF TERMS AND CONDITIONS
|
|
188
|
+
|
|
189
|
+
APPENDIX: How to apply the Apache License to your work.
|
|
190
|
+
|
|
191
|
+
To apply the Apache License to your work, attach the following
|
|
192
|
+
boilerplate notice, with the fields enclosed by brackets "[]"
|
|
193
|
+
replaced with your own identifying information. (Don't include
|
|
194
|
+
the brackets!) The text should be enclosed in the appropriate
|
|
195
|
+
comment syntax for the file format. We also recommend that a
|
|
196
|
+
file or class name and description of purpose be included on the
|
|
197
|
+
same "printed page" as the copyright notice for easier
|
|
198
|
+
identification within third-party archives.
|
|
199
|
+
|
|
200
|
+
Copyright [yyyy] [name of copyright owner]
|
|
201
|
+
|
|
202
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
203
|
+
you may not use this file except in compliance with the License.
|
|
204
|
+
You may obtain a copy of the License at
|
|
205
|
+
|
|
206
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
207
|
+
|
|
208
|
+
Unless required by applicable law or agreed to in writing, software
|
|
209
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
210
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
211
|
+
See the License for the specific language governing permissions and
|
|
212
|
+
limitations under the License.
|
|
23
213
|
|
|
24
214
|
-----------------------------------------------------------------------------
|
|
25
215
|
Mozilla Public License, version 2.0
|
package/README.md
CHANGED
|
@@ -10,7 +10,7 @@ It's also very simple to use and get started with. DOMPurify was [started in Feb
|
|
|
10
10
|
|
|
11
11
|
DOMPurify is written in JavaScript and works in all modern browsers (Safari (10+), Opera (15+), Internet Explorer (10+), Edge, Firefox and Chrome - as well as almost anything else using Blink or WebKit). It doesn't break on MSIE6 or other legacy browsers. It either uses [a fall-back](#what-about-older-browsers-like-msie8) or simply does nothing.
|
|
12
12
|
|
|
13
|
-
**Note that DOMPurify v2.4.
|
|
13
|
+
**Note that DOMPurify v2.4.7 is the latest version supporting MSIE. For important security updates compatible with MSIE, please use the 2.x branch.**
|
|
14
14
|
|
|
15
15
|
Our automated tests cover [19 different browsers](https://github.com/cure53/DOMPurify/blob/main/test/karma.custom-launchers.config.js#L5) right now, more to come. We also cover Node.js v14.x, v16.x, v17.x and v18.x, running DOMPurify on [jsdom](https://github.com/jsdom/jsdom). Older Node versions are known to work as well, but hey... no guarantees.
|
|
16
16
|
|
package/dist/purify.cjs.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @license DOMPurify 2.4.
|
|
1
|
+
/*! @license DOMPurify 2.4.7 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.7/LICENSE */
|
|
2
2
|
|
|
3
3
|
'use strict';
|
|
4
4
|
|
|
@@ -326,7 +326,7 @@ function createDOMPurify() {
|
|
|
326
326
|
*/
|
|
327
327
|
|
|
328
328
|
|
|
329
|
-
DOMPurify.version = '2.4.
|
|
329
|
+
DOMPurify.version = '2.4.7';
|
|
330
330
|
/**
|
|
331
331
|
* Array of elements that DOMPurify removed during sanitation.
|
|
332
332
|
* Empty if nothing was removed.
|
package/dist/purify.es.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @license DOMPurify 2.4.
|
|
1
|
+
/*! @license DOMPurify 2.4.7 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.7/LICENSE */
|
|
2
2
|
|
|
3
3
|
function _typeof(obj) {
|
|
4
4
|
"@babel/helpers - typeof";
|
|
@@ -324,7 +324,7 @@ function createDOMPurify() {
|
|
|
324
324
|
*/
|
|
325
325
|
|
|
326
326
|
|
|
327
|
-
DOMPurify.version = '2.4.
|
|
327
|
+
DOMPurify.version = '2.4.7';
|
|
328
328
|
/**
|
|
329
329
|
* Array of elements that DOMPurify removed during sanitation.
|
|
330
330
|
* Empty if nothing was removed.
|
package/dist/purify.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @license DOMPurify 2.4.
|
|
1
|
+
/*! @license DOMPurify 2.4.7 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.7/LICENSE */
|
|
2
2
|
|
|
3
3
|
(function (global, factory) {
|
|
4
4
|
typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
|
|
@@ -330,7 +330,7 @@
|
|
|
330
330
|
*/
|
|
331
331
|
|
|
332
332
|
|
|
333
|
-
DOMPurify.version = '2.4.
|
|
333
|
+
DOMPurify.version = '2.4.7';
|
|
334
334
|
/**
|
|
335
335
|
* Array of elements that DOMPurify removed during sanitation.
|
|
336
336
|
* Empty if nothing was removed.
|
package/dist/purify.min.js
CHANGED
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
/*! @license DOMPurify 2.4.
|
|
2
|
-
!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).DOMPurify=t()}(this,(function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,n){return t=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e},t(e,n)}function n(){if("undefined"==typeof Reflect||!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catch(e){return!1}}function r(e,o,a){return r=n()?Reflect.construct:function(e,n,r){var o=[null];o.push.apply(o,n);var a=new(Function.bind.apply(e,o));return r&&t(a,r.prototype),a},r.apply(null,arguments)}function o(e){return function(e){if(Array.isArray(e))return a(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return a(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return a(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function a(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var i=Object.hasOwnProperty,l=Object.setPrototypeOf,c=Object.isFrozen,u=Object.getPrototypeOf,s=Object.getOwnPropertyDescriptor,m=Object.freeze,f=Object.seal,p=Object.create,d="undefined"!=typeof Reflect&&Reflect,h=d.apply,g=d.construct;h||(h=function(e,t,n){return e.apply(t,n)}),m||(m=function(e){return e}),f||(f=function(e){return e}),g||(g=function(e,t){return r(e,o(t))});var y,b=L(Array.prototype.forEach),v=L(Array.prototype.pop),T=L(Array.prototype.push),N=L(String.prototype.toLowerCase),E=L(String.prototype.toString),A=L(String.prototype.match),w=L(String.prototype.replace),S=L(String.prototype.indexOf),_=L(String.prototype.trim),x=L(RegExp.prototype.test),k=(y=TypeError,function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return g(y,t)});function L(e){return function(t){for(var n=arguments.length,r=new Array(n>1?n-1:0),o=1;o<n;o++)r[o-1]=arguments[o];return h(e,t,r)}}function O(e,t,n){var r;n=null!==(r=n)&&void 0!==r?r:N,l&&l(e,null);for(var o=t.length;o--;){var a=t[o];if("string"==typeof a){var i=n(a);i!==a&&(c(t)||(t[o]=i),a=i)}e[a]=!0}return e}function D(e){var t,n=p(null);for(t in e)!0===h(i,e,[t])&&(n[t]=e[t]);return n}function M(e,t){for(;null!==e;){var n=s(e,t);if(n){if(n.get)return L(n.get);if("function"==typeof n.value)return L(n.value)}e=u(e)}return function(e){return console.warn("fallback value for",e),null}}var R=m(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","section","select","shadow","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),C=m(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","filter","font","g","glyph","glyphref","hkern","image","line","lineargradient","marker","mask","metadata","mpath","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),I=m(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),F=m(["animate","color-profile","cursor","discard","fedropshadow","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),U=m(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover"]),H=m(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),z=m(["#text"]),P=m(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","controls","controlslist","coords","crossorigin","datetime","decoding","default","dir","disabled","disablepictureinpicture","disableremoteplayback","download","draggable","enctype","enterkeyhint","face","for","headers","height","hidden","high","href","hreflang","id","inputmode","integrity","ismap","kind","label","lang","list","loading","loop","low","max","maxlength","media","method","min","minlength","multiple","muted","name","nonce","noshade","novalidate","nowrap","open","optimum","pattern","placeholder","playsinline","poster","preload","pubdate","radiogroup","readonly","rel","required","rev","reversed","role","rows","rowspan","spellcheck","scope","selected","shape","size","sizes","span","srclang","start","src","srcset","step","style","summary","tabindex","title","translate","type","usemap","valign","value","width","xmlns","slot"]),j=m(["accent-height","accumulate","additive","alignment-baseline","ascent","attributename","attributetype","azimuth","basefrequency","baseline-shift","begin","bias","by","class","clip","clippathunits","clip-path","clip-rule","color","color-interpolation","color-interpolation-filters","color-profile","color-rendering","cx","cy","d","dx","dy","diffuseconstant","direction","display","divisor","dur","edgemode","elevation","end","fill","fill-opacity","fill-rule","filter","filterunits","flood-color","flood-opacity","font-family","font-size","font-size-adjust","font-stretch","font-style","font-variant","font-weight","fx","fy","g1","g2","glyph-name","glyphref","gradientunits","gradienttransform","height","href","id","image-rendering","in","in2","k","k1","k2","k3","k4","kerning","keypoints","keysplines","keytimes","lang","lengthadjust","letter-spacing","kernelmatrix","kernelunitlength","lighting-color","local","marker-end","marker-mid","marker-start","markerheight","markerunits","markerwidth","maskcontentunits","maskunits","max","mask","media","method","mode","min","name","numoctaves","offset","operator","opacity","order","orient","orientation","origin","overflow","paint-order","path","pathlength","patterncontentunits","patterntransform","patternunits","points","preservealpha","preserveaspectratio","primitiveunits","r","rx","ry","radius","refx","refy","repeatcount","repeatdur","restart","result","rotate","scale","seed","shape-rendering","specularconstant","specularexponent","spreadmethod","startoffset","stddeviation","stitchtiles","stop-color","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-linecap","stroke-linejoin","stroke-miterlimit","stroke-opacity","stroke","stroke-width","style","surfacescale","systemlanguage","tabindex","targetx","targety","transform","transform-origin","text-anchor","text-decoration","text-rendering","textlength","type","u1","u2","unicode","values","viewbox","visibility","version","vert-adv-y","vert-origin-x","vert-origin-y","width","word-spacing","wrap","writing-mode","xchannelselector","ychannelselector","x","x1","x2","xmlns","y","y1","y2","z","zoomandpan"]),B=m(["accent","accentunder","align","bevelled","close","columnsalign","columnlines","columnspan","denomalign","depth","dir","display","displaystyle","encoding","fence","frame","height","href","id","largeop","length","linethickness","lspace","lquote","mathbackground","mathcolor","mathsize","mathvariant","maxsize","minsize","movablelimits","notation","numalign","open","rowalign","rowlines","rowspacing","rowspan","rspace","rquote","scriptlevel","scriptminsize","scriptsizemultiplier","selection","separator","separators","stretchy","subscriptshift","supscriptshift","symmetric","voffset","width","xmlns"]),G=m(["xlink:href","xml:id","xlink:title","xml:space","xmlns:xlink"]),W=f(/\{\{[\w\W]*|[\w\W]*\}\}/gm),q=f(/<%[\w\W]*|[\w\W]*%>/gm),Y=f(/\${[\w\W]*}/gm),$=f(/^data-[\-\w.\u00B7-\uFFFF]/),K=f(/^aria-[\-\w]+$/),V=f(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),X=f(/^(?:\w+script|data):/i),Z=f(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),J=f(/^html$/i),Q=function(){return"undefined"==typeof window?null:window},ee=function(t,n){if("object"!==e(t)||"function"!=typeof t.createPolicy)return null;var r=null,o="data-tt-policy-suffix";n.currentScript&&n.currentScript.hasAttribute(o)&&(r=n.currentScript.getAttribute(o));var a="dompurify"+(r?"#"+r:"");try{return t.createPolicy(a,{createHTML:function(e){return e},createScriptURL:function(e){return e}})}catch(e){return console.warn("TrustedTypes policy "+a+" could not be created."),null}};var te=function t(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:Q(),r=function(e){return t(e)};if(r.version="2.4.6",r.removed=[],!n||!n.document||9!==n.document.nodeType)return r.isSupported=!1,r;var a=n.document,i=n.document,l=n.DocumentFragment,c=n.HTMLTemplateElement,u=n.Node,s=n.Element,f=n.NodeFilter,p=n.NamedNodeMap,d=void 0===p?n.NamedNodeMap||n.MozNamedAttrMap:p,h=n.HTMLFormElement,g=n.DOMParser,y=n.trustedTypes,L=s.prototype,te=M(L,"cloneNode"),ne=M(L,"nextSibling"),re=M(L,"childNodes"),oe=M(L,"parentNode");if("function"==typeof c){var ae=i.createElement("template");ae.content&&ae.content.ownerDocument&&(i=ae.content.ownerDocument)}var ie=ee(y,a),le=ie?ie.createHTML(""):"",ce=i,ue=ce.implementation,se=ce.createNodeIterator,me=ce.createDocumentFragment,fe=ce.getElementsByTagName,pe=a.importNode,de={};try{de=D(i).documentMode?i.documentMode:{}}catch(e){}var he={};r.isSupported="function"==typeof oe&&ue&&void 0!==ue.createHTMLDocument&&9!==de;var ge,ye,be=W,ve=q,Te=Y,Ne=$,Ee=K,Ae=X,we=Z,Se=V,_e=null,xe=O({},[].concat(o(R),o(C),o(I),o(U),o(z))),ke=null,Le=O({},[].concat(o(P),o(j),o(B),o(G))),Oe=Object.seal(Object.create(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),De=null,Me=null,Re=!0,Ce=!0,Ie=!1,Fe=!0,Ue=!1,He=!1,ze=!1,Pe=!1,je=!1,Be=!1,Ge=!1,We=!0,qe=!1,Ye="user-content-",$e=!0,Ke=!1,Ve={},Xe=null,Ze=O({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","style","svg","template","thead","title","video","xmp"]),Je=null,Qe=O({},["audio","video","img","source","image","track"]),et=null,tt=O({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),nt="http://www.w3.org/1998/Math/MathML",rt="http://www.w3.org/2000/svg",ot="http://www.w3.org/1999/xhtml",at=ot,it=!1,lt=null,ct=O({},[nt,rt,ot],E),ut=["application/xhtml+xml","text/html"],st="text/html",mt=null,ft=i.createElement("form"),pt=function(e){return e instanceof RegExp||e instanceof Function},dt=function(t){mt&&mt===t||(t&&"object"===e(t)||(t={}),t=D(t),ge=ge=-1===ut.indexOf(t.PARSER_MEDIA_TYPE)?st:t.PARSER_MEDIA_TYPE,ye="application/xhtml+xml"===ge?E:N,_e="ALLOWED_TAGS"in t?O({},t.ALLOWED_TAGS,ye):xe,ke="ALLOWED_ATTR"in t?O({},t.ALLOWED_ATTR,ye):Le,lt="ALLOWED_NAMESPACES"in t?O({},t.ALLOWED_NAMESPACES,E):ct,et="ADD_URI_SAFE_ATTR"in t?O(D(tt),t.ADD_URI_SAFE_ATTR,ye):tt,Je="ADD_DATA_URI_TAGS"in t?O(D(Qe),t.ADD_DATA_URI_TAGS,ye):Qe,Xe="FORBID_CONTENTS"in t?O({},t.FORBID_CONTENTS,ye):Ze,De="FORBID_TAGS"in t?O({},t.FORBID_TAGS,ye):{},Me="FORBID_ATTR"in t?O({},t.FORBID_ATTR,ye):{},Ve="USE_PROFILES"in t&&t.USE_PROFILES,Re=!1!==t.ALLOW_ARIA_ATTR,Ce=!1!==t.ALLOW_DATA_ATTR,Ie=t.ALLOW_UNKNOWN_PROTOCOLS||!1,Fe=!1!==t.ALLOW_SELF_CLOSE_IN_ATTR,Ue=t.SAFE_FOR_TEMPLATES||!1,He=t.WHOLE_DOCUMENT||!1,je=t.RETURN_DOM||!1,Be=t.RETURN_DOM_FRAGMENT||!1,Ge=t.RETURN_TRUSTED_TYPE||!1,Pe=t.FORCE_BODY||!1,We=!1!==t.SANITIZE_DOM,qe=t.SANITIZE_NAMED_PROPS||!1,$e=!1!==t.KEEP_CONTENT,Ke=t.IN_PLACE||!1,Se=t.ALLOWED_URI_REGEXP||Se,at=t.NAMESPACE||ot,Oe=t.CUSTOM_ELEMENT_HANDLING||{},t.CUSTOM_ELEMENT_HANDLING&&pt(t.CUSTOM_ELEMENT_HANDLING.tagNameCheck)&&(Oe.tagNameCheck=t.CUSTOM_ELEMENT_HANDLING.tagNameCheck),t.CUSTOM_ELEMENT_HANDLING&&pt(t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(Oe.attributeNameCheck=t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),t.CUSTOM_ELEMENT_HANDLING&&"boolean"==typeof t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(Oe.allowCustomizedBuiltInElements=t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements),Ue&&(Ce=!1),Be&&(je=!0),Ve&&(_e=O({},o(z)),ke=[],!0===Ve.html&&(O(_e,R),O(ke,P)),!0===Ve.svg&&(O(_e,C),O(ke,j),O(ke,G)),!0===Ve.svgFilters&&(O(_e,I),O(ke,j),O(ke,G)),!0===Ve.mathMl&&(O(_e,U),O(ke,B),O(ke,G))),t.ADD_TAGS&&(_e===xe&&(_e=D(_e)),O(_e,t.ADD_TAGS,ye)),t.ADD_ATTR&&(ke===Le&&(ke=D(ke)),O(ke,t.ADD_ATTR,ye)),t.ADD_URI_SAFE_ATTR&&O(et,t.ADD_URI_SAFE_ATTR,ye),t.FORBID_CONTENTS&&(Xe===Ze&&(Xe=D(Xe)),O(Xe,t.FORBID_CONTENTS,ye)),$e&&(_e["#text"]=!0),He&&O(_e,["html","head","body"]),_e.table&&(O(_e,["tbody"]),delete De.tbody),m&&m(t),mt=t)},ht=O({},["mi","mo","mn","ms","mtext"]),gt=O({},["foreignobject","desc","title","annotation-xml"]),yt=O({},["title","style","font","a","script"]),bt=O({},C);O(bt,I),O(bt,F);var vt=O({},U);O(vt,H);var Tt=function(e){var t=oe(e);t&&t.tagName||(t={namespaceURI:at,tagName:"template"});var n=N(e.tagName),r=N(t.tagName);return!!lt[e.namespaceURI]&&(e.namespaceURI===rt?t.namespaceURI===ot?"svg"===n:t.namespaceURI===nt?"svg"===n&&("annotation-xml"===r||ht[r]):Boolean(bt[n]):e.namespaceURI===nt?t.namespaceURI===ot?"math"===n:t.namespaceURI===rt?"math"===n&>[r]:Boolean(vt[n]):e.namespaceURI===ot?!(t.namespaceURI===rt&&!gt[r])&&(!(t.namespaceURI===nt&&!ht[r])&&(!vt[n]&&(yt[n]||!bt[n]))):!("application/xhtml+xml"!==ge||!lt[e.namespaceURI]))},Nt=function(e){T(r.removed,{element:e});try{e.parentNode.removeChild(e)}catch(t){try{e.outerHTML=le}catch(t){e.remove()}}},Et=function(e,t){try{T(r.removed,{attribute:t.getAttributeNode(e),from:t})}catch(e){T(r.removed,{attribute:null,from:t})}if(t.removeAttribute(e),"is"===e&&!ke[e])if(je||Be)try{Nt(t)}catch(e){}else try{t.setAttribute(e,"")}catch(e){}},At=function(e){var t,n;if(Pe)e="<remove></remove>"+e;else{var r=A(e,/^[\r\n\t ]+/);n=r&&r[0]}"application/xhtml+xml"===ge&&at===ot&&(e='<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>'+e+"</body></html>");var o=ie?ie.createHTML(e):e;if(at===ot)try{t=(new g).parseFromString(o,ge)}catch(e){}if(!t||!t.documentElement){t=ue.createDocument(at,"template",null);try{t.documentElement.innerHTML=it?le:o}catch(e){}}var a=t.body||t.documentElement;return e&&n&&a.insertBefore(i.createTextNode(n),a.childNodes[0]||null),at===ot?fe.call(t,He?"html":"body")[0]:He?t.documentElement:a},wt=function(e){return se.call(e.ownerDocument||e,e,f.SHOW_ELEMENT|f.SHOW_COMMENT|f.SHOW_TEXT,null,!1)},St=function(e){return e instanceof h&&("string"!=typeof e.nodeName||"string"!=typeof e.textContent||"function"!=typeof e.removeChild||!(e.attributes instanceof d)||"function"!=typeof e.removeAttribute||"function"!=typeof e.setAttribute||"string"!=typeof e.namespaceURI||"function"!=typeof e.insertBefore||"function"!=typeof e.hasChildNodes)},_t=function(t){return"object"===e(u)?t instanceof u:t&&"object"===e(t)&&"number"==typeof t.nodeType&&"string"==typeof t.nodeName},xt=function(e,t,n){he[e]&&b(he[e],(function(e){e.call(r,t,n,mt)}))},kt=function(e){var t;if(xt("beforeSanitizeElements",e,null),St(e))return Nt(e),!0;if(x(/[\u0080-\uFFFF]/,e.nodeName))return Nt(e),!0;var n=ye(e.nodeName);if(xt("uponSanitizeElement",e,{tagName:n,allowedTags:_e}),e.hasChildNodes()&&!_t(e.firstElementChild)&&(!_t(e.content)||!_t(e.content.firstElementChild))&&x(/<[/\w]/g,e.innerHTML)&&x(/<[/\w]/g,e.textContent))return Nt(e),!0;if("select"===n&&x(/<template/i,e.innerHTML))return Nt(e),!0;if(!_e[n]||De[n]){if(!De[n]&&Ot(n)){if(Oe.tagNameCheck instanceof RegExp&&x(Oe.tagNameCheck,n))return!1;if(Oe.tagNameCheck instanceof Function&&Oe.tagNameCheck(n))return!1}if($e&&!Xe[n]){var o=oe(e)||e.parentNode,a=re(e)||e.childNodes;if(a&&o)for(var i=a.length-1;i>=0;--i)o.insertBefore(te(a[i],!0),ne(e))}return Nt(e),!0}return e instanceof s&&!Tt(e)?(Nt(e),!0):"noscript"!==n&&"noembed"!==n&&"noframes"!==n||!x(/<\/no(script|embed|frames)/i,e.innerHTML)?(Ue&&3===e.nodeType&&(t=e.textContent,t=w(t,be," "),t=w(t,ve," "),t=w(t,Te," "),e.textContent!==t&&(T(r.removed,{element:e.cloneNode()}),e.textContent=t)),xt("afterSanitizeElements",e,null),!1):(Nt(e),!0)},Lt=function(e,t,n){if(We&&("id"===t||"name"===t)&&(n in i||n in ft))return!1;if(Ce&&!Me[t]&&x(Ne,t));else if(Re&&x(Ee,t));else if(!ke[t]||Me[t]){if(!(Ot(e)&&(Oe.tagNameCheck instanceof RegExp&&x(Oe.tagNameCheck,e)||Oe.tagNameCheck instanceof Function&&Oe.tagNameCheck(e))&&(Oe.attributeNameCheck instanceof RegExp&&x(Oe.attributeNameCheck,t)||Oe.attributeNameCheck instanceof Function&&Oe.attributeNameCheck(t))||"is"===t&&Oe.allowCustomizedBuiltInElements&&(Oe.tagNameCheck instanceof RegExp&&x(Oe.tagNameCheck,n)||Oe.tagNameCheck instanceof Function&&Oe.tagNameCheck(n))))return!1}else if(et[t]);else if(x(Se,w(n,we,"")));else if("src"!==t&&"xlink:href"!==t&&"href"!==t||"script"===e||0!==S(n,"data:")||!Je[e]){if(Ie&&!x(Ae,w(n,we,"")));else if(n)return!1}else;return!0},Ot=function(e){return e.indexOf("-")>0},Dt=function(t){var n,o,a,i;xt("beforeSanitizeAttributes",t,null);var l=t.attributes;if(l){var c={attrName:"",attrValue:"",keepAttr:!0,allowedAttributes:ke};for(i=l.length;i--;){var u=n=l[i],s=u.name,m=u.namespaceURI;if(o="value"===s?n.value:_(n.value),a=ye(s),c.attrName=a,c.attrValue=o,c.keepAttr=!0,c.forceKeepAttr=void 0,xt("uponSanitizeAttribute",t,c),o=c.attrValue,!c.forceKeepAttr&&(Et(s,t),c.keepAttr))if(Fe||!x(/\/>/i,o)){Ue&&(o=w(o,be," "),o=w(o,ve," "),o=w(o,Te," "));var f=ye(t.nodeName);if(Lt(f,a,o)){if(!qe||"id"!==a&&"name"!==a||(Et(s,t),o=Ye+o),ie&&"object"===e(y)&&"function"==typeof y.getAttributeType)if(m);else switch(y.getAttributeType(f,a)){case"TrustedHTML":o=ie.createHTML(o);break;case"TrustedScriptURL":o=ie.createScriptURL(o)}try{m?t.setAttributeNS(m,s,o):t.setAttribute(s,o),v(r.removed)}catch(e){}}}else Et(s,t)}xt("afterSanitizeAttributes",t,null)}},Mt=function e(t){var n,r=wt(t);for(xt("beforeSanitizeShadowDOM",t,null);n=r.nextNode();)xt("uponSanitizeShadowNode",n,null),kt(n)||(n.content instanceof l&&e(n.content),Dt(n));xt("afterSanitizeShadowDOM",t,null)};return r.sanitize=function(t){var o,i,c,s,m,f=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};if((it=!t)&&(t="\x3c!--\x3e"),"string"!=typeof t&&!_t(t)){if("function"!=typeof t.toString)throw k("toString is not a function");if("string"!=typeof(t=t.toString()))throw k("dirty is not a string, aborting")}if(!r.isSupported){if("object"===e(n.toStaticHTML)||"function"==typeof n.toStaticHTML){if("string"==typeof t)return n.toStaticHTML(t);if(_t(t))return n.toStaticHTML(t.outerHTML)}return t}if(ze||dt(f),r.removed=[],"string"==typeof t&&(Ke=!1),Ke){if(t.nodeName){var p=ye(t.nodeName);if(!_e[p]||De[p])throw k("root node is forbidden and cannot be sanitized in-place")}}else if(t instanceof u)1===(i=(o=At("\x3c!----\x3e")).ownerDocument.importNode(t,!0)).nodeType&&"BODY"===i.nodeName||"HTML"===i.nodeName?o=i:o.appendChild(i);else{if(!je&&!Ue&&!He&&-1===t.indexOf("<"))return ie&&Ge?ie.createHTML(t):t;if(!(o=At(t)))return je?null:Ge?le:""}o&&Pe&&Nt(o.firstChild);for(var d=wt(Ke?t:o);c=d.nextNode();)3===c.nodeType&&c===s||kt(c)||(c.content instanceof l&&Mt(c.content),Dt(c),s=c);if(s=null,Ke)return t;if(je){if(Be)for(m=me.call(o.ownerDocument);o.firstChild;)m.appendChild(o.firstChild);else m=o;return(ke.shadowroot||ke.shadowrootmod)&&(m=pe.call(a,m,!0)),m}var h=He?o.outerHTML:o.innerHTML;return He&&_e["!doctype"]&&o.ownerDocument&&o.ownerDocument.doctype&&o.ownerDocument.doctype.name&&x(J,o.ownerDocument.doctype.name)&&(h="<!DOCTYPE "+o.ownerDocument.doctype.name+">\n"+h),Ue&&(h=w(h,be," "),h=w(h,ve," "),h=w(h,Te," ")),ie&&Ge?ie.createHTML(h):h},r.setConfig=function(e){dt(e),ze=!0},r.clearConfig=function(){mt=null,ze=!1},r.isValidAttribute=function(e,t,n){mt||dt({});var r=ye(e),o=ye(t);return Lt(r,o,n)},r.addHook=function(e,t){"function"==typeof t&&(he[e]=he[e]||[],T(he[e],t))},r.removeHook=function(e){if(he[e])return v(he[e])},r.removeHooks=function(e){he[e]&&(he[e]=[])},r.removeAllHooks=function(){he={}},r}();return te}));
|
|
1
|
+
/*! @license DOMPurify 2.4.7 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.7/LICENSE */
|
|
2
|
+
!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).DOMPurify=t()}(this,(function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,n){return t=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e},t(e,n)}function n(e,r,o){return n=function(){if("undefined"==typeof Reflect||!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catch(e){return!1}}()?Reflect.construct:function(e,n,r){var o=[null];o.push.apply(o,n);var a=new(Function.bind.apply(e,o));return r&&t(a,r.prototype),a},n.apply(null,arguments)}function r(e){return function(e){if(Array.isArray(e))return o(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return o(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return o(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function o(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var a=Object.hasOwnProperty,i=Object.setPrototypeOf,l=Object.isFrozen,c=Object.getPrototypeOf,s=Object.getOwnPropertyDescriptor,u=Object.freeze,m=Object.seal,f=Object.create,p="undefined"!=typeof Reflect&&Reflect,d=p.apply,h=p.construct;d||(d=function(e,t,n){return e.apply(t,n)}),u||(u=function(e){return e}),m||(m=function(e){return e}),h||(h=function(e,t){return n(e,r(t))});var g,y=k(Array.prototype.forEach),b=k(Array.prototype.pop),v=k(Array.prototype.push),T=k(String.prototype.toLowerCase),N=k(String.prototype.toString),E=k(String.prototype.match),A=k(String.prototype.replace),w=k(String.prototype.indexOf),S=k(String.prototype.trim),_=k(RegExp.prototype.test),x=(g=TypeError,function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return h(g,t)});function k(e){return function(t){for(var n=arguments.length,r=new Array(n>1?n-1:0),o=1;o<n;o++)r[o-1]=arguments[o];return d(e,t,r)}}function L(e,t,n){var r;n=null!==(r=n)&&void 0!==r?r:T,i&&i(e,null);for(var o=t.length;o--;){var a=t[o];if("string"==typeof a){var c=n(a);c!==a&&(l(t)||(t[o]=c),a=c)}e[a]=!0}return e}function O(e){var t,n=f(null);for(t in e)!0===d(a,e,[t])&&(n[t]=e[t]);return n}function D(e,t){for(;null!==e;){var n=s(e,t);if(n){if(n.get)return k(n.get);if("function"==typeof n.value)return k(n.value)}e=c(e)}return function(e){return console.warn("fallback value for",e),null}}var M=u(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","section","select","shadow","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),R=u(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","filter","font","g","glyph","glyphref","hkern","image","line","lineargradient","marker","mask","metadata","mpath","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),C=u(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),I=u(["animate","color-profile","cursor","discard","fedropshadow","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),F=u(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover"]),U=u(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),H=u(["#text"]),z=u(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","controls","controlslist","coords","crossorigin","datetime","decoding","default","dir","disabled","disablepictureinpicture","disableremoteplayback","download","draggable","enctype","enterkeyhint","face","for","headers","height","hidden","high","href","hreflang","id","inputmode","integrity","ismap","kind","label","lang","list","loading","loop","low","max","maxlength","media","method","min","minlength","multiple","muted","name","nonce","noshade","novalidate","nowrap","open","optimum","pattern","placeholder","playsinline","poster","preload","pubdate","radiogroup","readonly","rel","required","rev","reversed","role","rows","rowspan","spellcheck","scope","selected","shape","size","sizes","span","srclang","start","src","srcset","step","style","summary","tabindex","title","translate","type","usemap","valign","value","width","xmlns","slot"]),P=u(["accent-height","accumulate","additive","alignment-baseline","ascent","attributename","attributetype","azimuth","basefrequency","baseline-shift","begin","bias","by","class","clip","clippathunits","clip-path","clip-rule","color","color-interpolation","color-interpolation-filters","color-profile","color-rendering","cx","cy","d","dx","dy","diffuseconstant","direction","display","divisor","dur","edgemode","elevation","end","fill","fill-opacity","fill-rule","filter","filterunits","flood-color","flood-opacity","font-family","font-size","font-size-adjust","font-stretch","font-style","font-variant","font-weight","fx","fy","g1","g2","glyph-name","glyphref","gradientunits","gradienttransform","height","href","id","image-rendering","in","in2","k","k1","k2","k3","k4","kerning","keypoints","keysplines","keytimes","lang","lengthadjust","letter-spacing","kernelmatrix","kernelunitlength","lighting-color","local","marker-end","marker-mid","marker-start","markerheight","markerunits","markerwidth","maskcontentunits","maskunits","max","mask","media","method","mode","min","name","numoctaves","offset","operator","opacity","order","orient","orientation","origin","overflow","paint-order","path","pathlength","patterncontentunits","patterntransform","patternunits","points","preservealpha","preserveaspectratio","primitiveunits","r","rx","ry","radius","refx","refy","repeatcount","repeatdur","restart","result","rotate","scale","seed","shape-rendering","specularconstant","specularexponent","spreadmethod","startoffset","stddeviation","stitchtiles","stop-color","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-linecap","stroke-linejoin","stroke-miterlimit","stroke-opacity","stroke","stroke-width","style","surfacescale","systemlanguage","tabindex","targetx","targety","transform","transform-origin","text-anchor","text-decoration","text-rendering","textlength","type","u1","u2","unicode","values","viewbox","visibility","version","vert-adv-y","vert-origin-x","vert-origin-y","width","word-spacing","wrap","writing-mode","xchannelselector","ychannelselector","x","x1","x2","xmlns","y","y1","y2","z","zoomandpan"]),j=u(["accent","accentunder","align","bevelled","close","columnsalign","columnlines","columnspan","denomalign","depth","dir","display","displaystyle","encoding","fence","frame","height","href","id","largeop","length","linethickness","lspace","lquote","mathbackground","mathcolor","mathsize","mathvariant","maxsize","minsize","movablelimits","notation","numalign","open","rowalign","rowlines","rowspacing","rowspan","rspace","rquote","scriptlevel","scriptminsize","scriptsizemultiplier","selection","separator","separators","stretchy","subscriptshift","supscriptshift","symmetric","voffset","width","xmlns"]),B=u(["xlink:href","xml:id","xlink:title","xml:space","xmlns:xlink"]),G=m(/\{\{[\w\W]*|[\w\W]*\}\}/gm),W=m(/<%[\w\W]*|[\w\W]*%>/gm),q=m(/\${[\w\W]*}/gm),Y=m(/^data-[\-\w.\u00B7-\uFFFF]/),$=m(/^aria-[\-\w]+$/),K=m(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),V=m(/^(?:\w+script|data):/i),X=m(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),Z=m(/^html$/i),J=function(){return"undefined"==typeof window?null:window};var Q=function t(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:J(),o=function(e){return t(e)};if(o.version="2.4.7",o.removed=[],!n||!n.document||9!==n.document.nodeType)return o.isSupported=!1,o;var a=n.document,i=n.document,l=n.DocumentFragment,c=n.HTMLTemplateElement,s=n.Node,m=n.Element,f=n.NodeFilter,p=n.NamedNodeMap,d=void 0===p?n.NamedNodeMap||n.MozNamedAttrMap:p,h=n.HTMLFormElement,g=n.DOMParser,k=n.trustedTypes,Q=m.prototype,ee=D(Q,"cloneNode"),te=D(Q,"nextSibling"),ne=D(Q,"childNodes"),re=D(Q,"parentNode");if("function"==typeof c){var oe=i.createElement("template");oe.content&&oe.content.ownerDocument&&(i=oe.content.ownerDocument)}var ae=function(t,n){if("object"!==e(t)||"function"!=typeof t.createPolicy)return null;var r=null,o="data-tt-policy-suffix";n.currentScript&&n.currentScript.hasAttribute(o)&&(r=n.currentScript.getAttribute(o));var a="dompurify"+(r?"#"+r:"");try{return t.createPolicy(a,{createHTML:function(e){return e},createScriptURL:function(e){return e}})}catch(e){return console.warn("TrustedTypes policy "+a+" could not be created."),null}}(k,a),ie=ae?ae.createHTML(""):"",le=i,ce=le.implementation,se=le.createNodeIterator,ue=le.createDocumentFragment,me=le.getElementsByTagName,fe=a.importNode,pe={};try{pe=O(i).documentMode?i.documentMode:{}}catch(e){}var de={};o.isSupported="function"==typeof re&&ce&&void 0!==ce.createHTMLDocument&&9!==pe;var he,ge,ye=G,be=W,ve=q,Te=Y,Ne=$,Ee=V,Ae=X,we=K,Se=null,_e=L({},[].concat(r(M),r(R),r(C),r(F),r(H))),xe=null,ke=L({},[].concat(r(z),r(P),r(j),r(B))),Le=Object.seal(Object.create(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),Oe=null,De=null,Me=!0,Re=!0,Ce=!1,Ie=!0,Fe=!1,Ue=!1,He=!1,ze=!1,Pe=!1,je=!1,Be=!1,Ge=!0,We=!1,qe=!0,Ye=!1,$e={},Ke=null,Ve=L({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","style","svg","template","thead","title","video","xmp"]),Xe=null,Ze=L({},["audio","video","img","source","image","track"]),Je=null,Qe=L({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),et="http://www.w3.org/1998/Math/MathML",tt="http://www.w3.org/2000/svg",nt="http://www.w3.org/1999/xhtml",rt=nt,ot=!1,at=null,it=L({},[et,tt,nt],N),lt=["application/xhtml+xml","text/html"],ct=null,st=i.createElement("form"),ut=function(e){return e instanceof RegExp||e instanceof Function},mt=function(t){ct&&ct===t||(t&&"object"===e(t)||(t={}),t=O(t),he=he=-1===lt.indexOf(t.PARSER_MEDIA_TYPE)?"text/html":t.PARSER_MEDIA_TYPE,ge="application/xhtml+xml"===he?N:T,Se="ALLOWED_TAGS"in t?L({},t.ALLOWED_TAGS,ge):_e,xe="ALLOWED_ATTR"in t?L({},t.ALLOWED_ATTR,ge):ke,at="ALLOWED_NAMESPACES"in t?L({},t.ALLOWED_NAMESPACES,N):it,Je="ADD_URI_SAFE_ATTR"in t?L(O(Qe),t.ADD_URI_SAFE_ATTR,ge):Qe,Xe="ADD_DATA_URI_TAGS"in t?L(O(Ze),t.ADD_DATA_URI_TAGS,ge):Ze,Ke="FORBID_CONTENTS"in t?L({},t.FORBID_CONTENTS,ge):Ve,Oe="FORBID_TAGS"in t?L({},t.FORBID_TAGS,ge):{},De="FORBID_ATTR"in t?L({},t.FORBID_ATTR,ge):{},$e="USE_PROFILES"in t&&t.USE_PROFILES,Me=!1!==t.ALLOW_ARIA_ATTR,Re=!1!==t.ALLOW_DATA_ATTR,Ce=t.ALLOW_UNKNOWN_PROTOCOLS||!1,Ie=!1!==t.ALLOW_SELF_CLOSE_IN_ATTR,Fe=t.SAFE_FOR_TEMPLATES||!1,Ue=t.WHOLE_DOCUMENT||!1,Pe=t.RETURN_DOM||!1,je=t.RETURN_DOM_FRAGMENT||!1,Be=t.RETURN_TRUSTED_TYPE||!1,ze=t.FORCE_BODY||!1,Ge=!1!==t.SANITIZE_DOM,We=t.SANITIZE_NAMED_PROPS||!1,qe=!1!==t.KEEP_CONTENT,Ye=t.IN_PLACE||!1,we=t.ALLOWED_URI_REGEXP||we,rt=t.NAMESPACE||nt,Le=t.CUSTOM_ELEMENT_HANDLING||{},t.CUSTOM_ELEMENT_HANDLING&&ut(t.CUSTOM_ELEMENT_HANDLING.tagNameCheck)&&(Le.tagNameCheck=t.CUSTOM_ELEMENT_HANDLING.tagNameCheck),t.CUSTOM_ELEMENT_HANDLING&&ut(t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(Le.attributeNameCheck=t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),t.CUSTOM_ELEMENT_HANDLING&&"boolean"==typeof t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(Le.allowCustomizedBuiltInElements=t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements),Fe&&(Re=!1),je&&(Pe=!0),$e&&(Se=L({},r(H)),xe=[],!0===$e.html&&(L(Se,M),L(xe,z)),!0===$e.svg&&(L(Se,R),L(xe,P),L(xe,B)),!0===$e.svgFilters&&(L(Se,C),L(xe,P),L(xe,B)),!0===$e.mathMl&&(L(Se,F),L(xe,j),L(xe,B))),t.ADD_TAGS&&(Se===_e&&(Se=O(Se)),L(Se,t.ADD_TAGS,ge)),t.ADD_ATTR&&(xe===ke&&(xe=O(xe)),L(xe,t.ADD_ATTR,ge)),t.ADD_URI_SAFE_ATTR&&L(Je,t.ADD_URI_SAFE_ATTR,ge),t.FORBID_CONTENTS&&(Ke===Ve&&(Ke=O(Ke)),L(Ke,t.FORBID_CONTENTS,ge)),qe&&(Se["#text"]=!0),Ue&&L(Se,["html","head","body"]),Se.table&&(L(Se,["tbody"]),delete Oe.tbody),u&&u(t),ct=t)},ft=L({},["mi","mo","mn","ms","mtext"]),pt=L({},["foreignobject","desc","title","annotation-xml"]),dt=L({},["title","style","font","a","script"]),ht=L({},R);L(ht,C),L(ht,I);var gt=L({},F);L(gt,U);var yt=function(e){v(o.removed,{element:e});try{e.parentNode.removeChild(e)}catch(t){try{e.outerHTML=ie}catch(t){e.remove()}}},bt=function(e,t){try{v(o.removed,{attribute:t.getAttributeNode(e),from:t})}catch(e){v(o.removed,{attribute:null,from:t})}if(t.removeAttribute(e),"is"===e&&!xe[e])if(Pe||je)try{yt(t)}catch(e){}else try{t.setAttribute(e,"")}catch(e){}},vt=function(e){var t,n;if(ze)e="<remove></remove>"+e;else{var r=E(e,/^[\r\n\t ]+/);n=r&&r[0]}"application/xhtml+xml"===he&&rt===nt&&(e='<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>'+e+"</body></html>");var o=ae?ae.createHTML(e):e;if(rt===nt)try{t=(new g).parseFromString(o,he)}catch(e){}if(!t||!t.documentElement){t=ce.createDocument(rt,"template",null);try{t.documentElement.innerHTML=ot?ie:o}catch(e){}}var a=t.body||t.documentElement;return e&&n&&a.insertBefore(i.createTextNode(n),a.childNodes[0]||null),rt===nt?me.call(t,Ue?"html":"body")[0]:Ue?t.documentElement:a},Tt=function(e){return se.call(e.ownerDocument||e,e,f.SHOW_ELEMENT|f.SHOW_COMMENT|f.SHOW_TEXT,null,!1)},Nt=function(t){return"object"===e(s)?t instanceof s:t&&"object"===e(t)&&"number"==typeof t.nodeType&&"string"==typeof t.nodeName},Et=function(e,t,n){de[e]&&y(de[e],(function(e){e.call(o,t,n,ct)}))},At=function(e){var t,n;if(Et("beforeSanitizeElements",e,null),(n=e)instanceof h&&("string"!=typeof n.nodeName||"string"!=typeof n.textContent||"function"!=typeof n.removeChild||!(n.attributes instanceof d)||"function"!=typeof n.removeAttribute||"function"!=typeof n.setAttribute||"string"!=typeof n.namespaceURI||"function"!=typeof n.insertBefore||"function"!=typeof n.hasChildNodes))return yt(e),!0;if(_(/[\u0080-\uFFFF]/,e.nodeName))return yt(e),!0;var r=ge(e.nodeName);if(Et("uponSanitizeElement",e,{tagName:r,allowedTags:Se}),e.hasChildNodes()&&!Nt(e.firstElementChild)&&(!Nt(e.content)||!Nt(e.content.firstElementChild))&&_(/<[/\w]/g,e.innerHTML)&&_(/<[/\w]/g,e.textContent))return yt(e),!0;if("select"===r&&_(/<template/i,e.innerHTML))return yt(e),!0;if(!Se[r]||Oe[r]){if(!Oe[r]&&St(r)){if(Le.tagNameCheck instanceof RegExp&&_(Le.tagNameCheck,r))return!1;if(Le.tagNameCheck instanceof Function&&Le.tagNameCheck(r))return!1}if(qe&&!Ke[r]){var a=re(e)||e.parentNode,i=ne(e)||e.childNodes;if(i&&a)for(var l=i.length-1;l>=0;--l)a.insertBefore(ee(i[l],!0),te(e))}return yt(e),!0}return e instanceof m&&!function(e){var t=re(e);t&&t.tagName||(t={namespaceURI:rt,tagName:"template"});var n=T(e.tagName),r=T(t.tagName);return!!at[e.namespaceURI]&&(e.namespaceURI===tt?t.namespaceURI===nt?"svg"===n:t.namespaceURI===et?"svg"===n&&("annotation-xml"===r||ft[r]):Boolean(ht[n]):e.namespaceURI===et?t.namespaceURI===nt?"math"===n:t.namespaceURI===tt?"math"===n&&pt[r]:Boolean(gt[n]):e.namespaceURI===nt?!(t.namespaceURI===tt&&!pt[r])&&!(t.namespaceURI===et&&!ft[r])&&!gt[n]&&(dt[n]||!ht[n]):!("application/xhtml+xml"!==he||!at[e.namespaceURI]))}(e)?(yt(e),!0):"noscript"!==r&&"noembed"!==r&&"noframes"!==r||!_(/<\/no(script|embed|frames)/i,e.innerHTML)?(Fe&&3===e.nodeType&&(t=e.textContent,t=A(t,ye," "),t=A(t,be," "),t=A(t,ve," "),e.textContent!==t&&(v(o.removed,{element:e.cloneNode()}),e.textContent=t)),Et("afterSanitizeElements",e,null),!1):(yt(e),!0)},wt=function(e,t,n){if(Ge&&("id"===t||"name"===t)&&(n in i||n in st))return!1;if(Re&&!De[t]&&_(Te,t));else if(Me&&_(Ne,t));else if(!xe[t]||De[t]){if(!(St(e)&&(Le.tagNameCheck instanceof RegExp&&_(Le.tagNameCheck,e)||Le.tagNameCheck instanceof Function&&Le.tagNameCheck(e))&&(Le.attributeNameCheck instanceof RegExp&&_(Le.attributeNameCheck,t)||Le.attributeNameCheck instanceof Function&&Le.attributeNameCheck(t))||"is"===t&&Le.allowCustomizedBuiltInElements&&(Le.tagNameCheck instanceof RegExp&&_(Le.tagNameCheck,n)||Le.tagNameCheck instanceof Function&&Le.tagNameCheck(n))))return!1}else if(Je[t]);else if(_(we,A(n,Ae,"")));else if("src"!==t&&"xlink:href"!==t&&"href"!==t||"script"===e||0!==w(n,"data:")||!Xe[e]){if(Ce&&!_(Ee,A(n,Ae,"")));else if(n)return!1}else;return!0},St=function(e){return e.indexOf("-")>0},_t=function(t){var n,r,a,i;Et("beforeSanitizeAttributes",t,null);var l=t.attributes;if(l){var c={attrName:"",attrValue:"",keepAttr:!0,allowedAttributes:xe};for(i=l.length;i--;){var s=n=l[i],u=s.name,m=s.namespaceURI;if(r="value"===u?n.value:S(n.value),a=ge(u),c.attrName=a,c.attrValue=r,c.keepAttr=!0,c.forceKeepAttr=void 0,Et("uponSanitizeAttribute",t,c),r=c.attrValue,!c.forceKeepAttr&&(bt(u,t),c.keepAttr))if(Ie||!_(/\/>/i,r)){Fe&&(r=A(r,ye," "),r=A(r,be," "),r=A(r,ve," "));var f=ge(t.nodeName);if(wt(f,a,r)){if(!We||"id"!==a&&"name"!==a||(bt(u,t),r="user-content-"+r),ae&&"object"===e(k)&&"function"==typeof k.getAttributeType)if(m);else switch(k.getAttributeType(f,a)){case"TrustedHTML":r=ae.createHTML(r);break;case"TrustedScriptURL":r=ae.createScriptURL(r)}try{m?t.setAttributeNS(m,u,r):t.setAttribute(u,r),b(o.removed)}catch(e){}}}else bt(u,t)}Et("afterSanitizeAttributes",t,null)}},xt=function e(t){var n,r=Tt(t);for(Et("beforeSanitizeShadowDOM",t,null);n=r.nextNode();)Et("uponSanitizeShadowNode",n,null),At(n)||(n.content instanceof l&&e(n.content),_t(n));Et("afterSanitizeShadowDOM",t,null)};return o.sanitize=function(t){var r,i,c,u,m,f=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};if((ot=!t)&&(t="\x3c!--\x3e"),"string"!=typeof t&&!Nt(t)){if("function"!=typeof t.toString)throw x("toString is not a function");if("string"!=typeof(t=t.toString()))throw x("dirty is not a string, aborting")}if(!o.isSupported){if("object"===e(n.toStaticHTML)||"function"==typeof n.toStaticHTML){if("string"==typeof t)return n.toStaticHTML(t);if(Nt(t))return n.toStaticHTML(t.outerHTML)}return t}if(He||mt(f),o.removed=[],"string"==typeof t&&(Ye=!1),Ye){if(t.nodeName){var p=ge(t.nodeName);if(!Se[p]||Oe[p])throw x("root node is forbidden and cannot be sanitized in-place")}}else if(t instanceof s)1===(i=(r=vt("\x3c!----\x3e")).ownerDocument.importNode(t,!0)).nodeType&&"BODY"===i.nodeName||"HTML"===i.nodeName?r=i:r.appendChild(i);else{if(!Pe&&!Fe&&!Ue&&-1===t.indexOf("<"))return ae&&Be?ae.createHTML(t):t;if(!(r=vt(t)))return Pe?null:Be?ie:""}r&&ze&&yt(r.firstChild);for(var d=Tt(Ye?t:r);c=d.nextNode();)3===c.nodeType&&c===u||At(c)||(c.content instanceof l&&xt(c.content),_t(c),u=c);if(u=null,Ye)return t;if(Pe){if(je)for(m=ue.call(r.ownerDocument);r.firstChild;)m.appendChild(r.firstChild);else m=r;return(xe.shadowroot||xe.shadowrootmod)&&(m=fe.call(a,m,!0)),m}var h=Ue?r.outerHTML:r.innerHTML;return Ue&&Se["!doctype"]&&r.ownerDocument&&r.ownerDocument.doctype&&r.ownerDocument.doctype.name&&_(Z,r.ownerDocument.doctype.name)&&(h="<!DOCTYPE "+r.ownerDocument.doctype.name+">\n"+h),Fe&&(h=A(h,ye," "),h=A(h,be," "),h=A(h,ve," ")),ae&&Be?ae.createHTML(h):h},o.setConfig=function(e){mt(e),He=!0},o.clearConfig=function(){ct=null,He=!1},o.isValidAttribute=function(e,t,n){ct||mt({});var r=ge(e),o=ge(t);return wt(r,o,n)},o.addHook=function(e,t){"function"==typeof t&&(de[e]=de[e]||[],v(de[e],t))},o.removeHook=function(e){if(de[e])return b(de[e])},o.removeHooks=function(e){de[e]&&(de[e]=[])},o.removeAllHooks=function(){de={}},o}();return Q}));
|
|
3
3
|
//# sourceMappingURL=purify.min.js.map
|
package/dist/purify.min.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"purify.min.js","sources":["../src/utils.js","../src/tags.js","../src/attrs.js","../src/regexp.js","../src/purify.js"],"sourcesContent":["const {\n hasOwnProperty,\n setPrototypeOf,\n isFrozen,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n} = Object;\n\nlet { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports\nlet { apply, construct } = typeof Reflect !== 'undefined' && Reflect;\n\nif (!apply) {\n apply = function (fun, thisValue, args) {\n return fun.apply(thisValue, args);\n };\n}\n\nif (!freeze) {\n freeze = function (x) {\n return x;\n };\n}\n\nif (!seal) {\n seal = function (x) {\n return x;\n };\n}\n\nif (!construct) {\n construct = function (Func, args) {\n return new Func(...args);\n };\n}\n\nconst arrayForEach = unapply(Array.prototype.forEach);\nconst arrayIndexOf = unapply(Array.prototype.indexOf);\nconst arrayPop = unapply(Array.prototype.pop);\nconst arrayPush = unapply(Array.prototype.push);\nconst arraySlice = unapply(Array.prototype.slice);\n\nconst stringToLowerCase = unapply(String.prototype.toLowerCase);\nconst stringToString = unapply(String.prototype.toString);\nconst stringMatch = unapply(String.prototype.match);\nconst stringReplace = unapply(String.prototype.replace);\nconst stringIndexOf = unapply(String.prototype.indexOf);\nconst stringTrim = unapply(String.prototype.trim);\n\nconst regExpTest = unapply(RegExp.prototype.test);\n\nconst typeErrorCreate = unconstruct(TypeError);\n\nexport function unapply(func) {\n return (thisArg, ...args) => apply(func, thisArg, args);\n}\n\nexport function unconstruct(func) {\n return (...args) => construct(func, args);\n}\n\n/* Add properties to a lookup table */\nexport function addToSet(set, array, transformCaseFunc) {\n transformCaseFunc = transformCaseFunc ?? stringToLowerCase;\n if (setPrototypeOf) {\n // Make 'in' and truthy checks like Boolean(set.constructor)\n // independent of any properties defined on Object.prototype.\n // Prevent prototype setters from intercepting set as a this value.\n setPrototypeOf(set, null);\n }\n\n let l = array.length;\n while (l--) {\n let element = array[l];\n if (typeof element === 'string') {\n const lcElement = transformCaseFunc(element);\n if (lcElement !== element) {\n // Config presets (e.g. tags.js, attrs.js) are immutable.\n if (!isFrozen(array)) {\n array[l] = lcElement;\n }\n\n element = lcElement;\n }\n }\n\n set[element] = true;\n }\n\n return set;\n}\n\n/* Shallow clone an object */\nexport function clone(object) {\n const newObject = create(null);\n\n let property;\n for (property in object) {\n if (apply(hasOwnProperty, object, [property]) === true) {\n newObject[property] = object[property];\n }\n }\n\n return newObject;\n}\n\n/* IE10 doesn't support __lookupGetter__ so lets'\n * simulate it. It also automatically checks\n * if the prop is function or getter and behaves\n * accordingly. */\nfunction lookupGetter(object, prop) {\n while (object !== null) {\n const desc = getOwnPropertyDescriptor(object, prop);\n if (desc) {\n if (desc.get) {\n return unapply(desc.get);\n }\n\n if (typeof desc.value === 'function') {\n return unapply(desc.value);\n }\n }\n\n object = getPrototypeOf(object);\n }\n\n function fallbackValue(element) {\n console.warn('fallback value for', element);\n return null;\n }\n\n return fallbackValue;\n}\n\nexport {\n // Array\n arrayForEach,\n arrayIndexOf,\n arrayPop,\n arrayPush,\n arraySlice,\n // Object\n freeze,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n hasOwnProperty,\n isFrozen,\n setPrototypeOf,\n seal,\n // RegExp\n regExpTest,\n // String\n stringIndexOf,\n stringMatch,\n stringReplace,\n stringToLowerCase,\n stringToString,\n stringTrim,\n // Errors\n typeErrorCreate,\n // Other\n lookupGetter,\n};\n","import { freeze } from './utils.js';\n\nexport const html = freeze([\n 'a',\n 'abbr',\n 'acronym',\n 'address',\n 'area',\n 'article',\n 'aside',\n 'audio',\n 'b',\n 'bdi',\n 'bdo',\n 'big',\n 'blink',\n 'blockquote',\n 'body',\n 'br',\n 'button',\n 'canvas',\n 'caption',\n 'center',\n 'cite',\n 'code',\n 'col',\n 'colgroup',\n 'content',\n 'data',\n 'datalist',\n 'dd',\n 'decorator',\n 'del',\n 'details',\n 'dfn',\n 'dialog',\n 'dir',\n 'div',\n 'dl',\n 'dt',\n 'element',\n 'em',\n 'fieldset',\n 'figcaption',\n 'figure',\n 'font',\n 'footer',\n 'form',\n 'h1',\n 'h2',\n 'h3',\n 'h4',\n 'h5',\n 'h6',\n 'head',\n 'header',\n 'hgroup',\n 'hr',\n 'html',\n 'i',\n 'img',\n 'input',\n 'ins',\n 'kbd',\n 'label',\n 'legend',\n 'li',\n 'main',\n 'map',\n 'mark',\n 'marquee',\n 'menu',\n 'menuitem',\n 'meter',\n 'nav',\n 'nobr',\n 'ol',\n 'optgroup',\n 'option',\n 'output',\n 'p',\n 'picture',\n 'pre',\n 'progress',\n 'q',\n 'rp',\n 'rt',\n 'ruby',\n 's',\n 'samp',\n 'section',\n 'select',\n 'shadow',\n 'small',\n 'source',\n 'spacer',\n 'span',\n 'strike',\n 'strong',\n 'style',\n 'sub',\n 'summary',\n 'sup',\n 'table',\n 'tbody',\n 'td',\n 'template',\n 'textarea',\n 'tfoot',\n 'th',\n 'thead',\n 'time',\n 'tr',\n 'track',\n 'tt',\n 'u',\n 'ul',\n 'var',\n 'video',\n 'wbr',\n]);\n\n// SVG\nexport const svg = freeze([\n 'svg',\n 'a',\n 'altglyph',\n 'altglyphdef',\n 'altglyphitem',\n 'animatecolor',\n 'animatemotion',\n 'animatetransform',\n 'circle',\n 'clippath',\n 'defs',\n 'desc',\n 'ellipse',\n 'filter',\n 'font',\n 'g',\n 'glyph',\n 'glyphref',\n 'hkern',\n 'image',\n 'line',\n 'lineargradient',\n 'marker',\n 'mask',\n 'metadata',\n 'mpath',\n 'path',\n 'pattern',\n 'polygon',\n 'polyline',\n 'radialgradient',\n 'rect',\n 'stop',\n 'style',\n 'switch',\n 'symbol',\n 'text',\n 'textpath',\n 'title',\n 'tref',\n 'tspan',\n 'view',\n 'vkern',\n]);\n\nexport const svgFilters = freeze([\n 'feBlend',\n 'feColorMatrix',\n 'feComponentTransfer',\n 'feComposite',\n 'feConvolveMatrix',\n 'feDiffuseLighting',\n 'feDisplacementMap',\n 'feDistantLight',\n 'feFlood',\n 'feFuncA',\n 'feFuncB',\n 'feFuncG',\n 'feFuncR',\n 'feGaussianBlur',\n 'feImage',\n 'feMerge',\n 'feMergeNode',\n 'feMorphology',\n 'feOffset',\n 'fePointLight',\n 'feSpecularLighting',\n 'feSpotLight',\n 'feTile',\n 'feTurbulence',\n]);\n\n// List of SVG elements that are disallowed by default.\n// We still need to know them so that we can do namespace\n// checks properly in case one wants to add them to\n// allow-list.\nexport const svgDisallowed = freeze([\n 'animate',\n 'color-profile',\n 'cursor',\n 'discard',\n 'fedropshadow',\n 'font-face',\n 'font-face-format',\n 'font-face-name',\n 'font-face-src',\n 'font-face-uri',\n 'foreignobject',\n 'hatch',\n 'hatchpath',\n 'mesh',\n 'meshgradient',\n 'meshpatch',\n 'meshrow',\n 'missing-glyph',\n 'script',\n 'set',\n 'solidcolor',\n 'unknown',\n 'use',\n]);\n\nexport const mathMl = freeze([\n 'math',\n 'menclose',\n 'merror',\n 'mfenced',\n 'mfrac',\n 'mglyph',\n 'mi',\n 'mlabeledtr',\n 'mmultiscripts',\n 'mn',\n 'mo',\n 'mover',\n 'mpadded',\n 'mphantom',\n 'mroot',\n 'mrow',\n 'ms',\n 'mspace',\n 'msqrt',\n 'mstyle',\n 'msub',\n 'msup',\n 'msubsup',\n 'mtable',\n 'mtd',\n 'mtext',\n 'mtr',\n 'munder',\n 'munderover',\n]);\n\n// Similarly to SVG, we want to know all MathML elements,\n// even those that we disallow by default.\nexport const mathMlDisallowed = freeze([\n 'maction',\n 'maligngroup',\n 'malignmark',\n 'mlongdiv',\n 'mscarries',\n 'mscarry',\n 'msgroup',\n 'mstack',\n 'msline',\n 'msrow',\n 'semantics',\n 'annotation',\n 'annotation-xml',\n 'mprescripts',\n 'none',\n]);\n\nexport const text = freeze(['#text']);\n","import { freeze } from './utils.js';\n\nexport const html = freeze([\n 'accept',\n 'action',\n 'align',\n 'alt',\n 'autocapitalize',\n 'autocomplete',\n 'autopictureinpicture',\n 'autoplay',\n 'background',\n 'bgcolor',\n 'border',\n 'capture',\n 'cellpadding',\n 'cellspacing',\n 'checked',\n 'cite',\n 'class',\n 'clear',\n 'color',\n 'cols',\n 'colspan',\n 'controls',\n 'controlslist',\n 'coords',\n 'crossorigin',\n 'datetime',\n 'decoding',\n 'default',\n 'dir',\n 'disabled',\n 'disablepictureinpicture',\n 'disableremoteplayback',\n 'download',\n 'draggable',\n 'enctype',\n 'enterkeyhint',\n 'face',\n 'for',\n 'headers',\n 'height',\n 'hidden',\n 'high',\n 'href',\n 'hreflang',\n 'id',\n 'inputmode',\n 'integrity',\n 'ismap',\n 'kind',\n 'label',\n 'lang',\n 'list',\n 'loading',\n 'loop',\n 'low',\n 'max',\n 'maxlength',\n 'media',\n 'method',\n 'min',\n 'minlength',\n 'multiple',\n 'muted',\n 'name',\n 'nonce',\n 'noshade',\n 'novalidate',\n 'nowrap',\n 'open',\n 'optimum',\n 'pattern',\n 'placeholder',\n 'playsinline',\n 'poster',\n 'preload',\n 'pubdate',\n 'radiogroup',\n 'readonly',\n 'rel',\n 'required',\n 'rev',\n 'reversed',\n 'role',\n 'rows',\n 'rowspan',\n 'spellcheck',\n 'scope',\n 'selected',\n 'shape',\n 'size',\n 'sizes',\n 'span',\n 'srclang',\n 'start',\n 'src',\n 'srcset',\n 'step',\n 'style',\n 'summary',\n 'tabindex',\n 'title',\n 'translate',\n 'type',\n 'usemap',\n 'valign',\n 'value',\n 'width',\n 'xmlns',\n 'slot',\n]);\n\nexport const svg = freeze([\n 'accent-height',\n 'accumulate',\n 'additive',\n 'alignment-baseline',\n 'ascent',\n 'attributename',\n 'attributetype',\n 'azimuth',\n 'basefrequency',\n 'baseline-shift',\n 'begin',\n 'bias',\n 'by',\n 'class',\n 'clip',\n 'clippathunits',\n 'clip-path',\n 'clip-rule',\n 'color',\n 'color-interpolation',\n 'color-interpolation-filters',\n 'color-profile',\n 'color-rendering',\n 'cx',\n 'cy',\n 'd',\n 'dx',\n 'dy',\n 'diffuseconstant',\n 'direction',\n 'display',\n 'divisor',\n 'dur',\n 'edgemode',\n 'elevation',\n 'end',\n 'fill',\n 'fill-opacity',\n 'fill-rule',\n 'filter',\n 'filterunits',\n 'flood-color',\n 'flood-opacity',\n 'font-family',\n 'font-size',\n 'font-size-adjust',\n 'font-stretch',\n 'font-style',\n 'font-variant',\n 'font-weight',\n 'fx',\n 'fy',\n 'g1',\n 'g2',\n 'glyph-name',\n 'glyphref',\n 'gradientunits',\n 'gradienttransform',\n 'height',\n 'href',\n 'id',\n 'image-rendering',\n 'in',\n 'in2',\n 'k',\n 'k1',\n 'k2',\n 'k3',\n 'k4',\n 'kerning',\n 'keypoints',\n 'keysplines',\n 'keytimes',\n 'lang',\n 'lengthadjust',\n 'letter-spacing',\n 'kernelmatrix',\n 'kernelunitlength',\n 'lighting-color',\n 'local',\n 'marker-end',\n 'marker-mid',\n 'marker-start',\n 'markerheight',\n 'markerunits',\n 'markerwidth',\n 'maskcontentunits',\n 'maskunits',\n 'max',\n 'mask',\n 'media',\n 'method',\n 'mode',\n 'min',\n 'name',\n 'numoctaves',\n 'offset',\n 'operator',\n 'opacity',\n 'order',\n 'orient',\n 'orientation',\n 'origin',\n 'overflow',\n 'paint-order',\n 'path',\n 'pathlength',\n 'patterncontentunits',\n 'patterntransform',\n 'patternunits',\n 'points',\n 'preservealpha',\n 'preserveaspectratio',\n 'primitiveunits',\n 'r',\n 'rx',\n 'ry',\n 'radius',\n 'refx',\n 'refy',\n 'repeatcount',\n 'repeatdur',\n 'restart',\n 'result',\n 'rotate',\n 'scale',\n 'seed',\n 'shape-rendering',\n 'specularconstant',\n 'specularexponent',\n 'spreadmethod',\n 'startoffset',\n 'stddeviation',\n 'stitchtiles',\n 'stop-color',\n 'stop-opacity',\n 'stroke-dasharray',\n 'stroke-dashoffset',\n 'stroke-linecap',\n 'stroke-linejoin',\n 'stroke-miterlimit',\n 'stroke-opacity',\n 'stroke',\n 'stroke-width',\n 'style',\n 'surfacescale',\n 'systemlanguage',\n 'tabindex',\n 'targetx',\n 'targety',\n 'transform',\n 'transform-origin',\n 'text-anchor',\n 'text-decoration',\n 'text-rendering',\n 'textlength',\n 'type',\n 'u1',\n 'u2',\n 'unicode',\n 'values',\n 'viewbox',\n 'visibility',\n 'version',\n 'vert-adv-y',\n 'vert-origin-x',\n 'vert-origin-y',\n 'width',\n 'word-spacing',\n 'wrap',\n 'writing-mode',\n 'xchannelselector',\n 'ychannelselector',\n 'x',\n 'x1',\n 'x2',\n 'xmlns',\n 'y',\n 'y1',\n 'y2',\n 'z',\n 'zoomandpan',\n]);\n\nexport const mathMl = freeze([\n 'accent',\n 'accentunder',\n 'align',\n 'bevelled',\n 'close',\n 'columnsalign',\n 'columnlines',\n 'columnspan',\n 'denomalign',\n 'depth',\n 'dir',\n 'display',\n 'displaystyle',\n 'encoding',\n 'fence',\n 'frame',\n 'height',\n 'href',\n 'id',\n 'largeop',\n 'length',\n 'linethickness',\n 'lspace',\n 'lquote',\n 'mathbackground',\n 'mathcolor',\n 'mathsize',\n 'mathvariant',\n 'maxsize',\n 'minsize',\n 'movablelimits',\n 'notation',\n 'numalign',\n 'open',\n 'rowalign',\n 'rowlines',\n 'rowspacing',\n 'rowspan',\n 'rspace',\n 'rquote',\n 'scriptlevel',\n 'scriptminsize',\n 'scriptsizemultiplier',\n 'selection',\n 'separator',\n 'separators',\n 'stretchy',\n 'subscriptshift',\n 'supscriptshift',\n 'symmetric',\n 'voffset',\n 'width',\n 'xmlns',\n]);\n\nexport const xml = freeze([\n 'xlink:href',\n 'xml:id',\n 'xlink:title',\n 'xml:space',\n 'xmlns:xlink',\n]);\n","import { seal } from './utils.js';\n\n// eslint-disable-next-line unicorn/better-regex\nexport const MUSTACHE_EXPR = seal(/\\{\\{[\\w\\W]*|[\\w\\W]*\\}\\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode\nexport const ERB_EXPR = seal(/<%[\\w\\W]*|[\\w\\W]*%>/gm);\nexport const TMPLIT_EXPR = seal(/\\${[\\w\\W]*}/gm);\nexport const DATA_ATTR = seal(/^data-[\\-\\w.\\u00B7-\\uFFFF]/); // eslint-disable-line no-useless-escape\nexport const ARIA_ATTR = seal(/^aria-[\\-\\w]+$/); // eslint-disable-line no-useless-escape\nexport const IS_ALLOWED_URI = seal(\n /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\\-]+(?:[^a-z+.\\-:]|$))/i // eslint-disable-line no-useless-escape\n);\nexport const IS_SCRIPT_OR_DATA = seal(/^(?:\\w+script|data):/i);\nexport const ATTR_WHITESPACE = seal(\n /[\\u0000-\\u0020\\u00A0\\u1680\\u180E\\u2000-\\u2029\\u205F\\u3000]/g // eslint-disable-line no-control-regex\n);\nexport const DOCTYPE_NAME = seal(/^html$/i);\n","import * as TAGS from './tags.js';\nimport * as ATTRS from './attrs.js';\nimport * as EXPRESSIONS from './regexp.js';\nimport {\n addToSet,\n clone,\n freeze,\n arrayForEach,\n arrayPop,\n arrayPush,\n stringMatch,\n stringReplace,\n stringToLowerCase,\n stringToString,\n stringIndexOf,\n stringTrim,\n regExpTest,\n typeErrorCreate,\n lookupGetter,\n} from './utils.js';\n\nconst getGlobal = () => (typeof window === 'undefined' ? null : window);\n\n/**\n * Creates a no-op policy for internal use only.\n * Don't export this function outside this module!\n * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.\n * @param {Document} document The document object (to determine policy name suffix)\n * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types\n * are not supported).\n */\nconst _createTrustedTypesPolicy = function (trustedTypes, document) {\n if (\n typeof trustedTypes !== 'object' ||\n typeof trustedTypes.createPolicy !== 'function'\n ) {\n return null;\n }\n\n // Allow the callers to control the unique policy name\n // by adding a data-tt-policy-suffix to the script element with the DOMPurify.\n // Policy creation with duplicate names throws in Trusted Types.\n let suffix = null;\n const ATTR_NAME = 'data-tt-policy-suffix';\n if (\n document.currentScript &&\n document.currentScript.hasAttribute(ATTR_NAME)\n ) {\n suffix = document.currentScript.getAttribute(ATTR_NAME);\n }\n\n const policyName = 'dompurify' + (suffix ? '#' + suffix : '');\n\n try {\n return trustedTypes.createPolicy(policyName, {\n createHTML(html) {\n return html;\n },\n createScriptURL(scriptUrl) {\n return scriptUrl;\n },\n });\n } catch (_) {\n // Policy creation failed (most likely another DOMPurify script has\n // already run). Skip creating the policy, as this will only cause errors\n // if TT are enforced.\n console.warn(\n 'TrustedTypes policy ' + policyName + ' could not be created.'\n );\n return null;\n }\n};\n\nfunction createDOMPurify(window = getGlobal()) {\n const DOMPurify = (root) => createDOMPurify(root);\n\n /**\n * Version label, exposed for easier checks\n * if DOMPurify is up to date or not\n */\n DOMPurify.version = VERSION;\n\n /**\n * Array of elements that DOMPurify removed during sanitation.\n * Empty if nothing was removed.\n */\n DOMPurify.removed = [];\n\n if (!window || !window.document || window.document.nodeType !== 9) {\n // Not running in a browser, provide a factory function\n // so that you can pass your own Window\n DOMPurify.isSupported = false;\n\n return DOMPurify;\n }\n\n const originalDocument = window.document;\n\n let { document } = window;\n const {\n DocumentFragment,\n HTMLTemplateElement,\n Node,\n Element,\n NodeFilter,\n NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,\n HTMLFormElement,\n DOMParser,\n trustedTypes,\n } = window;\n\n const ElementPrototype = Element.prototype;\n\n const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');\n const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');\n const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');\n const getParentNode = lookupGetter(ElementPrototype, 'parentNode');\n\n // As per issue #47, the web-components registry is inherited by a\n // new document created via createHTMLDocument. As per the spec\n // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)\n // a new empty registry is used when creating a template contents owner\n // document, so we use that as our parent document to ensure nothing\n // is inherited.\n if (typeof HTMLTemplateElement === 'function') {\n const template = document.createElement('template');\n if (template.content && template.content.ownerDocument) {\n document = template.content.ownerDocument;\n }\n }\n\n const trustedTypesPolicy = _createTrustedTypesPolicy(\n trustedTypes,\n originalDocument\n );\n const emptyHTML = trustedTypesPolicy ? trustedTypesPolicy.createHTML('') : '';\n\n const {\n implementation,\n createNodeIterator,\n createDocumentFragment,\n getElementsByTagName,\n } = document;\n const { importNode } = originalDocument;\n\n let documentMode = {};\n try {\n documentMode = clone(document).documentMode ? document.documentMode : {};\n } catch (_) {}\n\n let hooks = {};\n\n /**\n * Expose whether this browser supports running the full DOMPurify.\n */\n DOMPurify.isSupported =\n typeof getParentNode === 'function' &&\n implementation &&\n implementation.createHTMLDocument !== undefined &&\n documentMode !== 9;\n\n const {\n MUSTACHE_EXPR,\n ERB_EXPR,\n TMPLIT_EXPR,\n DATA_ATTR,\n ARIA_ATTR,\n IS_SCRIPT_OR_DATA,\n ATTR_WHITESPACE,\n } = EXPRESSIONS;\n\n let { IS_ALLOWED_URI } = EXPRESSIONS;\n\n /**\n * We consider the elements and attributes below to be safe. Ideally\n * don't add any new ones but feel free to remove unwanted ones.\n */\n\n /* allowed element names */\n let ALLOWED_TAGS = null;\n const DEFAULT_ALLOWED_TAGS = addToSet({}, [\n ...TAGS.html,\n ...TAGS.svg,\n ...TAGS.svgFilters,\n ...TAGS.mathMl,\n ...TAGS.text,\n ]);\n\n /* Allowed attribute names */\n let ALLOWED_ATTR = null;\n const DEFAULT_ALLOWED_ATTR = addToSet({}, [\n ...ATTRS.html,\n ...ATTRS.svg,\n ...ATTRS.mathMl,\n ...ATTRS.xml,\n ]);\n\n /*\n * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.\n * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)\n * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)\n * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.\n */\n let CUSTOM_ELEMENT_HANDLING = Object.seal(\n Object.create(null, {\n tagNameCheck: {\n writable: true,\n configurable: false,\n enumerable: true,\n value: null,\n },\n attributeNameCheck: {\n writable: true,\n configurable: false,\n enumerable: true,\n value: null,\n },\n allowCustomizedBuiltInElements: {\n writable: true,\n configurable: false,\n enumerable: true,\n value: false,\n },\n })\n );\n\n /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */\n let FORBID_TAGS = null;\n\n /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */\n let FORBID_ATTR = null;\n\n /* Decide if ARIA attributes are okay */\n let ALLOW_ARIA_ATTR = true;\n\n /* Decide if custom data attributes are okay */\n let ALLOW_DATA_ATTR = true;\n\n /* Decide if unknown protocols are okay */\n let ALLOW_UNKNOWN_PROTOCOLS = false;\n\n /* Decide if self-closing tags in attributes are allowed.\n * Usually removed due to a mXSS issue in jQuery 3.0 */\n let ALLOW_SELF_CLOSE_IN_ATTR = true;\n\n /* Output should be safe for common template engines.\n * This means, DOMPurify removes data attributes, mustaches and ERB\n */\n let SAFE_FOR_TEMPLATES = false;\n\n /* Decide if document with <html>... should be returned */\n let WHOLE_DOCUMENT = false;\n\n /* Track whether config is already set on this instance of DOMPurify. */\n let SET_CONFIG = false;\n\n /* Decide if all elements (e.g. style, script) must be children of\n * document.body. By default, browsers might move them to document.head */\n let FORCE_BODY = false;\n\n /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html\n * string (or a TrustedHTML object if Trusted Types are supported).\n * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead\n */\n let RETURN_DOM = false;\n\n /* Decide if a DOM `DocumentFragment` should be returned, instead of a html\n * string (or a TrustedHTML object if Trusted Types are supported) */\n let RETURN_DOM_FRAGMENT = false;\n\n /* Try to return a Trusted Type object instead of a string, return a string in\n * case Trusted Types are not supported */\n let RETURN_TRUSTED_TYPE = false;\n\n /* Output should be free from DOM clobbering attacks?\n * This sanitizes markups named with colliding, clobberable built-in DOM APIs.\n */\n let SANITIZE_DOM = true;\n\n /* Achieve full DOM Clobbering protection by isolating the namespace of named\n * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.\n *\n * HTML/DOM spec rules that enable DOM Clobbering:\n * - Named Access on Window (§7.3.3)\n * - DOM Tree Accessors (§3.1.5)\n * - Form Element Parent-Child Relations (§4.10.3)\n * - Iframe srcdoc / Nested WindowProxies (§4.8.5)\n * - HTMLCollection (§4.2.10.2)\n *\n * Namespace isolation is implemented by prefixing `id` and `name` attributes\n * with a constant string, i.e., `user-content-`\n */\n let SANITIZE_NAMED_PROPS = false;\n const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';\n\n /* Keep element content when removing element? */\n let KEEP_CONTENT = true;\n\n /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead\n * of importing it into a new Document and returning a sanitized copy */\n let IN_PLACE = false;\n\n /* Allow usage of profiles like html, svg and mathMl */\n let USE_PROFILES = {};\n\n /* Tags to ignore content of when KEEP_CONTENT is true */\n let FORBID_CONTENTS = null;\n const DEFAULT_FORBID_CONTENTS = addToSet({}, [\n 'annotation-xml',\n 'audio',\n 'colgroup',\n 'desc',\n 'foreignobject',\n 'head',\n 'iframe',\n 'math',\n 'mi',\n 'mn',\n 'mo',\n 'ms',\n 'mtext',\n 'noembed',\n 'noframes',\n 'noscript',\n 'plaintext',\n 'script',\n 'style',\n 'svg',\n 'template',\n 'thead',\n 'title',\n 'video',\n 'xmp',\n ]);\n\n /* Tags that are safe for data: URIs */\n let DATA_URI_TAGS = null;\n const DEFAULT_DATA_URI_TAGS = addToSet({}, [\n 'audio',\n 'video',\n 'img',\n 'source',\n 'image',\n 'track',\n ]);\n\n /* Attributes safe for values like \"javascript:\" */\n let URI_SAFE_ATTRIBUTES = null;\n const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, [\n 'alt',\n 'class',\n 'for',\n 'id',\n 'label',\n 'name',\n 'pattern',\n 'placeholder',\n 'role',\n 'summary',\n 'title',\n 'value',\n 'style',\n 'xmlns',\n ]);\n\n const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';\n const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';\n const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';\n /* Document namespace */\n let NAMESPACE = HTML_NAMESPACE;\n let IS_EMPTY_INPUT = false;\n\n /* Allowed XHTML+XML namespaces */\n let ALLOWED_NAMESPACES = null;\n const DEFAULT_ALLOWED_NAMESPACES = addToSet(\n {},\n [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE],\n stringToString\n );\n\n /* Parsing of strict XHTML documents */\n let PARSER_MEDIA_TYPE;\n const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];\n const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';\n let transformCaseFunc;\n\n /* Keep a reference to config to pass to hooks */\n let CONFIG = null;\n\n /* Ideally, do not touch anything below this line */\n /* ______________________________________________ */\n\n const formElement = document.createElement('form');\n\n const isRegexOrFunction = function (testValue) {\n return testValue instanceof RegExp || testValue instanceof Function;\n };\n\n /**\n * _parseConfig\n *\n * @param {Object} cfg optional config literal\n */\n // eslint-disable-next-line complexity\n const _parseConfig = function (cfg) {\n if (CONFIG && CONFIG === cfg) {\n return;\n }\n\n /* Shield configuration object from tampering */\n if (!cfg || typeof cfg !== 'object') {\n cfg = {};\n }\n\n /* Shield configuration object from prototype pollution */\n cfg = clone(cfg);\n\n PARSER_MEDIA_TYPE =\n // eslint-disable-next-line unicorn/prefer-includes\n SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1\n ? (PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE)\n : (PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE);\n\n // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.\n transformCaseFunc =\n PARSER_MEDIA_TYPE === 'application/xhtml+xml'\n ? stringToString\n : stringToLowerCase;\n\n /* Set configuration parameters */\n ALLOWED_TAGS =\n 'ALLOWED_TAGS' in cfg\n ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc)\n : DEFAULT_ALLOWED_TAGS;\n ALLOWED_ATTR =\n 'ALLOWED_ATTR' in cfg\n ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc)\n : DEFAULT_ALLOWED_ATTR;\n ALLOWED_NAMESPACES =\n 'ALLOWED_NAMESPACES' in cfg\n ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString)\n : DEFAULT_ALLOWED_NAMESPACES;\n URI_SAFE_ATTRIBUTES =\n 'ADD_URI_SAFE_ATTR' in cfg\n ? addToSet(\n clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent\n cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent\n transformCaseFunc // eslint-disable-line indent\n ) // eslint-disable-line indent\n : DEFAULT_URI_SAFE_ATTRIBUTES;\n DATA_URI_TAGS =\n 'ADD_DATA_URI_TAGS' in cfg\n ? addToSet(\n clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent\n cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent\n transformCaseFunc // eslint-disable-line indent\n ) // eslint-disable-line indent\n : DEFAULT_DATA_URI_TAGS;\n FORBID_CONTENTS =\n 'FORBID_CONTENTS' in cfg\n ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc)\n : DEFAULT_FORBID_CONTENTS;\n FORBID_TAGS =\n 'FORBID_TAGS' in cfg\n ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc)\n : {};\n FORBID_ATTR =\n 'FORBID_ATTR' in cfg\n ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc)\n : {};\n USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;\n ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true\n ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true\n ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false\n ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true\n SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false\n WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false\n RETURN_DOM = cfg.RETURN_DOM || false; // Default false\n RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false\n RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false\n FORCE_BODY = cfg.FORCE_BODY || false; // Default false\n SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true\n SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false\n KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true\n IN_PLACE = cfg.IN_PLACE || false; // Default false\n IS_ALLOWED_URI = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;\n NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;\n CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};\n if (\n cfg.CUSTOM_ELEMENT_HANDLING &&\n isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)\n ) {\n CUSTOM_ELEMENT_HANDLING.tagNameCheck =\n cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;\n }\n\n if (\n cfg.CUSTOM_ELEMENT_HANDLING &&\n isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)\n ) {\n CUSTOM_ELEMENT_HANDLING.attributeNameCheck =\n cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;\n }\n\n if (\n cfg.CUSTOM_ELEMENT_HANDLING &&\n typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements ===\n 'boolean'\n ) {\n CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements =\n cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;\n }\n\n if (SAFE_FOR_TEMPLATES) {\n ALLOW_DATA_ATTR = false;\n }\n\n if (RETURN_DOM_FRAGMENT) {\n RETURN_DOM = true;\n }\n\n /* Parse profile info */\n if (USE_PROFILES) {\n ALLOWED_TAGS = addToSet({}, [...TAGS.text]);\n ALLOWED_ATTR = [];\n if (USE_PROFILES.html === true) {\n addToSet(ALLOWED_TAGS, TAGS.html);\n addToSet(ALLOWED_ATTR, ATTRS.html);\n }\n\n if (USE_PROFILES.svg === true) {\n addToSet(ALLOWED_TAGS, TAGS.svg);\n addToSet(ALLOWED_ATTR, ATTRS.svg);\n addToSet(ALLOWED_ATTR, ATTRS.xml);\n }\n\n if (USE_PROFILES.svgFilters === true) {\n addToSet(ALLOWED_TAGS, TAGS.svgFilters);\n addToSet(ALLOWED_ATTR, ATTRS.svg);\n addToSet(ALLOWED_ATTR, ATTRS.xml);\n }\n\n if (USE_PROFILES.mathMl === true) {\n addToSet(ALLOWED_TAGS, TAGS.mathMl);\n addToSet(ALLOWED_ATTR, ATTRS.mathMl);\n addToSet(ALLOWED_ATTR, ATTRS.xml);\n }\n }\n\n /* Merge configuration parameters */\n if (cfg.ADD_TAGS) {\n if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {\n ALLOWED_TAGS = clone(ALLOWED_TAGS);\n }\n\n addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);\n }\n\n if (cfg.ADD_ATTR) {\n if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {\n ALLOWED_ATTR = clone(ALLOWED_ATTR);\n }\n\n addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);\n }\n\n if (cfg.ADD_URI_SAFE_ATTR) {\n addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);\n }\n\n if (cfg.FORBID_CONTENTS) {\n if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {\n FORBID_CONTENTS = clone(FORBID_CONTENTS);\n }\n\n addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);\n }\n\n /* Add #text in case KEEP_CONTENT is set to true */\n if (KEEP_CONTENT) {\n ALLOWED_TAGS['#text'] = true;\n }\n\n /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */\n if (WHOLE_DOCUMENT) {\n addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);\n }\n\n /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */\n if (ALLOWED_TAGS.table) {\n addToSet(ALLOWED_TAGS, ['tbody']);\n delete FORBID_TAGS.tbody;\n }\n\n // Prevent further manipulation of configuration.\n // Not available in IE8, Safari 5, etc.\n if (freeze) {\n freeze(cfg);\n }\n\n CONFIG = cfg;\n };\n\n const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [\n 'mi',\n 'mo',\n 'mn',\n 'ms',\n 'mtext',\n ]);\n\n const HTML_INTEGRATION_POINTS = addToSet({}, [\n 'foreignobject',\n 'desc',\n 'title',\n 'annotation-xml',\n ]);\n\n // Certain elements are allowed in both SVG and HTML\n // namespace. We need to specify them explicitly\n // so that they don't get erroneously deleted from\n // HTML namespace.\n const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, [\n 'title',\n 'style',\n 'font',\n 'a',\n 'script',\n ]);\n\n /* Keep track of all possible SVG and MathML tags\n * so that we can perform the namespace checks\n * correctly. */\n const ALL_SVG_TAGS = addToSet({}, TAGS.svg);\n addToSet(ALL_SVG_TAGS, TAGS.svgFilters);\n addToSet(ALL_SVG_TAGS, TAGS.svgDisallowed);\n\n const ALL_MATHML_TAGS = addToSet({}, TAGS.mathMl);\n addToSet(ALL_MATHML_TAGS, TAGS.mathMlDisallowed);\n\n /**\n *\n *\n * @param {Element} element a DOM element whose namespace is being checked\n * @returns {boolean} Return false if the element has a\n * namespace that a spec-compliant parser would never\n * return. Return true otherwise.\n */\n const _checkValidNamespace = function (element) {\n let parent = getParentNode(element);\n\n // In JSDOM, if we're inside shadow DOM, then parentNode\n // can be null. We just simulate parent in this case.\n if (!parent || !parent.tagName) {\n parent = {\n namespaceURI: NAMESPACE,\n tagName: 'template',\n };\n }\n\n const tagName = stringToLowerCase(element.tagName);\n const parentTagName = stringToLowerCase(parent.tagName);\n\n if (!ALLOWED_NAMESPACES[element.namespaceURI]) {\n return false;\n }\n\n if (element.namespaceURI === SVG_NAMESPACE) {\n // The only way to switch from HTML namespace to SVG\n // is via <svg>. If it happens via any other tag, then\n // it should be killed.\n if (parent.namespaceURI === HTML_NAMESPACE) {\n return tagName === 'svg';\n }\n\n // The only way to switch from MathML to SVG is via`\n // svg if parent is either <annotation-xml> or MathML\n // text integration points.\n if (parent.namespaceURI === MATHML_NAMESPACE) {\n return (\n tagName === 'svg' &&\n (parentTagName === 'annotation-xml' ||\n MATHML_TEXT_INTEGRATION_POINTS[parentTagName])\n );\n }\n\n // We only allow elements that are defined in SVG\n // spec. All others are disallowed in SVG namespace.\n return Boolean(ALL_SVG_TAGS[tagName]);\n }\n\n if (element.namespaceURI === MATHML_NAMESPACE) {\n // The only way to switch from HTML namespace to MathML\n // is via <math>. If it happens via any other tag, then\n // it should be killed.\n if (parent.namespaceURI === HTML_NAMESPACE) {\n return tagName === 'math';\n }\n\n // The only way to switch from SVG to MathML is via\n // <math> and HTML integration points\n if (parent.namespaceURI === SVG_NAMESPACE) {\n return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];\n }\n\n // We only allow elements that are defined in MathML\n // spec. All others are disallowed in MathML namespace.\n return Boolean(ALL_MATHML_TAGS[tagName]);\n }\n\n if (element.namespaceURI === HTML_NAMESPACE) {\n // The only way to switch from SVG to HTML is via\n // HTML integration points, and from MathML to HTML\n // is via MathML text integration points\n if (\n parent.namespaceURI === SVG_NAMESPACE &&\n !HTML_INTEGRATION_POINTS[parentTagName]\n ) {\n return false;\n }\n\n if (\n parent.namespaceURI === MATHML_NAMESPACE &&\n !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]\n ) {\n return false;\n }\n\n // We disallow tags that are specific for MathML\n // or SVG and should never appear in HTML namespace\n return (\n !ALL_MATHML_TAGS[tagName] &&\n (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName])\n );\n }\n\n // For XHTML and XML documents that support custom namespaces\n if (\n PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&\n ALLOWED_NAMESPACES[element.namespaceURI]\n ) {\n return true;\n }\n\n // The code should never reach this place (this means\n // that the element somehow got namespace that is not\n // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).\n // Return false just in case.\n return false;\n };\n\n /**\n * _forceRemove\n *\n * @param {Node} node a DOM node\n */\n const _forceRemove = function (node) {\n arrayPush(DOMPurify.removed, { element: node });\n try {\n // eslint-disable-next-line unicorn/prefer-dom-node-remove\n node.parentNode.removeChild(node);\n } catch (_) {\n try {\n node.outerHTML = emptyHTML;\n } catch (_) {\n node.remove();\n }\n }\n };\n\n /**\n * _removeAttribute\n *\n * @param {String} name an Attribute name\n * @param {Node} node a DOM node\n */\n const _removeAttribute = function (name, node) {\n try {\n arrayPush(DOMPurify.removed, {\n attribute: node.getAttributeNode(name),\n from: node,\n });\n } catch (_) {\n arrayPush(DOMPurify.removed, {\n attribute: null,\n from: node,\n });\n }\n\n node.removeAttribute(name);\n\n // We void attribute values for unremovable \"is\"\" attributes\n if (name === 'is' && !ALLOWED_ATTR[name]) {\n if (RETURN_DOM || RETURN_DOM_FRAGMENT) {\n try {\n _forceRemove(node);\n } catch (_) {}\n } else {\n try {\n node.setAttribute(name, '');\n } catch (_) {}\n }\n }\n };\n\n /**\n * _initDocument\n *\n * @param {String} dirty a string of dirty markup\n * @return {Document} a DOM, filled with the dirty markup\n */\n const _initDocument = function (dirty) {\n /* Create a HTML document */\n let doc;\n let leadingWhitespace;\n\n if (FORCE_BODY) {\n dirty = '<remove></remove>' + dirty;\n } else {\n /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */\n const matches = stringMatch(dirty, /^[\\r\\n\\t ]+/);\n leadingWhitespace = matches && matches[0];\n }\n\n if (\n PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&\n NAMESPACE === HTML_NAMESPACE\n ) {\n // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)\n dirty =\n '<html xmlns=\"http://www.w3.org/1999/xhtml\"><head></head><body>' +\n dirty +\n '</body></html>';\n }\n\n const dirtyPayload = trustedTypesPolicy\n ? trustedTypesPolicy.createHTML(dirty)\n : dirty;\n /*\n * Use the DOMParser API by default, fallback later if needs be\n * DOMParser not work for svg when has multiple root element.\n */\n if (NAMESPACE === HTML_NAMESPACE) {\n try {\n doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);\n } catch (_) {}\n }\n\n /* Use createHTMLDocument in case DOMParser is not available */\n if (!doc || !doc.documentElement) {\n doc = implementation.createDocument(NAMESPACE, 'template', null);\n try {\n doc.documentElement.innerHTML = IS_EMPTY_INPUT\n ? emptyHTML\n : dirtyPayload;\n } catch (_) {\n // Syntax error if dirtyPayload is invalid xml\n }\n }\n\n const body = doc.body || doc.documentElement;\n\n if (dirty && leadingWhitespace) {\n body.insertBefore(\n document.createTextNode(leadingWhitespace),\n body.childNodes[0] || null\n );\n }\n\n /* Work on whole document or just its body */\n if (NAMESPACE === HTML_NAMESPACE) {\n return getElementsByTagName.call(\n doc,\n WHOLE_DOCUMENT ? 'html' : 'body'\n )[0];\n }\n\n return WHOLE_DOCUMENT ? doc.documentElement : body;\n };\n\n /**\n * _createIterator\n *\n * @param {Document} root document/fragment to create iterator for\n * @return {Iterator} iterator instance\n */\n const _createIterator = function (root) {\n return createNodeIterator.call(\n root.ownerDocument || root,\n root,\n // eslint-disable-next-line no-bitwise\n NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT,\n null,\n false\n );\n };\n\n /**\n * _isClobbered\n *\n * @param {Node} elm element to check for clobbering attacks\n * @return {Boolean} true if clobbered, false if safe\n */\n const _isClobbered = function (elm) {\n return (\n elm instanceof HTMLFormElement &&\n (typeof elm.nodeName !== 'string' ||\n typeof elm.textContent !== 'string' ||\n typeof elm.removeChild !== 'function' ||\n !(elm.attributes instanceof NamedNodeMap) ||\n typeof elm.removeAttribute !== 'function' ||\n typeof elm.setAttribute !== 'function' ||\n typeof elm.namespaceURI !== 'string' ||\n typeof elm.insertBefore !== 'function' ||\n typeof elm.hasChildNodes !== 'function')\n );\n };\n\n /**\n * _isNode\n *\n * @param {Node} obj object to check whether it's a DOM node\n * @return {Boolean} true is object is a DOM node\n */\n const _isNode = function (object) {\n return typeof Node === 'object'\n ? object instanceof Node\n : object &&\n typeof object === 'object' &&\n typeof object.nodeType === 'number' &&\n typeof object.nodeName === 'string';\n };\n\n /**\n * _executeHook\n * Execute user configurable hooks\n *\n * @param {String} entryPoint Name of the hook's entry point\n * @param {Node} currentNode node to work on with the hook\n * @param {Object} data additional hook parameters\n */\n const _executeHook = function (entryPoint, currentNode, data) {\n if (!hooks[entryPoint]) {\n return;\n }\n\n arrayForEach(hooks[entryPoint], (hook) => {\n hook.call(DOMPurify, currentNode, data, CONFIG);\n });\n };\n\n /**\n * _sanitizeElements\n *\n * @protect nodeName\n * @protect textContent\n * @protect removeChild\n *\n * @param {Node} currentNode to check for permission to exist\n * @return {Boolean} true if node was killed, false if left alive\n */\n const _sanitizeElements = function (currentNode) {\n let content;\n\n /* Execute a hook if present */\n _executeHook('beforeSanitizeElements', currentNode, null);\n\n /* Check if element is clobbered or can clobber */\n if (_isClobbered(currentNode)) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Check if tagname contains Unicode */\n if (regExpTest(/[\\u0080-\\uFFFF]/, currentNode.nodeName)) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Now let's check the element's type and name */\n const tagName = transformCaseFunc(currentNode.nodeName);\n\n /* Execute a hook if present */\n _executeHook('uponSanitizeElement', currentNode, {\n tagName,\n allowedTags: ALLOWED_TAGS,\n });\n\n /* Detect mXSS attempts abusing namespace confusion */\n if (\n currentNode.hasChildNodes() &&\n !_isNode(currentNode.firstElementChild) &&\n (!_isNode(currentNode.content) ||\n !_isNode(currentNode.content.firstElementChild)) &&\n regExpTest(/<[/\\w]/g, currentNode.innerHTML) &&\n regExpTest(/<[/\\w]/g, currentNode.textContent)\n ) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Mitigate a problem with templates inside select */\n if (\n tagName === 'select' &&\n regExpTest(/<template/i, currentNode.innerHTML)\n ) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Remove element if anything forbids its presence */\n if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {\n /* Check if we have a custom element to handle */\n if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {\n if (\n CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)\n )\n return false;\n if (\n CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)\n )\n return false;\n }\n\n /* Keep content except for bad-listed elements */\n if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {\n const parentNode = getParentNode(currentNode) || currentNode.parentNode;\n const childNodes = getChildNodes(currentNode) || currentNode.childNodes;\n\n if (childNodes && parentNode) {\n const childCount = childNodes.length;\n\n for (let i = childCount - 1; i >= 0; --i) {\n parentNode.insertBefore(\n cloneNode(childNodes[i], true),\n getNextSibling(currentNode)\n );\n }\n }\n }\n\n _forceRemove(currentNode);\n return true;\n }\n\n /* Check whether element has a valid namespace */\n if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Make sure that older browsers don't get fallback-tag mXSS */\n if (\n (tagName === 'noscript' ||\n tagName === 'noembed' ||\n tagName === 'noframes') &&\n regExpTest(/<\\/no(script|embed|frames)/i, currentNode.innerHTML)\n ) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Sanitize element content to be template-safe */\n if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {\n /* Get the element's text content */\n content = currentNode.textContent;\n content = stringReplace(content, MUSTACHE_EXPR, ' ');\n content = stringReplace(content, ERB_EXPR, ' ');\n content = stringReplace(content, TMPLIT_EXPR, ' ');\n if (currentNode.textContent !== content) {\n arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });\n currentNode.textContent = content;\n }\n }\n\n /* Execute a hook if present */\n _executeHook('afterSanitizeElements', currentNode, null);\n\n return false;\n };\n\n /**\n * _isValidAttribute\n *\n * @param {string} lcTag Lowercase tag name of containing element.\n * @param {string} lcName Lowercase attribute name.\n * @param {string} value Attribute value.\n * @return {Boolean} Returns true if `value` is valid, otherwise false.\n */\n // eslint-disable-next-line complexity\n const _isValidAttribute = function (lcTag, lcName, value) {\n /* Make sure attribute cannot clobber */\n if (\n SANITIZE_DOM &&\n (lcName === 'id' || lcName === 'name') &&\n (value in document || value in formElement)\n ) {\n return false;\n }\n\n /* Allow valid data-* attributes: At least one character after \"-\"\n (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)\n XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)\n We don't need to check the value; it's always URI safe. */\n if (\n ALLOW_DATA_ATTR &&\n !FORBID_ATTR[lcName] &&\n regExpTest(DATA_ATTR, lcName)\n ) {\n // This attribute is safe\n } else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) {\n // This attribute is safe\n /* Otherwise, check the name is permitted */\n } else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {\n if (\n // First condition does a very basic check if a) it's basically a valid custom element tagname AND\n // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck\n // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck\n (_basicCustomElementTest(lcTag) &&\n ((CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag)) ||\n (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag))) &&\n ((CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName)) ||\n (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)))) ||\n // Alternative, second condition checks if it's an `is`-attribute, AND\n // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck\n (lcName === 'is' &&\n CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements &&\n ((CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value)) ||\n (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))))\n ) {\n // If user has supplied a regexp or function in CUSTOM_ELEMENT_HANDLING.tagNameCheck, we need to also allow derived custom elements using the same tagName test.\n // Additionally, we need to allow attributes passing the CUSTOM_ELEMENT_HANDLING.attributeNameCheck user has configured, as custom elements can define these at their own discretion.\n } else {\n return false;\n }\n /* Check value is safe. First, is attr inert? If so, is safe */\n } else if (URI_SAFE_ATTRIBUTES[lcName]) {\n // This attribute is safe\n /* Check no script, data or unknown possibly unsafe URI\n unless we know URI values are safe for that attribute */\n } else if (\n regExpTest(IS_ALLOWED_URI, stringReplace(value, ATTR_WHITESPACE, ''))\n ) {\n // This attribute is safe\n /* Keep image data URIs alive if src/xlink:href is allowed */\n /* Further prevent gadget XSS for dynamically built script tags */\n } else if (\n (lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') &&\n lcTag !== 'script' &&\n stringIndexOf(value, 'data:') === 0 &&\n DATA_URI_TAGS[lcTag]\n ) {\n // This attribute is safe\n /* Allow unknown protocols: This provides support for links that\n are handled by protocol handlers which may be unknown ahead of\n time, e.g. fb:, spotify: */\n } else if (\n ALLOW_UNKNOWN_PROTOCOLS &&\n !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))\n ) {\n // This attribute is safe\n /* Check for binary attributes */\n } else if (value) {\n return false;\n } else {\n // Binary attributes are safe at this point\n /* Anything else, presume unsafe, do not add it back */\n }\n\n return true;\n };\n\n /**\n * _basicCustomElementCheck\n * checks if at least one dash is included in tagName, and it's not the first char\n * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name\n * @param {string} tagName name of the tag of the node to sanitize\n */\n const _basicCustomElementTest = function (tagName) {\n return tagName.indexOf('-') > 0;\n };\n\n /**\n * _sanitizeAttributes\n *\n * @protect attributes\n * @protect nodeName\n * @protect removeAttribute\n * @protect setAttribute\n *\n * @param {Node} currentNode to sanitize\n */\n const _sanitizeAttributes = function (currentNode) {\n let attr;\n let value;\n let lcName;\n let l;\n /* Execute a hook if present */\n _executeHook('beforeSanitizeAttributes', currentNode, null);\n\n const { attributes } = currentNode;\n\n /* Check if we have attributes; if not we might have a text node */\n if (!attributes) {\n return;\n }\n\n const hookEvent = {\n attrName: '',\n attrValue: '',\n keepAttr: true,\n allowedAttributes: ALLOWED_ATTR,\n };\n l = attributes.length;\n\n /* Go backwards over all attributes; safely remove bad ones */\n while (l--) {\n attr = attributes[l];\n const { name, namespaceURI } = attr;\n value = name === 'value' ? attr.value : stringTrim(attr.value);\n lcName = transformCaseFunc(name);\n\n /* Execute a hook if present */\n hookEvent.attrName = lcName;\n hookEvent.attrValue = value;\n hookEvent.keepAttr = true;\n hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set\n _executeHook('uponSanitizeAttribute', currentNode, hookEvent);\n value = hookEvent.attrValue;\n /* Did the hooks approve of the attribute? */\n if (hookEvent.forceKeepAttr) {\n continue;\n }\n\n /* Remove attribute */\n _removeAttribute(name, currentNode);\n\n /* Did the hooks approve of the attribute? */\n if (!hookEvent.keepAttr) {\n continue;\n }\n\n /* Work around a security issue in jQuery 3.0 */\n if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\\/>/i, value)) {\n _removeAttribute(name, currentNode);\n continue;\n }\n\n /* Sanitize attribute content to be template-safe */\n if (SAFE_FOR_TEMPLATES) {\n value = stringReplace(value, MUSTACHE_EXPR, ' ');\n value = stringReplace(value, ERB_EXPR, ' ');\n value = stringReplace(value, TMPLIT_EXPR, ' ');\n }\n\n /* Is `value` valid for this attribute? */\n const lcTag = transformCaseFunc(currentNode.nodeName);\n if (!_isValidAttribute(lcTag, lcName, value)) {\n continue;\n }\n\n /* Full DOM Clobbering protection via namespace isolation,\n * Prefix id and name attributes with `user-content-`\n */\n if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {\n // Remove the attribute with this value\n _removeAttribute(name, currentNode);\n\n // Prefix the value and later re-create the attribute with the sanitized value\n value = SANITIZE_NAMED_PROPS_PREFIX + value;\n }\n\n /* Handle attributes that require Trusted Types */\n if (\n trustedTypesPolicy &&\n typeof trustedTypes === 'object' &&\n typeof trustedTypes.getAttributeType === 'function'\n ) {\n if (namespaceURI) {\n /* Namespaces are not yet supported, see https://bugs.chromium.org/p/chromium/issues/detail?id=1305293 */\n } else {\n switch (trustedTypes.getAttributeType(lcTag, lcName)) {\n case 'TrustedHTML': {\n value = trustedTypesPolicy.createHTML(value);\n break;\n }\n\n case 'TrustedScriptURL': {\n value = trustedTypesPolicy.createScriptURL(value);\n break;\n }\n\n default: {\n break;\n }\n }\n }\n }\n\n /* Handle invalid data-* attribute set by try-catching it */\n try {\n if (namespaceURI) {\n currentNode.setAttributeNS(namespaceURI, name, value);\n } else {\n /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. \"x-schema\". */\n currentNode.setAttribute(name, value);\n }\n\n arrayPop(DOMPurify.removed);\n } catch (_) {}\n }\n\n /* Execute a hook if present */\n _executeHook('afterSanitizeAttributes', currentNode, null);\n };\n\n /**\n * _sanitizeShadowDOM\n *\n * @param {DocumentFragment} fragment to iterate over recursively\n */\n const _sanitizeShadowDOM = function (fragment) {\n let shadowNode;\n const shadowIterator = _createIterator(fragment);\n\n /* Execute a hook if present */\n _executeHook('beforeSanitizeShadowDOM', fragment, null);\n\n while ((shadowNode = shadowIterator.nextNode())) {\n /* Execute a hook if present */\n _executeHook('uponSanitizeShadowNode', shadowNode, null);\n\n /* Sanitize tags and elements */\n if (_sanitizeElements(shadowNode)) {\n continue;\n }\n\n /* Deep shadow DOM detected */\n if (shadowNode.content instanceof DocumentFragment) {\n _sanitizeShadowDOM(shadowNode.content);\n }\n\n /* Check attributes, sanitize if necessary */\n _sanitizeAttributes(shadowNode);\n }\n\n /* Execute a hook if present */\n _executeHook('afterSanitizeShadowDOM', fragment, null);\n };\n\n /**\n * Sanitize\n * Public method providing core sanitation functionality\n *\n * @param {String|Node} dirty string or DOM node\n * @param {Object} configuration object\n */\n // eslint-disable-next-line complexity\n DOMPurify.sanitize = function (dirty, cfg = {}) {\n let body;\n let importedNode;\n let currentNode;\n let oldNode;\n let returnNode;\n /* Make sure we have a string to sanitize.\n DO NOT return early, as this will return the wrong type if\n the user has requested a DOM object rather than a string */\n IS_EMPTY_INPUT = !dirty;\n if (IS_EMPTY_INPUT) {\n dirty = '<!-->';\n }\n\n /* Stringify, in case dirty is an object */\n if (typeof dirty !== 'string' && !_isNode(dirty)) {\n if (typeof dirty.toString === 'function') {\n dirty = dirty.toString();\n if (typeof dirty !== 'string') {\n throw typeErrorCreate('dirty is not a string, aborting');\n }\n } else {\n throw typeErrorCreate('toString is not a function');\n }\n }\n\n /* Check we can run. Otherwise fall back or ignore */\n if (!DOMPurify.isSupported) {\n if (\n typeof window.toStaticHTML === 'object' ||\n typeof window.toStaticHTML === 'function'\n ) {\n if (typeof dirty === 'string') {\n return window.toStaticHTML(dirty);\n }\n\n if (_isNode(dirty)) {\n return window.toStaticHTML(dirty.outerHTML);\n }\n }\n\n return dirty;\n }\n\n /* Assign config vars */\n if (!SET_CONFIG) {\n _parseConfig(cfg);\n }\n\n /* Clean up removed elements */\n DOMPurify.removed = [];\n\n /* Check if dirty is correctly typed for IN_PLACE */\n if (typeof dirty === 'string') {\n IN_PLACE = false;\n }\n\n if (IN_PLACE) {\n /* Do some early pre-sanitization to avoid unsafe root nodes */\n if (dirty.nodeName) {\n const tagName = transformCaseFunc(dirty.nodeName);\n if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {\n throw typeErrorCreate(\n 'root node is forbidden and cannot be sanitized in-place'\n );\n }\n }\n } else if (dirty instanceof Node) {\n /* If dirty is a DOM element, append to an empty document to avoid\n elements being stripped by the parser */\n body = _initDocument('<!---->');\n importedNode = body.ownerDocument.importNode(dirty, true);\n if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {\n /* Node is already a body, use as is */\n body = importedNode;\n } else if (importedNode.nodeName === 'HTML') {\n body = importedNode;\n } else {\n // eslint-disable-next-line unicorn/prefer-dom-node-append\n body.appendChild(importedNode);\n }\n } else {\n /* Exit directly if we have nothing to do */\n if (\n !RETURN_DOM &&\n !SAFE_FOR_TEMPLATES &&\n !WHOLE_DOCUMENT &&\n // eslint-disable-next-line unicorn/prefer-includes\n dirty.indexOf('<') === -1\n ) {\n return trustedTypesPolicy && RETURN_TRUSTED_TYPE\n ? trustedTypesPolicy.createHTML(dirty)\n : dirty;\n }\n\n /* Initialize the document to work on */\n body = _initDocument(dirty);\n\n /* Check we have a DOM node from the data */\n if (!body) {\n return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';\n }\n }\n\n /* Remove first element node (ours) if FORCE_BODY is set */\n if (body && FORCE_BODY) {\n _forceRemove(body.firstChild);\n }\n\n /* Get node iterator */\n const nodeIterator = _createIterator(IN_PLACE ? dirty : body);\n\n /* Now start iterating over the created document */\n while ((currentNode = nodeIterator.nextNode())) {\n /* Fix IE's strange behavior with manipulated textNodes #89 */\n if (currentNode.nodeType === 3 && currentNode === oldNode) {\n continue;\n }\n\n /* Sanitize tags and elements */\n if (_sanitizeElements(currentNode)) {\n continue;\n }\n\n /* Shadow DOM detected, sanitize it */\n if (currentNode.content instanceof DocumentFragment) {\n _sanitizeShadowDOM(currentNode.content);\n }\n\n /* Check attributes, sanitize if necessary */\n _sanitizeAttributes(currentNode);\n\n oldNode = currentNode;\n }\n\n oldNode = null;\n\n /* If we sanitized `dirty` in-place, return it. */\n if (IN_PLACE) {\n return dirty;\n }\n\n /* Return sanitized string or DOM */\n if (RETURN_DOM) {\n if (RETURN_DOM_FRAGMENT) {\n returnNode = createDocumentFragment.call(body.ownerDocument);\n\n while (body.firstChild) {\n // eslint-disable-next-line unicorn/prefer-dom-node-append\n returnNode.appendChild(body.firstChild);\n }\n } else {\n returnNode = body;\n }\n\n if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {\n /*\n AdoptNode() is not used because internal state is not reset\n (e.g. the past names map of a HTMLFormElement), this is safe\n in theory but we would rather not risk another attack vector.\n The state that is cloned by importNode() is explicitly defined\n by the specs.\n */\n returnNode = importNode.call(originalDocument, returnNode, true);\n }\n\n return returnNode;\n }\n\n let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;\n\n /* Serialize doctype if allowed */\n if (\n WHOLE_DOCUMENT &&\n ALLOWED_TAGS['!doctype'] &&\n body.ownerDocument &&\n body.ownerDocument.doctype &&\n body.ownerDocument.doctype.name &&\n regExpTest(EXPRESSIONS.DOCTYPE_NAME, body.ownerDocument.doctype.name)\n ) {\n serializedHTML =\n '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\\n' + serializedHTML;\n }\n\n /* Sanitize final string template-safe */\n if (SAFE_FOR_TEMPLATES) {\n serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');\n serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');\n serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');\n }\n\n return trustedTypesPolicy && RETURN_TRUSTED_TYPE\n ? trustedTypesPolicy.createHTML(serializedHTML)\n : serializedHTML;\n };\n\n /**\n * Public method to set the configuration once\n * setConfig\n *\n * @param {Object} cfg configuration object\n */\n DOMPurify.setConfig = function (cfg) {\n _parseConfig(cfg);\n SET_CONFIG = true;\n };\n\n /**\n * Public method to remove the configuration\n * clearConfig\n *\n */\n DOMPurify.clearConfig = function () {\n CONFIG = null;\n SET_CONFIG = false;\n };\n\n /**\n * Public method to check if an attribute value is valid.\n * Uses last set config, if any. Otherwise, uses config defaults.\n * isValidAttribute\n *\n * @param {string} tag Tag name of containing element.\n * @param {string} attr Attribute name.\n * @param {string} value Attribute value.\n * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.\n */\n DOMPurify.isValidAttribute = function (tag, attr, value) {\n /* Initialize shared config vars if necessary. */\n if (!CONFIG) {\n _parseConfig({});\n }\n\n const lcTag = transformCaseFunc(tag);\n const lcName = transformCaseFunc(attr);\n return _isValidAttribute(lcTag, lcName, value);\n };\n\n /**\n * AddHook\n * Public method to add DOMPurify hooks\n *\n * @param {String} entryPoint entry point for the hook to add\n * @param {Function} hookFunction function to execute\n */\n DOMPurify.addHook = function (entryPoint, hookFunction) {\n if (typeof hookFunction !== 'function') {\n return;\n }\n\n hooks[entryPoint] = hooks[entryPoint] || [];\n arrayPush(hooks[entryPoint], hookFunction);\n };\n\n /**\n * RemoveHook\n * Public method to remove a DOMPurify hook at a given entryPoint\n * (pops it from the stack of hooks if more are present)\n *\n * @param {String} entryPoint entry point for the hook to remove\n * @return {Function} removed(popped) hook\n */\n DOMPurify.removeHook = function (entryPoint) {\n if (hooks[entryPoint]) {\n return arrayPop(hooks[entryPoint]);\n }\n };\n\n /**\n * RemoveHooks\n * Public method to remove all DOMPurify hooks at a given entryPoint\n *\n * @param {String} entryPoint entry point for the hooks to remove\n */\n DOMPurify.removeHooks = function (entryPoint) {\n if (hooks[entryPoint]) {\n hooks[entryPoint] = [];\n }\n };\n\n /**\n * RemoveAllHooks\n * Public method to remove all DOMPurify hooks\n *\n */\n DOMPurify.removeAllHooks = function () {\n hooks = {};\n };\n\n return DOMPurify;\n}\n\nexport default createDOMPurify();\n"],"names":["hasOwnProperty","Object","setPrototypeOf","isFrozen","getPrototypeOf","getOwnPropertyDescriptor","freeze","seal","create","_ref","Reflect","apply","construct","fun","thisValue","args","x","Func","func","arrayForEach","unapply","Array","prototype","forEach","arrayPop","pop","arrayPush","push","stringToLowerCase","String","toLowerCase","stringToString","toString","stringMatch","match","stringReplace","replace","stringIndexOf","indexOf","stringTrim","trim","regExpTest","RegExp","test","typeErrorCreate","TypeError","_len2","arguments","length","_key2","thisArg","_len","_key","addToSet","set","array","transformCaseFunc","_transformCaseFunc","l","element","lcElement","clone","object","property","newObject","lookupGetter","prop","desc","get","value","fallbackValue","console","warn","html","svg","svgFilters","svgDisallowed","mathMl","mathMlDisallowed","text","xml","MUSTACHE_EXPR","ERB_EXPR","TMPLIT_EXPR","DATA_ATTR","ARIA_ATTR","IS_ALLOWED_URI","IS_SCRIPT_OR_DATA","ATTR_WHITESPACE","DOCTYPE_NAME","getGlobal","window","_createTrustedTypesPolicy","trustedTypes","document","_typeof","createPolicy","suffix","ATTR_NAME","currentScript","hasAttribute","getAttribute","policyName","createHTML","createScriptURL","scriptUrl","_","purify","createDOMPurify","DOMPurify","root","version","VERSION","removed","nodeType","isSupported","originalDocument","DocumentFragment","HTMLTemplateElement","Node","Element","NodeFilter","NamedNodeMap","MozNamedAttrMap","_window$NamedNodeMap","HTMLFormElement","DOMParser","ElementPrototype","cloneNode","getNextSibling","getChildNodes","getParentNode","template","createElement","content","ownerDocument","trustedTypesPolicy","emptyHTML","_document","implementation","createNodeIterator","createDocumentFragment","getElementsByTagName","importNode","documentMode","hooks","undefined","createHTMLDocument","PARSER_MEDIA_TYPE","EXPRESSIONS","ALLOWED_TAGS","DEFAULT_ALLOWED_TAGS","TAGS","_toConsumableArray","ALLOWED_ATTR","DEFAULT_ALLOWED_ATTR","ATTRS","CUSTOM_ELEMENT_HANDLING","tagNameCheck","writable","configurable","enumerable","attributeNameCheck","allowCustomizedBuiltInElements","FORBID_TAGS","FORBID_ATTR","ALLOW_ARIA_ATTR","ALLOW_DATA_ATTR","ALLOW_UNKNOWN_PROTOCOLS","ALLOW_SELF_CLOSE_IN_ATTR","SAFE_FOR_TEMPLATES","WHOLE_DOCUMENT","SET_CONFIG","FORCE_BODY","RETURN_DOM","RETURN_DOM_FRAGMENT","RETURN_TRUSTED_TYPE","SANITIZE_DOM","SANITIZE_NAMED_PROPS","SANITIZE_NAMED_PROPS_PREFIX","KEEP_CONTENT","IN_PLACE","USE_PROFILES","FORBID_CONTENTS","DEFAULT_FORBID_CONTENTS","DATA_URI_TAGS","DEFAULT_DATA_URI_TAGS","URI_SAFE_ATTRIBUTES","DEFAULT_URI_SAFE_ATTRIBUTES","MATHML_NAMESPACE","SVG_NAMESPACE","HTML_NAMESPACE","NAMESPACE","IS_EMPTY_INPUT","ALLOWED_NAMESPACES","DEFAULT_ALLOWED_NAMESPACES","SUPPORTED_PARSER_MEDIA_TYPES","DEFAULT_PARSER_MEDIA_TYPE","CONFIG","formElement","isRegexOrFunction","testValue","Function","_parseConfig","cfg","ADD_URI_SAFE_ATTR","ADD_DATA_URI_TAGS","ALLOWED_URI_REGEXP","ADD_TAGS","ADD_ATTR","table","tbody","MATHML_TEXT_INTEGRATION_POINTS","HTML_INTEGRATION_POINTS","COMMON_SVG_AND_HTML_ELEMENTS","ALL_SVG_TAGS","ALL_MATHML_TAGS","_checkValidNamespace","parent","tagName","namespaceURI","parentTagName","Boolean","_forceRemove","node","parentNode","removeChild","outerHTML","remove","_removeAttribute","name","attribute","getAttributeNode","from","removeAttribute","setAttribute","_initDocument","dirty","doc","leadingWhitespace","matches","dirtyPayload","parseFromString","documentElement","createDocument","innerHTML","body","insertBefore","createTextNode","childNodes","call","_createIterator","SHOW_ELEMENT","SHOW_COMMENT","SHOW_TEXT","_isClobbered","elm","nodeName","textContent","attributes","hasChildNodes","_isNode","_executeHook","entryPoint","currentNode","data","hook","_sanitizeElements","allowedTags","firstElementChild","_basicCustomElementTest","i","_isValidAttribute","lcTag","lcName","_sanitizeAttributes","attr","hookEvent","attrName","attrValue","keepAttr","allowedAttributes","_attr","forceKeepAttr","getAttributeType","setAttributeNS","_sanitizeShadowDOM","fragment","shadowNode","shadowIterator","nextNode","sanitize","importedNode","oldNode","returnNode","toStaticHTML","appendChild","firstChild","nodeIterator","shadowroot","shadowrootmod","serializedHTML","doctype","setConfig","clearConfig","isValidAttribute","tag","addHook","hookFunction","removeHook","removeHooks","removeAllHooks"],"mappings":";muDAAA,IACEA,EAKEC,OALFD,eACAE,EAIED,OAJFC,eACAC,EAGEF,OAHFE,SACAC,EAEEH,OAFFG,eACAC,EACEJ,OADFI,yBAGIC,EAAyBL,OAAzBK,OAAQC,EAAiBN,OAAjBM,KAAMC,EAAWP,OAAXO,OACpBC,EAA8C,oBAAZC,SAA2BA,QAAvDC,IAAAA,MAAOC,IAAAA,UAERD,IACHA,EAAQ,SAAUE,EAAKC,EAAWC,GAChC,OAAOF,EAAIF,MAAMG,EAAWC,EAC7B,GAGET,IACHA,EAAS,SAAUU,GACjB,OAAOA,CACR,GAGET,IACHA,EAAO,SAAUS,GACf,OAAOA,CACR,GAGEJ,IACHA,EAAY,SAAUK,EAAMF,GACfE,OAAAA,EAAAA,IAAQF,GACpB,GAGH,IAqB4BG,EArBtBC,EAAeC,EAAQC,MAAMC,UAAUC,SAEvCC,EAAWJ,EAAQC,MAAMC,UAAUG,KACnCC,EAAYN,EAAQC,MAAMC,UAAUK,MAGpCC,EAAoBR,EAAQS,OAAOP,UAAUQ,aAC7CC,EAAiBX,EAAQS,OAAOP,UAAUU,UAC1CC,EAAcb,EAAQS,OAAOP,UAAUY,OACvCC,EAAgBf,EAAQS,OAAOP,UAAUc,SACzCC,EAAgBjB,EAAQS,OAAOP,UAAUgB,SACzCC,EAAanB,EAAQS,OAAOP,UAAUkB,MAEtCC,EAAarB,EAAQsB,OAAOpB,UAAUqB,MAEtCC,GAMsB1B,EANQ2B,UAO3B,WAAA,IAAA,IAAAC,EAAAC,UAAAC,OAAIjC,EAAJ,IAAAM,MAAAyB,GAAAG,EAAA,EAAAA,EAAAH,EAAAG,IAAIlC,EAAJkC,GAAAF,UAAAE,GAAA,OAAarC,EAAUM,EAAMH,EAA7B,GALF,SAASK,EAAQF,GACtB,OAAO,SAACgC,GAAD,IAAA,IAAAC,EAAAJ,UAAAC,OAAajC,EAAb,IAAAM,MAAA8B,EAAA,EAAAA,EAAA,EAAA,GAAAC,EAAA,EAAAA,EAAAD,EAAAC,IAAarC,EAAbqC,EAAA,GAAAL,UAAAK,GAAA,OAAsBzC,EAAMO,EAAMgC,EAASnC,EAA3C,CACR,CAOM,SAASsC,EAASC,EAAKC,EAAOC,GAAmB,IAAAC,EACtDD,EAAiB,QAAAC,EAAGD,SAAH,IAAAC,EAAAA,EAAwB7B,EACrC1B,GAIFA,EAAeoD,EAAK,MAIfI,IADP,IAAIA,EAAIH,EAAMP,OACPU,KAAK,CACV,IAAIC,EAAUJ,EAAMG,GACpB,GAAuB,iBAAZC,EAAsB,CAC/B,IAAMC,EAAYJ,EAAkBG,GAChCC,IAAcD,IAEXxD,EAASoD,KACZA,EAAMG,GAAKE,GAGbD,EAAUC,EAEb,CAEDN,EAAIK,IAAW,CAChB,CAED,OAAOL,CACR,CAGM,SAASO,EAAMC,GACpB,IAEIC,EAFEC,EAAYxD,EAAO,MAGpBuD,IAAAA,KAAYD,GACmC,IAA9CnD,EAAMX,EAAgB8D,EAAQ,CAACC,MACjCC,EAAUD,GAAYD,EAAOC,IAIjC,OAAOC,CACR,CAMD,SAASC,EAAaH,EAAQI,GACrBJ,KAAW,OAAXA,GAAiB,CACtB,IAAMK,EAAO9D,EAAyByD,EAAQI,GAC9C,GAAIC,EAAM,CACJA,GAAAA,EAAKC,IACP,OAAOhD,EAAQ+C,EAAKC,KAGtB,GAA0B,mBAAfD,EAAKE,MACd,OAAOjD,EAAQ+C,EAAKE,MAEvB,CAEDP,EAAS1D,EAAe0D,EACzB,CAOD,OALSQ,SAAcX,GAErB,OADAY,QAAQC,KAAK,qBAAsBb,GAC5B,IACR,CAGF,CCjIM,IAAMc,EAAOnE,EAAO,CACzB,IACA,OACA,UACA,UACA,OACA,UACA,QACA,QACA,IACA,MACA,MACA,MACA,QACA,aACA,OACA,KACA,SACA,SACA,UACA,SACA,OACA,OACA,MACA,WACA,UACA,OACA,WACA,KACA,YACA,MACA,UACA,MACA,SACA,MACA,MACA,KACA,KACA,UACA,KACA,WACA,aACA,SACA,OACA,SACA,OACA,KACA,KACA,KACA,KACA,KACA,KACA,OACA,SACA,SACA,KACA,OACA,IACA,MACA,QACA,MACA,MACA,QACA,SACA,KACA,OACA,MACA,OACA,UACA,OACA,WACA,QACA,MACA,OACA,KACA,WACA,SACA,SACA,IACA,UACA,MACA,WACA,IACA,KACA,KACA,OACA,IACA,OACA,UACA,SACA,SACA,QACA,SACA,SACA,OACA,SACA,SACA,QACA,MACA,UACA,MACA,QACA,QACA,KACA,WACA,WACA,QACA,KACA,QACA,OACA,KACA,QACA,KACA,IACA,KACA,MACA,QACA,QAIWoE,EAAMpE,EAAO,CACxB,MACA,IACA,WACA,cACA,eACA,eACA,gBACA,mBACA,SACA,WACA,OACA,OACA,UACA,SACA,OACA,IACA,QACA,WACA,QACA,QACA,OACA,iBACA,SACA,OACA,WACA,QACA,OACA,UACA,UACA,WACA,iBACA,OACA,OACA,QACA,SACA,SACA,OACA,WACA,QACA,OACA,QACA,OACA,UAGWqE,EAAarE,EAAO,CAC/B,UACA,gBACA,sBACA,cACA,mBACA,oBACA,oBACA,iBACA,UACA,UACA,UACA,UACA,UACA,iBACA,UACA,UACA,cACA,eACA,WACA,eACA,qBACA,cACA,SACA,iBAOWsE,EAAgBtE,EAAO,CAClC,UACA,gBACA,SACA,UACA,eACA,YACA,mBACA,iBACA,gBACA,gBACA,gBACA,QACA,YACA,OACA,eACA,YACA,UACA,gBACA,SACA,MACA,aACA,UACA,QAGWuE,EAASvE,EAAO,CAC3B,OACA,WACA,SACA,UACA,QACA,SACA,KACA,aACA,gBACA,KACA,KACA,QACA,UACA,WACA,QACA,OACA,KACA,SACA,QACA,SACA,OACA,OACA,UACA,SACA,MACA,QACA,MACA,SACA,eAKWwE,EAAmBxE,EAAO,CACrC,UACA,cACA,aACA,WACA,YACA,UACA,UACA,SACA,SACA,QACA,YACA,aACA,iBACA,cACA,SAGWyE,EAAOzE,EAAO,CAAC,UCpRfmE,EAAOnE,EAAO,CACzB,SACA,SACA,QACA,MACA,iBACA,eACA,uBACA,WACA,aACA,UACA,SACA,UACA,cACA,cACA,UACA,OACA,QACA,QACA,QACA,OACA,UACA,WACA,eACA,SACA,cACA,WACA,WACA,UACA,MACA,WACA,0BACA,wBACA,WACA,YACA,UACA,eACA,OACA,MACA,UACA,SACA,SACA,OACA,OACA,WACA,KACA,YACA,YACA,QACA,OACA,QACA,OACA,OACA,UACA,OACA,MACA,MACA,YACA,QACA,SACA,MACA,YACA,WACA,QACA,OACA,QACA,UACA,aACA,SACA,OACA,UACA,UACA,cACA,cACA,SACA,UACA,UACA,aACA,WACA,MACA,WACA,MACA,WACA,OACA,OACA,UACA,aACA,QACA,WACA,QACA,OACA,QACA,OACA,UACA,QACA,MACA,SACA,OACA,QACA,UACA,WACA,QACA,YACA,OACA,SACA,SACA,QACA,QACA,QACA,SAGWoE,EAAMpE,EAAO,CACxB,gBACA,aACA,WACA,qBACA,SACA,gBACA,gBACA,UACA,gBACA,iBACA,QACA,OACA,KACA,QACA,OACA,gBACA,YACA,YACA,QACA,sBACA,8BACA,gBACA,kBACA,KACA,KACA,IACA,KACA,KACA,kBACA,YACA,UACA,UACA,MACA,WACA,YACA,MACA,OACA,eACA,YACA,SACA,cACA,cACA,gBACA,cACA,YACA,mBACA,eACA,aACA,eACA,cACA,KACA,KACA,KACA,KACA,aACA,WACA,gBACA,oBACA,SACA,OACA,KACA,kBACA,KACA,MACA,IACA,KACA,KACA,KACA,KACA,UACA,YACA,aACA,WACA,OACA,eACA,iBACA,eACA,mBACA,iBACA,QACA,aACA,aACA,eACA,eACA,cACA,cACA,mBACA,YACA,MACA,OACA,QACA,SACA,OACA,MACA,OACA,aACA,SACA,WACA,UACA,QACA,SACA,cACA,SACA,WACA,cACA,OACA,aACA,sBACA,mBACA,eACA,SACA,gBACA,sBACA,iBACA,IACA,KACA,KACA,SACA,OACA,OACA,cACA,YACA,UACA,SACA,SACA,QACA,OACA,kBACA,mBACA,mBACA,eACA,cACA,eACA,cACA,aACA,eACA,mBACA,oBACA,iBACA,kBACA,oBACA,iBACA,SACA,eACA,QACA,eACA,iBACA,WACA,UACA,UACA,YACA,mBACA,cACA,kBACA,iBACA,aACA,OACA,KACA,KACA,UACA,SACA,UACA,aACA,UACA,aACA,gBACA,gBACA,QACA,eACA,OACA,eACA,mBACA,mBACA,IACA,KACA,KACA,QACA,IACA,KACA,KACA,IACA,eAGWuE,EAASvE,EAAO,CAC3B,SACA,cACA,QACA,WACA,QACA,eACA,cACA,aACA,aACA,QACA,MACA,UACA,eACA,WACA,QACA,QACA,SACA,OACA,KACA,UACA,SACA,gBACA,SACA,SACA,iBACA,YACA,WACA,cACA,UACA,UACA,gBACA,WACA,WACA,OACA,WACA,WACA,aACA,UACA,SACA,SACA,cACA,gBACA,uBACA,YACA,YACA,aACA,WACA,iBACA,iBACA,YACA,UACA,QACA,UAGW0E,EAAM1E,EAAO,CACxB,aACA,SACA,cACA,YACA,gBCrWW2E,EAAgB1E,EAAK,6BACrB2E,EAAW3E,EAAK,yBAChB4E,EAAc5E,EAAK,iBACnB6E,EAAY7E,EAAK,8BACjB8E,EAAY9E,EAAK,kBACjB+E,EAAiB/E,EAC5B,yFAEWgF,EAAoBhF,EAAK,yBACzBiF,EAAkBjF,EAC7B,+DAEWkF,EAAelF,EAAK,WCM3BmF,EAAY,WAAA,MAAyB,oBAAXC,OAAyB,KAAOA,MAA9C,EAUZC,GAA4B,SAAUC,EAAcC,GAEtD,GAAwB,WAAxBC,EAAOF,IAC8B,mBAA9BA,EAAaG,aAEpB,OAAO,KAMLC,IAAAA,EAAS,KACPC,EAAY,wBAEhBJ,EAASK,eACTL,EAASK,cAAcC,aAAaF,KAEpCD,EAASH,EAASK,cAAcE,aAAaH,IAGzCI,IAAAA,EAAa,aAAeL,EAAS,IAAMA,EAAS,IAEtD,IACF,OAAOJ,EAAaG,aAAaM,EAAY,CAC3CC,WAAW9B,SAAAA,GACT,OAAOA,CAFkC,EAI3C+B,gBAAgBC,SAAAA,GACd,OAAOA,CACR,GAUJ,CARC,MAAOC,GAOP,OAHAnC,QAAQC,KACN,uBAAyB8B,EAAa,0BAEjC,IACR,CACF,EAmjDD,IAAAK,GAjjDA,SAASC,IAAgBjB,IAAAA,EAASD,UAAAA,OAAAA,QAAAA,IAAAA,UAAAA,GAAAA,UAAAA,GAAAA,IAC1BmB,EAAY,SAACC,GAASF,OAAAA,EAAgBE,EAA1B,EAclB,GARAD,EAAUE,QAAUC,QAMpBH,EAAUI,QAAU,IAEftB,IAAWA,EAAOG,UAAyC,IAA7BH,EAAOG,SAASoB,SAKjD,OAFAL,EAAUM,aAAc,EAEjBN,EAGT,IAAMO,EAAmBzB,EAAOG,SAE1BA,EAAaH,EAAbG,SAEJuB,EASE1B,EATF0B,iBACAC,EAQE3B,EARF2B,oBACAC,EAOE5B,EAPF4B,KACAC,EAME7B,EANF6B,QACAC,EAKE9B,EALF8B,WAKE9B,EAAAA,EAJF+B,aAAAA,aAAe/B,EAAO+B,cAAgB/B,EAAOgC,gBAN/CC,EAOEC,EAGElC,EAHFkC,gBACAC,EAEEnC,EAFFmC,UACAjC,EACEF,EADFE,aAGIkC,EAAmBP,EAAQlG,UAE3B0G,GAAY/D,EAAa8D,EAAkB,aAC3CE,GAAiBhE,EAAa8D,EAAkB,eAChDG,GAAgBjE,EAAa8D,EAAkB,cAC/CI,GAAgBlE,EAAa8D,EAAkB,cAQrD,GAAmC,mBAAxBT,EAAoC,CAC7C,IAAMc,GAAWtC,EAASuC,cAAc,YACpCD,GAASE,SAAWF,GAASE,QAAQC,gBACvCzC,EAAWsC,GAASE,QAAQC,cAE/B,CAED,IAAMC,GAAqB5C,GACzBC,EACAuB,GAEIqB,GAAYD,GAAqBA,GAAmBjC,WAAW,IAAM,GAE3EmC,GAKI5C,EAJF6C,MAAAA,eACAC,MAAAA,mBACAC,MAAAA,uBACAC,MAAAA,qBAEMC,GAAe3B,EAAf2B,WAEJC,GAAe,CAAA,EACf,IACFA,GAAenF,EAAMiC,GAAUkD,aAAelD,EAASkD,aAAe,EAC1D,CAAZ,MAAOtC,GAAK,CAEVuC,IAAAA,GAAQ,CAAA,EAKZpC,EAAUM,YACiB,mBAAlBgB,IACPQ,SACsCO,IAAtCP,GAAeQ,oBACE,IAAjBH,GAEF,IA4NII,GAGA5F,GA9NFyB,GAOEoE,EANFnE,GAMEmE,EALFlE,GAKEkE,EAJFjE,GAIEiE,EAHFhE,GAGEgE,EAFF9D,GAEE8D,EADF7D,GACE6D,EAEE/D,GAAmB+D,EAQrBC,GAAe,KACbC,GAAuBlG,EAAS,eACjCmG,GADgCC,EAEhCD,GACAA,EAAAA,GACAA,EAAAA,GACAA,EAAAA,KAIDE,GAAe,KACbC,GAAuBtG,EAAS,CAAD,EAChCuG,GAAAA,OAAAA,EAAAA,GADgCH,EAEhCG,KACAA,GACAA,EAAAA,KASDC,GAA0B5J,OAAOM,KACnCN,OAAOO,OAAO,KAAM,CAClBsJ,aAAc,CACZC,UAAU,EACVC,cAAc,EACdC,YAAY,EACZ5F,MAAO,MAET6F,mBAAoB,CAClBH,UAAU,EACVC,cAAc,EACdC,YAAY,EACZ5F,MAAO,MAET8F,+BAAgC,CAC9BJ,UAAU,EACVC,cAAc,EACdC,YAAY,EACZ5F,OAAO,MAMT+F,GAAc,KAGdC,GAAc,KAGdC,IAAkB,EAGlBC,IAAkB,EAGlBC,IAA0B,EAI1BC,IAA2B,EAK3BC,IAAqB,EAGrBC,IAAiB,EAGjBC,IAAa,EAIbC,IAAa,EAMbC,IAAa,EAIbC,IAAsB,EAItBC,IAAsB,EAKtBC,IAAe,EAefC,IAAuB,EACrBC,GAA8B,gBAGhCC,IAAe,EAIfC,IAAW,EAGXC,GAAe,CAAA,EAGfC,GAAkB,KAChBC,GAA0BnI,EAAS,CAAD,EAAK,CAC3C,iBACA,QACA,WACA,OACA,gBACA,OACA,SACA,OACA,KACA,KACA,KACA,KACA,QACA,UACA,WACA,WACA,YACA,SACA,QACA,MACA,WACA,QACA,QACA,QACA,QAIEoI,GAAgB,KACdC,GAAwBrI,EAAS,CAAD,EAAK,CACzC,QACA,QACA,MACA,SACA,QACA,UAIEsI,GAAsB,KACpBC,GAA8BvI,EAAS,GAAI,CAC/C,MACA,QACA,MACA,KACA,QACA,OACA,UACA,cACA,OACA,UACA,QACA,QACA,QACA,UAGIwI,GAAmB,qCACnBC,GAAgB,6BAChBC,GAAiB,+BAEnBC,GAAYD,GACZE,IAAiB,EAGjBC,GAAqB,KACnBC,GAA6B9I,EACjC,GACA,CAACwI,GAAkBC,GAAeC,IAClChK,GAKIqK,GAA+B,CAAC,wBAAyB,aACzDC,GAA4B,YAI9BC,GAAS,KAKPC,GAAczG,EAASuC,cAAc,QAErCmE,GAAoB,SAAUC,GAClC,OAAOA,aAAqB/J,QAAU+J,aAAqBC,QAC5D,EAQKC,GAAe,SAAUC,GACzBN,IAAUA,KAAWM,IAKpBA,GAAsB,WAAf7G,EAAO6G,KACjBA,EAAM,CAAA,GAIRA,EAAM/I,EAAM+I,GAEZxD,GAGOA,IAD4D,IAAjEgD,GAA6B9J,QAAQsK,EAAIxD,mBAChBiD,GACAO,EAAIxD,kBAG/B5F,GACwB,0BAAtB4F,GACIrH,EACAH,EAGN0H,GACE,iBAAkBsD,EACdvJ,EAAS,CAAA,EAAIuJ,EAAItD,aAAc9F,IAC/B+F,GACNG,GACE,iBAAkBkD,EACdvJ,EAAS,CAAA,EAAIuJ,EAAIlD,aAAclG,IAC/BmG,GACNuC,GACE,uBAAwBU,EACpBvJ,EAAS,CAAA,EAAIuJ,EAAIV,mBAAoBnK,GACrCoK,GACNR,GACE,sBAAuBiB,EACnBvJ,EACEQ,EAAM+H,IACNgB,EAAIC,kBACJrJ,IAEFoI,GACNH,GACE,sBAAuBmB,EACnBvJ,EACEQ,EAAM6H,IACNkB,EAAIE,kBACJtJ,IAEFkI,GACNH,GACE,oBAAqBqB,EACjBvJ,EAAS,CAAA,EAAIuJ,EAAIrB,gBAAiB/H,IAClCgI,GACNpB,GACE,gBAAiBwC,EACbvJ,EAAS,CAAA,EAAIuJ,EAAIxC,YAAa5G,IAC9B,GACN6G,GACE,gBAAiBuC,EACbvJ,EAAS,CAAA,EAAIuJ,EAAIvC,YAAa7G,IAC9B,GACN8H,GAAe,iBAAkBsB,GAAMA,EAAItB,aAC3ChB,IAA0C,IAAxBsC,EAAItC,gBACtBC,IAA0C,IAAxBqC,EAAIrC,gBACtBC,GAA0BoC,EAAIpC,0BAA2B,EACzDC,IAA4D,IAAjCmC,EAAInC,yBAC/BC,GAAqBkC,EAAIlC,qBAAsB,EAC/CC,GAAiBiC,EAAIjC,iBAAkB,EACvCG,GAAa8B,EAAI9B,aAAc,EAC/BC,GAAsB6B,EAAI7B,sBAAuB,EACjDC,GAAsB4B,EAAI5B,sBAAuB,EACjDH,GAAa+B,EAAI/B,aAAc,EAC/BI,IAAoC,IAArB2B,EAAI3B,aACnBC,GAAuB0B,EAAI1B,uBAAwB,EACnDE,IAAoC,IAArBwB,EAAIxB,aACnBC,GAAWuB,EAAIvB,WAAY,EAC3B/F,GAAiBsH,EAAIG,oBAAsBzH,GAC3C0G,GAAYY,EAAIZ,WAAaD,GAC7BlC,GAA0B+C,EAAI/C,yBAA2B,GAEvD+C,EAAI/C,yBACJ2C,GAAkBI,EAAI/C,wBAAwBC,gBAE9CD,GAAwBC,aACtB8C,EAAI/C,wBAAwBC,cAI9B8C,EAAI/C,yBACJ2C,GAAkBI,EAAI/C,wBAAwBK,sBAE9CL,GAAwBK,mBACtB0C,EAAI/C,wBAAwBK,oBAI9B0C,EAAI/C,yBAEF,kBADK+C,EAAI/C,wBAAwBM,iCAGnCN,GAAwBM,+BACtByC,EAAI/C,wBAAwBM,gCAG5BO,KACFH,IAAkB,GAGhBQ,KACFD,IAAa,GAIXQ,KACFhC,GAAejG,EAAS,CAAA,EAAQmG,EAAAA,IAChCE,GAAe,IACW,IAAtB4B,GAAa7G,OACfpB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,KAGA,IAArB0B,GAAa5G,MACfrB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,GACvBvG,EAASqG,GAAcE,KAGO,IAA5B0B,GAAa3G,aACftB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,GACvBvG,EAASqG,GAAcE,KAGG,IAAxB0B,GAAazG,SACfxB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,GACvBvG,EAASqG,GAAcE,KAKvBgD,EAAII,WACF1D,KAAiBC,KACnBD,GAAezF,EAAMyF,KAGvBjG,EAASiG,GAAcsD,EAAII,SAAUxJ,KAGnCoJ,EAAIK,WACFvD,KAAiBC,KACnBD,GAAe7F,EAAM6F,KAGvBrG,EAASqG,GAAckD,EAAIK,SAAUzJ,KAGnCoJ,EAAIC,mBACNxJ,EAASsI,GAAqBiB,EAAIC,kBAAmBrJ,IAGnDoJ,EAAIrB,kBACFA,KAAoBC,KACtBD,GAAkB1H,EAAM0H,KAG1BlI,EAASkI,GAAiBqB,EAAIrB,gBAAiB/H,KAI7C4H,KACF9B,GAAa,UAAW,GAItBqB,IACFtH,EAASiG,GAAc,CAAC,OAAQ,OAAQ,SAItCA,GAAa4D,QACf7J,EAASiG,GAAc,CAAC,iBACjBc,GAAY+C,OAKjB7M,GACFA,EAAOsM,GAGTN,GAASM,EACV,EAEKQ,GAAiC/J,EAAS,CAAA,EAAI,CAClD,KACA,KACA,KACA,KACA,UAGIgK,GAA0BhK,EAAS,GAAI,CAC3C,gBACA,OACA,QACA,mBAOIiK,GAA+BjK,EAAS,CAAA,EAAI,CAChD,QACA,QACA,OACA,IACA,WAMIkK,GAAelK,EAAS,CAAD,EAAKmG,GAClCnG,EAASkK,GAAc/D,GACvBnG,EAASkK,GAAc/D,GAEjBgE,IAAAA,GAAkBnK,EAAS,CAAD,EAAKmG,GACrCnG,EAASmK,GAAiBhE,GAU1B,IAAMiE,GAAuB,SAAU9J,GACrC,IAAI+J,EAASvF,GAAcxE,GAItB+J,GAAWA,EAAOC,UACrBD,EAAS,CACPE,aAAc5B,GACd2B,QAAS,aAIb,IAAMA,EAAU/L,EAAkB+B,EAAQgK,SACpCE,EAAgBjM,EAAkB8L,EAAOC,SAE/C,QAAKzB,GAAmBvI,EAAQiK,gBAI5BjK,EAAQiK,eAAiB9B,GAIvB4B,EAAOE,eAAiB7B,GACP,QAAZ4B,EAMLD,EAAOE,eAAiB/B,GAEZ,QAAZ8B,IACmB,mBAAlBE,GACCT,GAA+BS,IAM9BC,QAAQP,GAAaI,IAG1BhK,EAAQiK,eAAiB/B,GAIvB6B,EAAOE,eAAiB7B,GACP,SAAZ4B,EAKLD,EAAOE,eAAiB9B,GACP,SAAZ6B,GAAsBN,GAAwBQ,GAKhDC,QAAQN,GAAgBG,IAG7BhK,EAAQiK,eAAiB7B,KAKzB2B,EAAOE,eAAiB9B,KACvBuB,GAAwBQ,QAMzBH,EAAOE,eAAiB/B,KACvBuB,GAA+BS,OAQ/BL,GAAgBG,KAChBL,GAA6BK,KAAaJ,GAAaI,QAMpC,0BAAtBvE,KACA8C,GAAmBvI,EAAQiK,eAU9B,EAOKG,GAAe,SAAUC,GAC7BtM,EAAUmF,EAAUI,QAAS,CAAEtD,QAASqK,IACpC,IAEFA,EAAKC,WAAWC,YAAYF,EAO7B,CANC,MAAOtH,GACH,IACFsH,EAAKG,UAAY1F,EAGlB,CAFC,MAAO/B,GACPsH,EAAKI,QACN,CACF,CACF,EAQKC,GAAmB,SAAUC,EAAMN,GACnC,IACFtM,EAAUmF,EAAUI,QAAS,CAC3BsH,UAAWP,EAAKQ,iBAAiBF,GACjCG,KAAMT,GAOT,CALC,MAAOtH,GACPhF,EAAUmF,EAAUI,QAAS,CAC3BsH,UAAW,KACXE,KAAMT,GAET,CAKGM,GAHJN,EAAKU,gBAAgBJ,GAGR,OAATA,IAAkB5E,GAAa4E,GAC7BxD,GAAAA,IAAcC,GACZ,IACFgD,GAAaC,EACD,CAAZ,MAAOtH,GAAK,MAEV,IACFsH,EAAKW,aAAaL,EAAM,GACZ,CAAZ,MAAO5H,GAAK,CAGnB,EAQKkI,GAAgB,SAAUC,GAE9B,IAAIC,EACAC,EAEJ,GAAIlE,GACFgE,EAAQ,oBAAsBA,MACzB,CAEL,IAAMG,EAAU/M,EAAY4M,EAAO,eACnCE,EAAoBC,GAAWA,EAAQ,EACxC,CAGuB,0BAAtB5F,IACA4C,KAAcD,KAGd8C,EACE,iEACAA,EACA,kBAGEI,IAAAA,EAAezG,GACjBA,GAAmBjC,WAAWsI,GAC9BA,EAKA7C,GAAAA,KAAcD,GACZ,IACF+C,GAAM,IAAIhH,GAAYoH,gBAAgBD,EAAc7F,GACxC,CAAZ,MAAO1C,GAAK,CAIhB,IAAKoI,IAAQA,EAAIK,gBAAiB,CAChCL,EAAMnG,GAAeyG,eAAepD,GAAW,WAAY,MACvD,IACF8C,EAAIK,gBAAgBE,UAAYpD,GAC5BxD,GACAwG,CAGL,CAFC,MAAOvI,GAER,CACF,CAEK4I,IAAAA,EAAOR,EAAIQ,MAAQR,EAAIK,gBAUzBnD,OARA6C,GAASE,GACXO,EAAKC,aACHzJ,EAAS0J,eAAeT,GACxBO,EAAKG,WAAW,IAAM,MAKtBzD,KAAcD,GACTjD,GAAqB4G,KAC1BZ,EACAnE,GAAiB,OAAS,QAC1B,GAGGA,GAAiBmE,EAAIK,gBAAkBG,CAC/C,EAQKK,GAAkB,SAAU7I,GACzB8B,OAAAA,GAAmB8G,KACxB5I,EAAKyB,eAAiBzB,EACtBA,EAEAW,EAAWmI,aAAenI,EAAWoI,aAAepI,EAAWqI,UAC/D,MACA,EAEH,EAQKC,GAAe,SAAUC,GAC7B,OACEA,aAAenI,IACU,iBAAjBmI,EAAIC,UACiB,iBAApBD,EAAIE,aACgB,mBAApBF,EAAI9B,eACT8B,EAAIG,sBAAsBzI,IACG,mBAAxBsI,EAAItB,iBACiB,mBAArBsB,EAAIrB,cACiB,iBAArBqB,EAAIpC,cACiB,mBAArBoC,EAAIT,cACkB,mBAAtBS,EAAII,cAEhB,EAQKC,GAAU,SAAUvM,GACxB,MAAuB,WAAhBiC,EAAOwB,GACVzD,aAAkByD,EAClBzD,GACoB,WAAlBiC,EAAOjC,IACoB,iBAApBA,EAAOoD,UACa,iBAApBpD,EAAOmM,QACrB,EAUKK,GAAe,SAAUC,EAAYC,EAAaC,GACjDxH,GAAMsH,IAIXpP,EAAa8H,GAAMsH,IAAa,SAACG,GAC/BA,EAAKhB,KAAK7I,EAAW2J,EAAaC,EAAMnE,GACzC,GACF,EAYKqE,GAAoB,SAAUH,GAClC,IAAIlI,EAMJ,GAHAgI,GAAa,yBAA0BE,EAAa,MAGhDT,GAAaS,GAEf,OADAzC,GAAayC,IACN,EAIL/N,GAAAA,EAAW,kBAAmB+N,EAAYP,UAE5C,OADAlC,GAAayC,IACN,EAIT,IAAM7C,EAAUnK,GAAkBgN,EAAYP,UAU5CO,GAPFF,GAAa,sBAAuBE,EAAa,CAC/C7C,QAAAA,EACAiD,YAAatH,KAKbkH,EAAYJ,kBACXC,GAAQG,EAAYK,sBACnBR,GAAQG,EAAYlI,WACnB+H,GAAQG,EAAYlI,QAAQuI,qBAC/BpO,EAAW,UAAW+N,EAAYnB,YAClC5M,EAAW,UAAW+N,EAAYN,aAGlC,OADAnC,GAAayC,IACN,EAIT,GACc,WAAZ7C,GACAlL,EAAW,aAAc+N,EAAYnB,WAGrC,OADAtB,GAAayC,IACN,EAIL,IAAClH,GAAaqE,IAAYvD,GAAYuD,GAAU,CAE9C,IAACvD,GAAYuD,IAAYmD,GAAwBnD,GAAU,CAC7D,GACE9D,GAAwBC,wBAAwBpH,QAChDD,EAAWoH,GAAwBC,aAAc6D,GAEjD,OAAO,EACT,GACE9D,GAAwBC,wBAAwB4C,UAChD7C,GAAwBC,aAAa6D,GAErC,OAAO,CACV,CAGD,GAAIvC,KAAiBG,GAAgBoC,GAAU,CACvCM,IAAAA,EAAa9F,GAAcqI,IAAgBA,EAAYvC,WACvDwB,EAAavH,GAAcsI,IAAgBA,EAAYf,WAEzDA,GAAAA,GAAcxB,EAGhB,IAFA,IAES8C,EAFUtB,EAAWzM,OAEJ,EAAG+N,GAAK,IAAKA,EACrC9C,EAAWsB,aACTvH,GAAUyH,EAAWsB,IAAI,GACzB9I,GAAeuI,GAItB,CAGD,OADAzC,GAAayC,IACN,CACR,CAGGA,OAAAA,aAAuBhJ,IAAYiG,GAAqB+C,IAC1DzC,GAAayC,IACN,GAKM,aAAZ7C,GACa,YAAZA,GACY,aAAZA,IACFlL,EAAW,8BAA+B+N,EAAYnB,YAOpD3E,IAA+C,IAAzB8F,EAAYtJ,WAEpCoB,EAAUkI,EAAYN,YACtB5H,EAAUnG,EAAcmG,EAASrD,GAAe,KAChDqD,EAAUnG,EAAcmG,EAASpD,GAAU,KAC3CoD,EAAUnG,EAAcmG,EAASnD,GAAa,KAC1CqL,EAAYN,cAAgB5H,IAC9B5G,EAAUmF,EAAUI,QAAS,CAAEtD,QAAS6M,EAAYxI,cACpDwI,EAAYN,YAAc5H,IAK9BgI,GAAa,wBAAyBE,EAAa,OAE5C,IApBLzC,GAAayC,IACN,EAoBV,EAWKQ,GAAoB,SAAUC,EAAOC,EAAQ7M,GAEjD,GACE4G,KACY,OAAXiG,GAA8B,SAAXA,KACnB7M,KAASyB,GAAYzB,KAASkI,IAE/B,OAAO,EAOT,GACEhC,KACCF,GAAY6G,IACbzO,EAAW2C,GAAW8L,SAGjB,GAAI5G,IAAmB7H,EAAW4C,GAAW6L,SAG7C,IAAKxH,GAAawH,IAAW7G,GAAY6G,IAE5C,KAGCJ,GAAwBG,KACrBpH,GAAwBC,wBAAwBpH,QAChDD,EAAWoH,GAAwBC,aAAcmH,IAChDpH,GAAwBC,wBAAwB4C,UAC/C7C,GAAwBC,aAAamH,MACvCpH,GAAwBK,8BAA8BxH,QACtDD,EAAWoH,GAAwBK,mBAAoBgH,IACtDrH,GAAwBK,8BAA8BwC,UACrD7C,GAAwBK,mBAAmBgH,KAGrC,OAAXA,GACCrH,GAAwBM,iCACtBN,GAAwBC,wBAAwBpH,QAChDD,EAAWoH,GAAwBC,aAAczF,IAChDwF,GAAwBC,wBAAwB4C,UAC/C7C,GAAwBC,aAAazF,KAK3C,OAAO,OAGJ,GAAIsH,GAAoBuF,SAIxB,GACLzO,EAAW6C,GAAgBnD,EAAckC,EAAOmB,GAAiB,WAK5D,GACO,QAAX0L,GAA+B,eAAXA,GAAsC,SAAXA,GACtC,WAAVD,GACkC,IAAlC5O,EAAcgC,EAAO,WACrBoH,GAAcwF,IAMT,GACLzG,KACC/H,EAAW8C,GAAmBpD,EAAckC,EAAOmB,GAAiB,WAIhE,GAAInB,EACT,OAAO,OAMT,OAAO,CACR,EAQKyM,GAA0B,SAAUnD,GACxC,OAAOA,EAAQrL,QAAQ,KAAO,CAC/B,EAYK6O,GAAsB,SAAUX,GACpC,IAAIY,EACA/M,EACA6M,EACAxN,EAEJ4M,GAAa,2BAA4BE,EAAa,MAEtD,IAAQL,EAAeK,EAAfL,WAGJ,GAACA,EAAD,CAIJ,IAAMkB,EAAY,CAChBC,SAAU,GACVC,UAAW,GACXC,UAAU,EACVC,kBAAmB/H,IAKdhG,IAHPA,EAAIyM,EAAWnN,OAGRU,KAAK,CAEV,IAAAgO,EADAN,EAAOjB,EAAWzM,GACV4K,IAAAA,KAAMV,IAAAA,aAYVyD,GAXJhN,EAAiB,UAATiK,EAAmB8C,EAAK/M,MAAQ9B,EAAW6O,EAAK/M,OACxD6M,EAAS1N,GAAkB8K,GAG3B+C,EAAUC,SAAWJ,EACrBG,EAAUE,UAAYlN,EACtBgN,EAAUG,UAAW,EACrBH,EAAUM,mBAAgBzI,EAC1BoH,GAAa,wBAAyBE,EAAaa,GACnDhN,EAAQgN,EAAUE,WAEdF,EAAUM,gBAKdtD,GAAiBC,EAAMkC,GAGlBa,EAAUG,UAKX,GAAC/G,KAA4BhI,EAAW,OAAQ4B,GAAhD,CAMAqG,KACFrG,EAAQlC,EAAckC,EAAOY,GAAe,KAC5CZ,EAAQlC,EAAckC,EAAOa,GAAU,KACvCb,EAAQlC,EAAckC,EAAOc,GAAa,MAI5C,IAAM8L,EAAQzN,GAAkBgN,EAAYP,UACxC,GAACe,GAAkBC,EAAOC,EAAQ7M,GAAlC,CAgBJ,IATI6G,IAAoC,OAAXgG,GAA8B,SAAXA,IAE9C7C,GAAiBC,EAAMkC,GAGvBnM,EAAQ8G,GAA8B9G,GAKtCmE,IACwB,WAAxBzC,EAAOF,IACkC,mBAAlCA,EAAa+L,iBAEpB,GAAIhE,QAGF,OAAQ/H,EAAa+L,iBAAiBX,EAAOC,IAC3C,IAAK,cACH7M,EAAQmE,GAAmBjC,WAAWlC,GACtC,MAGF,IAAK,mBACHA,EAAQmE,GAAmBhC,gBAAgBnC,GAY/C,IACEuJ,EACF4C,EAAYqB,eAAejE,EAAcU,EAAMjK,GAG/CmM,EAAY7B,aAAaL,EAAMjK,GAGjC7C,EAASqF,EAAUI,QACP,CAAZ,MAAOP,GAAK,CAlDb,CAbA,MAFC2H,GAAiBC,EAAMkC,EAkE1B,CAGDF,GAAa,0BAA2BE,EAAa,KA5GpD,CA6GF,EAOKsB,GAAqB,SAArBA,EAA+BC,GACnC,IAAIC,EACEC,EAAiBtC,GAAgBoC,GAKvC,IAFAzB,GAAa,0BAA2ByB,EAAU,MAE1CC,EAAaC,EAAeC,YAElC5B,GAAa,yBAA0B0B,EAAY,MAG/CrB,GAAkBqB,KAKlBA,EAAW1J,mBAAmBjB,GAChCyK,EAAmBE,EAAW1J,SAIhC6I,GAAoBa,IAItB1B,GAAa,yBAA0ByB,EAAU,KAClD,EA2SD,OAjSAlL,EAAUsL,SAAW,SAAUtD,GAAOjC,IAChC0C,EACA8C,EACA5B,EACA6B,EACAC,EALgC1F,yDAAM,CAAA,EAetC,IANJX,IAAkB4C,KAEhBA,EAAQ,eAIW,iBAAVA,IAAuBwB,GAAQxB,GAAQ,CAChD,GAA8B,mBAAnBA,EAAM7M,SAMTY,MAAAA,EAAgB,8BAJtB,GAAqB,iBADrBiM,EAAQA,EAAM7M,YAENY,MAAAA,EAAgB,kCAK3B,CAGD,IAAKiE,EAAUM,YAAa,CAC1B,GACiC,WAA/BpB,EAAOJ,EAAO4M,eACiB,mBAAxB5M,EAAO4M,aACd,CACA,GAAqB,iBAAV1D,EACT,OAAOlJ,EAAO4M,aAAa1D,GAG7B,GAAIwB,GAAQxB,GACV,OAAOlJ,EAAO4M,aAAa1D,EAAMV,UAEpC,CAED,OAAOU,CACR,CAeD,GAZKjE,IACH+B,GAAaC,GAIf/F,EAAUI,QAAU,GAGC,iBAAV4H,IACTxD,IAAW,GAGTA,IAEEwD,GAAAA,EAAMoB,SAAU,CAClB,IAAMtC,EAAUnK,GAAkBqL,EAAMoB,UACpC,IAAC3G,GAAaqE,IAAYvD,GAAYuD,GAClC/K,MAAAA,EACJ,0DAGL,OACI,GAAIiM,aAAiBtH,EAKI,KAD9B6K,GADA9C,EAAOV,GAAc,kBACDrG,cAAcQ,WAAW8F,GAAO,IACnC3H,UAA4C,SAA1BkL,EAAanC,UAGX,SAA1BmC,EAAanC,SADtBX,EAAO8C,EAKP9C,EAAKkD,YAAYJ,OAEd,CAGH,IAACtH,KACAJ,KACAC,KAEuB,IAAxBkE,EAAMvM,QAAQ,KAEPkG,OAAAA,IAAsBwC,GACzBxC,GAAmBjC,WAAWsI,GAC9BA,EAOF,KAHJS,EAAOV,GAAcC,IAIZ/D,OAAAA,GAAa,KAAOE,GAAsBvC,GAAY,EAEhE,CAGG6G,GAAQzE,IACVkD,GAAauB,EAAKmD,YAOpB,IAHMC,IAAAA,EAAe/C,GAAgBtE,GAAWwD,EAAQS,GAGhDkB,EAAckC,EAAaR,YAEJ,IAAzB1B,EAAYtJ,UAAkBsJ,IAAgB6B,GAK9C1B,GAAkBH,KAKlBA,EAAYlI,mBAAmBjB,GACjCyK,GAAmBtB,EAAYlI,SAIjC6I,GAAoBX,GAEpB6B,EAAU7B,GAMZ,GAHA6B,EAAU,KAGNhH,GACF,OAAOwD,EAIT,GAAI/D,GAAY,CACd,GAAIC,GAGKuE,IAFPgD,EAAazJ,GAAuB6G,KAAKJ,EAAK/G,eAEvC+G,EAAKmD,YAEVH,EAAWE,YAAYlD,EAAKmD,iBAG9BH,EAAahD,EAcf,OAXI5F,GAAaiJ,YAAcjJ,GAAakJ,iBAQ1CN,EAAavJ,GAAW2G,KAAKtI,EAAkBkL,GAAY,IAGtDA,CACR,CAEGO,IAAAA,EAAiBlI,GAAiB2E,EAAKnB,UAAYmB,EAAKD,UAsBrD7G,OAlBLmC,IACArB,GAAa,aACbgG,EAAK/G,eACL+G,EAAK/G,cAAcuK,SACnBxD,EAAK/G,cAAcuK,QAAQxE,MAC3B7L,EAAW4G,EAA0BiG,EAAK/G,cAAcuK,QAAQxE,QAEhEuE,EACE,aAAevD,EAAK/G,cAAcuK,QAAQxE,KAAO,MAAQuE,GAIzDnI,KACFmI,EAAiB1Q,EAAc0Q,EAAgB5N,GAAe,KAC9D4N,EAAiB1Q,EAAc0Q,EAAgB3N,GAAU,KACzD2N,EAAiB1Q,EAAc0Q,EAAgB1N,GAAa,MAGvDqD,IAAsBwC,GACzBxC,GAAmBjC,WAAWsM,GAC9BA,CACL,EAQDhM,EAAUkM,UAAY,SAAUnG,GAC9BD,GAAaC,GACbhC,IAAa,CACd,EAOD/D,EAAUmM,YAAc,WACtB1G,GAAS,KACT1B,IAAa,CACd,EAYD/D,EAAUoM,iBAAmB,SAAUC,EAAK9B,EAAM/M,GAE3CiI,IACHK,GAAa,CAAD,GAGd,IAAMsE,EAAQzN,GAAkB0P,GAC1BhC,EAAS1N,GAAkB4N,GACjC,OAAOJ,GAAkBC,EAAOC,EAAQ7M,EACzC,EASDwC,EAAUsM,QAAU,SAAU5C,EAAY6C,GACZ,mBAAjBA,IAIXnK,GAAMsH,GAActH,GAAMsH,IAAe,GACzC7O,EAAUuH,GAAMsH,GAAa6C,GAC9B,EAUDvM,EAAUwM,WAAa,SAAU9C,GAC/B,GAAItH,GAAMsH,GACR,OAAO/O,EAASyH,GAAMsH,GAEzB,EAQD1J,EAAUyM,YAAc,SAAU/C,GAC5BtH,GAAMsH,KACRtH,GAAMsH,GAAc,GAEvB,EAOD1J,EAAU0M,eAAiB,WACzBtK,GAAQ,CAAA,CACT,EAEMpC,CACR,CAEcD"}
|
|
1
|
+
{"version":3,"file":"purify.min.js","sources":["../src/utils.js","../src/tags.js","../src/attrs.js","../src/regexp.js","../src/purify.js"],"sourcesContent":["const {\n hasOwnProperty,\n setPrototypeOf,\n isFrozen,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n} = Object;\n\nlet { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports\nlet { apply, construct } = typeof Reflect !== 'undefined' && Reflect;\n\nif (!apply) {\n apply = function (fun, thisValue, args) {\n return fun.apply(thisValue, args);\n };\n}\n\nif (!freeze) {\n freeze = function (x) {\n return x;\n };\n}\n\nif (!seal) {\n seal = function (x) {\n return x;\n };\n}\n\nif (!construct) {\n construct = function (Func, args) {\n return new Func(...args);\n };\n}\n\nconst arrayForEach = unapply(Array.prototype.forEach);\nconst arrayIndexOf = unapply(Array.prototype.indexOf);\nconst arrayPop = unapply(Array.prototype.pop);\nconst arrayPush = unapply(Array.prototype.push);\nconst arraySlice = unapply(Array.prototype.slice);\n\nconst stringToLowerCase = unapply(String.prototype.toLowerCase);\nconst stringToString = unapply(String.prototype.toString);\nconst stringMatch = unapply(String.prototype.match);\nconst stringReplace = unapply(String.prototype.replace);\nconst stringIndexOf = unapply(String.prototype.indexOf);\nconst stringTrim = unapply(String.prototype.trim);\n\nconst regExpTest = unapply(RegExp.prototype.test);\n\nconst typeErrorCreate = unconstruct(TypeError);\n\nexport function unapply(func) {\n return (thisArg, ...args) => apply(func, thisArg, args);\n}\n\nexport function unconstruct(func) {\n return (...args) => construct(func, args);\n}\n\n/* Add properties to a lookup table */\nexport function addToSet(set, array, transformCaseFunc) {\n transformCaseFunc = transformCaseFunc ?? stringToLowerCase;\n if (setPrototypeOf) {\n // Make 'in' and truthy checks like Boolean(set.constructor)\n // independent of any properties defined on Object.prototype.\n // Prevent prototype setters from intercepting set as a this value.\n setPrototypeOf(set, null);\n }\n\n let l = array.length;\n while (l--) {\n let element = array[l];\n if (typeof element === 'string') {\n const lcElement = transformCaseFunc(element);\n if (lcElement !== element) {\n // Config presets (e.g. tags.js, attrs.js) are immutable.\n if (!isFrozen(array)) {\n array[l] = lcElement;\n }\n\n element = lcElement;\n }\n }\n\n set[element] = true;\n }\n\n return set;\n}\n\n/* Shallow clone an object */\nexport function clone(object) {\n const newObject = create(null);\n\n let property;\n for (property in object) {\n if (apply(hasOwnProperty, object, [property]) === true) {\n newObject[property] = object[property];\n }\n }\n\n return newObject;\n}\n\n/* IE10 doesn't support __lookupGetter__ so lets'\n * simulate it. It also automatically checks\n * if the prop is function or getter and behaves\n * accordingly. */\nfunction lookupGetter(object, prop) {\n while (object !== null) {\n const desc = getOwnPropertyDescriptor(object, prop);\n if (desc) {\n if (desc.get) {\n return unapply(desc.get);\n }\n\n if (typeof desc.value === 'function') {\n return unapply(desc.value);\n }\n }\n\n object = getPrototypeOf(object);\n }\n\n function fallbackValue(element) {\n console.warn('fallback value for', element);\n return null;\n }\n\n return fallbackValue;\n}\n\nexport {\n // Array\n arrayForEach,\n arrayIndexOf,\n arrayPop,\n arrayPush,\n arraySlice,\n // Object\n freeze,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n hasOwnProperty,\n isFrozen,\n setPrototypeOf,\n seal,\n // RegExp\n regExpTest,\n // String\n stringIndexOf,\n stringMatch,\n stringReplace,\n stringToLowerCase,\n stringToString,\n stringTrim,\n // Errors\n typeErrorCreate,\n // Other\n lookupGetter,\n};\n","import { freeze } from './utils.js';\n\nexport const html = freeze([\n 'a',\n 'abbr',\n 'acronym',\n 'address',\n 'area',\n 'article',\n 'aside',\n 'audio',\n 'b',\n 'bdi',\n 'bdo',\n 'big',\n 'blink',\n 'blockquote',\n 'body',\n 'br',\n 'button',\n 'canvas',\n 'caption',\n 'center',\n 'cite',\n 'code',\n 'col',\n 'colgroup',\n 'content',\n 'data',\n 'datalist',\n 'dd',\n 'decorator',\n 'del',\n 'details',\n 'dfn',\n 'dialog',\n 'dir',\n 'div',\n 'dl',\n 'dt',\n 'element',\n 'em',\n 'fieldset',\n 'figcaption',\n 'figure',\n 'font',\n 'footer',\n 'form',\n 'h1',\n 'h2',\n 'h3',\n 'h4',\n 'h5',\n 'h6',\n 'head',\n 'header',\n 'hgroup',\n 'hr',\n 'html',\n 'i',\n 'img',\n 'input',\n 'ins',\n 'kbd',\n 'label',\n 'legend',\n 'li',\n 'main',\n 'map',\n 'mark',\n 'marquee',\n 'menu',\n 'menuitem',\n 'meter',\n 'nav',\n 'nobr',\n 'ol',\n 'optgroup',\n 'option',\n 'output',\n 'p',\n 'picture',\n 'pre',\n 'progress',\n 'q',\n 'rp',\n 'rt',\n 'ruby',\n 's',\n 'samp',\n 'section',\n 'select',\n 'shadow',\n 'small',\n 'source',\n 'spacer',\n 'span',\n 'strike',\n 'strong',\n 'style',\n 'sub',\n 'summary',\n 'sup',\n 'table',\n 'tbody',\n 'td',\n 'template',\n 'textarea',\n 'tfoot',\n 'th',\n 'thead',\n 'time',\n 'tr',\n 'track',\n 'tt',\n 'u',\n 'ul',\n 'var',\n 'video',\n 'wbr',\n]);\n\n// SVG\nexport const svg = freeze([\n 'svg',\n 'a',\n 'altglyph',\n 'altglyphdef',\n 'altglyphitem',\n 'animatecolor',\n 'animatemotion',\n 'animatetransform',\n 'circle',\n 'clippath',\n 'defs',\n 'desc',\n 'ellipse',\n 'filter',\n 'font',\n 'g',\n 'glyph',\n 'glyphref',\n 'hkern',\n 'image',\n 'line',\n 'lineargradient',\n 'marker',\n 'mask',\n 'metadata',\n 'mpath',\n 'path',\n 'pattern',\n 'polygon',\n 'polyline',\n 'radialgradient',\n 'rect',\n 'stop',\n 'style',\n 'switch',\n 'symbol',\n 'text',\n 'textpath',\n 'title',\n 'tref',\n 'tspan',\n 'view',\n 'vkern',\n]);\n\nexport const svgFilters = freeze([\n 'feBlend',\n 'feColorMatrix',\n 'feComponentTransfer',\n 'feComposite',\n 'feConvolveMatrix',\n 'feDiffuseLighting',\n 'feDisplacementMap',\n 'feDistantLight',\n 'feFlood',\n 'feFuncA',\n 'feFuncB',\n 'feFuncG',\n 'feFuncR',\n 'feGaussianBlur',\n 'feImage',\n 'feMerge',\n 'feMergeNode',\n 'feMorphology',\n 'feOffset',\n 'fePointLight',\n 'feSpecularLighting',\n 'feSpotLight',\n 'feTile',\n 'feTurbulence',\n]);\n\n// List of SVG elements that are disallowed by default.\n// We still need to know them so that we can do namespace\n// checks properly in case one wants to add them to\n// allow-list.\nexport const svgDisallowed = freeze([\n 'animate',\n 'color-profile',\n 'cursor',\n 'discard',\n 'fedropshadow',\n 'font-face',\n 'font-face-format',\n 'font-face-name',\n 'font-face-src',\n 'font-face-uri',\n 'foreignobject',\n 'hatch',\n 'hatchpath',\n 'mesh',\n 'meshgradient',\n 'meshpatch',\n 'meshrow',\n 'missing-glyph',\n 'script',\n 'set',\n 'solidcolor',\n 'unknown',\n 'use',\n]);\n\nexport const mathMl = freeze([\n 'math',\n 'menclose',\n 'merror',\n 'mfenced',\n 'mfrac',\n 'mglyph',\n 'mi',\n 'mlabeledtr',\n 'mmultiscripts',\n 'mn',\n 'mo',\n 'mover',\n 'mpadded',\n 'mphantom',\n 'mroot',\n 'mrow',\n 'ms',\n 'mspace',\n 'msqrt',\n 'mstyle',\n 'msub',\n 'msup',\n 'msubsup',\n 'mtable',\n 'mtd',\n 'mtext',\n 'mtr',\n 'munder',\n 'munderover',\n]);\n\n// Similarly to SVG, we want to know all MathML elements,\n// even those that we disallow by default.\nexport const mathMlDisallowed = freeze([\n 'maction',\n 'maligngroup',\n 'malignmark',\n 'mlongdiv',\n 'mscarries',\n 'mscarry',\n 'msgroup',\n 'mstack',\n 'msline',\n 'msrow',\n 'semantics',\n 'annotation',\n 'annotation-xml',\n 'mprescripts',\n 'none',\n]);\n\nexport const text = freeze(['#text']);\n","import { freeze } from './utils.js';\n\nexport const html = freeze([\n 'accept',\n 'action',\n 'align',\n 'alt',\n 'autocapitalize',\n 'autocomplete',\n 'autopictureinpicture',\n 'autoplay',\n 'background',\n 'bgcolor',\n 'border',\n 'capture',\n 'cellpadding',\n 'cellspacing',\n 'checked',\n 'cite',\n 'class',\n 'clear',\n 'color',\n 'cols',\n 'colspan',\n 'controls',\n 'controlslist',\n 'coords',\n 'crossorigin',\n 'datetime',\n 'decoding',\n 'default',\n 'dir',\n 'disabled',\n 'disablepictureinpicture',\n 'disableremoteplayback',\n 'download',\n 'draggable',\n 'enctype',\n 'enterkeyhint',\n 'face',\n 'for',\n 'headers',\n 'height',\n 'hidden',\n 'high',\n 'href',\n 'hreflang',\n 'id',\n 'inputmode',\n 'integrity',\n 'ismap',\n 'kind',\n 'label',\n 'lang',\n 'list',\n 'loading',\n 'loop',\n 'low',\n 'max',\n 'maxlength',\n 'media',\n 'method',\n 'min',\n 'minlength',\n 'multiple',\n 'muted',\n 'name',\n 'nonce',\n 'noshade',\n 'novalidate',\n 'nowrap',\n 'open',\n 'optimum',\n 'pattern',\n 'placeholder',\n 'playsinline',\n 'poster',\n 'preload',\n 'pubdate',\n 'radiogroup',\n 'readonly',\n 'rel',\n 'required',\n 'rev',\n 'reversed',\n 'role',\n 'rows',\n 'rowspan',\n 'spellcheck',\n 'scope',\n 'selected',\n 'shape',\n 'size',\n 'sizes',\n 'span',\n 'srclang',\n 'start',\n 'src',\n 'srcset',\n 'step',\n 'style',\n 'summary',\n 'tabindex',\n 'title',\n 'translate',\n 'type',\n 'usemap',\n 'valign',\n 'value',\n 'width',\n 'xmlns',\n 'slot',\n]);\n\nexport const svg = freeze([\n 'accent-height',\n 'accumulate',\n 'additive',\n 'alignment-baseline',\n 'ascent',\n 'attributename',\n 'attributetype',\n 'azimuth',\n 'basefrequency',\n 'baseline-shift',\n 'begin',\n 'bias',\n 'by',\n 'class',\n 'clip',\n 'clippathunits',\n 'clip-path',\n 'clip-rule',\n 'color',\n 'color-interpolation',\n 'color-interpolation-filters',\n 'color-profile',\n 'color-rendering',\n 'cx',\n 'cy',\n 'd',\n 'dx',\n 'dy',\n 'diffuseconstant',\n 'direction',\n 'display',\n 'divisor',\n 'dur',\n 'edgemode',\n 'elevation',\n 'end',\n 'fill',\n 'fill-opacity',\n 'fill-rule',\n 'filter',\n 'filterunits',\n 'flood-color',\n 'flood-opacity',\n 'font-family',\n 'font-size',\n 'font-size-adjust',\n 'font-stretch',\n 'font-style',\n 'font-variant',\n 'font-weight',\n 'fx',\n 'fy',\n 'g1',\n 'g2',\n 'glyph-name',\n 'glyphref',\n 'gradientunits',\n 'gradienttransform',\n 'height',\n 'href',\n 'id',\n 'image-rendering',\n 'in',\n 'in2',\n 'k',\n 'k1',\n 'k2',\n 'k3',\n 'k4',\n 'kerning',\n 'keypoints',\n 'keysplines',\n 'keytimes',\n 'lang',\n 'lengthadjust',\n 'letter-spacing',\n 'kernelmatrix',\n 'kernelunitlength',\n 'lighting-color',\n 'local',\n 'marker-end',\n 'marker-mid',\n 'marker-start',\n 'markerheight',\n 'markerunits',\n 'markerwidth',\n 'maskcontentunits',\n 'maskunits',\n 'max',\n 'mask',\n 'media',\n 'method',\n 'mode',\n 'min',\n 'name',\n 'numoctaves',\n 'offset',\n 'operator',\n 'opacity',\n 'order',\n 'orient',\n 'orientation',\n 'origin',\n 'overflow',\n 'paint-order',\n 'path',\n 'pathlength',\n 'patterncontentunits',\n 'patterntransform',\n 'patternunits',\n 'points',\n 'preservealpha',\n 'preserveaspectratio',\n 'primitiveunits',\n 'r',\n 'rx',\n 'ry',\n 'radius',\n 'refx',\n 'refy',\n 'repeatcount',\n 'repeatdur',\n 'restart',\n 'result',\n 'rotate',\n 'scale',\n 'seed',\n 'shape-rendering',\n 'specularconstant',\n 'specularexponent',\n 'spreadmethod',\n 'startoffset',\n 'stddeviation',\n 'stitchtiles',\n 'stop-color',\n 'stop-opacity',\n 'stroke-dasharray',\n 'stroke-dashoffset',\n 'stroke-linecap',\n 'stroke-linejoin',\n 'stroke-miterlimit',\n 'stroke-opacity',\n 'stroke',\n 'stroke-width',\n 'style',\n 'surfacescale',\n 'systemlanguage',\n 'tabindex',\n 'targetx',\n 'targety',\n 'transform',\n 'transform-origin',\n 'text-anchor',\n 'text-decoration',\n 'text-rendering',\n 'textlength',\n 'type',\n 'u1',\n 'u2',\n 'unicode',\n 'values',\n 'viewbox',\n 'visibility',\n 'version',\n 'vert-adv-y',\n 'vert-origin-x',\n 'vert-origin-y',\n 'width',\n 'word-spacing',\n 'wrap',\n 'writing-mode',\n 'xchannelselector',\n 'ychannelselector',\n 'x',\n 'x1',\n 'x2',\n 'xmlns',\n 'y',\n 'y1',\n 'y2',\n 'z',\n 'zoomandpan',\n]);\n\nexport const mathMl = freeze([\n 'accent',\n 'accentunder',\n 'align',\n 'bevelled',\n 'close',\n 'columnsalign',\n 'columnlines',\n 'columnspan',\n 'denomalign',\n 'depth',\n 'dir',\n 'display',\n 'displaystyle',\n 'encoding',\n 'fence',\n 'frame',\n 'height',\n 'href',\n 'id',\n 'largeop',\n 'length',\n 'linethickness',\n 'lspace',\n 'lquote',\n 'mathbackground',\n 'mathcolor',\n 'mathsize',\n 'mathvariant',\n 'maxsize',\n 'minsize',\n 'movablelimits',\n 'notation',\n 'numalign',\n 'open',\n 'rowalign',\n 'rowlines',\n 'rowspacing',\n 'rowspan',\n 'rspace',\n 'rquote',\n 'scriptlevel',\n 'scriptminsize',\n 'scriptsizemultiplier',\n 'selection',\n 'separator',\n 'separators',\n 'stretchy',\n 'subscriptshift',\n 'supscriptshift',\n 'symmetric',\n 'voffset',\n 'width',\n 'xmlns',\n]);\n\nexport const xml = freeze([\n 'xlink:href',\n 'xml:id',\n 'xlink:title',\n 'xml:space',\n 'xmlns:xlink',\n]);\n","import { seal } from './utils.js';\n\n// eslint-disable-next-line unicorn/better-regex\nexport const MUSTACHE_EXPR = seal(/\\{\\{[\\w\\W]*|[\\w\\W]*\\}\\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode\nexport const ERB_EXPR = seal(/<%[\\w\\W]*|[\\w\\W]*%>/gm);\nexport const TMPLIT_EXPR = seal(/\\${[\\w\\W]*}/gm);\nexport const DATA_ATTR = seal(/^data-[\\-\\w.\\u00B7-\\uFFFF]/); // eslint-disable-line no-useless-escape\nexport const ARIA_ATTR = seal(/^aria-[\\-\\w]+$/); // eslint-disable-line no-useless-escape\nexport const IS_ALLOWED_URI = seal(\n /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\\-]+(?:[^a-z+.\\-:]|$))/i // eslint-disable-line no-useless-escape\n);\nexport const IS_SCRIPT_OR_DATA = seal(/^(?:\\w+script|data):/i);\nexport const ATTR_WHITESPACE = seal(\n /[\\u0000-\\u0020\\u00A0\\u1680\\u180E\\u2000-\\u2029\\u205F\\u3000]/g // eslint-disable-line no-control-regex\n);\nexport const DOCTYPE_NAME = seal(/^html$/i);\n","import * as TAGS from './tags.js';\nimport * as ATTRS from './attrs.js';\nimport * as EXPRESSIONS from './regexp.js';\nimport {\n addToSet,\n clone,\n freeze,\n arrayForEach,\n arrayPop,\n arrayPush,\n stringMatch,\n stringReplace,\n stringToLowerCase,\n stringToString,\n stringIndexOf,\n stringTrim,\n regExpTest,\n typeErrorCreate,\n lookupGetter,\n} from './utils.js';\n\nconst getGlobal = () => (typeof window === 'undefined' ? null : window);\n\n/**\n * Creates a no-op policy for internal use only.\n * Don't export this function outside this module!\n * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.\n * @param {Document} document The document object (to determine policy name suffix)\n * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types\n * are not supported).\n */\nconst _createTrustedTypesPolicy = function (trustedTypes, document) {\n if (\n typeof trustedTypes !== 'object' ||\n typeof trustedTypes.createPolicy !== 'function'\n ) {\n return null;\n }\n\n // Allow the callers to control the unique policy name\n // by adding a data-tt-policy-suffix to the script element with the DOMPurify.\n // Policy creation with duplicate names throws in Trusted Types.\n let suffix = null;\n const ATTR_NAME = 'data-tt-policy-suffix';\n if (\n document.currentScript &&\n document.currentScript.hasAttribute(ATTR_NAME)\n ) {\n suffix = document.currentScript.getAttribute(ATTR_NAME);\n }\n\n const policyName = 'dompurify' + (suffix ? '#' + suffix : '');\n\n try {\n return trustedTypes.createPolicy(policyName, {\n createHTML(html) {\n return html;\n },\n createScriptURL(scriptUrl) {\n return scriptUrl;\n },\n });\n } catch (_) {\n // Policy creation failed (most likely another DOMPurify script has\n // already run). Skip creating the policy, as this will only cause errors\n // if TT are enforced.\n console.warn(\n 'TrustedTypes policy ' + policyName + ' could not be created.'\n );\n return null;\n }\n};\n\nfunction createDOMPurify(window = getGlobal()) {\n const DOMPurify = (root) => createDOMPurify(root);\n\n /**\n * Version label, exposed for easier checks\n * if DOMPurify is up to date or not\n */\n DOMPurify.version = VERSION;\n\n /**\n * Array of elements that DOMPurify removed during sanitation.\n * Empty if nothing was removed.\n */\n DOMPurify.removed = [];\n\n if (!window || !window.document || window.document.nodeType !== 9) {\n // Not running in a browser, provide a factory function\n // so that you can pass your own Window\n DOMPurify.isSupported = false;\n\n return DOMPurify;\n }\n\n const originalDocument = window.document;\n\n let { document } = window;\n const {\n DocumentFragment,\n HTMLTemplateElement,\n Node,\n Element,\n NodeFilter,\n NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,\n HTMLFormElement,\n DOMParser,\n trustedTypes,\n } = window;\n\n const ElementPrototype = Element.prototype;\n\n const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');\n const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');\n const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');\n const getParentNode = lookupGetter(ElementPrototype, 'parentNode');\n\n // As per issue #47, the web-components registry is inherited by a\n // new document created via createHTMLDocument. As per the spec\n // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)\n // a new empty registry is used when creating a template contents owner\n // document, so we use that as our parent document to ensure nothing\n // is inherited.\n if (typeof HTMLTemplateElement === 'function') {\n const template = document.createElement('template');\n if (template.content && template.content.ownerDocument) {\n document = template.content.ownerDocument;\n }\n }\n\n const trustedTypesPolicy = _createTrustedTypesPolicy(\n trustedTypes,\n originalDocument\n );\n const emptyHTML = trustedTypesPolicy ? trustedTypesPolicy.createHTML('') : '';\n\n const {\n implementation,\n createNodeIterator,\n createDocumentFragment,\n getElementsByTagName,\n } = document;\n const { importNode } = originalDocument;\n\n let documentMode = {};\n try {\n documentMode = clone(document).documentMode ? document.documentMode : {};\n } catch (_) {}\n\n let hooks = {};\n\n /**\n * Expose whether this browser supports running the full DOMPurify.\n */\n DOMPurify.isSupported =\n typeof getParentNode === 'function' &&\n implementation &&\n implementation.createHTMLDocument !== undefined &&\n documentMode !== 9;\n\n const {\n MUSTACHE_EXPR,\n ERB_EXPR,\n TMPLIT_EXPR,\n DATA_ATTR,\n ARIA_ATTR,\n IS_SCRIPT_OR_DATA,\n ATTR_WHITESPACE,\n } = EXPRESSIONS;\n\n let { IS_ALLOWED_URI } = EXPRESSIONS;\n\n /**\n * We consider the elements and attributes below to be safe. Ideally\n * don't add any new ones but feel free to remove unwanted ones.\n */\n\n /* allowed element names */\n let ALLOWED_TAGS = null;\n const DEFAULT_ALLOWED_TAGS = addToSet({}, [\n ...TAGS.html,\n ...TAGS.svg,\n ...TAGS.svgFilters,\n ...TAGS.mathMl,\n ...TAGS.text,\n ]);\n\n /* Allowed attribute names */\n let ALLOWED_ATTR = null;\n const DEFAULT_ALLOWED_ATTR = addToSet({}, [\n ...ATTRS.html,\n ...ATTRS.svg,\n ...ATTRS.mathMl,\n ...ATTRS.xml,\n ]);\n\n /*\n * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.\n * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)\n * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)\n * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.\n */\n let CUSTOM_ELEMENT_HANDLING = Object.seal(\n Object.create(null, {\n tagNameCheck: {\n writable: true,\n configurable: false,\n enumerable: true,\n value: null,\n },\n attributeNameCheck: {\n writable: true,\n configurable: false,\n enumerable: true,\n value: null,\n },\n allowCustomizedBuiltInElements: {\n writable: true,\n configurable: false,\n enumerable: true,\n value: false,\n },\n })\n );\n\n /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */\n let FORBID_TAGS = null;\n\n /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */\n let FORBID_ATTR = null;\n\n /* Decide if ARIA attributes are okay */\n let ALLOW_ARIA_ATTR = true;\n\n /* Decide if custom data attributes are okay */\n let ALLOW_DATA_ATTR = true;\n\n /* Decide if unknown protocols are okay */\n let ALLOW_UNKNOWN_PROTOCOLS = false;\n\n /* Decide if self-closing tags in attributes are allowed.\n * Usually removed due to a mXSS issue in jQuery 3.0 */\n let ALLOW_SELF_CLOSE_IN_ATTR = true;\n\n /* Output should be safe for common template engines.\n * This means, DOMPurify removes data attributes, mustaches and ERB\n */\n let SAFE_FOR_TEMPLATES = false;\n\n /* Decide if document with <html>... should be returned */\n let WHOLE_DOCUMENT = false;\n\n /* Track whether config is already set on this instance of DOMPurify. */\n let SET_CONFIG = false;\n\n /* Decide if all elements (e.g. style, script) must be children of\n * document.body. By default, browsers might move them to document.head */\n let FORCE_BODY = false;\n\n /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html\n * string (or a TrustedHTML object if Trusted Types are supported).\n * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead\n */\n let RETURN_DOM = false;\n\n /* Decide if a DOM `DocumentFragment` should be returned, instead of a html\n * string (or a TrustedHTML object if Trusted Types are supported) */\n let RETURN_DOM_FRAGMENT = false;\n\n /* Try to return a Trusted Type object instead of a string, return a string in\n * case Trusted Types are not supported */\n let RETURN_TRUSTED_TYPE = false;\n\n /* Output should be free from DOM clobbering attacks?\n * This sanitizes markups named with colliding, clobberable built-in DOM APIs.\n */\n let SANITIZE_DOM = true;\n\n /* Achieve full DOM Clobbering protection by isolating the namespace of named\n * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.\n *\n * HTML/DOM spec rules that enable DOM Clobbering:\n * - Named Access on Window (§7.3.3)\n * - DOM Tree Accessors (§3.1.5)\n * - Form Element Parent-Child Relations (§4.10.3)\n * - Iframe srcdoc / Nested WindowProxies (§4.8.5)\n * - HTMLCollection (§4.2.10.2)\n *\n * Namespace isolation is implemented by prefixing `id` and `name` attributes\n * with a constant string, i.e., `user-content-`\n */\n let SANITIZE_NAMED_PROPS = false;\n const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';\n\n /* Keep element content when removing element? */\n let KEEP_CONTENT = true;\n\n /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead\n * of importing it into a new Document and returning a sanitized copy */\n let IN_PLACE = false;\n\n /* Allow usage of profiles like html, svg and mathMl */\n let USE_PROFILES = {};\n\n /* Tags to ignore content of when KEEP_CONTENT is true */\n let FORBID_CONTENTS = null;\n const DEFAULT_FORBID_CONTENTS = addToSet({}, [\n 'annotation-xml',\n 'audio',\n 'colgroup',\n 'desc',\n 'foreignobject',\n 'head',\n 'iframe',\n 'math',\n 'mi',\n 'mn',\n 'mo',\n 'ms',\n 'mtext',\n 'noembed',\n 'noframes',\n 'noscript',\n 'plaintext',\n 'script',\n 'style',\n 'svg',\n 'template',\n 'thead',\n 'title',\n 'video',\n 'xmp',\n ]);\n\n /* Tags that are safe for data: URIs */\n let DATA_URI_TAGS = null;\n const DEFAULT_DATA_URI_TAGS = addToSet({}, [\n 'audio',\n 'video',\n 'img',\n 'source',\n 'image',\n 'track',\n ]);\n\n /* Attributes safe for values like \"javascript:\" */\n let URI_SAFE_ATTRIBUTES = null;\n const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, [\n 'alt',\n 'class',\n 'for',\n 'id',\n 'label',\n 'name',\n 'pattern',\n 'placeholder',\n 'role',\n 'summary',\n 'title',\n 'value',\n 'style',\n 'xmlns',\n ]);\n\n const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';\n const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';\n const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';\n /* Document namespace */\n let NAMESPACE = HTML_NAMESPACE;\n let IS_EMPTY_INPUT = false;\n\n /* Allowed XHTML+XML namespaces */\n let ALLOWED_NAMESPACES = null;\n const DEFAULT_ALLOWED_NAMESPACES = addToSet(\n {},\n [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE],\n stringToString\n );\n\n /* Parsing of strict XHTML documents */\n let PARSER_MEDIA_TYPE;\n const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];\n const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';\n let transformCaseFunc;\n\n /* Keep a reference to config to pass to hooks */\n let CONFIG = null;\n\n /* Ideally, do not touch anything below this line */\n /* ______________________________________________ */\n\n const formElement = document.createElement('form');\n\n const isRegexOrFunction = function (testValue) {\n return testValue instanceof RegExp || testValue instanceof Function;\n };\n\n /**\n * _parseConfig\n *\n * @param {Object} cfg optional config literal\n */\n // eslint-disable-next-line complexity\n const _parseConfig = function (cfg) {\n if (CONFIG && CONFIG === cfg) {\n return;\n }\n\n /* Shield configuration object from tampering */\n if (!cfg || typeof cfg !== 'object') {\n cfg = {};\n }\n\n /* Shield configuration object from prototype pollution */\n cfg = clone(cfg);\n\n PARSER_MEDIA_TYPE =\n // eslint-disable-next-line unicorn/prefer-includes\n SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1\n ? (PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE)\n : (PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE);\n\n // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.\n transformCaseFunc =\n PARSER_MEDIA_TYPE === 'application/xhtml+xml'\n ? stringToString\n : stringToLowerCase;\n\n /* Set configuration parameters */\n ALLOWED_TAGS =\n 'ALLOWED_TAGS' in cfg\n ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc)\n : DEFAULT_ALLOWED_TAGS;\n ALLOWED_ATTR =\n 'ALLOWED_ATTR' in cfg\n ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc)\n : DEFAULT_ALLOWED_ATTR;\n ALLOWED_NAMESPACES =\n 'ALLOWED_NAMESPACES' in cfg\n ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString)\n : DEFAULT_ALLOWED_NAMESPACES;\n URI_SAFE_ATTRIBUTES =\n 'ADD_URI_SAFE_ATTR' in cfg\n ? addToSet(\n clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent\n cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent\n transformCaseFunc // eslint-disable-line indent\n ) // eslint-disable-line indent\n : DEFAULT_URI_SAFE_ATTRIBUTES;\n DATA_URI_TAGS =\n 'ADD_DATA_URI_TAGS' in cfg\n ? addToSet(\n clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent\n cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent\n transformCaseFunc // eslint-disable-line indent\n ) // eslint-disable-line indent\n : DEFAULT_DATA_URI_TAGS;\n FORBID_CONTENTS =\n 'FORBID_CONTENTS' in cfg\n ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc)\n : DEFAULT_FORBID_CONTENTS;\n FORBID_TAGS =\n 'FORBID_TAGS' in cfg\n ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc)\n : {};\n FORBID_ATTR =\n 'FORBID_ATTR' in cfg\n ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc)\n : {};\n USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;\n ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true\n ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true\n ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false\n ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true\n SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false\n WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false\n RETURN_DOM = cfg.RETURN_DOM || false; // Default false\n RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false\n RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false\n FORCE_BODY = cfg.FORCE_BODY || false; // Default false\n SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true\n SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false\n KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true\n IN_PLACE = cfg.IN_PLACE || false; // Default false\n IS_ALLOWED_URI = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;\n NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;\n CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};\n if (\n cfg.CUSTOM_ELEMENT_HANDLING &&\n isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)\n ) {\n CUSTOM_ELEMENT_HANDLING.tagNameCheck =\n cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;\n }\n\n if (\n cfg.CUSTOM_ELEMENT_HANDLING &&\n isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)\n ) {\n CUSTOM_ELEMENT_HANDLING.attributeNameCheck =\n cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;\n }\n\n if (\n cfg.CUSTOM_ELEMENT_HANDLING &&\n typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements ===\n 'boolean'\n ) {\n CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements =\n cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;\n }\n\n if (SAFE_FOR_TEMPLATES) {\n ALLOW_DATA_ATTR = false;\n }\n\n if (RETURN_DOM_FRAGMENT) {\n RETURN_DOM = true;\n }\n\n /* Parse profile info */\n if (USE_PROFILES) {\n ALLOWED_TAGS = addToSet({}, [...TAGS.text]);\n ALLOWED_ATTR = [];\n if (USE_PROFILES.html === true) {\n addToSet(ALLOWED_TAGS, TAGS.html);\n addToSet(ALLOWED_ATTR, ATTRS.html);\n }\n\n if (USE_PROFILES.svg === true) {\n addToSet(ALLOWED_TAGS, TAGS.svg);\n addToSet(ALLOWED_ATTR, ATTRS.svg);\n addToSet(ALLOWED_ATTR, ATTRS.xml);\n }\n\n if (USE_PROFILES.svgFilters === true) {\n addToSet(ALLOWED_TAGS, TAGS.svgFilters);\n addToSet(ALLOWED_ATTR, ATTRS.svg);\n addToSet(ALLOWED_ATTR, ATTRS.xml);\n }\n\n if (USE_PROFILES.mathMl === true) {\n addToSet(ALLOWED_TAGS, TAGS.mathMl);\n addToSet(ALLOWED_ATTR, ATTRS.mathMl);\n addToSet(ALLOWED_ATTR, ATTRS.xml);\n }\n }\n\n /* Merge configuration parameters */\n if (cfg.ADD_TAGS) {\n if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {\n ALLOWED_TAGS = clone(ALLOWED_TAGS);\n }\n\n addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);\n }\n\n if (cfg.ADD_ATTR) {\n if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {\n ALLOWED_ATTR = clone(ALLOWED_ATTR);\n }\n\n addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);\n }\n\n if (cfg.ADD_URI_SAFE_ATTR) {\n addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);\n }\n\n if (cfg.FORBID_CONTENTS) {\n if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {\n FORBID_CONTENTS = clone(FORBID_CONTENTS);\n }\n\n addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);\n }\n\n /* Add #text in case KEEP_CONTENT is set to true */\n if (KEEP_CONTENT) {\n ALLOWED_TAGS['#text'] = true;\n }\n\n /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */\n if (WHOLE_DOCUMENT) {\n addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);\n }\n\n /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */\n if (ALLOWED_TAGS.table) {\n addToSet(ALLOWED_TAGS, ['tbody']);\n delete FORBID_TAGS.tbody;\n }\n\n // Prevent further manipulation of configuration.\n // Not available in IE8, Safari 5, etc.\n if (freeze) {\n freeze(cfg);\n }\n\n CONFIG = cfg;\n };\n\n const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [\n 'mi',\n 'mo',\n 'mn',\n 'ms',\n 'mtext',\n ]);\n\n const HTML_INTEGRATION_POINTS = addToSet({}, [\n 'foreignobject',\n 'desc',\n 'title',\n 'annotation-xml',\n ]);\n\n // Certain elements are allowed in both SVG and HTML\n // namespace. We need to specify them explicitly\n // so that they don't get erroneously deleted from\n // HTML namespace.\n const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, [\n 'title',\n 'style',\n 'font',\n 'a',\n 'script',\n ]);\n\n /* Keep track of all possible SVG and MathML tags\n * so that we can perform the namespace checks\n * correctly. */\n const ALL_SVG_TAGS = addToSet({}, TAGS.svg);\n addToSet(ALL_SVG_TAGS, TAGS.svgFilters);\n addToSet(ALL_SVG_TAGS, TAGS.svgDisallowed);\n\n const ALL_MATHML_TAGS = addToSet({}, TAGS.mathMl);\n addToSet(ALL_MATHML_TAGS, TAGS.mathMlDisallowed);\n\n /**\n *\n *\n * @param {Element} element a DOM element whose namespace is being checked\n * @returns {boolean} Return false if the element has a\n * namespace that a spec-compliant parser would never\n * return. Return true otherwise.\n */\n const _checkValidNamespace = function (element) {\n let parent = getParentNode(element);\n\n // In JSDOM, if we're inside shadow DOM, then parentNode\n // can be null. We just simulate parent in this case.\n if (!parent || !parent.tagName) {\n parent = {\n namespaceURI: NAMESPACE,\n tagName: 'template',\n };\n }\n\n const tagName = stringToLowerCase(element.tagName);\n const parentTagName = stringToLowerCase(parent.tagName);\n\n if (!ALLOWED_NAMESPACES[element.namespaceURI]) {\n return false;\n }\n\n if (element.namespaceURI === SVG_NAMESPACE) {\n // The only way to switch from HTML namespace to SVG\n // is via <svg>. If it happens via any other tag, then\n // it should be killed.\n if (parent.namespaceURI === HTML_NAMESPACE) {\n return tagName === 'svg';\n }\n\n // The only way to switch from MathML to SVG is via`\n // svg if parent is either <annotation-xml> or MathML\n // text integration points.\n if (parent.namespaceURI === MATHML_NAMESPACE) {\n return (\n tagName === 'svg' &&\n (parentTagName === 'annotation-xml' ||\n MATHML_TEXT_INTEGRATION_POINTS[parentTagName])\n );\n }\n\n // We only allow elements that are defined in SVG\n // spec. All others are disallowed in SVG namespace.\n return Boolean(ALL_SVG_TAGS[tagName]);\n }\n\n if (element.namespaceURI === MATHML_NAMESPACE) {\n // The only way to switch from HTML namespace to MathML\n // is via <math>. If it happens via any other tag, then\n // it should be killed.\n if (parent.namespaceURI === HTML_NAMESPACE) {\n return tagName === 'math';\n }\n\n // The only way to switch from SVG to MathML is via\n // <math> and HTML integration points\n if (parent.namespaceURI === SVG_NAMESPACE) {\n return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];\n }\n\n // We only allow elements that are defined in MathML\n // spec. All others are disallowed in MathML namespace.\n return Boolean(ALL_MATHML_TAGS[tagName]);\n }\n\n if (element.namespaceURI === HTML_NAMESPACE) {\n // The only way to switch from SVG to HTML is via\n // HTML integration points, and from MathML to HTML\n // is via MathML text integration points\n if (\n parent.namespaceURI === SVG_NAMESPACE &&\n !HTML_INTEGRATION_POINTS[parentTagName]\n ) {\n return false;\n }\n\n if (\n parent.namespaceURI === MATHML_NAMESPACE &&\n !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]\n ) {\n return false;\n }\n\n // We disallow tags that are specific for MathML\n // or SVG and should never appear in HTML namespace\n return (\n !ALL_MATHML_TAGS[tagName] &&\n (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName])\n );\n }\n\n // For XHTML and XML documents that support custom namespaces\n if (\n PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&\n ALLOWED_NAMESPACES[element.namespaceURI]\n ) {\n return true;\n }\n\n // The code should never reach this place (this means\n // that the element somehow got namespace that is not\n // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).\n // Return false just in case.\n return false;\n };\n\n /**\n * _forceRemove\n *\n * @param {Node} node a DOM node\n */\n const _forceRemove = function (node) {\n arrayPush(DOMPurify.removed, { element: node });\n try {\n // eslint-disable-next-line unicorn/prefer-dom-node-remove\n node.parentNode.removeChild(node);\n } catch (_) {\n try {\n node.outerHTML = emptyHTML;\n } catch (_) {\n node.remove();\n }\n }\n };\n\n /**\n * _removeAttribute\n *\n * @param {String} name an Attribute name\n * @param {Node} node a DOM node\n */\n const _removeAttribute = function (name, node) {\n try {\n arrayPush(DOMPurify.removed, {\n attribute: node.getAttributeNode(name),\n from: node,\n });\n } catch (_) {\n arrayPush(DOMPurify.removed, {\n attribute: null,\n from: node,\n });\n }\n\n node.removeAttribute(name);\n\n // We void attribute values for unremovable \"is\"\" attributes\n if (name === 'is' && !ALLOWED_ATTR[name]) {\n if (RETURN_DOM || RETURN_DOM_FRAGMENT) {\n try {\n _forceRemove(node);\n } catch (_) {}\n } else {\n try {\n node.setAttribute(name, '');\n } catch (_) {}\n }\n }\n };\n\n /**\n * _initDocument\n *\n * @param {String} dirty a string of dirty markup\n * @return {Document} a DOM, filled with the dirty markup\n */\n const _initDocument = function (dirty) {\n /* Create a HTML document */\n let doc;\n let leadingWhitespace;\n\n if (FORCE_BODY) {\n dirty = '<remove></remove>' + dirty;\n } else {\n /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */\n const matches = stringMatch(dirty, /^[\\r\\n\\t ]+/);\n leadingWhitespace = matches && matches[0];\n }\n\n if (\n PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&\n NAMESPACE === HTML_NAMESPACE\n ) {\n // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)\n dirty =\n '<html xmlns=\"http://www.w3.org/1999/xhtml\"><head></head><body>' +\n dirty +\n '</body></html>';\n }\n\n const dirtyPayload = trustedTypesPolicy\n ? trustedTypesPolicy.createHTML(dirty)\n : dirty;\n /*\n * Use the DOMParser API by default, fallback later if needs be\n * DOMParser not work for svg when has multiple root element.\n */\n if (NAMESPACE === HTML_NAMESPACE) {\n try {\n doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);\n } catch (_) {}\n }\n\n /* Use createHTMLDocument in case DOMParser is not available */\n if (!doc || !doc.documentElement) {\n doc = implementation.createDocument(NAMESPACE, 'template', null);\n try {\n doc.documentElement.innerHTML = IS_EMPTY_INPUT\n ? emptyHTML\n : dirtyPayload;\n } catch (_) {\n // Syntax error if dirtyPayload is invalid xml\n }\n }\n\n const body = doc.body || doc.documentElement;\n\n if (dirty && leadingWhitespace) {\n body.insertBefore(\n document.createTextNode(leadingWhitespace),\n body.childNodes[0] || null\n );\n }\n\n /* Work on whole document or just its body */\n if (NAMESPACE === HTML_NAMESPACE) {\n return getElementsByTagName.call(\n doc,\n WHOLE_DOCUMENT ? 'html' : 'body'\n )[0];\n }\n\n return WHOLE_DOCUMENT ? doc.documentElement : body;\n };\n\n /**\n * _createIterator\n *\n * @param {Document} root document/fragment to create iterator for\n * @return {Iterator} iterator instance\n */\n const _createIterator = function (root) {\n return createNodeIterator.call(\n root.ownerDocument || root,\n root,\n // eslint-disable-next-line no-bitwise\n NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT,\n null,\n false\n );\n };\n\n /**\n * _isClobbered\n *\n * @param {Node} elm element to check for clobbering attacks\n * @return {Boolean} true if clobbered, false if safe\n */\n const _isClobbered = function (elm) {\n return (\n elm instanceof HTMLFormElement &&\n (typeof elm.nodeName !== 'string' ||\n typeof elm.textContent !== 'string' ||\n typeof elm.removeChild !== 'function' ||\n !(elm.attributes instanceof NamedNodeMap) ||\n typeof elm.removeAttribute !== 'function' ||\n typeof elm.setAttribute !== 'function' ||\n typeof elm.namespaceURI !== 'string' ||\n typeof elm.insertBefore !== 'function' ||\n typeof elm.hasChildNodes !== 'function')\n );\n };\n\n /**\n * _isNode\n *\n * @param {Node} obj object to check whether it's a DOM node\n * @return {Boolean} true is object is a DOM node\n */\n const _isNode = function (object) {\n return typeof Node === 'object'\n ? object instanceof Node\n : object &&\n typeof object === 'object' &&\n typeof object.nodeType === 'number' &&\n typeof object.nodeName === 'string';\n };\n\n /**\n * _executeHook\n * Execute user configurable hooks\n *\n * @param {String} entryPoint Name of the hook's entry point\n * @param {Node} currentNode node to work on with the hook\n * @param {Object} data additional hook parameters\n */\n const _executeHook = function (entryPoint, currentNode, data) {\n if (!hooks[entryPoint]) {\n return;\n }\n\n arrayForEach(hooks[entryPoint], (hook) => {\n hook.call(DOMPurify, currentNode, data, CONFIG);\n });\n };\n\n /**\n * _sanitizeElements\n *\n * @protect nodeName\n * @protect textContent\n * @protect removeChild\n *\n * @param {Node} currentNode to check for permission to exist\n * @return {Boolean} true if node was killed, false if left alive\n */\n const _sanitizeElements = function (currentNode) {\n let content;\n\n /* Execute a hook if present */\n _executeHook('beforeSanitizeElements', currentNode, null);\n\n /* Check if element is clobbered or can clobber */\n if (_isClobbered(currentNode)) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Check if tagname contains Unicode */\n if (regExpTest(/[\\u0080-\\uFFFF]/, currentNode.nodeName)) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Now let's check the element's type and name */\n const tagName = transformCaseFunc(currentNode.nodeName);\n\n /* Execute a hook if present */\n _executeHook('uponSanitizeElement', currentNode, {\n tagName,\n allowedTags: ALLOWED_TAGS,\n });\n\n /* Detect mXSS attempts abusing namespace confusion */\n if (\n currentNode.hasChildNodes() &&\n !_isNode(currentNode.firstElementChild) &&\n (!_isNode(currentNode.content) ||\n !_isNode(currentNode.content.firstElementChild)) &&\n regExpTest(/<[/\\w]/g, currentNode.innerHTML) &&\n regExpTest(/<[/\\w]/g, currentNode.textContent)\n ) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Mitigate a problem with templates inside select */\n if (\n tagName === 'select' &&\n regExpTest(/<template/i, currentNode.innerHTML)\n ) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Remove element if anything forbids its presence */\n if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {\n /* Check if we have a custom element to handle */\n if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {\n if (\n CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)\n )\n return false;\n if (\n CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)\n )\n return false;\n }\n\n /* Keep content except for bad-listed elements */\n if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {\n const parentNode = getParentNode(currentNode) || currentNode.parentNode;\n const childNodes = getChildNodes(currentNode) || currentNode.childNodes;\n\n if (childNodes && parentNode) {\n const childCount = childNodes.length;\n\n for (let i = childCount - 1; i >= 0; --i) {\n parentNode.insertBefore(\n cloneNode(childNodes[i], true),\n getNextSibling(currentNode)\n );\n }\n }\n }\n\n _forceRemove(currentNode);\n return true;\n }\n\n /* Check whether element has a valid namespace */\n if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Make sure that older browsers don't get fallback-tag mXSS */\n if (\n (tagName === 'noscript' ||\n tagName === 'noembed' ||\n tagName === 'noframes') &&\n regExpTest(/<\\/no(script|embed|frames)/i, currentNode.innerHTML)\n ) {\n _forceRemove(currentNode);\n return true;\n }\n\n /* Sanitize element content to be template-safe */\n if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {\n /* Get the element's text content */\n content = currentNode.textContent;\n content = stringReplace(content, MUSTACHE_EXPR, ' ');\n content = stringReplace(content, ERB_EXPR, ' ');\n content = stringReplace(content, TMPLIT_EXPR, ' ');\n if (currentNode.textContent !== content) {\n arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });\n currentNode.textContent = content;\n }\n }\n\n /* Execute a hook if present */\n _executeHook('afterSanitizeElements', currentNode, null);\n\n return false;\n };\n\n /**\n * _isValidAttribute\n *\n * @param {string} lcTag Lowercase tag name of containing element.\n * @param {string} lcName Lowercase attribute name.\n * @param {string} value Attribute value.\n * @return {Boolean} Returns true if `value` is valid, otherwise false.\n */\n // eslint-disable-next-line complexity\n const _isValidAttribute = function (lcTag, lcName, value) {\n /* Make sure attribute cannot clobber */\n if (\n SANITIZE_DOM &&\n (lcName === 'id' || lcName === 'name') &&\n (value in document || value in formElement)\n ) {\n return false;\n }\n\n /* Allow valid data-* attributes: At least one character after \"-\"\n (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)\n XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)\n We don't need to check the value; it's always URI safe. */\n if (\n ALLOW_DATA_ATTR &&\n !FORBID_ATTR[lcName] &&\n regExpTest(DATA_ATTR, lcName)\n ) {\n // This attribute is safe\n } else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) {\n // This attribute is safe\n /* Otherwise, check the name is permitted */\n } else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {\n if (\n // First condition does a very basic check if a) it's basically a valid custom element tagname AND\n // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck\n // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck\n (_basicCustomElementTest(lcTag) &&\n ((CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag)) ||\n (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag))) &&\n ((CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName)) ||\n (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)))) ||\n // Alternative, second condition checks if it's an `is`-attribute, AND\n // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck\n (lcName === 'is' &&\n CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements &&\n ((CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&\n regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value)) ||\n (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&\n CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))))\n ) {\n // If user has supplied a regexp or function in CUSTOM_ELEMENT_HANDLING.tagNameCheck, we need to also allow derived custom elements using the same tagName test.\n // Additionally, we need to allow attributes passing the CUSTOM_ELEMENT_HANDLING.attributeNameCheck user has configured, as custom elements can define these at their own discretion.\n } else {\n return false;\n }\n /* Check value is safe. First, is attr inert? If so, is safe */\n } else if (URI_SAFE_ATTRIBUTES[lcName]) {\n // This attribute is safe\n /* Check no script, data or unknown possibly unsafe URI\n unless we know URI values are safe for that attribute */\n } else if (\n regExpTest(IS_ALLOWED_URI, stringReplace(value, ATTR_WHITESPACE, ''))\n ) {\n // This attribute is safe\n /* Keep image data URIs alive if src/xlink:href is allowed */\n /* Further prevent gadget XSS for dynamically built script tags */\n } else if (\n (lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') &&\n lcTag !== 'script' &&\n stringIndexOf(value, 'data:') === 0 &&\n DATA_URI_TAGS[lcTag]\n ) {\n // This attribute is safe\n /* Allow unknown protocols: This provides support for links that\n are handled by protocol handlers which may be unknown ahead of\n time, e.g. fb:, spotify: */\n } else if (\n ALLOW_UNKNOWN_PROTOCOLS &&\n !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))\n ) {\n // This attribute is safe\n /* Check for binary attributes */\n } else if (value) {\n return false;\n } else {\n // Binary attributes are safe at this point\n /* Anything else, presume unsafe, do not add it back */\n }\n\n return true;\n };\n\n /**\n * _basicCustomElementCheck\n * checks if at least one dash is included in tagName, and it's not the first char\n * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name\n * @param {string} tagName name of the tag of the node to sanitize\n */\n const _basicCustomElementTest = function (tagName) {\n return tagName.indexOf('-') > 0;\n };\n\n /**\n * _sanitizeAttributes\n *\n * @protect attributes\n * @protect nodeName\n * @protect removeAttribute\n * @protect setAttribute\n *\n * @param {Node} currentNode to sanitize\n */\n const _sanitizeAttributes = function (currentNode) {\n let attr;\n let value;\n let lcName;\n let l;\n /* Execute a hook if present */\n _executeHook('beforeSanitizeAttributes', currentNode, null);\n\n const { attributes } = currentNode;\n\n /* Check if we have attributes; if not we might have a text node */\n if (!attributes) {\n return;\n }\n\n const hookEvent = {\n attrName: '',\n attrValue: '',\n keepAttr: true,\n allowedAttributes: ALLOWED_ATTR,\n };\n l = attributes.length;\n\n /* Go backwards over all attributes; safely remove bad ones */\n while (l--) {\n attr = attributes[l];\n const { name, namespaceURI } = attr;\n value = name === 'value' ? attr.value : stringTrim(attr.value);\n lcName = transformCaseFunc(name);\n\n /* Execute a hook if present */\n hookEvent.attrName = lcName;\n hookEvent.attrValue = value;\n hookEvent.keepAttr = true;\n hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set\n _executeHook('uponSanitizeAttribute', currentNode, hookEvent);\n value = hookEvent.attrValue;\n /* Did the hooks approve of the attribute? */\n if (hookEvent.forceKeepAttr) {\n continue;\n }\n\n /* Remove attribute */\n _removeAttribute(name, currentNode);\n\n /* Did the hooks approve of the attribute? */\n if (!hookEvent.keepAttr) {\n continue;\n }\n\n /* Work around a security issue in jQuery 3.0 */\n if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\\/>/i, value)) {\n _removeAttribute(name, currentNode);\n continue;\n }\n\n /* Sanitize attribute content to be template-safe */\n if (SAFE_FOR_TEMPLATES) {\n value = stringReplace(value, MUSTACHE_EXPR, ' ');\n value = stringReplace(value, ERB_EXPR, ' ');\n value = stringReplace(value, TMPLIT_EXPR, ' ');\n }\n\n /* Is `value` valid for this attribute? */\n const lcTag = transformCaseFunc(currentNode.nodeName);\n if (!_isValidAttribute(lcTag, lcName, value)) {\n continue;\n }\n\n /* Full DOM Clobbering protection via namespace isolation,\n * Prefix id and name attributes with `user-content-`\n */\n if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {\n // Remove the attribute with this value\n _removeAttribute(name, currentNode);\n\n // Prefix the value and later re-create the attribute with the sanitized value\n value = SANITIZE_NAMED_PROPS_PREFIX + value;\n }\n\n /* Handle attributes that require Trusted Types */\n if (\n trustedTypesPolicy &&\n typeof trustedTypes === 'object' &&\n typeof trustedTypes.getAttributeType === 'function'\n ) {\n if (namespaceURI) {\n /* Namespaces are not yet supported, see https://bugs.chromium.org/p/chromium/issues/detail?id=1305293 */\n } else {\n switch (trustedTypes.getAttributeType(lcTag, lcName)) {\n case 'TrustedHTML': {\n value = trustedTypesPolicy.createHTML(value);\n break;\n }\n\n case 'TrustedScriptURL': {\n value = trustedTypesPolicy.createScriptURL(value);\n break;\n }\n\n default: {\n break;\n }\n }\n }\n }\n\n /* Handle invalid data-* attribute set by try-catching it */\n try {\n if (namespaceURI) {\n currentNode.setAttributeNS(namespaceURI, name, value);\n } else {\n /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. \"x-schema\". */\n currentNode.setAttribute(name, value);\n }\n\n arrayPop(DOMPurify.removed);\n } catch (_) {}\n }\n\n /* Execute a hook if present */\n _executeHook('afterSanitizeAttributes', currentNode, null);\n };\n\n /**\n * _sanitizeShadowDOM\n *\n * @param {DocumentFragment} fragment to iterate over recursively\n */\n const _sanitizeShadowDOM = function (fragment) {\n let shadowNode;\n const shadowIterator = _createIterator(fragment);\n\n /* Execute a hook if present */\n _executeHook('beforeSanitizeShadowDOM', fragment, null);\n\n while ((shadowNode = shadowIterator.nextNode())) {\n /* Execute a hook if present */\n _executeHook('uponSanitizeShadowNode', shadowNode, null);\n\n /* Sanitize tags and elements */\n if (_sanitizeElements(shadowNode)) {\n continue;\n }\n\n /* Deep shadow DOM detected */\n if (shadowNode.content instanceof DocumentFragment) {\n _sanitizeShadowDOM(shadowNode.content);\n }\n\n /* Check attributes, sanitize if necessary */\n _sanitizeAttributes(shadowNode);\n }\n\n /* Execute a hook if present */\n _executeHook('afterSanitizeShadowDOM', fragment, null);\n };\n\n /**\n * Sanitize\n * Public method providing core sanitation functionality\n *\n * @param {String|Node} dirty string or DOM node\n * @param {Object} configuration object\n */\n // eslint-disable-next-line complexity\n DOMPurify.sanitize = function (dirty, cfg = {}) {\n let body;\n let importedNode;\n let currentNode;\n let oldNode;\n let returnNode;\n /* Make sure we have a string to sanitize.\n DO NOT return early, as this will return the wrong type if\n the user has requested a DOM object rather than a string */\n IS_EMPTY_INPUT = !dirty;\n if (IS_EMPTY_INPUT) {\n dirty = '<!-->';\n }\n\n /* Stringify, in case dirty is an object */\n if (typeof dirty !== 'string' && !_isNode(dirty)) {\n if (typeof dirty.toString === 'function') {\n dirty = dirty.toString();\n if (typeof dirty !== 'string') {\n throw typeErrorCreate('dirty is not a string, aborting');\n }\n } else {\n throw typeErrorCreate('toString is not a function');\n }\n }\n\n /* Check we can run. Otherwise fall back or ignore */\n if (!DOMPurify.isSupported) {\n if (\n typeof window.toStaticHTML === 'object' ||\n typeof window.toStaticHTML === 'function'\n ) {\n if (typeof dirty === 'string') {\n return window.toStaticHTML(dirty);\n }\n\n if (_isNode(dirty)) {\n return window.toStaticHTML(dirty.outerHTML);\n }\n }\n\n return dirty;\n }\n\n /* Assign config vars */\n if (!SET_CONFIG) {\n _parseConfig(cfg);\n }\n\n /* Clean up removed elements */\n DOMPurify.removed = [];\n\n /* Check if dirty is correctly typed for IN_PLACE */\n if (typeof dirty === 'string') {\n IN_PLACE = false;\n }\n\n if (IN_PLACE) {\n /* Do some early pre-sanitization to avoid unsafe root nodes */\n if (dirty.nodeName) {\n const tagName = transformCaseFunc(dirty.nodeName);\n if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {\n throw typeErrorCreate(\n 'root node is forbidden and cannot be sanitized in-place'\n );\n }\n }\n } else if (dirty instanceof Node) {\n /* If dirty is a DOM element, append to an empty document to avoid\n elements being stripped by the parser */\n body = _initDocument('<!---->');\n importedNode = body.ownerDocument.importNode(dirty, true);\n if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {\n /* Node is already a body, use as is */\n body = importedNode;\n } else if (importedNode.nodeName === 'HTML') {\n body = importedNode;\n } else {\n // eslint-disable-next-line unicorn/prefer-dom-node-append\n body.appendChild(importedNode);\n }\n } else {\n /* Exit directly if we have nothing to do */\n if (\n !RETURN_DOM &&\n !SAFE_FOR_TEMPLATES &&\n !WHOLE_DOCUMENT &&\n // eslint-disable-next-line unicorn/prefer-includes\n dirty.indexOf('<') === -1\n ) {\n return trustedTypesPolicy && RETURN_TRUSTED_TYPE\n ? trustedTypesPolicy.createHTML(dirty)\n : dirty;\n }\n\n /* Initialize the document to work on */\n body = _initDocument(dirty);\n\n /* Check we have a DOM node from the data */\n if (!body) {\n return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';\n }\n }\n\n /* Remove first element node (ours) if FORCE_BODY is set */\n if (body && FORCE_BODY) {\n _forceRemove(body.firstChild);\n }\n\n /* Get node iterator */\n const nodeIterator = _createIterator(IN_PLACE ? dirty : body);\n\n /* Now start iterating over the created document */\n while ((currentNode = nodeIterator.nextNode())) {\n /* Fix IE's strange behavior with manipulated textNodes #89 */\n if (currentNode.nodeType === 3 && currentNode === oldNode) {\n continue;\n }\n\n /* Sanitize tags and elements */\n if (_sanitizeElements(currentNode)) {\n continue;\n }\n\n /* Shadow DOM detected, sanitize it */\n if (currentNode.content instanceof DocumentFragment) {\n _sanitizeShadowDOM(currentNode.content);\n }\n\n /* Check attributes, sanitize if necessary */\n _sanitizeAttributes(currentNode);\n\n oldNode = currentNode;\n }\n\n oldNode = null;\n\n /* If we sanitized `dirty` in-place, return it. */\n if (IN_PLACE) {\n return dirty;\n }\n\n /* Return sanitized string or DOM */\n if (RETURN_DOM) {\n if (RETURN_DOM_FRAGMENT) {\n returnNode = createDocumentFragment.call(body.ownerDocument);\n\n while (body.firstChild) {\n // eslint-disable-next-line unicorn/prefer-dom-node-append\n returnNode.appendChild(body.firstChild);\n }\n } else {\n returnNode = body;\n }\n\n if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {\n /*\n AdoptNode() is not used because internal state is not reset\n (e.g. the past names map of a HTMLFormElement), this is safe\n in theory but we would rather not risk another attack vector.\n The state that is cloned by importNode() is explicitly defined\n by the specs.\n */\n returnNode = importNode.call(originalDocument, returnNode, true);\n }\n\n return returnNode;\n }\n\n let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;\n\n /* Serialize doctype if allowed */\n if (\n WHOLE_DOCUMENT &&\n ALLOWED_TAGS['!doctype'] &&\n body.ownerDocument &&\n body.ownerDocument.doctype &&\n body.ownerDocument.doctype.name &&\n regExpTest(EXPRESSIONS.DOCTYPE_NAME, body.ownerDocument.doctype.name)\n ) {\n serializedHTML =\n '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\\n' + serializedHTML;\n }\n\n /* Sanitize final string template-safe */\n if (SAFE_FOR_TEMPLATES) {\n serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR, ' ');\n serializedHTML = stringReplace(serializedHTML, ERB_EXPR, ' ');\n serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR, ' ');\n }\n\n return trustedTypesPolicy && RETURN_TRUSTED_TYPE\n ? trustedTypesPolicy.createHTML(serializedHTML)\n : serializedHTML;\n };\n\n /**\n * Public method to set the configuration once\n * setConfig\n *\n * @param {Object} cfg configuration object\n */\n DOMPurify.setConfig = function (cfg) {\n _parseConfig(cfg);\n SET_CONFIG = true;\n };\n\n /**\n * Public method to remove the configuration\n * clearConfig\n *\n */\n DOMPurify.clearConfig = function () {\n CONFIG = null;\n SET_CONFIG = false;\n };\n\n /**\n * Public method to check if an attribute value is valid.\n * Uses last set config, if any. Otherwise, uses config defaults.\n * isValidAttribute\n *\n * @param {string} tag Tag name of containing element.\n * @param {string} attr Attribute name.\n * @param {string} value Attribute value.\n * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.\n */\n DOMPurify.isValidAttribute = function (tag, attr, value) {\n /* Initialize shared config vars if necessary. */\n if (!CONFIG) {\n _parseConfig({});\n }\n\n const lcTag = transformCaseFunc(tag);\n const lcName = transformCaseFunc(attr);\n return _isValidAttribute(lcTag, lcName, value);\n };\n\n /**\n * AddHook\n * Public method to add DOMPurify hooks\n *\n * @param {String} entryPoint entry point for the hook to add\n * @param {Function} hookFunction function to execute\n */\n DOMPurify.addHook = function (entryPoint, hookFunction) {\n if (typeof hookFunction !== 'function') {\n return;\n }\n\n hooks[entryPoint] = hooks[entryPoint] || [];\n arrayPush(hooks[entryPoint], hookFunction);\n };\n\n /**\n * RemoveHook\n * Public method to remove a DOMPurify hook at a given entryPoint\n * (pops it from the stack of hooks if more are present)\n *\n * @param {String} entryPoint entry point for the hook to remove\n * @return {Function} removed(popped) hook\n */\n DOMPurify.removeHook = function (entryPoint) {\n if (hooks[entryPoint]) {\n return arrayPop(hooks[entryPoint]);\n }\n };\n\n /**\n * RemoveHooks\n * Public method to remove all DOMPurify hooks at a given entryPoint\n *\n * @param {String} entryPoint entry point for the hooks to remove\n */\n DOMPurify.removeHooks = function (entryPoint) {\n if (hooks[entryPoint]) {\n hooks[entryPoint] = [];\n }\n };\n\n /**\n * RemoveAllHooks\n * Public method to remove all DOMPurify hooks\n *\n */\n DOMPurify.removeAllHooks = function () {\n hooks = {};\n };\n\n return DOMPurify;\n}\n\nexport default createDOMPurify();\n"],"names":["hasOwnProperty","Object","setPrototypeOf","isFrozen","getPrototypeOf","getOwnPropertyDescriptor","freeze","seal","create","_ref","Reflect","apply","construct","fun","thisValue","args","x","Func","func","arrayForEach","unapply","Array","prototype","forEach","arrayPop","pop","arrayPush","push","stringToLowerCase","String","toLowerCase","stringToString","toString","stringMatch","match","stringReplace","replace","stringIndexOf","indexOf","stringTrim","trim","regExpTest","RegExp","test","typeErrorCreate","TypeError","_len2","arguments","length","_key2","thisArg","_len","_key","addToSet","set","array","transformCaseFunc","_transformCaseFunc","l","element","lcElement","clone","object","property","newObject","lookupGetter","prop","desc","get","value","fallbackValue","console","warn","html","svg","svgFilters","svgDisallowed","mathMl","mathMlDisallowed","text","xml","MUSTACHE_EXPR","ERB_EXPR","TMPLIT_EXPR","DATA_ATTR","ARIA_ATTR","IS_ALLOWED_URI","IS_SCRIPT_OR_DATA","ATTR_WHITESPACE","DOCTYPE_NAME","getGlobal","window","purify","createDOMPurify","DOMPurify","root","version","VERSION","removed","document","nodeType","isSupported","originalDocument","DocumentFragment","HTMLTemplateElement","Node","Element","NodeFilter","NamedNodeMap","MozNamedAttrMap","_window$NamedNodeMap","HTMLFormElement","DOMParser","trustedTypes","ElementPrototype","cloneNode","getNextSibling","getChildNodes","getParentNode","template","createElement","content","ownerDocument","trustedTypesPolicy","_typeof","createPolicy","suffix","ATTR_NAME","currentScript","hasAttribute","getAttribute","policyName","createHTML","createScriptURL","scriptUrl","_","_createTrustedTypesPolicy","emptyHTML","_document","implementation","createNodeIterator","createDocumentFragment","getElementsByTagName","importNode","documentMode","hooks","undefined","createHTMLDocument","PARSER_MEDIA_TYPE","EXPRESSIONS","ALLOWED_TAGS","DEFAULT_ALLOWED_TAGS","TAGS","_toConsumableArray","ALLOWED_ATTR","DEFAULT_ALLOWED_ATTR","ATTRS","CUSTOM_ELEMENT_HANDLING","tagNameCheck","writable","configurable","enumerable","attributeNameCheck","allowCustomizedBuiltInElements","FORBID_TAGS","FORBID_ATTR","ALLOW_ARIA_ATTR","ALLOW_DATA_ATTR","ALLOW_UNKNOWN_PROTOCOLS","ALLOW_SELF_CLOSE_IN_ATTR","SAFE_FOR_TEMPLATES","WHOLE_DOCUMENT","SET_CONFIG","FORCE_BODY","RETURN_DOM","RETURN_DOM_FRAGMENT","RETURN_TRUSTED_TYPE","SANITIZE_DOM","SANITIZE_NAMED_PROPS","KEEP_CONTENT","IN_PLACE","USE_PROFILES","FORBID_CONTENTS","DEFAULT_FORBID_CONTENTS","DATA_URI_TAGS","DEFAULT_DATA_URI_TAGS","URI_SAFE_ATTRIBUTES","DEFAULT_URI_SAFE_ATTRIBUTES","MATHML_NAMESPACE","SVG_NAMESPACE","HTML_NAMESPACE","NAMESPACE","IS_EMPTY_INPUT","ALLOWED_NAMESPACES","DEFAULT_ALLOWED_NAMESPACES","SUPPORTED_PARSER_MEDIA_TYPES","CONFIG","formElement","isRegexOrFunction","testValue","Function","_parseConfig","cfg","ADD_URI_SAFE_ATTR","ADD_DATA_URI_TAGS","ALLOWED_URI_REGEXP","ADD_TAGS","ADD_ATTR","table","tbody","MATHML_TEXT_INTEGRATION_POINTS","HTML_INTEGRATION_POINTS","COMMON_SVG_AND_HTML_ELEMENTS","ALL_SVG_TAGS","ALL_MATHML_TAGS","_forceRemove","node","parentNode","removeChild","outerHTML","remove","_removeAttribute","name","attribute","getAttributeNode","from","removeAttribute","setAttribute","_initDocument","dirty","doc","leadingWhitespace","matches","dirtyPayload","parseFromString","documentElement","createDocument","innerHTML","body","insertBefore","createTextNode","childNodes","call","_createIterator","SHOW_ELEMENT","SHOW_COMMENT","SHOW_TEXT","_isNode","nodeName","_executeHook","entryPoint","currentNode","data","hook","_sanitizeElements","elm","textContent","attributes","namespaceURI","hasChildNodes","tagName","allowedTags","firstElementChild","_basicCustomElementTest","i","parent","parentTagName","Boolean","_checkValidNamespace","_isValidAttribute","lcTag","lcName","_sanitizeAttributes","attr","hookEvent","attrName","attrValue","keepAttr","allowedAttributes","_attr","forceKeepAttr","getAttributeType","setAttributeNS","_sanitizeShadowDOM","fragment","shadowNode","shadowIterator","nextNode","sanitize","importedNode","oldNode","returnNode","toStaticHTML","appendChild","firstChild","nodeIterator","shadowroot","shadowrootmod","serializedHTML","doctype","setConfig","clearConfig","isValidAttribute","tag","addHook","hookFunction","removeHook","removeHooks","removeAllHooks"],"mappings":";guDAAA,IACEA,EAKEC,OALFD,eACAE,EAIED,OAJFC,eACAC,EAGEF,OAHFE,SACAC,EAEEH,OAFFG,eACAC,EACEJ,OADFI,yBAGIC,EAAyBL,OAAzBK,OAAQC,EAAiBN,OAAjBM,KAAMC,EAAWP,OAAXO,OACpBC,EAA8C,oBAAZC,SAA2BA,QAAvDC,IAAAA,MAAOC,IAAAA,UAERD,IACHA,EAAQ,SAAUE,EAAKC,EAAWC,GAChC,OAAOF,EAAIF,MAAMG,EAAWC,EAC7B,GAGET,IACHA,EAAS,SAAUU,GACjB,OAAOA,CACR,GAGET,IACHA,EAAO,SAAUS,GACf,OAAOA,CACR,GAGEJ,IACHA,EAAY,SAAUK,EAAMF,GACfE,OAAAA,EAAAA,IAAQF,GACpB,GAGH,IAqB4BG,EArBtBC,EAAeC,EAAQC,MAAMC,UAAUC,SAEvCC,EAAWJ,EAAQC,MAAMC,UAAUG,KACnCC,EAAYN,EAAQC,MAAMC,UAAUK,MAGpCC,EAAoBR,EAAQS,OAAOP,UAAUQ,aAC7CC,EAAiBX,EAAQS,OAAOP,UAAUU,UAC1CC,EAAcb,EAAQS,OAAOP,UAAUY,OACvCC,EAAgBf,EAAQS,OAAOP,UAAUc,SACzCC,EAAgBjB,EAAQS,OAAOP,UAAUgB,SACzCC,EAAanB,EAAQS,OAAOP,UAAUkB,MAEtCC,EAAarB,EAAQsB,OAAOpB,UAAUqB,MAEtCC,GAMsB1B,EANQ2B,UAO3B,WAAA,IAAA,IAAAC,EAAAC,UAAAC,OAAIjC,EAAJ,IAAAM,MAAAyB,GAAAG,EAAA,EAAAA,EAAAH,EAAAG,IAAIlC,EAAJkC,GAAAF,UAAAE,GAAA,OAAarC,EAAUM,EAAMH,EAA7B,GALF,SAASK,EAAQF,GACtB,OAAO,SAACgC,GAAD,IAAA,IAAAC,EAAAJ,UAAAC,OAAajC,EAAb,IAAAM,MAAA8B,EAAA,EAAAA,EAAA,EAAA,GAAAC,EAAA,EAAAA,EAAAD,EAAAC,IAAarC,EAAbqC,EAAA,GAAAL,UAAAK,GAAA,OAAsBzC,EAAMO,EAAMgC,EAASnC,EAA3C,CACR,CAOM,SAASsC,EAASC,EAAKC,EAAOC,GAAmB,IAAAC,EACtDD,EAAiB,QAAAC,EAAGD,SAAH,IAAAC,EAAAA,EAAwB7B,EACrC1B,GAIFA,EAAeoD,EAAK,MAIfI,IADP,IAAIA,EAAIH,EAAMP,OACPU,KAAK,CACV,IAAIC,EAAUJ,EAAMG,GACpB,GAAuB,iBAAZC,EAAsB,CAC/B,IAAMC,EAAYJ,EAAkBG,GAChCC,IAAcD,IAEXxD,EAASoD,KACZA,EAAMG,GAAKE,GAGbD,EAAUC,EAEb,CAEDN,EAAIK,IAAW,CAChB,CAED,OAAOL,CACR,CAGM,SAASO,EAAMC,GACpB,IAEIC,EAFEC,EAAYxD,EAAO,MAGpBuD,IAAAA,KAAYD,GACmC,IAA9CnD,EAAMX,EAAgB8D,EAAQ,CAACC,MACjCC,EAAUD,GAAYD,EAAOC,IAIjC,OAAOC,CACR,CAMD,SAASC,EAAaH,EAAQI,GACrBJ,KAAW,OAAXA,GAAiB,CACtB,IAAMK,EAAO9D,EAAyByD,EAAQI,GAC9C,GAAIC,EAAM,CACJA,GAAAA,EAAKC,IACP,OAAOhD,EAAQ+C,EAAKC,KAGtB,GAA0B,mBAAfD,EAAKE,MACd,OAAOjD,EAAQ+C,EAAKE,MAEvB,CAEDP,EAAS1D,EAAe0D,EACzB,CAOD,OALSQ,SAAcX,GAErB,OADAY,QAAQC,KAAK,qBAAsBb,GAC5B,IACR,CAGF,CCjIM,IAAMc,EAAOnE,EAAO,CACzB,IACA,OACA,UACA,UACA,OACA,UACA,QACA,QACA,IACA,MACA,MACA,MACA,QACA,aACA,OACA,KACA,SACA,SACA,UACA,SACA,OACA,OACA,MACA,WACA,UACA,OACA,WACA,KACA,YACA,MACA,UACA,MACA,SACA,MACA,MACA,KACA,KACA,UACA,KACA,WACA,aACA,SACA,OACA,SACA,OACA,KACA,KACA,KACA,KACA,KACA,KACA,OACA,SACA,SACA,KACA,OACA,IACA,MACA,QACA,MACA,MACA,QACA,SACA,KACA,OACA,MACA,OACA,UACA,OACA,WACA,QACA,MACA,OACA,KACA,WACA,SACA,SACA,IACA,UACA,MACA,WACA,IACA,KACA,KACA,OACA,IACA,OACA,UACA,SACA,SACA,QACA,SACA,SACA,OACA,SACA,SACA,QACA,MACA,UACA,MACA,QACA,QACA,KACA,WACA,WACA,QACA,KACA,QACA,OACA,KACA,QACA,KACA,IACA,KACA,MACA,QACA,QAIWoE,EAAMpE,EAAO,CACxB,MACA,IACA,WACA,cACA,eACA,eACA,gBACA,mBACA,SACA,WACA,OACA,OACA,UACA,SACA,OACA,IACA,QACA,WACA,QACA,QACA,OACA,iBACA,SACA,OACA,WACA,QACA,OACA,UACA,UACA,WACA,iBACA,OACA,OACA,QACA,SACA,SACA,OACA,WACA,QACA,OACA,QACA,OACA,UAGWqE,EAAarE,EAAO,CAC/B,UACA,gBACA,sBACA,cACA,mBACA,oBACA,oBACA,iBACA,UACA,UACA,UACA,UACA,UACA,iBACA,UACA,UACA,cACA,eACA,WACA,eACA,qBACA,cACA,SACA,iBAOWsE,EAAgBtE,EAAO,CAClC,UACA,gBACA,SACA,UACA,eACA,YACA,mBACA,iBACA,gBACA,gBACA,gBACA,QACA,YACA,OACA,eACA,YACA,UACA,gBACA,SACA,MACA,aACA,UACA,QAGWuE,EAASvE,EAAO,CAC3B,OACA,WACA,SACA,UACA,QACA,SACA,KACA,aACA,gBACA,KACA,KACA,QACA,UACA,WACA,QACA,OACA,KACA,SACA,QACA,SACA,OACA,OACA,UACA,SACA,MACA,QACA,MACA,SACA,eAKWwE,EAAmBxE,EAAO,CACrC,UACA,cACA,aACA,WACA,YACA,UACA,UACA,SACA,SACA,QACA,YACA,aACA,iBACA,cACA,SAGWyE,EAAOzE,EAAO,CAAC,UCpRfmE,EAAOnE,EAAO,CACzB,SACA,SACA,QACA,MACA,iBACA,eACA,uBACA,WACA,aACA,UACA,SACA,UACA,cACA,cACA,UACA,OACA,QACA,QACA,QACA,OACA,UACA,WACA,eACA,SACA,cACA,WACA,WACA,UACA,MACA,WACA,0BACA,wBACA,WACA,YACA,UACA,eACA,OACA,MACA,UACA,SACA,SACA,OACA,OACA,WACA,KACA,YACA,YACA,QACA,OACA,QACA,OACA,OACA,UACA,OACA,MACA,MACA,YACA,QACA,SACA,MACA,YACA,WACA,QACA,OACA,QACA,UACA,aACA,SACA,OACA,UACA,UACA,cACA,cACA,SACA,UACA,UACA,aACA,WACA,MACA,WACA,MACA,WACA,OACA,OACA,UACA,aACA,QACA,WACA,QACA,OACA,QACA,OACA,UACA,QACA,MACA,SACA,OACA,QACA,UACA,WACA,QACA,YACA,OACA,SACA,SACA,QACA,QACA,QACA,SAGWoE,EAAMpE,EAAO,CACxB,gBACA,aACA,WACA,qBACA,SACA,gBACA,gBACA,UACA,gBACA,iBACA,QACA,OACA,KACA,QACA,OACA,gBACA,YACA,YACA,QACA,sBACA,8BACA,gBACA,kBACA,KACA,KACA,IACA,KACA,KACA,kBACA,YACA,UACA,UACA,MACA,WACA,YACA,MACA,OACA,eACA,YACA,SACA,cACA,cACA,gBACA,cACA,YACA,mBACA,eACA,aACA,eACA,cACA,KACA,KACA,KACA,KACA,aACA,WACA,gBACA,oBACA,SACA,OACA,KACA,kBACA,KACA,MACA,IACA,KACA,KACA,KACA,KACA,UACA,YACA,aACA,WACA,OACA,eACA,iBACA,eACA,mBACA,iBACA,QACA,aACA,aACA,eACA,eACA,cACA,cACA,mBACA,YACA,MACA,OACA,QACA,SACA,OACA,MACA,OACA,aACA,SACA,WACA,UACA,QACA,SACA,cACA,SACA,WACA,cACA,OACA,aACA,sBACA,mBACA,eACA,SACA,gBACA,sBACA,iBACA,IACA,KACA,KACA,SACA,OACA,OACA,cACA,YACA,UACA,SACA,SACA,QACA,OACA,kBACA,mBACA,mBACA,eACA,cACA,eACA,cACA,aACA,eACA,mBACA,oBACA,iBACA,kBACA,oBACA,iBACA,SACA,eACA,QACA,eACA,iBACA,WACA,UACA,UACA,YACA,mBACA,cACA,kBACA,iBACA,aACA,OACA,KACA,KACA,UACA,SACA,UACA,aACA,UACA,aACA,gBACA,gBACA,QACA,eACA,OACA,eACA,mBACA,mBACA,IACA,KACA,KACA,QACA,IACA,KACA,KACA,IACA,eAGWuE,EAASvE,EAAO,CAC3B,SACA,cACA,QACA,WACA,QACA,eACA,cACA,aACA,aACA,QACA,MACA,UACA,eACA,WACA,QACA,QACA,SACA,OACA,KACA,UACA,SACA,gBACA,SACA,SACA,iBACA,YACA,WACA,cACA,UACA,UACA,gBACA,WACA,WACA,OACA,WACA,WACA,aACA,UACA,SACA,SACA,cACA,gBACA,uBACA,YACA,YACA,aACA,WACA,iBACA,iBACA,YACA,UACA,QACA,UAGW0E,EAAM1E,EAAO,CACxB,aACA,SACA,cACA,YACA,gBCrWW2E,EAAgB1E,EAAK,6BACrB2E,EAAW3E,EAAK,yBAChB4E,EAAc5E,EAAK,iBACnB6E,EAAY7E,EAAK,8BACjB8E,EAAY9E,EAAK,kBACjB+E,EAAiB/E,EAC5B,yFAEWgF,EAAoBhF,EAAK,yBACzBiF,EAAkBjF,EAC7B,+DAEWkF,EAAelF,EAAK,WCM3BmF,EAAY,WAAA,MAAyB,oBAAXC,OAAyB,KAAOA,MAA9C,EAqmDlB,IAAAC,EAjjDA,SAASC,IAAgBF,IAAAA,EAASD,UAAAA,OAAAA,QAAAA,IAAAA,UAAAA,GAAAA,UAAAA,GAAAA,IAC1BI,EAAY,SAACC,GAASF,OAAAA,EAAgBE,EAA1B,EAclB,GARAD,EAAUE,QAAUC,QAMpBH,EAAUI,QAAU,IAEfP,IAAWA,EAAOQ,UAAyC,IAA7BR,EAAOQ,SAASC,SAKjD,OAFAN,EAAUO,aAAc,EAEjBP,EAGT,IAAMQ,EAAmBX,EAAOQ,SAE1BA,EAAaR,EAAbQ,SAEJI,EASEZ,EATFY,iBACAC,EAQEb,EARFa,oBACAC,EAOEd,EAPFc,KACAC,EAMEf,EANFe,QACAC,EAKEhB,EALFgB,WAKEhB,EAAAA,EAJFiB,aAAAA,aAAejB,EAAOiB,cAAgBjB,EAAOkB,gBAN/CC,EAOEC,EAGEpB,EAHFoB,gBACAC,EAEErB,EAFFqB,UACAC,EACEtB,EADFsB,aAGIC,EAAmBR,EAAQpF,UAE3B6F,GAAYlD,EAAaiD,EAAkB,aAC3CE,GAAiBnD,EAAaiD,EAAkB,eAChDG,GAAgBpD,EAAaiD,EAAkB,cAC/CI,GAAgBrD,EAAaiD,EAAkB,cAQrD,GAAmC,mBAAxBV,EAAoC,CAC7C,IAAMe,GAAWpB,EAASqB,cAAc,YACpCD,GAASE,SAAWF,GAASE,QAAQC,gBACvCvB,EAAWoB,GAASE,QAAQC,cAE/B,CAED,IAAMC,GApG0B,SAAUV,EAAcd,GAEtD,GAAwB,WAAxByB,EAAOX,IAC8B,mBAA9BA,EAAaY,aAEpB,OAAO,KAMLC,IAAAA,EAAS,KACPC,EAAY,wBAEhB5B,EAAS6B,eACT7B,EAAS6B,cAAcC,aAAaF,KAEpCD,EAAS3B,EAAS6B,cAAcE,aAAaH,IAGzCI,IAAAA,EAAa,aAAeL,EAAS,IAAMA,EAAS,IAEtD,IACF,OAAOb,EAAaY,aAAaM,EAAY,CAC3CC,WAAW3D,SAAAA,GACT,OAAOA,CAFkC,EAI3C4D,gBAAgBC,SAAAA,GACd,OAAOA,CACR,GAPL,CASE,MAAOC,GAOP,OAHAhE,QAAQC,KACN,uBAAyB2D,EAAa,0BAEjC,IACR,CACF,CA4D4BK,CACzBvB,EACAX,GAEImC,GAAYd,GAAqBA,GAAmBS,WAAW,IAAM,GAE3EM,GAKIvC,EAJFwC,MAAAA,eACAC,MAAAA,mBACAC,MAAAA,uBACAC,MAAAA,qBAEMC,GAAezC,EAAfyC,WAEJC,GAAe,CAAA,EACf,IACFA,GAAenF,EAAMsC,GAAU6C,aAAe7C,EAAS6C,aAAe,EACvE,CAAC,MAAOT,GAAK,CAEVU,IAAAA,GAAQ,CAAA,EAKZnD,EAAUO,YACiB,mBAAlBiB,IACPqB,SACsCO,IAAtCP,GAAeQ,oBACE,IAAjBH,GAEF,IA4NII,GAGA5F,GA9NFyB,GAOEoE,EANFnE,GAMEmE,EALFlE,GAKEkE,EAJFjE,GAIEiE,EAHFhE,GAGEgE,EAFF9D,GAEE8D,EADF7D,GACE6D,EAEE/D,GAAmB+D,EAQrBC,GAAe,KACbC,GAAuBlG,EAAS,eACjCmG,GADgCC,EAEhCD,GACAA,EAAAA,GACAA,EAAAA,GACAA,EAAAA,KAIDE,GAAe,KACbC,GAAuBtG,EAAS,CAAD,EAChCuG,GAAAA,OAAAA,EAAAA,GADgCH,EAEhCG,KACAA,GACAA,EAAAA,KASDC,GAA0B5J,OAAOM,KACnCN,OAAOO,OAAO,KAAM,CAClBsJ,aAAc,CACZC,UAAU,EACVC,cAAc,EACdC,YAAY,EACZ5F,MAAO,MAET6F,mBAAoB,CAClBH,UAAU,EACVC,cAAc,EACdC,YAAY,EACZ5F,MAAO,MAET8F,+BAAgC,CAC9BJ,UAAU,EACVC,cAAc,EACdC,YAAY,EACZ5F,OAAO,MAMT+F,GAAc,KAGdC,GAAc,KAGdC,IAAkB,EAGlBC,IAAkB,EAGlBC,IAA0B,EAI1BC,IAA2B,EAK3BC,IAAqB,EAGrBC,IAAiB,EAGjBC,IAAa,EAIbC,IAAa,EAMbC,IAAa,EAIbC,IAAsB,EAItBC,IAAsB,EAKtBC,IAAe,EAefC,IAAuB,EAIvBC,IAAe,EAIfC,IAAW,EAGXC,GAAe,CAAA,EAGfC,GAAkB,KAChBC,GAA0BlI,EAAS,CAAD,EAAK,CAC3C,iBACA,QACA,WACA,OACA,gBACA,OACA,SACA,OACA,KACA,KACA,KACA,KACA,QACA,UACA,WACA,WACA,YACA,SACA,QACA,MACA,WACA,QACA,QACA,QACA,QAIEmI,GAAgB,KACdC,GAAwBpI,EAAS,CAAD,EAAK,CACzC,QACA,QACA,MACA,SACA,QACA,UAIEqI,GAAsB,KACpBC,GAA8BtI,EAAS,GAAI,CAC/C,MACA,QACA,MACA,KACA,QACA,OACA,UACA,cACA,OACA,UACA,QACA,QACA,QACA,UAGIuI,GAAmB,qCACnBC,GAAgB,6BAChBC,GAAiB,+BAEnBC,GAAYD,GACZE,IAAiB,EAGjBC,GAAqB,KACnBC,GAA6B7I,EACjC,GACA,CAACuI,GAAkBC,GAAeC,IAClC/J,GAKIoK,GAA+B,CAAC,wBAAyB,aAK3DC,GAAS,KAKPC,GAAclG,EAASqB,cAAc,QAErC8E,GAAoB,SAAUC,GAClC,OAAOA,aAAqB7J,QAAU6J,aAAqBC,QAC5D,EAQKC,GAAe,SAAUC,GACzBN,IAAUA,KAAWM,IAKpBA,GAAsB,WAAf9E,EAAO8E,KACjBA,EAAM,CAAA,GAIRA,EAAM7I,EAAM6I,GAEZtD,GAGOA,IAD4D,IAAjE+C,GAA6B7J,QAAQoK,EAAItD,mBApCX,YAsCLsD,EAAItD,kBAG/B5F,GACwB,0BAAtB4F,GACIrH,EACAH,EAGN0H,GACE,iBAAkBoD,EACdrJ,EAAS,CAAA,EAAIqJ,EAAIpD,aAAc9F,IAC/B+F,GACNG,GACE,iBAAkBgD,EACdrJ,EAAS,CAAA,EAAIqJ,EAAIhD,aAAclG,IAC/BmG,GACNsC,GACE,uBAAwBS,EACpBrJ,EAAS,CAAA,EAAIqJ,EAAIT,mBAAoBlK,GACrCmK,GACNR,GACE,sBAAuBgB,EACnBrJ,EACEQ,EAAM8H,IACNe,EAAIC,kBACJnJ,IAEFmI,GACNH,GACE,sBAAuBkB,EACnBrJ,EACEQ,EAAM4H,IACNiB,EAAIE,kBACJpJ,IAEFiI,GACNH,GACE,oBAAqBoB,EACjBrJ,EAAS,CAAA,EAAIqJ,EAAIpB,gBAAiB9H,IAClC+H,GACNnB,GACE,gBAAiBsC,EACbrJ,EAAS,CAAA,EAAIqJ,EAAItC,YAAa5G,IAC9B,GACN6G,GACE,gBAAiBqC,EACbrJ,EAAS,CAAA,EAAIqJ,EAAIrC,YAAa7G,IAC9B,GACN6H,GAAe,iBAAkBqB,GAAMA,EAAIrB,aAC3Cf,IAA0C,IAAxBoC,EAAIpC,gBACtBC,IAA0C,IAAxBmC,EAAInC,gBACtBC,GAA0BkC,EAAIlC,0BAA2B,EACzDC,IAA4D,IAAjCiC,EAAIjC,yBAC/BC,GAAqBgC,EAAIhC,qBAAsB,EAC/CC,GAAiB+B,EAAI/B,iBAAkB,EACvCG,GAAa4B,EAAI5B,aAAc,EAC/BC,GAAsB2B,EAAI3B,sBAAuB,EACjDC,GAAsB0B,EAAI1B,sBAAuB,EACjDH,GAAa6B,EAAI7B,aAAc,EAC/BI,IAAoC,IAArByB,EAAIzB,aACnBC,GAAuBwB,EAAIxB,uBAAwB,EACnDC,IAAoC,IAArBuB,EAAIvB,aACnBC,GAAWsB,EAAItB,WAAY,EAC3B9F,GAAiBoH,EAAIG,oBAAsBvH,GAC3CyG,GAAYW,EAAIX,WAAaD,GAC7BjC,GAA0B6C,EAAI7C,yBAA2B,GAEvD6C,EAAI7C,yBACJyC,GAAkBI,EAAI7C,wBAAwBC,gBAE9CD,GAAwBC,aACtB4C,EAAI7C,wBAAwBC,cAI9B4C,EAAI7C,yBACJyC,GAAkBI,EAAI7C,wBAAwBK,sBAE9CL,GAAwBK,mBACtBwC,EAAI7C,wBAAwBK,oBAI9BwC,EAAI7C,yBAEF,kBADK6C,EAAI7C,wBAAwBM,iCAGnCN,GAAwBM,+BACtBuC,EAAI7C,wBAAwBM,gCAG5BO,KACFH,IAAkB,GAGhBQ,KACFD,IAAa,GAIXO,KACF/B,GAAejG,EAAS,CAAA,EAAQmG,EAAAA,IAChCE,GAAe,IACW,IAAtB2B,GAAa5G,OACfpB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,KAGA,IAArByB,GAAa3G,MACfrB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,GACvBvG,EAASqG,GAAcE,KAGO,IAA5ByB,GAAa1G,aACftB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,GACvBvG,EAASqG,GAAcE,KAGG,IAAxByB,GAAaxG,SACfxB,EAASiG,GAAcE,GACvBnG,EAASqG,GAAcE,GACvBvG,EAASqG,GAAcE,KAKvB8C,EAAII,WACFxD,KAAiBC,KACnBD,GAAezF,EAAMyF,KAGvBjG,EAASiG,GAAcoD,EAAII,SAAUtJ,KAGnCkJ,EAAIK,WACFrD,KAAiBC,KACnBD,GAAe7F,EAAM6F,KAGvBrG,EAASqG,GAAcgD,EAAIK,SAAUvJ,KAGnCkJ,EAAIC,mBACNtJ,EAASqI,GAAqBgB,EAAIC,kBAAmBnJ,IAGnDkJ,EAAIpB,kBACFA,KAAoBC,KACtBD,GAAkBzH,EAAMyH,KAG1BjI,EAASiI,GAAiBoB,EAAIpB,gBAAiB9H,KAI7C2H,KACF7B,GAAa,UAAW,GAItBqB,IACFtH,EAASiG,GAAc,CAAC,OAAQ,OAAQ,SAItCA,GAAa0D,QACf3J,EAASiG,GAAc,CAAC,iBACjBc,GAAY6C,OAKjB3M,GACFA,EAAOoM,GAGTN,GAASM,EACV,EAEKQ,GAAiC7J,EAAS,CAAA,EAAI,CAClD,KACA,KACA,KACA,KACA,UAGI8J,GAA0B9J,EAAS,GAAI,CAC3C,gBACA,OACA,QACA,mBAOI+J,GAA+B/J,EAAS,CAAA,EAAI,CAChD,QACA,QACA,OACA,IACA,WAMIgK,GAAehK,EAAS,CAAD,EAAKmG,GAClCnG,EAASgK,GAAc7D,GACvBnG,EAASgK,GAAc7D,GAEjB8D,IAAAA,GAAkBjK,EAAS,CAAD,EAAKmG,GACrCnG,EAASiK,GAAiB9D,GAU1B,IA4GM+D,GAAe,SAAUC,GAC7B9L,EAAUoE,EAAUI,QAAS,CAAEvC,QAAS6J,IACpC,IAEFA,EAAKC,WAAWC,YAAYF,EAF9B,CAGE,MAAOjF,GACH,IACFiF,EAAKG,UAAYlF,EADnB,CAEE,MAAOF,GACPiF,EAAKI,QACN,CACF,CACF,EAQKC,GAAmB,SAAUC,EAAMN,GACnC,IACF9L,EAAUoE,EAAUI,QAAS,CAC3B6H,UAAWP,EAAKQ,iBAAiBF,GACjCG,KAAMT,GAHV,CAKE,MAAOjF,GACP7G,EAAUoE,EAAUI,QAAS,CAC3B6H,UAAW,KACXE,KAAMT,GAET,CAKGM,GAHJN,EAAKU,gBAAgBJ,GAGR,OAATA,IAAkBpE,GAAaoE,GAC7BhD,GAAAA,IAAcC,GACZ,IACFwC,GAAaC,EACd,CAAC,MAAOjF,GAAK,MAEV,IACFiF,EAAKW,aAAaL,EAAM,GACzB,CAAC,MAAOvF,GAAK,CAGnB,EAQK6F,GAAgB,SAAUC,GAE9B,IAAIC,EACAC,EAEJ,GAAI1D,GACFwD,EAAQ,oBAAsBA,MACzB,CAEL,IAAMG,EAAUvM,EAAYoM,EAAO,eACnCE,EAAoBC,GAAWA,EAAQ,EACxC,CAGuB,0BAAtBpF,IACA2C,KAAcD,KAGduC,EACE,iEACAA,EACA,kBAGEI,IAAAA,EAAe9G,GACjBA,GAAmBS,WAAWiG,GAC9BA,EAKAtC,GAAAA,KAAcD,GACZ,IACFwC,GAAM,IAAItH,GAAY0H,gBAAgBD,EAAcrF,GACrD,CAAC,MAAOb,GAAK,CAIhB,IAAK+F,IAAQA,EAAIK,gBAAiB,CAChCL,EAAM3F,GAAeiG,eAAe7C,GAAW,WAAY,MACvD,IACFuC,EAAIK,gBAAgBE,UAAY7C,GAC5BvD,GACAgG,CAHN,CAIE,MAAOlG,GAER,CACF,CAEKuG,IAAAA,EAAOR,EAAIQ,MAAQR,EAAIK,gBAUzB5C,OARAsC,GAASE,GACXO,EAAKC,aACH5I,EAAS6I,eAAeT,GACxBO,EAAKG,WAAW,IAAM,MAKtBlD,KAAcD,GACThD,GAAqBoG,KAC1BZ,EACA3D,GAAiB,OAAS,QAC1B,GAGGA,GAAiB2D,EAAIK,gBAAkBG,CAC/C,EAQKK,GAAkB,SAAUpJ,GACzB6C,OAAAA,GAAmBsG,KACxBnJ,EAAK2B,eAAiB3B,EACtBA,EAEAY,EAAWyI,aAAezI,EAAW0I,aAAe1I,EAAW2I,UAC/D,MACA,EAEH,EA6BKC,GAAU,SAAUzL,GACxB,MAAuB,WAAhB8D,EAAOnB,GACV3C,aAAkB2C,EAClB3C,GACoB,WAAlB8D,EAAO9D,IACoB,iBAApBA,EAAOsC,UACa,iBAApBtC,EAAO0L,QACrB,EAUKC,GAAe,SAAUC,EAAYC,EAAaC,GACjD3G,GAAMyG,IAIXvO,EAAa8H,GAAMyG,IAAa,SAACG,GAC/BA,EAAKX,KAAKpJ,EAAW6J,EAAaC,EAAMxD,GACzC,GACF,EAYK0D,GAAoB,SAAUH,GAClC,IAAIlI,EA3DyBsI,EAiE7B,GAHAN,GAAa,yBAA0BE,EAAa,OA9DvBI,EAiEZJ,aA/DA5I,IACU,iBAAjBgJ,EAAIP,UACiB,iBAApBO,EAAIC,aACgB,mBAApBD,EAAIrC,eACTqC,EAAIE,sBAAsBrJ,IACG,mBAAxBmJ,EAAI7B,iBACiB,mBAArB6B,EAAI5B,cACiB,iBAArB4B,EAAIG,cACiB,mBAArBH,EAAIhB,cACkB,mBAAtBgB,EAAII,eAwDb,OADA5C,GAAaoC,IACN,EAILlN,GAAAA,EAAW,kBAAmBkN,EAAYH,UAE5C,OADAjC,GAAaoC,IACN,EAIT,IAAMS,EAAU5M,GAAkBmM,EAAYH,UAU5CG,GAPFF,GAAa,sBAAuBE,EAAa,CAC/CS,QAAAA,EACAC,YAAa/G,KAKbqG,EAAYQ,kBACXZ,GAAQI,EAAYW,sBACnBf,GAAQI,EAAYlI,WACnB8H,GAAQI,EAAYlI,QAAQ6I,qBAC/B7N,EAAW,UAAWkN,EAAYd,YAClCpM,EAAW,UAAWkN,EAAYK,aAGlC,OADAzC,GAAaoC,IACN,EAIT,GACc,WAAZS,GACA3N,EAAW,aAAckN,EAAYd,WAGrC,OADAtB,GAAaoC,IACN,EAIL,IAACrG,GAAa8G,IAAYhG,GAAYgG,GAAU,CAE9C,IAAChG,GAAYgG,IAAYG,GAAwBH,GAAU,CAC7D,GACEvG,GAAwBC,wBAAwBpH,QAChDD,EAAWoH,GAAwBC,aAAcsG,GAEjD,OAAO,EACT,GACEvG,GAAwBC,wBAAwB0C,UAChD3C,GAAwBC,aAAasG,GAErC,OAAO,CACV,CAGD,GAAIjF,KAAiBG,GAAgB8E,GAAU,CACvC3C,IAAAA,EAAanG,GAAcqI,IAAgBA,EAAYlC,WACvDwB,EAAa5H,GAAcsI,IAAgBA,EAAYV,WAEzDA,GAAAA,GAAcxB,EAGhB,IAFA,IAES+C,EAFUvB,EAAWjM,OAEJ,EAAGwN,GAAK,IAAKA,EACrC/C,EAAWsB,aACT5H,GAAU8H,EAAWuB,IAAI,GACzBpJ,GAAeuI,GAItB,CAGD,OADApC,GAAaoC,IACN,CACR,CAGGA,OAAAA,aAAuBjJ,IAhZA,SAAU/C,GACrC,IAAI8M,EAASnJ,GAAc3D,GAItB8M,GAAWA,EAAOL,UACrBK,EAAS,CACPP,aAAcnE,GACdqE,QAAS,aAIb,IAAMA,EAAUxO,EAAkB+B,EAAQyM,SACpCM,EAAgB9O,EAAkB6O,EAAOL,SAE/C,QAAKnE,GAAmBtI,EAAQuM,gBAI5BvM,EAAQuM,eAAiBrE,GAIvB4E,EAAOP,eAAiBpE,GACP,QAAZsE,EAMLK,EAAOP,eAAiBtE,GAEZ,QAAZwE,IACmB,mBAAlBM,GACCxD,GAA+BwD,IAM9BC,QAAQtD,GAAa+C,IAG1BzM,EAAQuM,eAAiBtE,GAIvB6E,EAAOP,eAAiBpE,GACP,SAAZsE,EAKLK,EAAOP,eAAiBrE,GACP,SAAZuE,GAAsBjD,GAAwBuD,GAKhDC,QAAQrD,GAAgB8C,IAG7BzM,EAAQuM,eAAiBpE,KAKzB2E,EAAOP,eAAiBrE,KACvBsB,GAAwBuD,OAMzBD,EAAOP,eAAiBtE,KACvBsB,GAA+BwD,MAQ/BpD,GAAgB8C,KAChBhD,GAA6BgD,KAAa/C,GAAa+C,MAMpC,0BAAtBhH,KACA6C,GAAmBtI,EAAQuM,eAU9B,CA2SwCU,CAAqBjB,IAC1DpC,GAAaoC,IACN,GAKM,aAAZS,GACa,YAAZA,GACY,aAAZA,IACF3N,EAAW,8BAA+BkN,EAAYd,YAOpDnE,IAA+C,IAAzBiF,EAAYvJ,WAEpCqB,EAAUkI,EAAYK,YACtBvI,EAAUtF,EAAcsF,EAASxC,GAAe,KAChDwC,EAAUtF,EAAcsF,EAASvC,GAAU,KAC3CuC,EAAUtF,EAAcsF,EAAStC,GAAa,KAC1CwK,EAAYK,cAAgBvI,IAC9B/F,EAAUoE,EAAUI,QAAS,CAAEvC,QAASgM,EAAYxI,cACpDwI,EAAYK,YAAcvI,IAK9BgI,GAAa,wBAAyBE,EAAa,OAE5C,IApBLpC,GAAaoC,IACN,EAoBV,EAWKkB,GAAoB,SAAUC,EAAOC,EAAQ1M,GAEjD,GACE4G,KACY,OAAX8F,GAA8B,SAAXA,KACnB1M,KAAS8B,GAAY9B,KAASgI,IAE/B,OAAO,EAOT,GACE9B,KACCF,GAAY0G,IACbtO,EAAW2C,GAAW2L,SAGjB,GAAIzG,IAAmB7H,EAAW4C,GAAW0L,SAG7C,IAAKrH,GAAaqH,IAAW1G,GAAY0G,IAE5C,KAGCR,GAAwBO,KACrBjH,GAAwBC,wBAAwBpH,QAChDD,EAAWoH,GAAwBC,aAAcgH,IAChDjH,GAAwBC,wBAAwB0C,UAC/C3C,GAAwBC,aAAagH,MACvCjH,GAAwBK,8BAA8BxH,QACtDD,EAAWoH,GAAwBK,mBAAoB6G,IACtDlH,GAAwBK,8BAA8BsC,UACrD3C,GAAwBK,mBAAmB6G,KAGrC,OAAXA,GACClH,GAAwBM,iCACtBN,GAAwBC,wBAAwBpH,QAChDD,EAAWoH,GAAwBC,aAAczF,IAChDwF,GAAwBC,wBAAwB0C,UAC/C3C,GAAwBC,aAAazF,KAK3C,OAAO,OAGJ,GAAIqH,GAAoBqF,SAIxB,GACLtO,EAAW6C,GAAgBnD,EAAckC,EAAOmB,GAAiB,WAK5D,GACO,QAAXuL,GAA+B,eAAXA,GAAsC,SAAXA,GACtC,WAAVD,GACkC,IAAlCzO,EAAcgC,EAAO,WACrBmH,GAAcsF,IAMT,GACLtG,KACC/H,EAAW8C,GAAmBpD,EAAckC,EAAOmB,GAAiB,WAIhE,GAAInB,EACT,OAAO,OAMT,OAAO,CACR,EAQKkM,GAA0B,SAAUH,GACxC,OAAOA,EAAQ9N,QAAQ,KAAO,CAC/B,EAYK0O,GAAsB,SAAUrB,GACpC,IAAIsB,EACA5M,EACA0M,EACArN,EAEJ+L,GAAa,2BAA4BE,EAAa,MAEtD,IAAQM,EAAeN,EAAfM,WAGJ,GAACA,EAAD,CAIJ,IAAMiB,EAAY,CAChBC,SAAU,GACVC,UAAW,GACXC,UAAU,EACVC,kBAAmB5H,IAKdhG,IAHPA,EAAIuM,EAAWjN,OAGRU,KAAK,CAEV,IAAA6N,EADAN,EAAOhB,EAAWvM,GACVoK,IAAAA,KAAMoC,IAAAA,aAYVgB,GAXJ7M,EAAiB,UAATyJ,EAAmBmD,EAAK5M,MAAQ9B,EAAW0O,EAAK5M,OACxD0M,EAASvN,GAAkBsK,GAG3BoD,EAAUC,SAAWJ,EACrBG,EAAUE,UAAY/M,EACtB6M,EAAUG,UAAW,EACrBH,EAAUM,mBAAgBtI,EAC1BuG,GAAa,wBAAyBE,EAAauB,GACnD7M,EAAQ6M,EAAUE,WAEdF,EAAUM,gBAKd3D,GAAiBC,EAAM6B,GAGlBuB,EAAUG,UAKX,GAAC5G,KAA4BhI,EAAW,OAAQ4B,GAAhD,CAMAqG,KACFrG,EAAQlC,EAAckC,EAAOY,GAAe,KAC5CZ,EAAQlC,EAAckC,EAAOa,GAAU,KACvCb,EAAQlC,EAAckC,EAAOc,GAAa,MAI5C,IAAM2L,EAAQtN,GAAkBmM,EAAYH,UACxC,GAACqB,GAAkBC,EAAOC,EAAQ1M,GAAlC,CAgBJ,IATI6G,IAAoC,OAAX6F,GAA8B,SAAXA,IAE9ClD,GAAiBC,EAAM6B,GAGvBtL,EAx9B8B,gBAw9BQA,GAKtCsD,IACwB,WAAxBC,EAAOX,IACkC,mBAAlCA,EAAawK,iBAEpB,GAAIvB,QAGF,OAAQjJ,EAAawK,iBAAiBX,EAAOC,IAC3C,IAAK,cACH1M,EAAQsD,GAAmBS,WAAW/D,GACtC,MAGF,IAAK,mBACHA,EAAQsD,GAAmBU,gBAAgBhE,GAY/C,IACE6L,EACFP,EAAY+B,eAAexB,EAAcpC,EAAMzJ,GAG/CsL,EAAYxB,aAAaL,EAAMzJ,GAGjC7C,EAASsE,EAAUI,QACpB,CAAC,MAAOqC,GAAK,CAlDb,CAbA,MAFCsF,GAAiBC,EAAM6B,EAkE1B,CAGDF,GAAa,0BAA2BE,EAAa,KA5GpD,CA6GF,EAOKgC,GAAqB,SAArBA,EAA+BC,GACnC,IAAIC,EACEC,EAAiB3C,GAAgByC,GAKvC,IAFAnC,GAAa,0BAA2BmC,EAAU,MAE1CC,EAAaC,EAAeC,YAElCtC,GAAa,yBAA0BoC,EAAY,MAG/C/B,GAAkB+B,KAKlBA,EAAWpK,mBAAmBlB,GAChCoL,EAAmBE,EAAWpK,SAIhCuJ,GAAoBa,IAItBpC,GAAa,yBAA0BmC,EAAU,KAClD,EA2SD,OAjSA9L,EAAUkM,SAAW,SAAU3D,GAAO3B,IAChCoC,EACAmD,EACAtC,EACAuC,EACAC,EALgCzF,yDAAM,CAAA,EAetC,IANJV,IAAkBqC,KAEhBA,EAAQ,eAIW,iBAAVA,IAAuBkB,GAAQlB,GAAQ,CAChD,GAA8B,mBAAnBA,EAAMrM,SAMTY,MAAAA,EAAgB,8BAJtB,GAAqB,iBADrByL,EAAQA,EAAMrM,YAENY,MAAAA,EAAgB,kCAK3B,CAGD,IAAKkD,EAAUO,YAAa,CAC1B,GACiC,WAA/BuB,EAAOjC,EAAOyM,eACiB,mBAAxBzM,EAAOyM,aACd,CACA,GAAqB,iBAAV/D,EACT,OAAO1I,EAAOyM,aAAa/D,GAG7B,GAAIkB,GAAQlB,GACV,OAAO1I,EAAOyM,aAAa/D,EAAMV,UAEpC,CAED,OAAOU,CACR,CAeD,GAZKzD,IACH6B,GAAaC,GAIf5G,EAAUI,QAAU,GAGC,iBAAVmI,IACTjD,IAAW,GAGTA,IAEEiD,GAAAA,EAAMmB,SAAU,CAClB,IAAMY,EAAU5M,GAAkB6K,EAAMmB,UACpC,IAAClG,GAAa8G,IAAYhG,GAAYgG,GAClCxN,MAAAA,EACJ,0DAGL,OACI,GAAIyL,aAAiB5H,EAKI,KAD9BwL,GADAnD,EAAOV,GAAc,kBACD1G,cAAcqB,WAAWsF,GAAO,IACnCjI,UAA4C,SAA1B6L,EAAazC,UAGX,SAA1ByC,EAAazC,SADtBV,EAAOmD,EAKPnD,EAAKuD,YAAYJ,OAEd,CAGH,IAACnH,KACAJ,KACAC,KAEuB,IAAxB0D,EAAM/L,QAAQ,KAEPqF,OAAAA,IAAsBqD,GACzBrD,GAAmBS,WAAWiG,GAC9BA,EAOF,KAHJS,EAAOV,GAAcC,IAIZvD,OAAAA,GAAa,KAAOE,GAAsBvC,GAAY,EAEhE,CAGGqG,GAAQjE,IACV0C,GAAauB,EAAKwD,YAOpB,IAHMC,IAAAA,EAAepD,GAAgB/D,GAAWiD,EAAQS,GAGhDa,EAAc4C,EAAaR,YAEJ,IAAzBpC,EAAYvJ,UAAkBuJ,IAAgBuC,GAK9CpC,GAAkBH,KAKlBA,EAAYlI,mBAAmBlB,GACjCoL,GAAmBhC,EAAYlI,SAIjCuJ,GAAoBrB,GAEpBuC,EAAUvC,GAMZ,GAHAuC,EAAU,KAGN9G,GACF,OAAOiD,EAIT,GAAIvD,GAAY,CACd,GAAIC,GAGK+D,IAFPqD,EAAatJ,GAAuBqG,KAAKJ,EAAKpH,eAEvCoH,EAAKwD,YAEVH,EAAWE,YAAYvD,EAAKwD,iBAG9BH,EAAarD,EAcf,OAXIpF,GAAa8I,YAAc9I,GAAa+I,iBAQ1CN,EAAapJ,GAAWmG,KAAK5I,EAAkB6L,GAAY,IAGtDA,CACR,CAEGO,IAAAA,EAAiB/H,GAAiBmE,EAAKnB,UAAYmB,EAAKD,UAsBrDlH,OAlBLgD,IACArB,GAAa,aACbwF,EAAKpH,eACLoH,EAAKpH,cAAciL,SACnB7D,EAAKpH,cAAciL,QAAQ7E,MAC3BrL,EAAW4G,EAA0ByF,EAAKpH,cAAciL,QAAQ7E,QAEhE4E,EACE,aAAe5D,EAAKpH,cAAciL,QAAQ7E,KAAO,MAAQ4E,GAIzDhI,KACFgI,EAAiBvQ,EAAcuQ,EAAgBzN,GAAe,KAC9DyN,EAAiBvQ,EAAcuQ,EAAgBxN,GAAU,KACzDwN,EAAiBvQ,EAAcuQ,EAAgBvN,GAAa,MAGvDwC,IAAsBqD,GACzBrD,GAAmBS,WAAWsK,GAC9BA,CACL,EAQD5M,EAAU8M,UAAY,SAAUlG,GAC9BD,GAAaC,GACb9B,IAAa,CACd,EAOD9E,EAAU+M,YAAc,WACtBzG,GAAS,KACTxB,IAAa,CACd,EAYD9E,EAAUgN,iBAAmB,SAAUC,EAAK9B,EAAM5M,GAE3C+H,IACHK,GAAa,CAAD,GAGd,IAAMqE,EAAQtN,GAAkBuP,GAC1BhC,EAASvN,GAAkByN,GACjC,OAAOJ,GAAkBC,EAAOC,EAAQ1M,EACzC,EASDyB,EAAUkN,QAAU,SAAUtD,EAAYuD,GACZ,mBAAjBA,IAIXhK,GAAMyG,GAAczG,GAAMyG,IAAe,GACzChO,EAAUuH,GAAMyG,GAAauD,GAC9B,EAUDnN,EAAUoN,WAAa,SAAUxD,GAC/B,GAAIzG,GAAMyG,GACR,OAAOlO,EAASyH,GAAMyG,GAEzB,EAQD5J,EAAUqN,YAAc,SAAUzD,GAC5BzG,GAAMyG,KACRzG,GAAMyG,GAAc,GAEvB,EAOD5J,EAAUsN,eAAiB,WACzBnK,GAAQ,CAAA,CACT,EAEMnD,CACR,CAEcD"}
|
package/package.json
CHANGED
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
},
|
|
99
99
|
"name": "dompurify",
|
|
100
100
|
"description": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else using Blink or WebKit). DOMPurify is written by security people who have vast background in web attacks and XSS. Fear not.",
|
|
101
|
-
"version": "2.4.
|
|
101
|
+
"version": "2.4.7",
|
|
102
102
|
"directories": {
|
|
103
103
|
"test": "test"
|
|
104
104
|
},
|