ember-source 7.2.0-alpha.4 → 7.3.0-alpha.1

package/dist/prod/packages/shared-chunks/{alias-DsIh-16z.js → alias-Bod6qdNp.js}

@@ -1,12 +1,12 @@
 import { meta } from '../@ember/-internals/meta/lib/meta.js';
 import inspect from '../@ember/debug/lib/inspect.js';
-import { w as untrack, x as validateTag, U as UPDATE_TAG, y as valueForTag, k as consumeTag } from './cache-CG6_L9db.js';
-import { a as tagMetaFor, t as tagFor } from './meta-Ce6-qROq.js';
-import { C as CHAIN_PASS_THROUGH, g as getChainTagsForKey, f as finishLazyChains } from './chain-tags-BP0V2LnZ.js';
-import { m as makeComputedDecorator, d as descriptorForDecorator, a as ComputedDescriptor } from './decorator-B8Lpq40g.js';
-import { f as defineProperty } from './computed-D6MVTTDd.js';
-import { g as get } from './property_get-Sw0SicEZ.js';
-import { s as set } from './property_set-SHEIPMUG.js';
+import { u as untrack, v as validateTag, U as UPDATE_TAG, a as valueForTag, c as consumeTag } from './cache-CofLhaS4.js';
+import { a as tagMetaFor, t as tagFor } from './meta-BJtIZDir.js';
+import { C as CHAIN_PASS_THROUGH, g as getChainTagsForKey, f as finishLazyChains } from './chain-tags-B2J7DsxO.js';
+import { m as makeComputedDecorator, b as descriptorForDecorator, c as ComputedDescriptor } from './decorator-9ikVwsjY.js';
+import { d as defineProperty } from './computed-DtIStxvq.js';
+import { g as get } from './property_get-DAKgbeJX.js';
+import { s as set } from './property_set-BaQJdVfS.js';
 
 function alias(altKey) {
   return makeComputedDecorator(new AliasedProperty(altKey), AliasDecoratorImpl);

package/dist/prod/packages/shared-chunks/{api-CGZbGcvX.js → api-B_poQGXS.js}

@@ -1,10 +1,10 @@
-import { j as setInternalHelperManager, C as CustomHelperManager, s as setInternalComponentManager, k as setInternalModifierManager } from './api-DOLN_cR2.js';
+import { j as setInternalHelperManager, k as setInternalModifierManager, s as setInternalComponentManager, C as CustomHelperManager } from './api-DlJKfm_f.js';
 import { registerDestructor } from '../@glimmer/destroyable/index.js';
-import { d as createConstRef } from './reference-D2agTt1V.js';
-import { a as argsProxyFor } from './args-proxy-CaXVcI8G.js';
-import { b as buildCapabilities } from './capabilities-_5e35539.js';
-import { c as castToBrowser } from './simple-cast-BXTrayoV.js';
-import { w as untrack, n as createUpdatableTag } from './cache-CG6_L9db.js';
+import { a as createConstRef } from './reference-CG0yPgLy.js';
+import { a as argsProxyFor } from './args-proxy-CCoFtYLS.js';
+import { b as buildCapabilities } from './capabilities-BuVYh-vx.js';
+import { a as castToBrowser } from './simple-cast-DCvJLSin.js';
+import { u as untrack, b as createUpdatableTag } from './cache-CofLhaS4.js';
 
 const CAPABILITIES = {
   dynamicLayout: false,

package/dist/prod/packages/shared-chunks/{element-builder-CZePCkbA.js → api-CQexacBn.js}

@@ -1,9 +1,9 @@
-import { b as expect, S as StackImpl } from './collections-By4M3cTy.js';
-import { C as ConcreteBounds, e as isSafeString, n as normalizeStringValue, a as CursorImpl, c as clear } from './normalize-Bx4H3NjB.js';
+import { S as StackImpl, e as expect } from './collections-GpG8lT2g.js';
 import { a as assert } from './assert-Zqc4wiAV.js';
 import { s as setLocalDebugType } from './debug-brand-B1TWjOCH.js';
 import { registerDestructor, destroy } from '../@glimmer/destroyable/index.js';
-import { c as castToBrowser } from './simple-cast-BXTrayoV.js';
+import { i as isSafeString, n as normalizeStringValue, a as CursorImpl, C as ConcreteBounds, c as clear } from './normalize-C_IStty9.js';
+import { a as castToBrowser } from './simple-cast-DCvJLSin.js';
 import { n as normalizeProperty } from './props-fiqxqhAH.js';
 
 const ELEMENT_NODE = 1;
@@ -14,132 +14,32 @@ const NS_SVG = 'http://www.w3.org/2000/svg';
 const INSERT_BEFORE_BEGIN = 'beforebegin';
 const INSERT_BEFORE_END = 'beforeend';
 
-// http://www.w3.org/TR/html/syntax.html#html-integration-point
-const SVG_INTEGRATION_POINTS = {
-  foreignObject: 1,
-  desc: 1,
-  title: 1
-};
-
-// http://www.w3.org/TR/html/syntax.html#adjust-svg-attributes
-// TODO: Adjust SVG attributes
-
-// http://www.w3.org/TR/html/syntax.html#parsing-main-inforeign
-// TODO: Adjust SVG elements
-
-// http://www.w3.org/TR/html/syntax.html#parsing-main-inforeign
-const BLACKLIST_TABLE = Object.create(null);
-class DOMOperations {
-  // Set by this.setupUselessElement() in constructor
-
-  constructor(document) {
-    this.document = document;
-    this.setupUselessElement();
-  }
-
-  // split into separate method so that NodeDOMTreeConstruction
-  // can override it.
-  setupUselessElement() {
-    this.uselessElement = this.document.createElement('div');
-  }
-  createElement(tag, context) {
-    let isElementInSVGNamespace, isHTMLIntegrationPoint, isElementInMathMlNamespace, ns;
-    if (context) {
-      isElementInSVGNamespace = context.namespaceURI === NS_SVG || tag === 'svg';
-      isElementInMathMlNamespace = context.namespaceURI === NS_MATHML || tag === 'math';
-      isHTMLIntegrationPoint = !!SVG_INTEGRATION_POINTS[context.tagName];
-    } else {
-      isElementInSVGNamespace = tag === 'svg';
-      isElementInMathMlNamespace = tag === 'math';
-      isHTMLIntegrationPoint = false;
-    }
-    if ((isElementInMathMlNamespace || isElementInSVGNamespace) && !isHTMLIntegrationPoint) {
-      // FIXME: This does not properly handle <font> with color, face, or
-      // size attributes, which is also disallowed by the spec. We should fix
-      // this.
-      if (BLACKLIST_TABLE[tag]) {
-        throw new Error(`Cannot create a ${tag} inside an SVG context`);
-      }
-      if (isElementInMathMlNamespace) {
-        ns = NS_MATHML;
-      } else {
-        ns = NS_SVG;
-      }
-      return this.document.createElementNS(ns, tag);
-    } else {
-      return this.document.createElement(tag);
-    }
-  }
-  insertBefore(parent, node, reference) {
-    parent.insertBefore(node, reference);
-  }
-  insertHTMLBefore(parent, nextSibling, html) {
-    if (html === '') {
-      const comment = this.createComment('');
-      parent.insertBefore(comment, nextSibling);
-      return new ConcreteBounds(parent, comment, comment);
-    }
-    const prev = nextSibling ? nextSibling.previousSibling : parent.lastChild;
-    let last;
-    if (nextSibling === null) {
-      parent.insertAdjacentHTML(INSERT_BEFORE_END, html);
-      last = expect(parent.lastChild);
-    } else if (nextSibling instanceof HTMLElement) {
-      nextSibling.insertAdjacentHTML('beforebegin', html);
-      last = expect(nextSibling.previousSibling);
-    } else {
-      // Non-element nodes do not support insertAdjacentHTML, so add an
-      // element and call it on that element. Then remove the element.
-      const {
-        uselessElement
-      } = this;
-      parent.insertBefore(uselessElement, nextSibling);
-      uselessElement.insertAdjacentHTML(INSERT_BEFORE_BEGIN, html);
-      last = expect(uselessElement.previousSibling);
-      parent.removeChild(uselessElement);
-    }
-    const first = expect(prev ? prev.nextSibling : parent.firstChild);
-    return new ConcreteBounds(parent, first, last);
-  }
-  createTextNode(text) {
-    return this.document.createTextNode(text);
-  }
-  createComment(data) {
-    return this.document.createComment(data);
-  }
-}
-
-class TreeConstruction extends DOMOperations {
-  createElementNS(namespace, tag) {
-    return this.document.createElementNS(namespace, tag);
-  }
-  setAttribute(element, name, value, namespace = null) {
-    if (namespace) {
-      element.setAttributeNS(namespace, name, value);
-    } else {
-      element.setAttribute(name, value);
-    }
-  }
-}
-const DOMTreeConstruction = TreeConstruction;
-
 const badProtocols = ['javascript:', 'vbscript:'];
-const badTags = ['A', 'BODY', 'LINK', 'IMG', 'IFRAME', 'BASE', 'FORM'];
+const badTags = ['A', 'AREA', 'BODY', 'LINK', 'IMG', 'IFRAME', 'BASE', 'FORM', 'BUTTON', 'INPUT'];
 const badTagsForDataURI = ['EMBED'];
-const badAttributes = ['href', 'src', 'background', 'action'];
+const badTagsForDataProtocol = ['IFRAME', 'OBJECT'];
+const badAttributes = ['href', 'src', 'background', 'action', 'formaction', 'xlink:href'];
 const badAttributesForDataURI = ['src'];
+const badAttributesForDataProtocol = ['src', 'data'];
 function has(array, item) {
   return array.indexOf(item) !== -1;
 }
 function checkURI(tagName, attribute) {
-  return (tagName === null || has(badTags, tagName)) && has(badAttributes, attribute);
+  // SVG tagNames are case-preserved, so the SVG `<a>` element comes through as
+  // lowercase `a` and never matches the uppercase `badTags` entries unless we
+  // normalize first.
+  return (tagName === null || has(badTags, tagName.toUpperCase())) && has(badAttributes, attribute);
 }
 function checkDataURI(tagName, attribute) {
   if (tagName === null) return false;
-  return has(badTagsForDataURI, tagName) && has(badAttributesForDataURI, attribute);
+  return has(badTagsForDataURI, tagName.toUpperCase()) && has(badAttributesForDataURI, attribute);
+}
+function checkDataProtocol(tagName, attribute) {
+  if (tagName === null) return false;
+  return has(badTagsForDataProtocol, tagName.toUpperCase()) && has(badAttributesForDataProtocol, attribute);
 }
 function requiresSanitization(tagName, attribute) {
-  return checkURI(tagName, attribute) || checkDataURI(tagName, attribute);
+  return checkURI(tagName, attribute) || checkDataURI(tagName, attribute) || checkDataProtocol(tagName, attribute);
 }
 function findProtocolForURL() {
   const weirdURL = URL;
@@ -159,7 +59,11 @@ function findProtocolForURL() {
     return url => {
       let protocol = null;
       if (typeof url === 'string') {
-        protocol = nodeURL.parse(url).protocol;
+        // browsers strip ASCII tab/newline/CR from urls before navigating, so
+        // `java\nscript:` runs as `javascript:`. `url.parse` keeps them and reports
+        // a null protocol, slipping past the badProtocols check. Strip them here to
+        // match the WHATWG `URL` parser used on the non-fastboot path.
+        protocol = nodeURL.parse(url.replace(/[\t\n\r]/gu, '')).protocol;
       }
       return protocol === null ? ':' : protocol;
     };
@@ -194,7 +98,7 @@ function sanitizeAttributeValue(element, attribute, value) {
   if (isSafeString(value)) {
     return value.toHTML();
   }
-  const tagName = element.tagName.toUpperCase();
+  const tagName = element.tagName;
   let str = normalizeStringValue(value);
   if (checkURI(tagName, attribute)) {
     let protocol = protocolForUrl(str);
@@ -202,6 +106,12 @@ function sanitizeAttributeValue(element, attribute, value) {
       return `unsafe:${str}`;
     }
   }
+  if (checkDataProtocol(tagName, attribute)) {
+    let protocol = protocolForUrl(str);
+    if (protocol === 'data:' || has(badProtocols, protocol)) {
+      return `unsafe:${str}`;
+    }
+  }
   if (checkDataURI(tagName, attribute)) {
     return `unsafe:${str}`;
   }
@@ -792,4 +702,113 @@ function clientBuilder(env, cursor) {
   return NewTreeBuilder.forInitialRender(env, cursor);
 }
 
-export { BLACKLIST_TABLE as B, COMMENT_NODE as C, DOMOperations as D, ELEMENT_NODE as E, NS_SVG as N, RemoteBlock as R, SimpleDynamicAttribute as S, TEXT_NODE as T, DOMTreeConstruction as a, DynamicAttribute as b, NewTreeBuilder as c, ResettableBlockImpl as d, clientBuilder as e, dynamicAttribute as f };
+// http://www.w3.org/TR/html/syntax.html#html-integration-point
+const SVG_INTEGRATION_POINTS = {
+  foreignObject: 1,
+  desc: 1,
+  title: 1
+};
+
+// http://www.w3.org/TR/html/syntax.html#adjust-svg-attributes
+// TODO: Adjust SVG attributes
+
+// http://www.w3.org/TR/html/syntax.html#parsing-main-inforeign
+// TODO: Adjust SVG elements
+
+// http://www.w3.org/TR/html/syntax.html#parsing-main-inforeign
+const BLACKLIST_TABLE = Object.create(null);
+class DOMOperations {
+  // Set by this.setupUselessElement() in constructor
+
+  constructor(document) {
+    this.document = document;
+    this.setupUselessElement();
+  }
+
+  // split into separate method so that NodeDOMTreeConstruction
+  // can override it.
+  setupUselessElement() {
+    this.uselessElement = this.document.createElement('div');
+  }
+  createElement(tag, context) {
+    let isElementInSVGNamespace, isHTMLIntegrationPoint, isElementInMathMlNamespace, ns;
+    if (context) {
+      isElementInSVGNamespace = context.namespaceURI === NS_SVG || tag === 'svg';
+      isElementInMathMlNamespace = context.namespaceURI === NS_MATHML || tag === 'math';
+      isHTMLIntegrationPoint = !!SVG_INTEGRATION_POINTS[context.tagName];
+    } else {
+      isElementInSVGNamespace = tag === 'svg';
+      isElementInMathMlNamespace = tag === 'math';
+      isHTMLIntegrationPoint = false;
+    }
+    if ((isElementInMathMlNamespace || isElementInSVGNamespace) && !isHTMLIntegrationPoint) {
+      // FIXME: This does not properly handle <font> with color, face, or
+      // size attributes, which is also disallowed by the spec. We should fix
+      // this.
+      if (BLACKLIST_TABLE[tag]) {
+        throw new Error(`Cannot create a ${tag} inside an SVG context`);
+      }
+      if (isElementInMathMlNamespace) {
+        ns = NS_MATHML;
+      } else {
+        ns = NS_SVG;
+      }
+      return this.document.createElementNS(ns, tag);
+    } else {
+      return this.document.createElement(tag);
+    }
+  }
+  insertBefore(parent, node, reference) {
+    parent.insertBefore(node, reference);
+  }
+  insertHTMLBefore(parent, nextSibling, html) {
+    if (html === '') {
+      const comment = this.createComment('');
+      parent.insertBefore(comment, nextSibling);
+      return new ConcreteBounds(parent, comment, comment);
+    }
+    const prev = nextSibling ? nextSibling.previousSibling : parent.lastChild;
+    let last;
+    if (nextSibling === null) {
+      parent.insertAdjacentHTML(INSERT_BEFORE_END, html);
+      last = expect(parent.lastChild);
+    } else if (nextSibling instanceof HTMLElement) {
+      nextSibling.insertAdjacentHTML('beforebegin', html);
+      last = expect(nextSibling.previousSibling);
+    } else {
+      // Non-element nodes do not support insertAdjacentHTML, so add an
+      // element and call it on that element. Then remove the element.
+      const {
+        uselessElement
+      } = this;
+      parent.insertBefore(uselessElement, nextSibling);
+      uselessElement.insertAdjacentHTML(INSERT_BEFORE_BEGIN, html);
+      last = expect(uselessElement.previousSibling);
+      parent.removeChild(uselessElement);
+    }
+    const first = expect(prev ? prev.nextSibling : parent.firstChild);
+    return new ConcreteBounds(parent, first, last);
+  }
+  createTextNode(text) {
+    return this.document.createTextNode(text);
+  }
+  createComment(data) {
+    return this.document.createComment(data);
+  }
+}
+
+class TreeConstruction extends DOMOperations {
+  createElementNS(namespace, tag) {
+    return this.document.createElementNS(namespace, tag);
+  }
+  setAttribute(element, name, value, namespace = null) {
+    if (namespace) {
+      element.setAttributeNS(namespace, name, value);
+    } else {
+      element.setAttribute(name, value);
+    }
+  }
+}
+const DOMTreeConstruction = TreeConstruction;
+
+export { BLACKLIST_TABLE as B, COMMENT_NODE as C, DOMTreeConstruction as D, ELEMENT_NODE as E, NewTreeBuilder as N, RemoteBlock as R, SimpleDynamicAttribute as S, TEXT_NODE as T, DynamicAttribute as a, ResettableBlockImpl as b, clientBuilder as c, dynamicAttribute as d, NS_SVG as e, DOMOperations as f };

package/dist/prod/packages/shared-chunks/{api-DOLN_cR2.js → api-DlJKfm_f.js}

@@ -1,7 +1,7 @@
 import { associateDestroyableChild } from '../@glimmer/destroyable/index.js';
-import { b as createComputeRef, d as createConstRef, U as UNDEFINED_REFERENCE } from './reference-D2agTt1V.js';
-import { a as argsProxyFor } from './args-proxy-CaXVcI8G.js';
-import { b as buildCapabilities } from './capabilities-_5e35539.js';
+import { c as createComputeRef, a as createConstRef, U as UNDEFINED_REFERENCE } from './reference-CG0yPgLy.js';
+import { a as argsProxyFor } from './args-proxy-CCoFtYLS.js';
+import { b as buildCapabilities } from './capabilities-BuVYh-vx.js';
 
 function helperCapabilities(managerAPI, options = {}) {
   return buildCapabilities({

package/dist/prod/packages/shared-chunks/{args-proxy-CaXVcI8G.js → args-proxy-CCoFtYLS.js}

@@ -1,5 +1,5 @@
-import { v as valueForRef } from './reference-D2agTt1V.js';
-import { v as track } from './cache-CG6_L9db.js';
+import { v as valueForRef } from './reference-CG0yPgLy.js';
+import { t as track } from './cache-CofLhaS4.js';
 
 const CUSTOM_TAG_FOR = new WeakMap();
 function getCustomTagFor(obj) {