lambda-live-debugger 1.12.6 → 1.12.8

package/node_modules/fast-xml-parser/lib/fxparser.min.js

@@ -1,2 +1,2 @@
-!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.XMLParser=e():t.XMLParser=e()}(this,()=>(()=>{"use strict";var t={d:(e,r)=>{for(var n in r)t.o(r,n)&&!t.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:r[n]})},o:(t,e)=>Object.prototype.hasOwnProperty.call(t,e),r:t=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})}},e={};t.r(e),t.d(e,{default:()=>ne});var r=":A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD",n=new RegExp("^["+r+"]["+r+"\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$");function i(t,e){for(var r=[],n=e.exec(t);n;){var i=[];i.startIndex=e.lastIndex-n[0].length;for(var a=n.length,s=0;s<a;s++)i.push(n[s]);r.push(i),n=e.exec(t)}return r}var a=function(t){return!(null==n.exec(t))},s=["hasOwnProperty","toString","valueOf","__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__"],o=["__proto__","constructor","prototype"],l=function(t){return s.includes(t)?"__"+t:t},p={preserveOrder:!1,attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,parseTagValue:!0,parseAttributeValue:!1,trimValues:!0,cdataPropName:!1,numberParseOptions:{hex:!0,leadingZeros:!0,eNotation:!0,unicode:!1},tagValueProcessor:function(t,e){return e},attributeValueProcessor:function(t,e){return e},stopNodes:[],alwaysCreateTextNode:!1,isArray:function(){return!1},commentPropName:!1,unpairedTags:[],processEntities:!0,htmlEntities:!1,entityDecoder:null,ignoreDeclaration:!1,ignorePiTags:!1,transformTagName:!1,transformAttributeName:!1,updateTag:function(t,e,r){return t},captureMetaData:!1,maxNestedTags:100,strictReservedNames:!0,jPath:!0,onDangerousProperty:l};function c(t,e){if("string"==typeof t){var r=t.toLowerCase();if(s.some(function(t){return r===t.toLowerCase()}))throw new Error("[SECURITY] Invalid "+e+': "'+t+'" is a reserved JavaScript keyword that could cause prototype pollution');if(o.some(function(t){return r===t.toLowerCase()}))throw new Error("[SECURITY] Invalid "+e+': "'+t+'" is a reserved JavaScript keyword that could cause prototype pollution')}}function h(t,e){return"boolean"==typeof t?{enabled:t,maxEntitySize:1e4,maxExpansionDepth:1e4,maxTotalExpansions:1/0,maxExpandedLength:1e5,maxEntityCount:1e3,allowedTags:null,tagFilter:null,appliesTo:"all"}:"object"==typeof t&&null!==t?{enabled:!1!==t.enabled,maxEntitySize:Math.max(1,null!=(r=t.maxEntitySize)?r:1e4),maxExpansionDepth:Math.max(1,null!=(n=t.maxExpansionDepth)?n:1e4),maxTotalExpansions:Math.max(1,null!=(i=t.maxTotalExpansions)?i:1/0),maxExpandedLength:Math.max(1,null!=(a=t.maxExpandedLength)?a:1e5),maxEntityCount:Math.max(1,null!=(s=t.maxEntityCount)?s:1e3),allowedTags:null!=(o=t.allowedTags)?o:null,tagFilter:null!=(l=t.tagFilter)?l:null,appliesTo:null!=(p=t.appliesTo)?p:"all"}:h(!0);var r,n,i,a,s,o,l,p}var d,u=function(t){for(var e=Object.assign({},p,t),r=0,n=[{value:e.attributeNamePrefix,name:"attributeNamePrefix"},{value:e.attributesGroupName,name:"attributesGroupName"},{value:e.textNodeName,name:"textNodeName"},{value:e.cdataPropName,name:"cdataPropName"},{value:e.commentPropName,name:"commentPropName"}];r<n.length;r++){var i=n[r],a=i.value,s=i.name;a&&c(a,s)}return null===e.onDangerousProperty&&(e.onDangerousProperty=l),e.processEntities=h(e.processEntities,e.htmlEntities),e.unpairedTagsSet=new Set(e.unpairedTags),e.stopNodes&&Array.isArray(e.stopNodes)&&(e.stopNodes=e.stopNodes.map(function(t){return"string"==typeof t&&t.startsWith("*.")?".."+t.substring(2):t})),e};d="function"!=typeof Symbol?"@@xmlMetadata":Symbol("XML Node Metadata");var f=function(){function t(t){this.tagname=t,this.child=[],this[":@"]=Object.create(null)}var e=t.prototype;return e.add=function(t,e){var r;"__proto__"===t&&(t="#__proto__"),this.child.push(((r={})[t]=e,r))},e.addChild=function(t,e){var r,n;"__proto__"===t.tagname&&(t.tagname="#__proto__"),t[":@"]&&Object.keys(t[":@"]).length>0?this.child.push(((r={})[t.tagname]=t.child,r[":@"]=t[":@"],r)):this.child.push(((n={})[t.tagname]=t.child,n)),void 0!==e&&(this.child[this.child.length-1][d]={startIndex:e})},t.getMetaDataSymbol=function(){return d},t}();const g=":A-Za-z_À-ÖØ-öø-˿Ͱ-ͽͿ-҆҈-῿‌-‍⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�",m=":A-Za-z_À-˿Ͱ-ͽͿ-҆҈-῿‌-‍⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�𐀀-󯿿",v=m+"\\-\\.\\d·̀-ͯ҇‿-⁀",x=(t,e,r="")=>{const n=`[${t.replace(":","")}][${e.replace(":","")}]*`;return{name:new RegExp(`^[${t}][${e}]*$`,r),ncName:new RegExp(`^${n}$`,r),qName:new RegExp(`^${n}(?::${n})?$`,r),nmToken:new RegExp(`^[${e}]+$`,r),nmTokens:new RegExp(`^[${e}]+(?:\\s+[${e}]+)*$`,r)}},b=x(g,g+"\\-\\.\\d·̀-ͯ‿-⁀"),y=x(m,v,"u"),E=":A-Za-z_",w=x(E,E+"\\-\\.\\d"),S=(t,{xmlVersion:e="1.0",asciiOnly:r=!1}={})=>((t="1.0",e=!1)=>e?w:"1.1"===t?y:b)(e,r).qName.test(t);var N=function(){function t(t,e){this.suppressValidationErr=!t,this.options=t,this.xmlVersion=e||1}var e=t.prototype;return e.setXmlVersion=function(t){void 0===t&&(t=1),this.xmlVersion=t},e.readDocType=function(t,e){var r=Object.create(null),n=0;if("O"!==t[e+3]||"C"!==t[e+4]||"T"!==t[e+5]||"Y"!==t[e+6]||"P"!==t[e+7]||"E"!==t[e+8])throw new Error("Invalid Tag instead of DOCTYPE");e+=9;for(var i=1,a=!1,s=!1;e<t.length;e++)if("<"!==t[e]||s)if(">"===t[e]){if(s?"-"===t[e-1]&&"-"===t[e-2]&&(s=!1,i--):i--,0===i)break}else"["===t[e]?a=!0:t[e];else{if(a&&T(t,"!ENTITY",e)){e+=7;var o,l=void 0,p=this.readEntityExp(t,e+1,this.suppressValidationErr);if(o=p[0],l=p[1],e=p[2],-1===l.indexOf("&")){if(!1!==this.options.enabled&&null!=this.options.maxEntityCount&&n>=this.options.maxEntityCount)throw new Error("Entity count ("+(n+1)+") exceeds maximum allowed ("+this.options.maxEntityCount+")");r[o]=l,n++}}else if(a&&T(t,"!ELEMENT",e))e+=8,e=this.readElementExp(t,e+1).index;else if(a&&T(t,"!ATTLIST",e))e+=8;else if(a&&T(t,"!NOTATION",e))e+=9,e=this.readNotationExp(t,e+1,this.suppressValidationErr).index;else{if(!T(t,"!--",e))throw new Error("Invalid DOCTYPE");s=!0}i++}if(0!==i)throw new Error("Unclosed DOCTYPE");return{entities:r,i:e}},e.readEntityExp=function(t,e){for(var r=e=_(t,e);e<t.length&&!/\s/.test(t[e])&&'"'!==t[e]&&"'"!==t[e];)e++;var n=t.substring(r,e);if(A(n,{xmlVersion:this.xmlVersion}),e=_(t,e),!this.suppressValidationErr){if("SYSTEM"===t.substring(e,e+6).toUpperCase())throw new Error("External entities are not supported");if("%"===t[e])throw new Error("Parameter entities are not supported")}var i,a=this.readIdentifierVal(t,e,"entity");if(e=a[0],i=a[1],!1!==this.options.enabled&&null!=this.options.maxEntitySize&&i.length>this.options.maxEntitySize)throw new Error('Entity "'+n+'" size ('+i.length+") exceeds maximum allowed size ("+this.options.maxEntitySize+")");return[n,i,--e]},e.readNotationExp=function(t,e){for(var r=e=_(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var n=t.substring(r,e);!this.suppressValidationErr&&A(n,{xmlVersion:this.xmlVersion}),e=_(t,e);var i=t.substring(e,e+6).toUpperCase();if(!this.suppressValidationErr&&"SYSTEM"!==i&&"PUBLIC"!==i)throw new Error('Expected SYSTEM or PUBLIC, found "'+i+'"');e+=i.length,e=_(t,e);var a=null,s=null;if("PUBLIC"===i){var o=this.readIdentifierVal(t,e,"publicIdentifier");if(e=o[0],a=o[1],'"'===t[e=_(t,e)]||"'"===t[e]){var l=this.readIdentifierVal(t,e,"systemIdentifier");e=l[0],s=l[1]}}else if("SYSTEM"===i){var p=this.readIdentifierVal(t,e,"systemIdentifier");if(e=p[0],s=p[1],!this.suppressValidationErr&&!s)throw new Error("Missing mandatory system identifier for SYSTEM notation")}return{notationName:n,publicIdentifier:a,systemIdentifier:s,index:--e}},e.readIdentifierVal=function(t,e,r){var n,i=t[e];if('"'!==i&&"'"!==i)throw new Error('Expected quoted string, found "'+i+'"');for(var a=++e;e<t.length&&t[e]!==i;)e++;if(n=t.substring(a,e),t[e]!==i)throw new Error("Unterminated "+r+" value");return[++e,n]},e.readElementExp=function(t,e){for(var r=e=_(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var n=t.substring(r,e);if(!this.suppressValidationErr&&!S(n,{xmlVersion:this.xmlVersion}))throw new Error('Invalid element name: "'+n+'"');var i="";if("E"===t[e=_(t,e)]&&T(t,"MPTY",e))e+=4;else if("A"===t[e]&&T(t,"NY",e))e+=2;else if("("===t[e]){for(var a=++e;e<t.length&&")"!==t[e];)e++;if(i=t.substring(a,e),")"!==t[e])throw new Error("Unterminated content model")}else if(!this.suppressValidationErr)throw new Error('Invalid Element Expression, found "'+t[e]+'"');return{elementName:n,contentModel:i.trim(),index:e}},e.readAttlistExp=function(t,e){for(var r=e=_(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var n=t.substring(r,e);for(A(n,{xmlVersion:this.xmlVersion}),r=e=_(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var i=t.substring(r,e);if(!A(i,{xmlVersion:this.xmlVersion}))throw new Error('Invalid attribute name: "'+i+'"');e=_(t,e);var a="";if("NOTATION"===t.substring(e,e+8).toUpperCase()){if(a="NOTATION","("!==t[e=_(t,e+=8)])throw new Error("Expected '(', found \""+t[e]+'"');e++;for(var s=[];e<t.length&&")"!==t[e];){for(var o=e;e<t.length&&"|"!==t[e]&&")"!==t[e];)e++;var l=t.substring(o,e);if(!A(l=l.trim(),{xmlVersion:this.xmlVersion}))throw new Error('Invalid notation name: "'+l+'"');s.push(l),"|"===t[e]&&(e++,e=_(t,e))}if(")"!==t[e])throw new Error("Unterminated list of notations");e++,a+=" ("+s.join("|")+")"}else{for(var p=e;e<t.length&&!/\s/.test(t[e]);)e++;if(a+=t.substring(p,e),!this.suppressValidationErr&&!["CDATA","ID","IDREF","IDREFS","ENTITY","ENTITIES","NMTOKEN","NMTOKENS"].includes(a.toUpperCase()))throw new Error('Invalid attribute type: "'+a+'"')}e=_(t,e);var c="";if("#REQUIRED"===t.substring(e,e+8).toUpperCase())c="#REQUIRED",e+=8;else if("#IMPLIED"===t.substring(e,e+7).toUpperCase())c="#IMPLIED",e+=7;else{var h=this.readIdentifierVal(t,e,"ATTLIST");e=h[0],c=h[1]}return{elementName:n,attributeName:i,attributeType:a,defaultValue:c,index:e}},t}(),_=function(t,e){for(;e<t.length&&/\s/.test(t[e]);)e++;return e};function T(t,e,r){for(var n=0;n<e.length;n++)if(e[n]!==t[r+n+1])return!1;return!0}function A(t,e){if(S(t,{xmlVersion:e}))return t;throw new Error("Invalid entity name "+t)}const C=[48,1632,1776,2406,2534,2662,2790,2918,3046,3174,3302,3430,3558,3664,3792,3872,4160,4240,6112,6160,6470,6608,6784,6800,6992,7088,7232,7248,65296,120782,120792,120802,120812,120822,66720,68912,69734,69872,69942,70096,70384,70736,70864,71248,71360,71472,71904,72016,72688,72784,73040,73120,73552,92768,92864,93008,123200,123632,124144,125264,130032],I=new Map,O=1632,j=new Uint8Array(63904).fill(255);for(const t of C)for(let e=0;e<10;e++){const r=t+e;r<=65535?j[r-O]=e:I.set(r,e)}const k=new Set([8722,65293,65123]),L=/^[-+]?0x[a-fA-F0-9]+$/,P=/^0b[01]+$/,D=/^0o[0-7]+$/,M=/^([\-\+])?(0*)([0-9]*(\.[0-9]*)?)$/,$={hex:!0,binary:!1,octal:!1,leadingZeros:!0,decimalPoint:".",eNotation:!0,infinity:"original",unicode:!1};function R(t,e={}){if(e=Object.assign({},$,e),!t||"string"!=typeof t)return t;let r=t.trim();if(0===r.length)return t;if(void 0!==e.skipLike&&e.skipLike.test(r))return t;if("0"===r)return 0;if(e.unicode&&(r=function(t){if("string"!=typeof t)return t;const e=t.length;if(0===e)return t;let r=-1;for(let n=0;n<e;n++){const i=t.charCodeAt(n);if(!(i>=48&&i<=57||45===i))if(i<O){if(k.has(i)){r=n;break}}else if(i>=55296&&i<=56319){if(n+1<e){const e=t.charCodeAt(n+1);if(e>=56320&&e<=57343){const t=65536+(i-55296<<10)+(e-56320);if(I.has(t)){r=n;break}}}}else if(255!==j[i-O]||k.has(i)){r=n;break}}if(-1===r)return t;const n=[];r>0&&n.push(t.slice(0,r));for(let i=r;i<e;i++){const r=t.charCodeAt(i);if(r>=48&&r<=57||45===r){n.push(t[i]);continue}if(r<O){n.push(k.has(r)?"-":t[i]);continue}if(r>=55296&&r<=56319){if(i+1<e){const e=t.charCodeAt(i+1);if(e>=56320&&e<=57343){const t=65536+(r-55296<<10)+(e-56320),a=I.get(t);if(void 0!==a){n.push(String.fromCharCode(a+48)),i++;continue}}}n.push(t[i]);continue}if(k.has(r)){n.push("-");continue}const a=j[r-O];n.push(255!==a?String.fromCharCode(a+48):t[i])}return n.join("")}(r),"0"===r))return 0;if(e.hex&&L.test(r))return q(r,16);if(e.binary&&P.test(r))return q(r,2);if(e.octal&&D.test(r))return q(r,8);if(isFinite(r)){if(r.includes("e")||r.includes("E"))return function(t,e,r){if(!r.eNotation)return t;const n=e.match(V);if(n){let i=n[1]||"";const a=-1===n[3].indexOf("e")?"E":"e",s=n[2],o=i?t[s.length+1]===a:t[s.length]===a;return s.length>1&&o?t:(1!==s.length||!n[3].startsWith(`.${a}`)&&n[3][0]!==a)&&s.length>0?r.leadingZeros&&!o?(e=(n[1]||"")+n[3],Number(e)):t:Number(e)}return t}(t,r,e);{const i=M.exec(r);if(i){const a=i[1]||"",s=i[2];let o=(n=i[3])&&-1!==n.indexOf(".")?("."===(n=n.replace(/0+$/,""))?n="0":"."===n[0]?n="0"+n:"."===n[n.length-1]&&(n=n.substring(0,n.length-1)),n):n;const l=a?"."===t[s.length+1]:"."===t[s.length];if(!e.leadingZeros&&(s.length>1||1===s.length&&!l))return t;{const n=Number(r),i=String(n);if(0===n)return n;if(-1!==i.search(/[eE]/))return e.eNotation?n:t;if(-1!==r.indexOf("."))return"0"===i||i===o||i===`${a}${o}`?n:t;let l=s?o:r;return s?l===i||a+l===i?n:t:l===i||l===a+i?n:t}}return t}}var n;return function(t,e,r){const n=e===1/0;switch(r.infinity.toLowerCase()){case"null":return null;case"infinity":return e;case"string":return n?"Infinity":"-Infinity";default:return t}}(t,Number(r),e)}const V=/^([-+])?(0*)(\d*(\.\d*)?[eE][-\+]?\d+)$/;function q(t,e){const r=t.trim();if(2!==e&&8!==e||(t=r.substring(2)),parseInt)return parseInt(t,e);if(Number.parseInt)return Number.parseInt(t,e);if(window&&window.parseInt)return window.parseInt(t,e);throw new Error("parseInt, Number.parseInt, window.parseInt are not supported")}function U(t,e){(null==e||e>t.length)&&(e=t.length);for(var r=0,n=Array(e);r<e;r++)n[r]=t[r];return n}class F{constructor(t){this._matcher=t}get separator(){return this._matcher.separator}getCurrentTag(){const t=this._matcher.path;return t.length>0?t[t.length-1].tag:void 0}getCurrentNamespace(){const t=this._matcher.path;return t.length>0?t[t.length-1].namespace:void 0}getAttrValue(t){const e=this._matcher.path;if(0!==e.length)return e[e.length-1].values?.[t]}hasAttr(t){const e=this._matcher.path;if(0===e.length)return!1;const r=e[e.length-1];return void 0!==r.values&&t in r.values}getAnyParentAttr(t){return this._matcher.getAnyParentAttr(t)}hasAnyParentAttr(t){return this._matcher.hasAnyParentAttr(t)}getPosition(){const t=this._matcher.path;return 0===t.length?-1:t[t.length-1].position??0}getCounter(){const t=this._matcher.path;return 0===t.length?-1:t[t.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this._matcher.path.length}toString(t,e=!0){return this._matcher.toString(t,e)}toArray(){return this._matcher.path.map(t=>t.tag)}matches(t){return this._matcher.matches(t)}matchesAny(t){return t.matchesAny(this._matcher)}}class B{constructor(t={}){this.separator=t.separator||".",this.path=[],this.siblingStacks=[],this._pathStringCache=null,this._view=new F(this),this._keptAttrs=[]}push(t,e=null,r=null,n=null){this._pathStringCache=null,this.path.length>0&&(this.path[this.path.length-1].values=void 0);const i=this.path.length;let a=this.siblingStacks[i];a||(a={counts:new Map,total:0},this.siblingStacks[i]=a);const s=r?`${r}:${t}`:t,o=a.counts.get(s)||0,l=a.total;a.counts.set(s,o+1),a.total++;const p={tag:t,position:l,counter:o};null!=r&&(p.namespace=r),null!=e&&(p.values=e),this.path.push(p);const c=this.path.length,h=null!==n?n.keep:null;if(null!=h&&h.length>0&&e)for(let t=0;t<h.length;t++){const r=h[t];void 0!==e[r]&&this._keptAttrs.push({depth:c,name:r,value:e[r]})}}pop(){if(0===this.path.length)return;this._pathStringCache=null;const t=this.path.pop();this.siblingStacks.length>this.path.length+1&&(this.siblingStacks.length=this.path.length+1);const e=this.path.length+1;for(;this._keptAttrs.length>0&&this._keptAttrs[this._keptAttrs.length-1].depth>=e;)this._keptAttrs.pop();return t}updateCurrent(t){if(this.path.length>0){const e=this.path[this.path.length-1];null!=t&&(e.values=t)}}getCurrentTag(){return this.path.length>0?this.path[this.path.length-1].tag:void 0}getCurrentNamespace(){return this.path.length>0?this.path[this.path.length-1].namespace:void 0}getAttrValue(t){if(0!==this.path.length)return this.path[this.path.length-1].values?.[t]}hasAttr(t){if(0===this.path.length)return!1;const e=this.path[this.path.length-1];return void 0!==e.values&&t in e.values}getAnyParentAttr(t){const e=this._keptAttrs;for(let r=e.length-1;r>=0;r--)if(e[r].name===t)return e[r].value}hasAnyParentAttr(t){const e=this._keptAttrs;for(let r=e.length-1;r>=0;r--)if(e[r].name===t)return!0;return!1}getPosition(){return 0===this.path.length?-1:this.path[this.path.length-1].position??0}getCounter(){return 0===this.path.length?-1:this.path[this.path.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this.path.length}toString(t,e=!0){const r=t||this.separator;if(r===this.separator&&!0===e){if(null!==this._pathStringCache)return this._pathStringCache;const t=this.path.map(t=>t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(r);return this._pathStringCache=t,t}return this.path.map(t=>e&&t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(r)}toArray(){return this.path.map(t=>t.tag)}reset(){this._pathStringCache=null,this.path=[],this.siblingStacks=[],this._keptAttrs=[]}matches(t){const e=t.segments;return 0!==e.length&&(t.hasDeepWildcard()?this._matchWithDeepWildcard(e):this._matchSimple(e))}_matchSimple(t){if(this.path.length!==t.length)return!1;for(let e=0;e<t.length;e++)if(!this._matchSegment(t[e],this.path[e],e===this.path.length-1))return!1;return!0}_matchWithDeepWildcard(t){let e=this.path.length-1,r=t.length-1;for(;r>=0&&e>=0;){const n=t[r];if("deep-wildcard"===n.type){if(r--,r<0)return!0;const n=t[r];let i=!1;for(let t=e;t>=0;t--)if(this._matchSegment(n,this.path[t],t===this.path.length-1)){e=t-1,r--,i=!0;break}if(!i)return!1}else{if(!this._matchSegment(n,this.path[e],e===this.path.length-1))return!1;e--,r--}}return r<0}_matchSegment(t,e,r){if("*"!==t.tag&&t.tag!==e.tag)return!1;if(void 0!==t.namespace&&"*"!==t.namespace&&t.namespace!==e.namespace)return!1;if(void 0!==t.attrName){if(!r)return!1;if(!e.values||!(t.attrName in e.values))return!1;if(void 0!==t.attrValue&&String(e.values[t.attrName])!==String(t.attrValue))return!1}if(void 0!==t.position){if(!r)return!1;const n=e.counter??0;if("first"===t.position&&0!==n)return!1;if("odd"===t.position&&n%2!=1)return!1;if("even"===t.position&&n%2!=0)return!1;if("nth"===t.position&&n!==t.positionValue)return!1}return!0}matchesAny(t){return t.matchesAny(this)}snapshot(){return{path:this.path.map(t=>({...t})),siblingStacks:this.siblingStacks.map(t=>t?{counts:new Map(t.counts),total:t.total}:t),keptAttrs:this._keptAttrs.map(t=>({...t}))}}restore(t){this._pathStringCache=null,this.path=t.path.map(t=>({...t})),this.siblingStacks=t.siblingStacks.map(t=>t?{counts:new Map(t.counts),total:t.total}:t),this._keptAttrs=(t.keptAttrs||[]).map(t=>({...t}))}readOnly(){return this._view}}class X{constructor(t,e={},r){this.pattern=t,this.separator=e.separator||".",this.segments=this._parse(t),this.data=r,this._hasDeepWildcard=this.segments.some(t=>"deep-wildcard"===t.type),this._hasAttributeCondition=this.segments.some(t=>void 0!==t.attrName),this._hasPositionSelector=this.segments.some(t=>void 0!==t.position)}_parse(t){const e=[];let r=0,n="";for(;r<t.length;)t[r]===this.separator?r+1<t.length&&t[r+1]===this.separator?(n.trim()&&(e.push(this._parseSegment(n.trim())),n=""),e.push({type:"deep-wildcard"}),r+=2):(n.trim()&&e.push(this._parseSegment(n.trim())),n="",r++):(n+=t[r],r++);return n.trim()&&e.push(this._parseSegment(n.trim())),e}_parseSegment(t){const e={type:"tag"};let r=null,n=t;const i=t.match(/^([^\[]+)(\[[^\]]*\])(.*)$/);if(i&&(n=i[1]+i[3],i[2])){const t=i[2].slice(1,-1);t&&(r=t)}let a,s,o=n;if(n.includes("::")){const e=n.indexOf("::");if(a=n.substring(0,e).trim(),o=n.substring(e+2).trim(),!a)throw new Error(`Invalid namespace in pattern: ${t}`)}let l=null;if(o.includes(":")){const t=o.lastIndexOf(":"),e=o.substring(0,t).trim(),r=o.substring(t+1).trim();["first","last","odd","even"].includes(r)||/^nth\(\d+\)$/.test(r)?(s=e,l=r):s=o}else s=o;if(!s)throw new Error(`Invalid segment pattern: ${t}`);if(e.tag=s,a&&(e.namespace=a),r)if(r.includes("=")){const t=r.indexOf("=");e.attrName=r.substring(0,t).trim(),e.attrValue=r.substring(t+1).trim()}else e.attrName=r.trim();if(l){const t=l.match(/^nth\((\d+)\)$/);t?(e.position="nth",e.positionValue=parseInt(t[1],10)):e.position=l}return e}get length(){return this.segments.length}hasDeepWildcard(){return this._hasDeepWildcard}hasAttributeCondition(){return this._hasAttributeCondition}hasPositionSelector(){return this._hasPositionSelector}toString(){return this.pattern}}class W{constructor(){this._byDepthAndTag=new Map,this._wildcardByDepth=new Map,this._deepWildcards=[],this._deepByTerminalTag=new Map,this._patterns=new Set,this._sealed=!1}add(t){if(this._sealed)throw new TypeError("ExpressionSet is sealed. Create a new ExpressionSet to add more expressions.");if(this._patterns.has(t.pattern))return this;if(this._patterns.add(t.pattern),t.hasDeepWildcard()){const e=t.segments[t.segments.length-1];if(e&&"deep-wildcard"!==e.type&&"*"!==e.tag){const r=e.tag;this._deepByTerminalTag.has(r)||this._deepByTerminalTag.set(r,[]),this._deepByTerminalTag.get(r).push(t)}else this._deepWildcards.push(t);return this}const e=t.length,r=t.segments[t.segments.length-1],n=r?.tag;if(n&&"*"!==n){const r=`${e}:${n}`;this._byDepthAndTag.has(r)||this._byDepthAndTag.set(r,[]),this._byDepthAndTag.get(r).push(t)}else this._wildcardByDepth.has(e)||this._wildcardByDepth.set(e,[]),this._wildcardByDepth.get(e).push(t);return this}addAll(t){for(const e of t)this.add(e);return this}has(t){return this._patterns.has(t.pattern)}get size(){return this._patterns.size}seal(){return this._sealed=!0,this}get isSealed(){return this._sealed}matchesAny(t){return null!==this.findMatch(t)}findMatch(t){const e=t.getDepth(),r=t.getCurrentTag(),n=`${e}:${r}`,i=this._byDepthAndTag.get(n);if(i)for(let e=0;e<i.length;e++)if(t.matches(i[e]))return i[e];const a=this._wildcardByDepth.get(e);if(a)for(let e=0;e<a.length;e++)if(t.matches(a[e]))return a[e];const s=this._deepByTerminalTag.get(r);if(s)for(let e=0;e<s.length;e++)if(t.matches(s[e]))return s[e];for(let e=0;e<this._deepWildcards.length;e++)if(t.matches(this._deepWildcards[e]))return this._deepWildcards[e];return null}}const Y={cent:"¢",pound:"£",curren:"¤",yen:"¥",euro:"€",dollar:"$",fnof:"ƒ",inr:"₹",af:"؋",birr:"ብር",peso:"₱",rub:"₽",won:"₩",yuan:"¥",cedil:"¸"},H={amp:"&",apos:"'",gt:">",lt:"<",quot:'"'},G={nbsp:" ",copy:"©",reg:"®",trade:"™",mdash:"—",ndash:"–",hellip:"…",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",bull:"•",para:"¶",sect:"§",deg:"°",frac12:"½",frac14:"¼",frac34:"¾"},z=Object.freeze({ALLOW:"allow",BLOCK:"block",THROW:"throw"}),Q=new Set("!?\\\\/[]$%{}^&*()<>|+");function J(t){if("#"===t[0])throw new Error(`[EntityReplacer] Invalid character '#' in entity name: "${t}"`);for(const e of t)if(Q.has(e))throw new Error(`[EntityReplacer] Invalid character '${e}' in entity name: "${t}"`);return t}function Z(...t){const e=Object.create(null);for(const r of t)if(r)for(const t of Object.keys(r)){const n=r[t];if("string"==typeof n)e[t]=n;else if(n&&"object"==typeof n&&void 0!==n.val){const r=n.val;"string"==typeof r&&(e[t]=r)}}return e}const K="external",tt="base",et="all",rt=Object.freeze({allow:0,leave:1,remove:2,throw:3}),nt=new Set([9,10,13]);class it{constructor(t={}){var e;this._limit=t.limit||{},this._maxTotalExpansions=this._limit.maxTotalExpansions||0,this._maxExpandedLength=this._limit.maxExpandedLength||0,this._postCheck="function"==typeof t.postCheck?t.postCheck:t=>t,this._limitTiers=(e=this._limit.applyLimitsTo??K)&&e!==K?e===et?new Set([et]):e===tt?new Set([tt]):Array.isArray(e)?new Set(e):new Set([K]):new Set([K]),this._numericAllowed=t.numericAllowed??!0,this._baseMap=Z(H,t.namedEntities||null),this._externalMap=Object.create(null),this._inputMap=Object.create(null),this._totalExpansions=0,this._expandedLength=0,this._removeSet=new Set(t.remove&&Array.isArray(t.remove)?t.remove:[]),this._leaveSet=new Set(t.leave&&Array.isArray(t.leave)?t.leave:[]);const r=function(t){if(!t)return{xmlVersion:1,onLevel:rt.allow,nullLevel:rt.remove};const e=1.1===t.xmlVersion?1.1:1,r=rt[t.onNCR]??rt.allow,n=rt[t.nullNCR]??rt.remove;return{xmlVersion:e,onLevel:r,nullLevel:Math.max(n,rt.remove)}}(t.ncr);this._ncrXmlVersion=r.xmlVersion,this._ncrOnLevel=r.onLevel,this._ncrNullLevel=r.nullLevel,this._onExternalEntity="function"==typeof t.onExternalEntity?t.onExternalEntity:null,this._onInputEntity="function"==typeof t.onInputEntity?t.onInputEntity:null}_applyRegistrationHook(t,e,r,n){if(!t)return!0;const i=t(e,r);if(i===z.BLOCK)return!1;if(i===z.THROW)throw new Error(`[EntityDecoder] Registration of ${n} entity "&${e};" was rejected by hook`);return!0}setExternalEntities(t){if(t)for(const e of Object.keys(t))J(e);if(!this._onExternalEntity)return void(this._externalMap=Z(t));const e=Z(t),r=Object.create(null);for(const[t,n]of Object.entries(e))this._applyRegistrationHook(this._onExternalEntity,t,n,"external")&&(r[t]=n);this._externalMap=r}addExternalEntity(t,e){J(t),"string"==typeof e&&-1===e.indexOf("&")&&this._applyRegistrationHook(this._onExternalEntity,t,e,"external")&&(this._externalMap[t]=e)}addInputEntities(t){if(this._totalExpansions=0,this._expandedLength=0,!this._onInputEntity)return void(this._inputMap=Z(t));const e=Z(t),r=Object.create(null);for(const[t,n]of Object.entries(e))this._applyRegistrationHook(this._onInputEntity,t,n,"input")&&(r[t]=n);this._inputMap=r}reset(){return this._inputMap=Object.create(null),this._totalExpansions=0,this._expandedLength=0,this}setXmlVersion(t){this._ncrXmlVersion=1.1===t?1.1:1}decode(t){if("string"!=typeof t||0===t.length)return t;if(-1===t.indexOf("&"))return t;const e=t,r=[],n=t.length;let i=0,a=0;const s=this._maxTotalExpansions>0,o=this._maxExpandedLength>0,l=s||o;for(;a<n;){if(38!==t.charCodeAt(a)){a++;continue}let e=a+1;for(;e<n&&59!==t.charCodeAt(e)&&e-a<=32;)e++;if(e>=n||59!==t.charCodeAt(e)){a++;continue}const p=t.slice(a+1,e);if(0===p.length){a++;continue}let c,h;if(this._removeSet.has(p))c="",void 0===h&&(h=K);else{if(this._leaveSet.has(p)){a++;continue}if(35===p.charCodeAt(0)){const t=this._resolveNCR(p);if(void 0===t){a++;continue}c=t,h=tt}else{const t=this._resolveName(p);c=t?.value,h=t?.tier}}if(void 0!==c){if(a>i&&r.push(t.slice(i,a)),r.push(c),i=e+1,a=i,l&&this._tierCounts(h)){if(s&&(this._totalExpansions++,this._totalExpansions>this._maxTotalExpansions))throw new Error(`[EntityReplacer] Entity expansion count limit exceeded: ${this._totalExpansions} > ${this._maxTotalExpansions}`);if(o){const t=c.length-(p.length+2);if(t>0&&(this._expandedLength+=t,this._expandedLength>this._maxExpandedLength))throw new Error(`[EntityReplacer] Expanded content length limit exceeded: ${this._expandedLength} > ${this._maxExpandedLength}`)}}}else a++}i<n&&r.push(t.slice(i));const p=0===r.length?t:r.join("");return this._postCheck(p,e)}_tierCounts(t){return!!this._limitTiers.has(et)||this._limitTiers.has(t)}_resolveName(t){return t in this._inputMap?{value:this._inputMap[t],tier:K}:t in this._externalMap?{value:this._externalMap[t],tier:K}:t in this._baseMap?{value:this._baseMap[t],tier:tt}:void 0}_classifyNCR(t){return 0===t?this._ncrNullLevel:t>=55296&&t<=57343||1===this._ncrXmlVersion&&t>=1&&t<=31&&!nt.has(t)?rt.remove:-1}_applyNCRAction(t,e,r){switch(t){case rt.allow:return String.fromCodePoint(r);case rt.remove:return"";case rt.leave:return;case rt.throw:throw new Error(`[EntityDecoder] Prohibited numeric character reference &${e}; (U+${r.toString(16).toUpperCase().padStart(4,"0")})`);default:return String.fromCodePoint(r)}}_resolveNCR(t){const e=t.charCodeAt(1);let r;if(r=120===e||88===e?parseInt(t.slice(2),16):parseInt(t.slice(1),10),Number.isNaN(r)||r<0||r>1114111)return;const n=this._classifyNCR(r);if(!this._numericAllowed&&n<rt.remove)return;const i=-1===n?this._ncrOnLevel:Math.max(this._ncrOnLevel,n);return this._applyNCRAction(i,t,r)}}const at=[{id:"sql-block-comment-open",description:"SQL block comment open: /* ... */ — unusual in legitimate user text",pattern:/\/\*/},{id:"sql-union-select",description:"UNION SELECT — most common SQL injection aggregation attack",pattern:/\bUNION\s{1,20}(?:ALL\s{1,20})?SELECT\b/i},{id:"sql-drop-table",description:"DROP TABLE — destructive DDL injection",pattern:/\bDROP\s{1,20}TABLE\b/i},{id:"sql-drop-database",description:"DROP DATABASE — destructive DDL injection",pattern:/\bDROP\s{1,20}DATABASE\b/i},{id:"sql-insert-into",description:"INSERT INTO — data injection",pattern:/\bINSERT\s{1,20}INTO\b/i},{id:"sql-delete-from",description:"DELETE FROM — data deletion injection",pattern:/\bDELETE\s{1,20}FROM\b/i},{id:"sql-update-set",description:"UPDATE ... SET — data modification injection",pattern:/\bUPDATE\b[\s\S]{1,60}\bSET\b/i},{id:"sql-exec-xp",description:"EXEC xp_ — MSSQL extended stored procedure execution",pattern:/\bEXEC(?:UTE)?\s{1,20}xp_/i},{id:"sql-tautology-string",description:'Classic string tautology: \' OR \'1\'=\'1 or " OR "1"="1"',pattern:/'\s{0,10}OR\s{0,10}'[^']{0,20}'\s*=\s*'[^']{0,20}/i},{id:"sql-tautology-numeric",description:"Numeric tautology: OR 1=1",pattern:/\bOR\s{1,10}1\s*=\s*1\b/i},{id:"sql-always-true-zero",description:"Numeric tautology: OR 0=0",pattern:/\bOR\s{1,10}0\s*=\s*0\b/i},{id:"sql-sleep-benchmark",description:"Time-based blind injection: SLEEP() or BENCHMARK()",pattern:/\b(?:SLEEP|BENCHMARK)\s*\(/i},{id:"sql-waitfor-delay",description:"MSSQL time-based blind injection: WAITFOR DELAY",pattern:/\bWAITFOR\s{1,20}DELAY\b/i},{id:"sql-char-function",description:"CHAR() function — used to obfuscate injected strings",pattern:/\bCHAR\s*\(\s*\d{1,3}/i},{id:"sql-information-schema",description:"INFORMATION_SCHEMA — reconnaissance query for table/column enumeration",pattern:/\bINFORMATION_SCHEMA\b/i}],st=[...at,{id:"sql-line-comment",description:"SQL line comment: -- followed by whitespace or end of string",pattern:/--(?:\s|$)/},{id:"sql-stacked-query",description:"Stacked queries: semicolon immediately followed by a SQL keyword",pattern:/;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i},{id:"sql-hex-encoding",description:"Hex-encoded string injection: 0x41414141 style (MySQL)",pattern:/\b0x[0-9a-f]{4,}/i}],ot=[{id:"html-script-open",description:"<script opening tag",pattern:/<script[\s>/]/i},{id:"html-script-close",description:"<\/script closing tag",pattern:/<\/script[\s>]/i},{id:"html-javascript-protocol",description:"javascript: URI scheme (with optional whitespace/encoding)",pattern:/j[\t\n\r ]*a[\t\n\r ]*v[\t\n\r ]*a[\t\n\r ]*s[\t\n\r ]*c[\t\n\r ]*r[\t\n\r ]*i[\t\n\r ]*p[\t\n\r ]*t[\t\n\r ]*:/i},{id:"html-vbscript-protocol",description:"vbscript: URI scheme",pattern:/vbscript[\t\n\r ]*:/i},{id:"html-data-html",description:"data:text/html URI — can execute scripts in browsers",pattern:/data[\t\n\r ]*:[\t\n\r ]*text\/html/i},{id:"html-data-xhtml",description:"data:application/xhtml+xml URI",pattern:/data[\t\n\r ]*:[\t\n\r ]*application\/xhtml/i},{id:"html-data-svg",description:"data:image/svg+xml URI — can execute scripts",pattern:/data[\t\n\r ]*:[\t\n\r ]*image\/svg\+xml/i},{id:"html-inline-event-handler",description:"Inline event handler attributes: onclick=, onerror=, onload=, etc.",pattern:/\bon\w{1,30}\s*=/i},{id:"html-entity-obfuscated-script",description:"HTML-entity-encoded <script (e.g. &#x3C;script or &lt;script)",pattern:/(?:&#x0*3[Cc];?|&#0*60;?|&lt;)\s*script/i},{id:"html-entity-obfuscated-javascript",description:'HTML-entity-encoded javascript: (partial — catches common &#106; or &#x6a; for "j")',pattern:/(?:&#x0*6[Aa];?|&#0*106;?)\s*(?:&#x0*61;?|a)[\s\S]{0,80}script\s*:/i},{id:"html-style-expression",description:"CSS expression() — IE-era code execution in style attributes",pattern:/style[\s\S]{0,20}expression\s*\(/i},{id:"html-object-embed",description:"<object or <embed tags that can load active content",pattern:/<(?:object|embed)[\s>/]/i},{id:"html-base-tag",description:"<base href= — can hijack all relative URLs on a page",pattern:/<base[\s>]/i},{id:"html-meta-refresh",description:'<meta http-equiv="refresh" — can redirect users',pattern:/<meta[\s\S]{0,40}http-equiv[\s\S]{0,20}refresh/i},{id:"html-srcdoc",description:"srcdoc= attribute on iframes — embeds HTML that can run scripts",pattern:/srcdoc\s*=/i},{id:"html-iframe",description:"<iframe tag",pattern:/<iframe[\s>/]/i},{id:"html-form",description:"<form tag — can be used for phishing / credential harvesting injection",pattern:/<form[\s>/]/i}],lt=[{id:"xml-cdata-injection",description:"CDATA section injection: <![CDATA[ breaks out of text node context",pattern:/<!\[CDATA\[/i},{id:"xml-cdata-close",description:"CDATA close sequence: ]]> can terminate an enclosing CDATA section",pattern:/\]\]>/},{id:"xml-processing-instruction",description:"XML processing instruction: <?xml-stylesheet or <?php etc.",pattern:/<\?(?:xml[\- ]|php|asp)/i},{id:"xml-doctype-injection",description:"DOCTYPE declaration embedded in content — can define entities",pattern:/<!DOCTYPE(?:[\s[]|$)/i},{id:"xml-entity-system",description:"SYSTEM keyword — used in external entity declarations (XXE)",pattern:/\bSYSTEM\s+["']/i},{id:"xml-entity-public",description:"PUBLIC keyword — used in external entity declarations (XXE)",pattern:/\bPUBLIC\s+["']/i},{id:"xml-entity-declaration",description:"<!ENTITY declaration — defines entities, potential XXE or entity expansion",pattern:/<!ENTITY[\s%]/i},{id:"xml-billion-laughs",description:"Entity reference chaining / billion laughs: repeated &eX; style references",pattern:/(?:&\w{1,20};){3,}/},{id:"xml-namespace-confusion",description:"xmlns: attribute injection — can redefine namespaces to confuse parsers",pattern:/\bxmlns\s*(?::\w{1,40})?\s*=/i},{id:"xml-comment-injection",description:"\x3c!-- comment injection — can hide content from some parsers",pattern:/<!--/},{id:"xml-comment-close",description:"--\x3e closes an enclosing XML comment",pattern:/-->/},{id:"xml-pi-close",description:"?> closes an enclosing processing instruction",pattern:/\?>/}],pt=[{id:"svg-script-element",description:"<script element inside SVG executes JavaScript",pattern:/<script[\s>/]/i},{id:"svg-xlink-href-javascript",description:"xlink:href with javascript: — classic SVG XSS via <a> or <use>",pattern:/xlink\s*:\s*href\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-href-javascript",description:"href= with javascript: in SVG context (<a>, <animate>, etc.)",pattern:/href\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-foreignobject",description:"<foreignObject embeds HTML inside SVG — can execute scripts",pattern:/<foreignObject[\s>/]/i},{id:"svg-use-external",description:"<use xlink:href or href pointing to external resource (non-fragment URL)",pattern:/<use[\s\S]{0,60}(?:xlink\s*:\s*)?href\s*=\s*(?:["'][^#]|[^"'#\s>])/i},{id:"svg-animate-href",description:'<animate attributeName="href" — can dynamically change href to javascript:',pattern:/<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*href["']/i},{id:"svg-animate-xlinkhref",description:'<animate attributeName="xlink:href"',pattern:/<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*xlink\s*:\s*href["']/i},{id:"svg-set-javascript",description:'<set to="javascript:..." — sets an attribute to a javascript: URI',pattern:/<set[\s\S]{0,80}to\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-event-handler",description:"SVG-specific event handler attributes: onload=, onerror=, onactivate=, etc.",pattern:/\bon(?:load|error|activate|begin|end|repeat|focus|blur|click|mouse\w{1,20}|key\w{1,20})\s*=/i},{id:"svg-handler-generic",description:"Generic on* handler catch-all for SVG attributes",pattern:/\bon\w{1,30}\s*=/i},{id:"svg-filter-feimage",description:"<feImage href= — filter primitive that can load external resources",pattern:/<feImage[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=/i},{id:"svg-image-external",description:"<image xlink:href with http/https or javascript protocol",pattern:/<image[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=\s*["']?\s*(?:https?|javascript)\s*:/i},{id:"svg-style-javascript",description:"style= attribute containing javascript: (e.g. background:url(javascript:...))",pattern:/style\s*=[\s\S]{0,60}javascript\s*:/i}],ct=[{id:"shell-path-traversal-unix",description:"Unix path traversal: ../  — climbing the directory tree",pattern:/\.\.\//},{id:"shell-path-traversal-windows",description:"Windows path traversal: ..\\ — climbing the directory tree",pattern:/\.\.\\/},{id:"shell-path-traversal-encoded",description:"URL-encoded path traversal: %2e%2e or %2f variants",pattern:/%2e%2e|%2f\.\.|\.\.%2f/i},{id:"shell-null-byte",description:"Null byte injection: \\x00 or %00 — truncates strings in C-backed functions",pattern:/\x00|%00/},{id:"shell-semicolon",description:"Semicolon command separator: cmd1; cmd2",pattern:/;/},{id:"shell-pipe",description:"Pipe operator: cmd1 | cmd2",pattern:/\|/},{id:"shell-and-operator",description:"AND operator: cmd1 && cmd2",pattern:/&&/},{id:"shell-or-operator",description:"OR operator: cmd1 || cmd2",pattern:/\|\|/},{id:"shell-backtick",description:"Backtick command substitution: `cmd`",pattern:/`/},{id:"shell-dollar-paren",description:"Dollar-paren command substitution: $(cmd)",pattern:/\$\(/},{id:"shell-dollar-brace",description:"Dollar-brace variable expansion: ${var} — can be abused for injection",pattern:/\$\{/},{id:"shell-redirect-out",description:"Output redirection: cmd > file or cmd >> file",pattern:/>{1,2}/},{id:"shell-redirect-in",description:"Input redirection: cmd < file",pattern:/</},{id:"shell-newline-injection",description:"Newline injection: \\n or \\r — can inject new shell commands",pattern:/[\n\r]/},{id:"shell-glob-star",description:"Glob expansion: * or ? — can expand to unintended files",pattern:/[/\\][*?]/},{id:"shell-absolute-root",description:"Absolute root path injection: string starting with / or \\ (Windows UNC)",pattern:/^(?:\/|\\\\)/},{id:"shell-windows-drive",description:"Windows drive letter path injection: C:\\ or D:/",pattern:/^[a-zA-Z]:[/\\]/},{id:"shell-curl-wget",description:"curl/wget with URL or flags — can exfiltrate data or download payloads",pattern:/\b(?:curl|wget)\s+(?:https?:\/\/|ftp:\/\/|-)/i}],ht=[{id:"redos-nested-quantifier-plus",description:"Nested + quantifier inside a group with outer quantifier: (a+)+, (.+b)*, etc.",pattern:/\([^)]*\+[^)]*\)[+*]/},{id:"redos-nested-quantifier-star",description:"Nested * quantifier: (a*)* or (a*)+ — catastrophic backtracking",pattern:/\([^)]*\*[^)]*\)[*+]/},{id:"redos-nested-groups",description:"Doubly nested quantified groups: ((a+)+) — guaranteed catastrophic",pattern:/\(\([^)]{0,40}\)[+*]\)[+*]/},{id:"redos-alternation-overlap",description:"Overlapping alternation under quantifier: (a|a)+ — ambiguous NFA paths",pattern:/\(([^|()]{1,20})\|(?:\1)(?:\|[^|()]{1,20}){0,5}\)[+*?]{1,2}/},{id:"redos-star-plus-concat",description:"(x*x)+ pattern — triggers super-linear backtracking",pattern:/\([^)]{0,10}\*[^)]{0,10}\)[+*]/},{id:"redos-dot-star-greedy",description:"(.*){n,} or (.+){n,} — repeated greedy dot quantifiers",pattern:/\(\.[*+]\)\{?\d/},{id:"redos-large-repetition",description:"Very large fixed or range repetition count {1000,} or {1000,n} — denial of service via backtracking",pattern:/\{\d{4,}(?:,\d*)?\}/},{id:"redos-catastrophic-alternation",description:"Long alternation with many similar branches — polynomial backtracking risk",pattern:/\([^)]{0,200}(?:\|[^|)]{0,50}){9,}\)/}],dt="[\"'\\s]*:",ut=[{id:"nosql-where-operator",description:"$where — executes arbitrary JavaScript server-side in MongoDB",pattern:new RegExp(`\\$where${dt}`,"i")},{id:"nosql-ne-operator",description:'$ne — "not equal" operator used to bypass equality checks',pattern:new RegExp(`\\$ne${dt}`,"i")},{id:"nosql-gt-operator",description:'$gt — "greater than" used to bypass password/value checks',pattern:new RegExp(`\\$gte?${dt}`,"i")},{id:"nosql-lt-operator",description:'$lt / $lte — "less than" bypass variants',pattern:new RegExp(`\\$lte?${dt}`,"i")},{id:"nosql-regex-operator",description:"$regex — can be used to extract data character by character (blind injection)",pattern:new RegExp(`\\$regex${dt}`,"i")},{id:"nosql-or-operator",description:"$or — logical OR; used to create always-true conditions",pattern:new RegExp(`\\$or${dt}\\s*\\[`,"i")},{id:"nosql-and-operator",description:"$and — logical AND operator injection",pattern:new RegExp(`\\$and${dt}\\s*\\[`,"i")},{id:"nosql-nor-operator",description:"$nor — logical NOR operator injection",pattern:new RegExp(`\\$nor${dt}\\s*\\[`,"i")},{id:"nosql-exists-operator",description:"$exists — can enumerate fields to determine schema",pattern:new RegExp(`\\$exists${dt}`,"i")},{id:"nosql-in-operator",description:"$in — matches any value in a list; can enumerate values",pattern:new RegExp(`\\$in${dt}\\s*\\[`,"i")},{id:"nosql-expr-operator",description:"$expr — allows aggregation expressions in queries (MongoDB 3.6+)",pattern:new RegExp(`\\$expr${dt}`,"i")},{id:"nosql-function-operator",description:"$function — executes arbitrary JavaScript in MongoDB 4.4+",pattern:new RegExp(`\\$function${dt}`,"i")},{id:"nosql-accumulator-operator",description:"$accumulator — custom aggregation with arbitrary JS execution",pattern:new RegExp(`\\$accumulator${dt}`,"i")},{id:"nosql-proto-pollution",description:"__proto__ — prototype pollution via object key injection",pattern:/__proto__/},{id:"nosql-constructor-prototype",description:"constructor.prototype — alternative prototype pollution vector (dot notation or JSON key)",pattern:/constructor[\s"':.,{\[]*prototype/i},{id:"nosql-proto-bracket",description:'["__proto__"] — bracket-notation prototype pollution',pattern:/\[["']__proto__["']\]/}],ft=[{id:"log-crlf-injection",description:"CRLF injection: literal \\r or \\n embeds fake log lines",pattern:/[\r\n]/},{id:"log-url-encoded-crlf",description:"URL-encoded CRLF: %0d, %0a, %0D, %0A — decoded by some log parsers",pattern:/%0[dDaA]/},{id:"log-unicode-newline",description:"Unicode newline variants: U+2028 (line separator), U+2029 (paragraph separator)",pattern:/[\u2028\u2029]/},{id:"log-log4shell-jndi",description:"Log4Shell: ${jndi:...} triggers remote code execution in Apache Log4j",pattern:/\$\{jndi\s*:/i},{id:"log-log4shell-obfuscated",description:"Obfuscated Log4Shell: ${::-j}... lookup-bypass prefix used to evade WAF detection",pattern:/\$\{::-/},{id:"log-log4j-lookup",description:"Log4j lookup syntax: ${env:...}, ${sys:...}, ${ctx:...} — data exfiltration",pattern:/\$\{(?:env|sys|ctx|main|map|sd|web|docker|k8s|spring)\s*:/i},{id:"log-ssti-double-brace",description:"SSTI double-brace: {{expression}} — Jinja2, Twig, Handlebars, etc.",pattern:/\{\{[\s\S]{0,80}\}\}/},{id:"log-ssti-hash-brace",description:"SSTI hash-brace: #{expression} — Thymeleaf, Velocity, Ruby ERB",pattern:/#\{[\s\S]{0,80}\}/},{id:"log-ssti-dollar-brace",description:"SSTI/EL injection: ${expression with operators or method calls} — JSP EL, Freemarker, SpEL",pattern:/\$\{[^}]*(?:\.|\(|\*|\+|\bclass\b|\bruntime\b|\bprocess\b|\bexec\b)[^}]{0,80}\}/i},{id:"log-ssti-percent-tag",description:"SSTI ERB/ASP tag: <%= expression %> — Ruby ERB, ASP",pattern:/<%=[\s\S]{0,80}%>/},{id:"log-null-byte",description:"Null byte: \\x00 or %00 — can truncate log entries in C-backed loggers",pattern:/\x00|%00/},{id:"log-ansi-escape",description:"ANSI escape sequence: ESC[ — can manipulate terminal output when logs are tailed",pattern:/\x1b\[/}];function gt(t,e){const r=e.label??"CUSTOM";for(const n of e)if(n.pattern.test(t))return{context:r,id:n.id,description:n.description,pattern:n.pattern};return null}function mt(t,e){(function(t){if("string"!=typeof t)throw new TypeError("is-unsafe: first argument must be a string, got "+typeof t)})(t),function(t){if(!(t instanceof RegExp)){if(!Array.isArray(t))throw new TypeError("is-unsafe: second argument must be a PatternList (e.g. HTML), an array of PatternLists (e.g. [HTML, XML]), or a RegExp. Got: "+typeof t);if(0===t.length)throw new TypeError("is-unsafe: context must not be an empty array");if(Array.isArray(t[0]))for(const e of t)if(!Array.isArray(e)||0===e.length)throw new TypeError("is-unsafe: each context in the array must be a non-empty pattern array (PatternList)")}}(e);const{lists:r,regex:n}=function(t){return t instanceof RegExp?{lists:null,regex:t}:Array.isArray(t[0])?{lists:t,regex:null}:{lists:[t],regex:null}}(e);if(n)return n.test(t);for(const e of r)if(null!==gt(t,e))return!0;return!1}function vt(){return vt=Object.assign?Object.assign.bind():function(t){for(var e=1;e<arguments.length;e++){var r=arguments[e];for(var n in r)({}).hasOwnProperty.call(r,n)&&(t[n]=r[n])}return t},vt.apply(null,arguments)}function xt(t,e){if(!t)return{};var r=e.attributesGroupName?t[e.attributesGroupName]:t;if(!r)return{};var n={};for(var i in r)i.startsWith(e.attributeNamePrefix)?n[i.substring(e.attributeNamePrefix.length)]=r[i]:n[i]=r[i];return n}function bt(t){if(t&&"string"==typeof t){var e=t.indexOf(":");if(-1!==e&&e>0){var r=t.substring(0,e);if("xmlns"!==r)return r}}}ot.label="HTML",lt.label="XML",pt.label="SVG",at.label="SQL",st.label="SQL-STRICT",ct.label="SHELL",ht.label="REDOS",ut.label="NOSQL",ft.label="LOG",Object.freeze({HTML:ot,XML:lt,SVG:pt,SQL:at,"SQL-STRICT":st,SHELL:ct,REDOS:ht,NOSQL:ut,LOG:ft});var yt=function(t,e){var r;this.options=t,this.currentNode=null,this.tagsNodeStack=[],this.parseXml=_t,this.parseTextData=Et,this.resolveNameSpace=wt,this.buildAttributesMap=Nt,this.isItStopNode=It,this.replaceEntitiesValue=At,this.readStopNodeData=Lt,this.saveTextToParentTag=Ct,this.addChild=Tt,this.ignoreAttributesFn="function"==typeof(r=this.options.ignoreAttributes)?r:Array.isArray(r)?function(t){for(var e,n=function(t,e){var r="undefined"!=typeof Symbol&&t[Symbol.iterator]||t["@@iterator"];if(r)return(r=r.call(t)).next.bind(r);if(Array.isArray(t)||(r=function(t,e){if(t){if("string"==typeof t)return U(t,e);var r={}.toString.call(t).slice(8,-1);return"Object"===r&&t.constructor&&(r=t.constructor.name),"Map"===r||"Set"===r?Array.from(t):"Arguments"===r||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r)?U(t,e):void 0}}(t))||e&&t&&"number"==typeof t.length){r&&(t=r);var n=0;return function(){return n>=t.length?{done:!0}:{done:!1,value:t[n++]}}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}(r);!(e=n()).done;){var i=e.value;if("string"==typeof i&&t===i)return!0;if(i instanceof RegExp&&i.test(t))return!0}}:function(){return!1},this.entityExpansionCount=0,this.currentExpandedLength=0;var n=vt({},H);this.options.entityDecoder?this.entityDecoder=this.options.entityDecoder:("object"==typeof this.options.htmlEntities?n=this.options.htmlEntities:!0===this.options.htmlEntities&&(n=vt({},G,Y)),this.entityDecoder=new it({namedEntities:vt({},n,e),numericAllowed:this.options.htmlEntities,limit:{maxTotalExpansions:this.options.processEntities.maxTotalExpansions,maxExpandedLength:this.options.processEntities.maxExpandedLength,applyLimitsTo:this.options.processEntities.appliesTo},onInputEntity:function(t,e){return mt(e,[ot,lt])?z.BLOCK:z.ALLOW}})),this.matcher=new B,this.readonlyMatcher=this.matcher.readOnly(),this.isCurrentNodeStopNode=!1,this.stopNodeExpressionsSet=new W;var i=this.options.stopNodes;if(i&&i.length>0){for(var a=0;a<i.length;a++){var s=i[a];"string"==typeof s?this.stopNodeExpressionsSet.add(new X(s)):s instanceof X&&this.stopNodeExpressionsSet.add(s)}this.stopNodeExpressionsSet.seal()}};function Et(t,e,r,n,i,a,s){var o=this.options;if(void 0!==t&&(o.trimValues&&!n&&(t=t.trim()),t.length>0)){s||(t=this.replaceEntitiesValue(t,e,r));var l=o.jPath?r.toString():r,p=o.tagValueProcessor(e,t,l,i,a);return null==p?t:typeof p!=typeof t||p!==t?p:o.trimValues||t.trim()===t?Pt(t,o.parseTagValue,o.numberParseOptions):t}}function wt(t){if(this.options.removeNSPrefix){var e=t.split(":"),r="/"===t.charAt(0)?"/":"";if("xmlns"===e[0])return"";2===e.length&&(t=r+e[1])}return t}var St=new RegExp("([^\\s=]+)\\s*(=\\s*(['\"])([\\s\\S]*?)\\3)?","gm");function Nt(t,e,r,n){void 0===n&&(n=!1);var a=this.options;if(!0===n||!0!==a.ignoreAttributes&&"string"==typeof t){for(var s=i(t,St),o=s.length,l={},p=new Array(o),c=!1,h={},d=0;d<o;d++){var u=this.resolveNameSpace(s[d][1]),f=s[d][4];if(u.length&&void 0!==f){var g=f;a.trimValues&&(g=g.trim()),g=this.replaceEntitiesValue(g,r,this.readonlyMatcher),p[d]=g,h[u]=g,c=!0}}c&&"object"==typeof e&&e.updateCurrent&&e.updateCurrent(h);for(var m=a.jPath?e.toString():this.readonlyMatcher,v=!1,x=0;x<o;x++){var b=this.resolveNameSpace(s[x][1]);if(!this.ignoreAttributesFn(b,m)){var y=a.attributeNamePrefix+b;if(b.length)if(a.transformAttributeName&&(y=a.transformAttributeName(y)),y=Mt(y,a),void 0!==s[x][4]){var E=p[x],w=a.attributeValueProcessor(b,E,m);l[y]=null==w?E:typeof w!=typeof E||w!==E?w:Pt(E,a.parseAttributeValue,a.numberParseOptions),v=!0}else a.allowBooleanAttributes&&(l[y]=!0,v=!0)}}if(!v)return;if(a.attributesGroupName&&!a.preserveOrder){var S={};return S[a.attributesGroupName]=l,S}return l}}var _t=function(t){t=t.replace(/\r\n?/g,"\n");var e=new f("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;for(var i=this.options,a=new N(i.processEntities),s=t.length,o=0;o<s;o++)if("<"===t[o]){var l=t.charCodeAt(o+1);if(47===l){var p=Ot(t,">",o,"Closing Tag is not closed."),c=t.substring(o+2,p).trim();if(i.removeNSPrefix){var h=c.indexOf(":");-1!==h&&(c=c.substr(h+1))}c=Dt(i.transformTagName,c,"",i).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMatcher));var d=this.matcher.getCurrentTag();if(c&&i.unpairedTagsSet.has(c))throw new Error("Unpaired tag can not be used as closing tag: </"+c+">");d&&i.unpairedTagsSet.has(d)&&(this.matcher.pop(),this.tagsNodeStack.pop()),this.matcher.pop(),this.isCurrentNodeStopNode=!1,r=this.tagsNodeStack.pop(),n="",o=p}else if(63===l){var u=kt(t,o,!1,"?>");if(!u)throw new Error("Pi Tag is not closed.");n=this.saveTextToParentTag(n,r,this.readonlyMatcher);var g=this.buildAttributesMap(u.tagExp,this.matcher,u.tagName,!0);if(g){var m=g[this.options.attributeNamePrefix+"version"];this.entityDecoder.setXmlVersion(Number(m)||1),a.setXmlVersion(Number(m)||1)}if(i.ignoreDeclaration&&"?xml"===u.tagName||i.ignorePiTags);else{var v=new f(u.tagName);v.add(i.textNodeName,""),u.tagName!==u.tagExp&&u.attrExpPresent&&!0!==i.ignoreAttributes&&(v[":@"]=g),this.addChild(r,v,this.readonlyMatcher,o)}o=u.closeIndex+1}else if(33===l&&45===t.charCodeAt(o+2)&&45===t.charCodeAt(o+3)){var x=Ot(t,"--\x3e",o+4,"Comment is not closed.");if(i.commentPropName){var b,y=t.substring(o+4,x-2);n=this.saveTextToParentTag(n,r,this.readonlyMatcher),r.add(i.commentPropName,[(b={},b[i.textNodeName]=y,b)])}o=x}else if(33===l&&68===t.charCodeAt(o+2)){var E=a.readDocType(t,o);this.entityDecoder.addInputEntities(E.entities),o=E.i}else if(33===l&&91===t.charCodeAt(o+2)){var w=Ot(t,"]]>",o,"CDATA is not closed.")-2,S=t.substring(o+9,w);n=this.saveTextToParentTag(n,r,this.readonlyMatcher);var _,T=this.parseTextData(S,r.tagname,this.readonlyMatcher,!0,!1,!0,!0);null==T&&(T=""),i.cdataPropName?r.add(i.cdataPropName,[(_={},_[i.textNodeName]=S,_)]):r.add(i.textNodeName,T),o=w+2}else{var A=kt(t,o,i.removeNSPrefix);if(!A){var C=t.substring(Math.max(0,o-50),Math.min(s,o+50));throw new Error("readTagExp returned undefined at position "+o+'. Context: "'+C+'"')}var I=A.tagName,O=A.rawTagName,j=A.tagExp,k=A.attrExpPresent,L=A.closeIndex,P=Dt(i.transformTagName,I,j,i);if(I=P.tagName,j=P.tagExp,i.strictReservedNames&&(I===i.commentPropName||I===i.cdataPropName||I===i.textNodeName||I===i.attributesGroupName))throw new Error("Invalid tag name: "+I);r&&n&&"!xml"!==r.tagname&&(n=this.saveTextToParentTag(n,r,this.readonlyMatcher,!1));var D=r;D&&i.unpairedTagsSet.has(D.tagname)&&(r=this.tagsNodeStack.pop(),this.matcher.pop());var M=!1;j.length>0&&j.lastIndexOf("/")===j.length-1&&(M=!0,j="/"===I[I.length-1]?I=I.substr(0,I.length-1):j.substr(0,j.length-1),k=I!==j);var $,R=null;$=bt(O),I!==e.tagname&&this.matcher.push(I,{},$),I!==j&&k&&(R=this.buildAttributesMap(j,this.matcher,I))&&xt(R,i),I!==e.tagname&&(this.isCurrentNodeStopNode=this.isItStopNode());var V=o;if(this.isCurrentNodeStopNode){var q="";if(M)o=A.closeIndex;else if(i.unpairedTagsSet.has(I))o=A.closeIndex;else{var U=this.readStopNodeData(t,O,L+1);if(!U)throw new Error("Unexpected end of "+O);o=U.i,q=U.tagContent}var F=new f(I);R&&(F[":@"]=R),F.add(i.textNodeName,q),this.matcher.pop(),this.isCurrentNodeStopNode=!1,this.addChild(r,F,this.readonlyMatcher,V)}else{if(M){var B=Dt(i.transformTagName,I,j,i);I=B.tagName,j=B.tagExp;var X=new f(I);R&&(X[":@"]=R),this.addChild(r,X,this.readonlyMatcher,V),this.matcher.pop(),this.isCurrentNodeStopNode=!1}else{if(i.unpairedTagsSet.has(I)){var W=new f(I);R&&(W[":@"]=R),this.addChild(r,W,this.readonlyMatcher,V),this.matcher.pop(),this.isCurrentNodeStopNode=!1,o=A.closeIndex;continue}var Y=new f(I);if(this.tagsNodeStack.length>i.maxNestedTags)throw new Error("Maximum nested tags exceeded");this.tagsNodeStack.push(r),R&&(Y[":@"]=R),this.addChild(r,Y,this.readonlyMatcher,V),r=Y}n="",o=L}}}else n+=t[o];return e.child};function Tt(t,e,r,n){this.options.captureMetaData||(n=void 0);var i=this.options.jPath?r.toString():r,a=this.options.updateTag(e.tagname,i,e[":@"]);!1===a||("string"==typeof a?(e.tagname=a,t.addChild(e,n)):t.addChild(e,n))}function At(t,e,r){var n=this.options.processEntities;if(!n||!n.enabled)return t;if(n.allowedTags){var i=this.options.jPath?r.toString():r;if(!(Array.isArray(n.allowedTags)?n.allowedTags.includes(e):n.allowedTags(e,i)))return t}if(n.tagFilter){var a=this.options.jPath?r.toString():r;if(!n.tagFilter(e,a))return t}return this.entityDecoder.decode(t)}function Ct(t,e,r,n){return t&&(void 0===n&&(n=0===e.child.length),void 0!==(t=this.parseTextData(t,e.tagname,r,!1,!!e[":@"]&&0!==Object.keys(e[":@"]).length,n))&&""!==t&&e.add(this.options.textNodeName,t),t=""),t}function It(){return 0!==this.stopNodeExpressionsSet.size&&this.matcher.matchesAny(this.stopNodeExpressionsSet)}function Ot(t,e,r,n){var i=t.indexOf(e,r);if(-1===i)throw new Error(n);return i+e.length-1}function jt(t,e,r,n){var i=t.indexOf(e,r);if(-1===i)throw new Error(n);return i}function kt(t,e,r,n){void 0===n&&(n=">");var i=function(t,e,r){void 0===r&&(r=">");for(var n=0,i=t.length,a=r.charCodeAt(0),s=r.length>1?r.charCodeAt(1):-1,o="",l=e,p=e;p<i;p++){var c=t.charCodeAt(p);if(n)c===n&&(n=0);else if(34===c||39===c)n=c;else if(c===a){if(-1===s)return{data:o+=t.substring(l,p),index:p};if(t.charCodeAt(p+1)===s)return{data:o+=t.substring(l,p),index:p}}else 9!==c||n||(o+=t.substring(l,p)+" ",l=p+1)}}(t,e+1,n);if(i){var a=i.data,s=i.index,o=a.search(/\s/),l=a,p=!0;-1!==o&&(l=a.substring(0,o),a=a.substring(o+1).trimStart());var c=l;if(r){var h=l.indexOf(":");-1!==h&&(p=(l=l.substr(h+1))!==i.data.substr(h+1))}return{tagName:l,tagExp:a,closeIndex:s,attrExpPresent:p,rawTagName:c}}}function Lt(t,e,r){for(var n=r,i=1,a=t.length;r<a;r++)if("<"===t[r]){var s=t.charCodeAt(r+1);if(47===s){var o=jt(t,">",r,e+" is not closed");if(t.substring(r+2,o).trim()===e&&0===--i)return{tagContent:t.substring(n,r),i:o};r=o}else if(63===s)r=Ot(t,"?>",r+1,"StopNode is not closed.");else if(33===s&&45===t.charCodeAt(r+2)&&45===t.charCodeAt(r+3))r=Ot(t,"--\x3e",r+3,"StopNode is not closed.");else if(33===s&&91===t.charCodeAt(r+2))r=Ot(t,"]]>",r,"StopNode is not closed.")-2;else{var l=kt(t,r,!1);l&&((l&&l.tagName)===e&&"/"!==l.tagExp[l.tagExp.length-1]&&i++,r=l.closeIndex)}}}function Pt(t,e,r){if(e&&"string"==typeof t){var n=t.trim();return"true"===n||"false"!==n&&R(t,r)}return void 0!==t?t:""}function Dt(t,e,r,n){if(t){var i=t(e);r===e&&(r=i),e=i}return{tagName:e=Mt(e,n),tagExp:r}}function Mt(t,e){if(o.includes(t))throw new Error('[SECURITY] Invalid name: "'+t+'" is a reserved JavaScript keyword that could cause prototype pollution');return s.includes(t)?e.onDangerousProperty(t):t}var $t=f.getMetaDataSymbol();function Rt(t,e){if(!t||"object"!=typeof t)return{};if(!e)return t;var r={};for(var n in t)n.startsWith(e)?r[n.substring(e.length)]=t[n]:r[n]=t[n];return r}function Vt(t,e,r,n){return qt(t,e,r,n)}function qt(t,e,r,n){for(var i,a={},s=0;s<t.length;s++){var o=t[s],l=Ut(o);if(void 0!==l&&l!==e.textNodeName){var p=Rt(o[":@"]||{},e.attributeNamePrefix);r.push(l,p)}if(l===e.textNodeName)void 0===i?i=o[l]:i+=""+o[l];else{if(void 0===l)continue;if(o[l]){var c=qt(o[l],e,r,n),h=Bt(c,e);if(0===Object.keys(c).length&&e.alwaysCreateTextNode&&(c[e.textNodeName]=""),o[":@"]?Ft(c,o[":@"],n,e):1!==Object.keys(c).length||void 0===c[e.textNodeName]||e.alwaysCreateTextNode?0===Object.keys(c).length&&(e.alwaysCreateTextNode?c[e.textNodeName]="":c=""):c=c[e.textNodeName],void 0!==o[$t]&&"object"==typeof c&&null!==c&&(c[$t]=o[$t]),void 0!==a[l]&&Object.prototype.hasOwnProperty.call(a,l))Array.isArray(a[l])||(a[l]=[a[l]]),a[l].push(c);else{var d=e.jPath?n.toString():n;e.isArray(l,d,h)?a[l]=[c]:a[l]=c}void 0!==l&&l!==e.textNodeName&&r.pop()}}}return"string"==typeof i?i.length>0&&(a[e.textNodeName]=i):void 0!==i&&(a[e.textNodeName]=i),a}function Ut(t){for(var e=Object.keys(t),r=0;r<e.length;r++){var n=e[r];if(":@"!==n)return n}}function Ft(t,e,r,n){if(e)for(var i=Object.keys(e),a=i.length,s=0;s<a;s++){var o=i[s],l=o.startsWith(n.attributeNamePrefix)?o.substring(n.attributeNamePrefix.length):o,p=n.jPath?r.toString()+"."+l:r;n.isArray(o,p,!0,!0)?t[o]=[e[o]]:t[o]=e[o]}}function Bt(t,e){var r=e.textNodeName,n=Object.keys(t).length;return 0===n||!(1!==n||!t[r]&&"boolean"!=typeof t[r]&&0!==t[r])}var Xt={allowBooleanAttributes:!1,unpairedTags:[]};function Wt(t){return" "===t||"\t"===t||"\n"===t||"\r"===t}function Yt(t,e){for(var r=e;e<t.length;e++)if("?"!=t[e]&&" "!=t[e]);else{var n=t.substr(r,e-r);if(e>5&&"xml"===n)return Zt("InvalidXml","XML declaration allowed only at the start of the document.",ee(t,e));if("?"==t[e]&&">"==t[e+1]){e++;break}}return e}function Ht(t,e){if(t.length>e+5&&"-"===t[e+1]&&"-"===t[e+2]){for(e+=3;e<t.length;e++)if("-"===t[e]&&"-"===t[e+1]&&">"===t[e+2]){e+=2;break}}else if(t.length>e+8&&"D"===t[e+1]&&"O"===t[e+2]&&"C"===t[e+3]&&"T"===t[e+4]&&"Y"===t[e+5]&&"P"===t[e+6]&&"E"===t[e+7]){var r=1;for(e+=8;e<t.length;e++)if("<"===t[e])r++;else if(">"===t[e]&&0===--r)break}else if(t.length>e+9&&"["===t[e+1]&&"C"===t[e+2]&&"D"===t[e+3]&&"A"===t[e+4]&&"T"===t[e+5]&&"A"===t[e+6]&&"["===t[e+7])for(e+=8;e<t.length;e++)if("]"===t[e]&&"]"===t[e+1]&&">"===t[e+2]){e+=2;break}return e}function Gt(t,e){for(var r="",n="",i=!1;e<t.length;e++){if('"'===t[e]||"'"===t[e])""===n?n=t[e]:n!==t[e]||(n="");else if(">"===t[e]&&""===n){i=!0;break}r+=t[e]}return""===n&&{value:r,index:e,tagClosed:i}}var zt=new RegExp("(\\s*)([^\\s=]+)(\\s*=)?(\\s*(['\"])(([\\s\\S])*?)\\5)?","g");function Qt(t,e){for(var r=i(t,zt),n={},a=0;a<r.length;a++){if(0===r[a][1].length)return Zt("InvalidAttr","Attribute '"+r[a][2]+"' has no space in starting.",re(r[a]));if(void 0!==r[a][3]&&void 0===r[a][4])return Zt("InvalidAttr","Attribute '"+r[a][2]+"' is without value.",re(r[a]));if(void 0===r[a][3]&&!e.allowBooleanAttributes)return Zt("InvalidAttr","boolean attribute '"+r[a][2]+"' is not allowed.",re(r[a]));var s=r[a][2];if(!Kt(s))return Zt("InvalidAttr","Attribute '"+s+"' is an invalid name.",re(r[a]));if(Object.prototype.hasOwnProperty.call(n,s))return Zt("InvalidAttr","Attribute '"+s+"' is repeated.",re(r[a]));n[s]=1}return!0}function Jt(t,e){if(";"===t[++e])return-1;if("#"===t[e])return function(t,e){var r=/\d/;for("x"===t[e]&&(e++,r=/[\da-fA-F]/);e<t.length;e++){if(";"===t[e])return e;if(!t[e].match(r))break}return-1}(t,++e);for(var r=0;e<t.length;e++,r++)if(!(t[e].match(/\w/)&&r<20)){if(";"===t[e])break;return-1}return e}function Zt(t,e,r){return{err:{code:t,msg:e,line:r.line||r,col:r.col}}}function Kt(t){return a(t)}function te(t){return a(t)}function ee(t,e){var r=t.substring(0,e).split(/\r?\n/);return{line:r.length,col:r[r.length-1].length+1}}function re(t){return t.startIndex+t[1].length}var ne=function(){function t(t){this.externalEntities={},this.options=u(t)}var e=t.prototype;return e.parse=function(t,e){if("string"!=typeof t&&t.toString)t=t.toString();else if("string"!=typeof t)throw new Error("XML data is accepted in String or Bytes[] form.");if(e){!0===e&&(e={});var r=function(t,e){e=Object.assign({},Xt,e);var r=[],n=!1,i=!1;"\ufeff"===t[0]&&(t=t.substr(1));for(var a=0;a<t.length;a++)if("<"===t[a]&&"?"===t[a+1]){if((a=Yt(t,a+=2)).err)return a}else{if("<"!==t[a]){if(Wt(t[a]))continue;return Zt("InvalidChar","char '"+t[a]+"' is not expected.",ee(t,a))}var s=a;if("!"===t[++a]){a=Ht(t,a);continue}var o=!1;"/"===t[a]&&(o=!0,a++);for(var l="";a<t.length&&">"!==t[a]&&" "!==t[a]&&"\t"!==t[a]&&"\n"!==t[a]&&"\r"!==t[a];a++)l+=t[a];if("/"===(l=l.trim())[l.length-1]&&(l=l.substring(0,l.length-1),a--),!te(l))return Zt("InvalidTag",0===l.trim().length?"Invalid space after '<'.":"Tag '"+l+"' is an invalid name.",ee(t,a));var p=Gt(t,a);if(!1===p)return Zt("InvalidAttr","Attributes for '"+l+"' have open quote.",ee(t,a));var c=p.value;if(a=p.index,"/"===c[c.length-1]){var h=a-c.length,d=Qt(c=c.substring(0,c.length-1),e);if(!0!==d)return Zt(d.err.code,d.err.msg,ee(t,h+d.err.line));n=!0}else if(o){if(!p.tagClosed)return Zt("InvalidTag","Closing tag '"+l+"' doesn't have proper closing.",ee(t,a));if(c.trim().length>0)return Zt("InvalidTag","Closing tag '"+l+"' can't have attributes or invalid starting.",ee(t,s));if(0===r.length)return Zt("InvalidTag","Closing tag '"+l+"' has not been opened.",ee(t,s));var u=r.pop();if(l!==u.tagName){var f=ee(t,u.tagStartPos);return Zt("InvalidTag","Expected closing tag '"+u.tagName+"' (opened in line "+f.line+", col "+f.col+") instead of closing tag '"+l+"'.",ee(t,s))}0==r.length&&(i=!0)}else{var g=Qt(c,e);if(!0!==g)return Zt(g.err.code,g.err.msg,ee(t,a-c.length+g.err.line));if(!0===i)return Zt("InvalidXml","Multiple possible root nodes found.",ee(t,a));-1!==e.unpairedTags.indexOf(l)||r.push({tagName:l,tagStartPos:s}),n=!0}for(a++;a<t.length;a++)if("<"===t[a]){if("!"===t[a+1]){a=Ht(t,++a);continue}if("?"!==t[a+1])break;if((a=Yt(t,++a)).err)return a}else if("&"===t[a]){var m=Jt(t,a);if(-1==m)return Zt("InvalidChar","char '&' is not expected.",ee(t,a));a=m}else if(!0===i&&!Wt(t[a]))return Zt("InvalidXml","Extra text at the end",ee(t,a));"<"===t[a]&&a--}return n?1==r.length?Zt("InvalidTag","Unclosed tag '"+r[0].tagName+"'.",ee(t,r[0].tagStartPos)):!(r.length>0)||Zt("InvalidXml","Invalid '"+JSON.stringify(r.map(function(t){return t.tagName}),null,4).replace(/\r?\n/g,"")+"' found.",{line:1,col:1}):Zt("InvalidXml","Start tag expected.",1)}(t,e);if(!0!==r)throw Error(r.err.msg+":"+r.err.line+":"+r.err.col)}var n=new yt(this.options,this.externalEntities),i=n.parseXml(t);return this.options.preserveOrder||void 0===i?i:Vt(i,this.options,n.matcher,n.readonlyMatcher)},e.addEntity=function(t,e){if(-1!==e.indexOf("&"))throw new Error("Entity value can't have '&'");if(-1!==t.indexOf("&")||-1!==t.indexOf(";"))throw new Error("An entity must be set without '&' and ';'. Eg. use '#xD' for '&#xD;'");if("&"===e)throw new Error("An entity with value '&' is not permitted");this.externalEntities[t]=e},t.getMetaDataSymbol=function(){return f.getMetaDataSymbol()},t}();return e})());
+!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.XMLParser=e():t.XMLParser=e()}(this,()=>(()=>{"use strict";var t={d:(e,r)=>{for(var n in r)t.o(r,n)&&!t.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:r[n]})},o:(t,e)=>Object.prototype.hasOwnProperty.call(t,e),r:t=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})}},e={};t.r(e),t.d(e,{default:()=>ee});var r=":A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD",n=new RegExp("^["+r+"]["+r+"\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$"),i=function(t){return!(null==n.exec(t))},a=["hasOwnProperty","toString","valueOf","__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__"],s=["__proto__","constructor","prototype"],o=function(t){return a.includes(t)?"__"+t:t},l={preserveOrder:!1,attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,parseTagValue:!0,parseAttributeValue:!1,trimValues:!0,cdataPropName:!1,numberParseOptions:{hex:!0,leadingZeros:!0,eNotation:!0,unicode:!1},tagValueProcessor:function(t,e){return e},attributeValueProcessor:function(t,e){return e},stopNodes:[],alwaysCreateTextNode:!1,isArray:function(){return!1},commentPropName:!1,unpairedTags:[],processEntities:!0,htmlEntities:!1,entityDecoder:null,ignoreDeclaration:!1,ignorePiTags:!1,transformTagName:!1,transformAttributeName:!1,updateTag:function(t,e,r){return t},captureMetaData:!1,maxNestedTags:100,strictReservedNames:!0,jPath:!0,onDangerousProperty:o};function p(t,e){if("string"==typeof t){var r=t.toLowerCase();if(a.some(function(t){return r===t.toLowerCase()}))throw new Error("[SECURITY] Invalid "+e+': "'+t+'" is a reserved JavaScript keyword that could cause prototype pollution');if(s.some(function(t){return r===t.toLowerCase()}))throw new Error("[SECURITY] Invalid "+e+': "'+t+'" is a reserved JavaScript keyword that could cause prototype pollution')}}function c(t,e){return"boolean"==typeof t?{enabled:t,maxEntitySize:1e4,maxExpansionDepth:1e4,maxTotalExpansions:1/0,maxExpandedLength:1e5,maxEntityCount:1e3,allowedTags:null,tagFilter:null,appliesTo:"all"}:"object"==typeof t&&null!==t?{enabled:!1!==t.enabled,maxEntitySize:Math.max(1,null!=(r=t.maxEntitySize)?r:1e4),maxExpansionDepth:Math.max(1,null!=(n=t.maxExpansionDepth)?n:1e4),maxTotalExpansions:Math.max(1,null!=(i=t.maxTotalExpansions)?i:1/0),maxExpandedLength:Math.max(1,null!=(a=t.maxExpandedLength)?a:1e5),maxEntityCount:Math.max(1,null!=(s=t.maxEntityCount)?s:1e3),allowedTags:null!=(o=t.allowedTags)?o:null,tagFilter:null!=(l=t.tagFilter)?l:null,appliesTo:null!=(p=t.appliesTo)?p:"all"}:c(!0);var r,n,i,a,s,o,l,p}var d,h=function(t){for(var e=Object.assign({},l,t),r=0,n=[{value:e.attributeNamePrefix,name:"attributeNamePrefix"},{value:e.attributesGroupName,name:"attributesGroupName"},{value:e.textNodeName,name:"textNodeName"},{value:e.cdataPropName,name:"cdataPropName"},{value:e.commentPropName,name:"commentPropName"}];r<n.length;r++){var i=n[r],a=i.value,s=i.name;a&&p(a,s)}return null===e.onDangerousProperty&&(e.onDangerousProperty=o),e.processEntities=c(e.processEntities,e.htmlEntities),e.unpairedTagsSet=new Set(e.unpairedTags),e.stopNodes&&Array.isArray(e.stopNodes)&&(e.stopNodes=e.stopNodes.map(function(t){return"string"==typeof t&&t.startsWith("*.")?".."+t.substring(2):t})),e};d="function"!=typeof Symbol?"@@xmlMetadata":Symbol("XML Node Metadata");var u=function(){function t(t){this.tagname=t,this.child=[],this[":@"]=Object.create(null)}var e=t.prototype;return e.add=function(t,e){var r;"__proto__"===t&&(t="#__proto__"),this.child.push(((r={})[t]=e,r))},e.addChild=function(t,e){var r,n;"__proto__"===t.tagname&&(t.tagname="#__proto__"),t[":@"]&&Object.keys(t[":@"]).length>0?this.child.push(((r={})[t.tagname]=t.child,r[":@"]=t[":@"],r)):this.child.push(((n={})[t.tagname]=t.child,n)),this.addStartIndex(e)},e.addStartIndex=function(t){void 0!==t&&(this.child[this.child.length-1][d]={startIndex:t})},e.addEndIndex=function(t){var e=this.child[this.child.length-1];void 0!==e&&void 0!==e[d]&&void 0===e[d].endIndex&&(e[d].endIndex=t)},t.getMetaDataSymbol=function(){return d},t}();const f=":A-Za-z_À-ÖØ-öø-˿Ͱ-ͽͿ-҆҈-῿‌-‍⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�",g=":A-Za-z_À-˿Ͱ-ͽͿ-҆҈-῿‌-‍⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�𐀀-󯿿",m=g+"\\-\\.\\d·̀-ͯ҇‿-⁀",v=(t,e,r="")=>{const n=`[${t.replace(":","")}][${e.replace(":","")}]*`;return{name:new RegExp(`^[${t}][${e}]*$`,r),ncName:new RegExp(`^${n}$`,r),qName:new RegExp(`^${n}(?::${n})?$`,r),nmToken:new RegExp(`^[${e}]+$`,r),nmTokens:new RegExp(`^[${e}]+(?:\\s+[${e}]+)*$`,r)}},x=v(f,f+"\\-\\.\\d·̀-ͯ‿-⁀"),b=v(g,m,"u"),y=":A-Za-z_",E=v(y,y+"\\-\\.\\d"),w=(t,{xmlVersion:e="1.0",asciiOnly:r=!1}={})=>((t="1.0",e=!1)=>e?E:"1.1"===t?b:x)(e,r).qName.test(t);var S=function(){function t(t,e){this.suppressValidationErr=!t,this.options=t,this.xmlVersion=e||1}var e=t.prototype;return e.setXmlVersion=function(t){void 0===t&&(t=1),this.xmlVersion=t},e.readDocType=function(t,e){var r=Object.create(null),n=0;if("O"!==t[e+3]||"C"!==t[e+4]||"T"!==t[e+5]||"Y"!==t[e+6]||"P"!==t[e+7]||"E"!==t[e+8])throw new Error("Invalid Tag instead of DOCTYPE");e+=9;for(var i=1,a=!1,s=!1,o=null;e<t.length;e++)if(null===o)if(a||s||'"'!==t[e]&&"'"!==t[e])if("<"!==t[e]||s)if(">"===t[e]){if(s?"-"===t[e-1]&&"-"===t[e-2]&&(s=!1,i--):i--,0===i)break}else"["===t[e]?a=!0:t[e];else{if(a&&_(t,"!ENTITY",e)){e+=7;var l,p=void 0,c=this.readEntityExp(t,e+1,this.suppressValidationErr);if(l=c[0],p=c[1],e=c[2],-1===p.indexOf("&")){if(!1!==this.options.enabled&&null!=this.options.maxEntityCount&&n>=this.options.maxEntityCount)throw new Error("Entity count ("+(n+1)+") exceeds maximum allowed ("+this.options.maxEntityCount+")");r[l]=p,n++}}else if(a&&_(t,"!ELEMENT",e))e+=8,e=this.readElementExp(t,e+1).index;else if(a&&_(t,"!ATTLIST",e))e+=8;else if(a&&_(t,"!NOTATION",e))e+=9,e=this.readNotationExp(t,e+1,this.suppressValidationErr).index;else{if(!_(t,"!--",e))throw new Error("Invalid DOCTYPE");s=!0}i++}else o=t[e],t[e];else t[e]===o&&(o=null),t[e];if(null!==o||0!==i)throw new Error("Unclosed DOCTYPE");return{entities:r,i:e}},e.readEntityExp=function(t,e){for(var r=e=N(t,e);e<t.length&&!/\s/.test(t[e])&&'"'!==t[e]&&"'"!==t[e];)e++;var n=t.substring(r,e);if(T(n,{xmlVersion:this.xmlVersion}),e=N(t,e),!this.suppressValidationErr){if("SYSTEM"===t.substring(e,e+6).toUpperCase())throw new Error("External entities are not supported");if("%"===t[e])throw new Error("Parameter entities are not supported")}var i,a=this.readIdentifierVal(t,e,"entity");if(e=a[0],i=a[1],!1!==this.options.enabled&&null!=this.options.maxEntitySize&&i.length>this.options.maxEntitySize)throw new Error('Entity "'+n+'" size ('+i.length+") exceeds maximum allowed size ("+this.options.maxEntitySize+")");return[n,i,--e]},e.readNotationExp=function(t,e){for(var r=e=N(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var n=t.substring(r,e);!this.suppressValidationErr&&T(n,{xmlVersion:this.xmlVersion}),e=N(t,e);var i=t.substring(e,e+6).toUpperCase();if(!this.suppressValidationErr&&"SYSTEM"!==i&&"PUBLIC"!==i)throw new Error('Expected SYSTEM or PUBLIC, found "'+i+'"');e+=i.length,e=N(t,e);var a=null,s=null;if("PUBLIC"===i){var o=this.readIdentifierVal(t,e,"publicIdentifier");if(e=o[0],a=o[1],'"'===t[e=N(t,e)]||"'"===t[e]){var l=this.readIdentifierVal(t,e,"systemIdentifier");e=l[0],s=l[1]}}else if("SYSTEM"===i){var p=this.readIdentifierVal(t,e,"systemIdentifier");if(e=p[0],s=p[1],!this.suppressValidationErr&&!s)throw new Error("Missing mandatory system identifier for SYSTEM notation")}return{notationName:n,publicIdentifier:a,systemIdentifier:s,index:--e}},e.readIdentifierVal=function(t,e,r){var n,i=t[e];if('"'!==i&&"'"!==i)throw new Error('Expected quoted string, found "'+i+'"');for(var a=++e;e<t.length&&t[e]!==i;)e++;if(n=t.substring(a,e),t[e]!==i)throw new Error("Unterminated "+r+" value");return[++e,n]},e.readElementExp=function(t,e){for(var r=e=N(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var n=t.substring(r,e);if(!this.suppressValidationErr&&!w(n,{xmlVersion:this.xmlVersion}))throw new Error('Invalid element name: "'+n+'"');var i="";if("E"===t[e=N(t,e)]&&_(t,"MPTY",e))e+=4;else if("A"===t[e]&&_(t,"NY",e))e+=2;else if("("===t[e]){for(var a=++e;e<t.length&&")"!==t[e];)e++;if(i=t.substring(a,e),")"!==t[e])throw new Error("Unterminated content model")}else if(!this.suppressValidationErr)throw new Error('Invalid Element Expression, found "'+t[e]+'"');return{elementName:n,contentModel:i.trim(),index:e}},e.readAttlistExp=function(t,e){for(var r=e=N(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var n=t.substring(r,e);for(T(n,{xmlVersion:this.xmlVersion}),r=e=N(t,e);e<t.length&&!/\s/.test(t[e]);)e++;var i=t.substring(r,e);if(!T(i,{xmlVersion:this.xmlVersion}))throw new Error('Invalid attribute name: "'+i+'"');e=N(t,e);var a="";if("NOTATION"===t.substring(e,e+8).toUpperCase()){if(a="NOTATION","("!==t[e=N(t,e+=8)])throw new Error("Expected '(', found \""+t[e]+'"');e++;for(var s=[];e<t.length&&")"!==t[e];){for(var o=e;e<t.length&&"|"!==t[e]&&")"!==t[e];)e++;var l=t.substring(o,e);if(!T(l=l.trim(),{xmlVersion:this.xmlVersion}))throw new Error('Invalid notation name: "'+l+'"');s.push(l),"|"===t[e]&&(e++,e=N(t,e))}if(")"!==t[e])throw new Error("Unterminated list of notations");e++,a+=" ("+s.join("|")+")"}else{for(var p=e;e<t.length&&!/\s/.test(t[e]);)e++;if(a+=t.substring(p,e),!this.suppressValidationErr&&!["CDATA","ID","IDREF","IDREFS","ENTITY","ENTITIES","NMTOKEN","NMTOKENS"].includes(a.toUpperCase()))throw new Error('Invalid attribute type: "'+a+'"')}e=N(t,e);var c="";if("#REQUIRED"===t.substring(e,e+8).toUpperCase())c="#REQUIRED",e+=8;else if("#IMPLIED"===t.substring(e,e+7).toUpperCase())c="#IMPLIED",e+=7;else{var d=this.readIdentifierVal(t,e,"ATTLIST");e=d[0],c=d[1]}return{elementName:n,attributeName:i,attributeType:a,defaultValue:c,index:e}},t}(),N=function(t,e){for(;e<t.length&&/\s/.test(t[e]);)e++;return e};function _(t,e,r){for(var n=0;n<e.length;n++)if(e[n]!==t[r+n+1])return!1;return!0}function T(t,e){if(w(t,{xmlVersion:e}))return t;throw new Error("Invalid entity name "+t)}const A=[48,1632,1776,2406,2534,2662,2790,2918,3046,3174,3302,3430,3558,3664,3792,3872,4160,4240,6112,6160,6470,6608,6784,6800,6992,7088,7232,7248,65296,120782,120792,120802,120812,120822,66720,68912,69734,69872,69942,70096,70384,70736,70864,71248,71360,71472,71904,72016,72688,72784,73040,73120,73552,92768,92864,93008,123200,123632,124144,125264,130032],C=new Map,I=1632,O=new Uint8Array(63904).fill(255);for(const t of A)for(let e=0;e<10;e++){const r=t+e;r<=65535?O[r-I]=e:C.set(r,e)}const j=new Set([8722,65293,65123]),k=/^[-+]?0x[a-fA-F0-9]+$/,L=/^0b[01]+$/,D=/^0o[0-7]+$/,P=/^([\-\+])?(0*)([0-9]*(\.[0-9]*)?)$/,M={hex:!0,binary:!1,octal:!1,leadingZeros:!0,decimalPoint:".",eNotation:!0,infinity:"original",unicode:!1};function $(t,e={}){if(e=Object.assign({},M,e),!t||"string"!=typeof t)return t;let r=t.trim();if(0===r.length)return t;if(void 0!==e.skipLike&&e.skipLike.test(r))return t;if("0"===r)return 0;if(e.unicode&&(r=function(t){if("string"!=typeof t)return t;const e=t.length;if(0===e)return t;let r=-1;for(let n=0;n<e;n++){const i=t.charCodeAt(n);if(!(i>=48&&i<=57||45===i))if(i<I){if(j.has(i)){r=n;break}}else if(i>=55296&&i<=56319){if(n+1<e){const e=t.charCodeAt(n+1);if(e>=56320&&e<=57343){const t=65536+(i-55296<<10)+(e-56320);if(C.has(t)){r=n;break}}}}else if(255!==O[i-I]||j.has(i)){r=n;break}}if(-1===r)return t;const n=[];r>0&&n.push(t.slice(0,r));for(let i=r;i<e;i++){const r=t.charCodeAt(i);if(r>=48&&r<=57||45===r){n.push(t[i]);continue}if(r<I){n.push(j.has(r)?"-":t[i]);continue}if(r>=55296&&r<=56319){if(i+1<e){const e=t.charCodeAt(i+1);if(e>=56320&&e<=57343){const t=65536+(r-55296<<10)+(e-56320),a=C.get(t);if(void 0!==a){n.push(String.fromCharCode(a+48)),i++;continue}}}n.push(t[i]);continue}if(j.has(r)){n.push("-");continue}const a=O[r-I];n.push(255!==a?String.fromCharCode(a+48):t[i])}return n.join("")}(r),"0"===r))return 0;if(e.hex&&k.test(r))return V(r,16);if(e.binary&&L.test(r))return V(r,2);if(e.octal&&D.test(r))return V(r,8);if(isFinite(r)){if(r.includes("e")||r.includes("E"))return function(t,e,r){if(!r.eNotation)return t;const n=e.match(R);if(n){let i=n[1]||"";const a=-1===n[3].indexOf("e")?"E":"e",s=n[2],o=i?t[s.length+1]===a:t[s.length]===a;return s.length>1&&o?t:(1!==s.length||!n[3].startsWith(`.${a}`)&&n[3][0]!==a)&&s.length>0?r.leadingZeros&&!o?(e=(n[1]||"")+n[3],Number(e)):t:Number(e)}return t}(t,r,e);{const n=P.exec(r);if(n){const i=n[1]||"",a=n[2];let s=function(t){if(t&&-1!==t.indexOf(".")){let e=t.length;for(;e>0&&48===t.charCodeAt(e-1);)e--;return"."===(t=t.slice(0,e))?t="0":"."===t[0]?t="0"+t:"."===t[t.length-1]&&(t=t.substring(0,t.length-1)),t}return t}(n[3]);const o=i?"."===t[a.length+1]:"."===t[a.length];if(!e.leadingZeros&&(a.length>1||1===a.length&&!o))return t;{const n=Number(r),o=String(n);if(0===n)return n;if(-1!==o.search(/[eE]/))return e.eNotation?n:t;if(-1!==r.indexOf("."))return"0"===o||o===s||o===`${i}${s}`?n:t;let l=a?s:r;return a?l===o||i+l===o?n:t:l===o||l===i+o?n:t}}return t}}return function(t,e,r){const n=e===1/0;switch(r.infinity.toLowerCase()){case"null":return null;case"infinity":return e;case"string":return n?"Infinity":"-Infinity";default:return t}}(t,Number(r),e)}const R=/^([-+])?(0*)(\d*(\.\d*)?[eE][-\+]?\d+)$/;function V(t,e){const r=t.trim();if(2!==e&&8!==e||(t=r.substring(2)),parseInt)return parseInt(t,e);if(Number.parseInt)return Number.parseInt(t,e);if(window&&window.parseInt)return window.parseInt(t,e);throw new Error("parseInt, Number.parseInt, window.parseInt are not supported")}function q(t,e){(null==e||e>t.length)&&(e=t.length);for(var r=0,n=Array(e);r<e;r++)n[r]=t[r];return n}class U{constructor(t){this._matcher=t}get separator(){return this._matcher.separator}getCurrentTag(){const t=this._matcher.path;return t.length>0?t[t.length-1].tag:void 0}getCurrentNamespace(){const t=this._matcher.path;return t.length>0?t[t.length-1].namespace:void 0}getAttrValue(t){const e=this._matcher.path;if(0!==e.length)return e[e.length-1].values?.[t]}hasAttr(t){const e=this._matcher.path;if(0===e.length)return!1;const r=e[e.length-1];return void 0!==r.values&&t in r.values}getAnyParentAttr(t){return this._matcher.getAnyParentAttr(t)}hasAnyParentAttr(t){return this._matcher.hasAnyParentAttr(t)}getPosition(){const t=this._matcher.path;return 0===t.length?-1:t[t.length-1].position??0}getCounter(){const t=this._matcher.path;return 0===t.length?-1:t[t.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this._matcher.path.length}toString(t,e=!0){return this._matcher.toString(t,e)}toArray(){return this._matcher.path.map(t=>t.tag)}matches(t){return this._matcher.matches(t)}matchesAny(t){return t.matchesAny(this._matcher)}}class F{constructor(t={}){this.separator=t.separator||".",this.path=[],this.siblingStacks=[],this._pathStringCache=null,this._view=new U(this),this._keptAttrs=[]}push(t,e=null,r=null,n=null){this._pathStringCache=null,this.path.length>0&&(this.path[this.path.length-1].values=void 0);const i=this.path.length;let a=this.siblingStacks[i];a||(a={counts:new Map,total:0},this.siblingStacks[i]=a);const s=r?`${r}:${t}`:t,o=a.counts.get(s)||0,l=a.total;a.counts.set(s,o+1),a.total++;const p={tag:t,position:l,counter:o};null!=r&&(p.namespace=r),null!=e&&(p.values=e),this.path.push(p);const c=this.path.length,d=null!==n?n.keep:null;if(null!=d&&d.length>0&&e)for(let t=0;t<d.length;t++){const r=d[t];void 0!==e[r]&&this._keptAttrs.push({depth:c,name:r,value:e[r]})}}pop(){if(0===this.path.length)return;this._pathStringCache=null;const t=this.path.pop();this.siblingStacks.length>this.path.length+1&&(this.siblingStacks.length=this.path.length+1);const e=this.path.length+1;for(;this._keptAttrs.length>0&&this._keptAttrs[this._keptAttrs.length-1].depth>=e;)this._keptAttrs.pop();return t}updateCurrent(t){if(this.path.length>0){const e=this.path[this.path.length-1];null!=t&&(e.values=t)}}getCurrentTag(){return this.path.length>0?this.path[this.path.length-1].tag:void 0}getCurrentNamespace(){return this.path.length>0?this.path[this.path.length-1].namespace:void 0}getAttrValue(t){if(0!==this.path.length)return this.path[this.path.length-1].values?.[t]}hasAttr(t){if(0===this.path.length)return!1;const e=this.path[this.path.length-1];return void 0!==e.values&&t in e.values}getAnyParentAttr(t){const e=this._keptAttrs;for(let r=e.length-1;r>=0;r--)if(e[r].name===t)return e[r].value}hasAnyParentAttr(t){const e=this._keptAttrs;for(let r=e.length-1;r>=0;r--)if(e[r].name===t)return!0;return!1}getPosition(){return 0===this.path.length?-1:this.path[this.path.length-1].position??0}getCounter(){return 0===this.path.length?-1:this.path[this.path.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this.path.length}toString(t,e=!0){const r=t||this.separator;if(r===this.separator&&!0===e){if(null!==this._pathStringCache)return this._pathStringCache;const t=this.path.map(t=>t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(r);return this._pathStringCache=t,t}return this.path.map(t=>e&&t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(r)}toArray(){return this.path.map(t=>t.tag)}reset(){this._pathStringCache=null,this.path=[],this.siblingStacks=[],this._keptAttrs=[]}matches(t){const e=t.segments;return 0!==e.length&&(t.hasDeepWildcard()?this._matchWithDeepWildcard(e):this._matchSimple(e))}_matchSimple(t){if(this.path.length!==t.length)return!1;for(let e=0;e<t.length;e++)if(!this._matchSegment(t[e],this.path[e],e===this.path.length-1))return!1;return!0}_matchWithDeepWildcard(t){let e=this.path.length-1,r=t.length-1;for(;r>=0&&e>=0;){const n=t[r];if("deep-wildcard"===n.type){if(r--,r<0)return!0;const n=t[r];let i=!1;for(let t=e;t>=0;t--)if(this._matchSegment(n,this.path[t],t===this.path.length-1)){e=t-1,r--,i=!0;break}if(!i)return!1}else{if(!this._matchSegment(n,this.path[e],e===this.path.length-1))return!1;e--,r--}}return r<0}_matchSegment(t,e,r){if("*"!==t.tag&&t.tag!==e.tag)return!1;if(void 0!==t.namespace&&"*"!==t.namespace&&t.namespace!==e.namespace)return!1;if(void 0!==t.attrName){if(!r)return!1;if(!e.values||!(t.attrName in e.values))return!1;if(void 0!==t.attrValue&&String(e.values[t.attrName])!==String(t.attrValue))return!1}if(void 0!==t.position){if(!r)return!1;const n=e.counter??0;if("first"===t.position&&0!==n)return!1;if("odd"===t.position&&n%2!=1)return!1;if("even"===t.position&&n%2!=0)return!1;if("nth"===t.position&&n!==t.positionValue)return!1}return!0}matchesAny(t){return t.matchesAny(this)}snapshot(){return{path:this.path.map(t=>({...t})),siblingStacks:this.siblingStacks.map(t=>t?{counts:new Map(t.counts),total:t.total}:t),keptAttrs:this._keptAttrs.map(t=>({...t}))}}restore(t){this._pathStringCache=null,this.path=t.path.map(t=>({...t})),this.siblingStacks=t.siblingStacks.map(t=>t?{counts:new Map(t.counts),total:t.total}:t),this._keptAttrs=(t.keptAttrs||[]).map(t=>({...t}))}readOnly(){return this._view}}class B{constructor(t,e={},r){this.pattern=t,this.separator=e.separator||".",this.segments=this._parse(t),this.data=r,this._hasDeepWildcard=this.segments.some(t=>"deep-wildcard"===t.type),this._hasAttributeCondition=this.segments.some(t=>void 0!==t.attrName),this._hasPositionSelector=this.segments.some(t=>void 0!==t.position)}_parse(t){const e=[];let r=0,n="";for(;r<t.length;)t[r]===this.separator?r+1<t.length&&t[r+1]===this.separator?(n.trim()&&(e.push(this._parseSegment(n.trim())),n=""),e.push({type:"deep-wildcard"}),r+=2):(n.trim()&&e.push(this._parseSegment(n.trim())),n="",r++):(n+=t[r],r++);return n.trim()&&e.push(this._parseSegment(n.trim())),e}_parseSegment(t){const e={type:"tag"};let r=null,n=t;const i=t.match(/^([^\[]+)(\[[^\]]*\])(.*)$/);if(i&&(n=i[1]+i[3],i[2])){const t=i[2].slice(1,-1);t&&(r=t)}let a,s,o=n;if(n.includes("::")){const e=n.indexOf("::");if(a=n.substring(0,e).trim(),o=n.substring(e+2).trim(),!a)throw new Error(`Invalid namespace in pattern: ${t}`)}let l=null;if(o.includes(":")){const t=o.lastIndexOf(":"),e=o.substring(0,t).trim(),r=o.substring(t+1).trim();["first","last","odd","even"].includes(r)||/^nth\(\d+\)$/.test(r)?(s=e,l=r):s=o}else s=o;if(!s)throw new Error(`Invalid segment pattern: ${t}`);if(e.tag=s,a&&(e.namespace=a),r)if(r.includes("=")){const t=r.indexOf("=");e.attrName=r.substring(0,t).trim(),e.attrValue=r.substring(t+1).trim()}else e.attrName=r.trim();if(l){const t=l.match(/^nth\((\d+)\)$/);t?(e.position="nth",e.positionValue=parseInt(t[1],10)):e.position=l}return e}get length(){return this.segments.length}hasDeepWildcard(){return this._hasDeepWildcard}hasAttributeCondition(){return this._hasAttributeCondition}hasPositionSelector(){return this._hasPositionSelector}toString(){return this.pattern}}class X{constructor(){this._byDepthAndTag=new Map,this._wildcardByDepth=new Map,this._deepWildcards=[],this._deepByTerminalTag=new Map,this._patterns=new Set,this._sealed=!1}add(t){if(this._sealed)throw new TypeError("ExpressionSet is sealed. Create a new ExpressionSet to add more expressions.");if(this._patterns.has(t.pattern))return this;if(this._patterns.add(t.pattern),t.hasDeepWildcard()){const e=t.segments[t.segments.length-1];if(e&&"deep-wildcard"!==e.type&&"*"!==e.tag){const r=e.tag;this._deepByTerminalTag.has(r)||this._deepByTerminalTag.set(r,[]),this._deepByTerminalTag.get(r).push(t)}else this._deepWildcards.push(t);return this}const e=t.length,r=t.segments[t.segments.length-1],n=r?.tag;if(n&&"*"!==n){const r=`${e}:${n}`;this._byDepthAndTag.has(r)||this._byDepthAndTag.set(r,[]),this._byDepthAndTag.get(r).push(t)}else this._wildcardByDepth.has(e)||this._wildcardByDepth.set(e,[]),this._wildcardByDepth.get(e).push(t);return this}addAll(t){for(const e of t)this.add(e);return this}has(t){return this._patterns.has(t.pattern)}get size(){return this._patterns.size}seal(){return this._sealed=!0,this}get isSealed(){return this._sealed}matchesAny(t){return null!==this.findMatch(t)}findMatch(t){const e=t.getDepth(),r=t.getCurrentTag(),n=`${e}:${r}`,i=this._byDepthAndTag.get(n);if(i)for(let e=0;e<i.length;e++)if(t.matches(i[e]))return i[e];const a=this._wildcardByDepth.get(e);if(a)for(let e=0;e<a.length;e++)if(t.matches(a[e]))return a[e];const s=this._deepByTerminalTag.get(r);if(s)for(let e=0;e<s.length;e++)if(t.matches(s[e]))return s[e];for(let e=0;e<this._deepWildcards.length;e++)if(t.matches(this._deepWildcards[e]))return this._deepWildcards[e];return null}}const W={cent:"¢",pound:"£",curren:"¤",yen:"¥",euro:"€",dollar:"$",fnof:"ƒ",inr:"₹",af:"؋",birr:"ብር",peso:"₱",rub:"₽",won:"₩",yuan:"¥",cedil:"¸"},Y={amp:"&",apos:"'",gt:">",lt:"<",quot:'"'},H={nbsp:" ",copy:"©",reg:"®",trade:"™",mdash:"—",ndash:"–",hellip:"…",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",bull:"•",para:"¶",sect:"§",deg:"°",frac12:"½",frac14:"¼",frac34:"¾"},G=Object.freeze({ALLOW:"allow",BLOCK:"block",THROW:"throw"}),z=new Set("!?\\\\/[]$%{}^&*()<>|+");function Q(t){if("#"===t[0])throw new Error(`[EntityReplacer] Invalid character '#' in entity name: "${t}"`);for(const e of t)if(z.has(e))throw new Error(`[EntityReplacer] Invalid character '${e}' in entity name: "${t}"`);return t}function J(...t){const e=Object.create(null);for(const r of t)if(r)for(const t of Object.keys(r)){const n=r[t];if("string"==typeof n)e[t]=n;else if(n&&"object"==typeof n&&void 0!==n.val){const r=n.val;"string"==typeof r&&(e[t]=r)}}return e}const Z="external",K="base",tt="all",et=Object.freeze({allow:0,leave:1,remove:2,throw:3}),rt=new Set([9,10,13]);class nt{constructor(t={}){var e;this._limit=t.limit||{},this._maxTotalExpansions=this._limit.maxTotalExpansions||0,this._maxExpandedLength=this._limit.maxExpandedLength||0,this._postCheck="function"==typeof t.postCheck?t.postCheck:t=>t,this._limitTiers=(e=this._limit.applyLimitsTo??Z)&&e!==Z?e===tt?new Set([tt]):e===K?new Set([K]):Array.isArray(e)?new Set(e):new Set([Z]):new Set([Z]),this._numericAllowed=t.numericAllowed??!0,this._baseMap=J(Y,t.namedEntities||null),this._externalMap=Object.create(null),this._inputMap=Object.create(null),this._totalExpansions=0,this._expandedLength=0,this._removeSet=new Set(t.remove&&Array.isArray(t.remove)?t.remove:[]),this._leaveSet=new Set(t.leave&&Array.isArray(t.leave)?t.leave:[]);const r=function(t){if(!t)return{xmlVersion:1,onLevel:et.allow,nullLevel:et.remove};const e=1.1===t.xmlVersion?1.1:1,r=et[t.onNCR]??et.allow,n=et[t.nullNCR]??et.remove;return{xmlVersion:e,onLevel:r,nullLevel:Math.max(n,et.remove)}}(t.ncr);this._ncrXmlVersion=r.xmlVersion,this._ncrOnLevel=r.onLevel,this._ncrNullLevel=r.nullLevel,this._onExternalEntity="function"==typeof t.onExternalEntity?t.onExternalEntity:null,this._onInputEntity="function"==typeof t.onInputEntity?t.onInputEntity:null}_applyRegistrationHook(t,e,r,n){if(!t)return!0;const i=t(e,r);if(i===G.BLOCK)return!1;if(i===G.THROW)throw new Error(`[EntityDecoder] Registration of ${n} entity "&${e};" was rejected by hook`);return!0}setExternalEntities(t){if(t)for(const e of Object.keys(t))Q(e);if(!this._onExternalEntity)return void(this._externalMap=J(t));const e=J(t),r=Object.create(null);for(const[t,n]of Object.entries(e))this._applyRegistrationHook(this._onExternalEntity,t,n,"external")&&(r[t]=n);this._externalMap=r}addExternalEntity(t,e){Q(t),"string"==typeof e&&-1===e.indexOf("&")&&this._applyRegistrationHook(this._onExternalEntity,t,e,"external")&&(this._externalMap[t]=e)}addInputEntities(t){if(this._totalExpansions=0,this._expandedLength=0,!this._onInputEntity)return void(this._inputMap=J(t));const e=J(t),r=Object.create(null);for(const[t,n]of Object.entries(e))this._applyRegistrationHook(this._onInputEntity,t,n,"input")&&(r[t]=n);this._inputMap=r}reset(){return this._inputMap=Object.create(null),this._totalExpansions=0,this._expandedLength=0,this}setXmlVersion(t){this._ncrXmlVersion=1.1===t?1.1:1}decode(t){if("string"!=typeof t||0===t.length)return t;if(-1===t.indexOf("&"))return t;const e=t,r=[],n=t.length;let i=0,a=0;const s=this._maxTotalExpansions>0,o=this._maxExpandedLength>0,l=s||o;for(;a<n;){if(38!==t.charCodeAt(a)){a++;continue}let e=a+1;for(;e<n&&59!==t.charCodeAt(e)&&e-a<=32;)e++;if(e>=n||59!==t.charCodeAt(e)){a++;continue}const p=t.slice(a+1,e);if(0===p.length){a++;continue}let c,d;if(this._removeSet.has(p))c="",void 0===d&&(d=Z);else{if(this._leaveSet.has(p)){a++;continue}if(35===p.charCodeAt(0)){const t=this._resolveNCR(p);if(void 0===t){a++;continue}c=t,d=K}else{const t=this._resolveName(p);c=t?.value,d=t?.tier}}if(void 0!==c){if(a>i&&r.push(t.slice(i,a)),r.push(c),i=e+1,a=i,l&&this._tierCounts(d)){if(s&&(this._totalExpansions++,this._totalExpansions>this._maxTotalExpansions))throw new Error(`[EntityReplacer] Entity expansion count limit exceeded: ${this._totalExpansions} > ${this._maxTotalExpansions}`);if(o){const t=c.length-(p.length+2);if(t>0&&(this._expandedLength+=t,this._expandedLength>this._maxExpandedLength))throw new Error(`[EntityReplacer] Expanded content length limit exceeded: ${this._expandedLength} > ${this._maxExpandedLength}`)}}}else a++}i<n&&r.push(t.slice(i));const p=0===r.length?t:r.join("");return this._postCheck(p,e)}_tierCounts(t){return!!this._limitTiers.has(tt)||this._limitTiers.has(t)}_resolveName(t){return t in this._inputMap?{value:this._inputMap[t],tier:Z}:t in this._externalMap?{value:this._externalMap[t],tier:Z}:t in this._baseMap?{value:this._baseMap[t],tier:K}:void 0}_classifyNCR(t){return 0===t?this._ncrNullLevel:t>=55296&&t<=57343||1===this._ncrXmlVersion&&t>=1&&t<=31&&!rt.has(t)?et.remove:-1}_applyNCRAction(t,e,r){switch(t){case et.allow:return String.fromCodePoint(r);case et.remove:return"";case et.leave:return;case et.throw:throw new Error(`[EntityDecoder] Prohibited numeric character reference &${e}; (U+${r.toString(16).toUpperCase().padStart(4,"0")})`);default:return String.fromCodePoint(r)}}_resolveNCR(t){const e=t.charCodeAt(1);let r;if(r=120===e||88===e?parseInt(t.slice(2),16):parseInt(t.slice(1),10),Number.isNaN(r)||r<0||r>1114111)return;const n=this._classifyNCR(r);if(!this._numericAllowed&&n<et.remove)return;const i=-1===n?this._ncrOnLevel:Math.max(this._ncrOnLevel,n);return this._applyNCRAction(i,t,r)}}const it=[{id:"sql-block-comment-open",description:"SQL block comment open: /* ... */ — unusual in legitimate user text",pattern:/\/\*/},{id:"sql-union-select",description:"UNION SELECT — most common SQL injection aggregation attack",pattern:/\bUNION\s{1,20}(?:ALL\s{1,20})?SELECT\b/i},{id:"sql-drop-table",description:"DROP TABLE — destructive DDL injection",pattern:/\bDROP\s{1,20}TABLE\b/i},{id:"sql-drop-database",description:"DROP DATABASE — destructive DDL injection",pattern:/\bDROP\s{1,20}DATABASE\b/i},{id:"sql-insert-into",description:"INSERT INTO — data injection",pattern:/\bINSERT\s{1,20}INTO\b/i},{id:"sql-delete-from",description:"DELETE FROM — data deletion injection",pattern:/\bDELETE\s{1,20}FROM\b/i},{id:"sql-update-set",description:"UPDATE ... SET — data modification injection",pattern:/\bUPDATE\b[\s\S]{1,60}\bSET\b/i},{id:"sql-exec-xp",description:"EXEC xp_ — MSSQL extended stored procedure execution",pattern:/\bEXEC(?:UTE)?\s{1,20}xp_/i},{id:"sql-tautology-string",description:'Classic string tautology: \' OR \'1\'=\'1 or " OR "1"="1"',pattern:/'\s{0,10}OR\s{0,10}'[^']{0,20}'\s*=\s*'[^']{0,20}/i},{id:"sql-tautology-numeric",description:"Numeric tautology: OR 1=1",pattern:/\bOR\s{1,10}1\s*=\s*1\b/i},{id:"sql-always-true-zero",description:"Numeric tautology: OR 0=0",pattern:/\bOR\s{1,10}0\s*=\s*0\b/i},{id:"sql-sleep-benchmark",description:"Time-based blind injection: SLEEP() or BENCHMARK()",pattern:/\b(?:SLEEP|BENCHMARK)\s*\(/i},{id:"sql-waitfor-delay",description:"MSSQL time-based blind injection: WAITFOR DELAY",pattern:/\bWAITFOR\s{1,20}DELAY\b/i},{id:"sql-char-function",description:"CHAR() function — used to obfuscate injected strings",pattern:/\bCHAR\s*\(\s*\d{1,3}/i},{id:"sql-information-schema",description:"INFORMATION_SCHEMA — reconnaissance query for table/column enumeration",pattern:/\bINFORMATION_SCHEMA\b/i}],at=[...it,{id:"sql-line-comment",description:"SQL line comment: -- followed by whitespace or end of string",pattern:/--(?:\s|$)/},{id:"sql-stacked-query",description:"Stacked queries: semicolon immediately followed by a SQL keyword",pattern:/;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i},{id:"sql-hex-encoding",description:"Hex-encoded string injection: 0x41414141 style (MySQL)",pattern:/\b0x[0-9a-f]{4,}/i}],st=[{id:"html-script-open",description:"<script opening tag",pattern:/<script[\s>/]/i},{id:"html-script-close",description:"<\/script closing tag",pattern:/<\/script[\s>]/i},{id:"html-javascript-protocol",description:"javascript: URI scheme (with optional whitespace/encoding)",pattern:/j[\t\n\r ]*a[\t\n\r ]*v[\t\n\r ]*a[\t\n\r ]*s[\t\n\r ]*c[\t\n\r ]*r[\t\n\r ]*i[\t\n\r ]*p[\t\n\r ]*t[\t\n\r ]*:/i},{id:"html-vbscript-protocol",description:"vbscript: URI scheme",pattern:/vbscript[\t\n\r ]*:/i},{id:"html-data-html",description:"data:text/html URI — can execute scripts in browsers",pattern:/data[\t\n\r ]*:[\t\n\r ]*text\/html/i},{id:"html-data-xhtml",description:"data:application/xhtml+xml URI",pattern:/data[\t\n\r ]*:[\t\n\r ]*application\/xhtml/i},{id:"html-data-svg",description:"data:image/svg+xml URI — can execute scripts",pattern:/data[\t\n\r ]*:[\t\n\r ]*image\/svg\+xml/i},{id:"html-inline-event-handler",description:"Inline event handler attributes: onclick=, onerror=, onload=, etc.",pattern:/\bon\w{1,30}\s*=/i},{id:"html-entity-obfuscated-script",description:"HTML-entity-encoded <script (e.g. &#x3C;script or &lt;script)",pattern:/(?:&#x0*3[Cc];?|&#0*60;?|&lt;)\s*script/i},{id:"html-entity-obfuscated-javascript",description:'HTML-entity-encoded javascript: (partial — catches common &#106; or &#x6a; for "j")',pattern:/(?:&#x0*6[Aa];?|&#0*106;?)\s*(?:&#x0*61;?|a)[\s\S]{0,80}script\s*:/i},{id:"html-style-expression",description:"CSS expression() — IE-era code execution in style attributes",pattern:/style[\s\S]{0,20}expression\s*\(/i},{id:"html-object-embed",description:"<object or <embed tags that can load active content",pattern:/<(?:object|embed)[\s>/]/i},{id:"html-base-tag",description:"<base href= — can hijack all relative URLs on a page",pattern:/<base[\s>]/i},{id:"html-meta-refresh",description:'<meta http-equiv="refresh" — can redirect users',pattern:/<meta[\s\S]{0,40}http-equiv[\s\S]{0,20}refresh/i},{id:"html-srcdoc",description:"srcdoc= attribute on iframes — embeds HTML that can run scripts",pattern:/srcdoc\s*=/i},{id:"html-iframe",description:"<iframe tag",pattern:/<iframe[\s>/]/i},{id:"html-form",description:"<form tag — can be used for phishing / credential harvesting injection",pattern:/<form[\s>/]/i}],ot=[{id:"xml-cdata-injection",description:"CDATA section injection: <![CDATA[ breaks out of text node context",pattern:/<!\[CDATA\[/i},{id:"xml-cdata-close",description:"CDATA close sequence: ]]> can terminate an enclosing CDATA section",pattern:/\]\]>/},{id:"xml-processing-instruction",description:"XML processing instruction: <?xml-stylesheet or <?php etc.",pattern:/<\?(?:xml[\- ]|php|asp)/i},{id:"xml-doctype-injection",description:"DOCTYPE declaration embedded in content — can define entities",pattern:/<!DOCTYPE(?:[\s[]|$)/i},{id:"xml-entity-system",description:"SYSTEM keyword — used in external entity declarations (XXE)",pattern:/\bSYSTEM\s+["']/i},{id:"xml-entity-public",description:"PUBLIC keyword — used in external entity declarations (XXE)",pattern:/\bPUBLIC\s+["']/i},{id:"xml-entity-declaration",description:"<!ENTITY declaration — defines entities, potential XXE or entity expansion",pattern:/<!ENTITY[\s%]/i},{id:"xml-billion-laughs",description:"Entity reference chaining / billion laughs: repeated &eX; style references",pattern:/(?:&\w{1,20};){3,}/},{id:"xml-namespace-confusion",description:"xmlns: attribute injection — can redefine namespaces to confuse parsers",pattern:/\bxmlns\s*(?::\w{1,40})?\s*=/i},{id:"xml-comment-injection",description:"\x3c!-- comment injection — can hide content from some parsers",pattern:/<!--/},{id:"xml-comment-close",description:"--\x3e closes an enclosing XML comment",pattern:/-->/},{id:"xml-pi-close",description:"?> closes an enclosing processing instruction",pattern:/\?>/}],lt=[{id:"svg-script-element",description:"<script element inside SVG executes JavaScript",pattern:/<script[\s>/]/i},{id:"svg-xlink-href-javascript",description:"xlink:href with javascript: — classic SVG XSS via <a> or <use>",pattern:/xlink\s*:\s*href\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-href-javascript",description:"href= with javascript: in SVG context (<a>, <animate>, etc.)",pattern:/href\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-foreignobject",description:"<foreignObject embeds HTML inside SVG — can execute scripts",pattern:/<foreignObject[\s>/]/i},{id:"svg-use-external",description:"<use xlink:href or href pointing to external resource (non-fragment URL)",pattern:/<use[\s\S]{0,60}(?:xlink\s*:\s*)?href\s*=\s*(?:["'][^#]|[^"'#\s>])/i},{id:"svg-animate-href",description:'<animate attributeName="href" — can dynamically change href to javascript:',pattern:/<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*href["']/i},{id:"svg-animate-xlinkhref",description:'<animate attributeName="xlink:href"',pattern:/<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*xlink\s*:\s*href["']/i},{id:"svg-set-javascript",description:'<set to="javascript:..." — sets an attribute to a javascript: URI',pattern:/<set[\s\S]{0,80}to\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-event-handler",description:"SVG-specific event handler attributes: onload=, onerror=, onactivate=, etc.",pattern:/\bon(?:load|error|activate|begin|end|repeat|focus|blur|click|mouse\w{1,20}|key\w{1,20})\s*=/i},{id:"svg-handler-generic",description:"Generic on* handler catch-all for SVG attributes",pattern:/\bon\w{1,30}\s*=/i},{id:"svg-filter-feimage",description:"<feImage href= — filter primitive that can load external resources",pattern:/<feImage[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=/i},{id:"svg-image-external",description:"<image xlink:href with http/https or javascript protocol",pattern:/<image[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=\s*["']?\s*(?:https?|javascript)\s*:/i},{id:"svg-style-javascript",description:"style= attribute containing javascript: (e.g. background:url(javascript:...))",pattern:/style\s*=[\s\S]{0,60}javascript\s*:/i}],pt=[{id:"shell-path-traversal-unix",description:"Unix path traversal: ../  — climbing the directory tree",pattern:/\.\.\//},{id:"shell-path-traversal-windows",description:"Windows path traversal: ..\\ — climbing the directory tree",pattern:/\.\.\\/},{id:"shell-path-traversal-encoded",description:"URL-encoded path traversal: %2e%2e or %2f variants",pattern:/%2e%2e|%2f\.\.|\.\.%2f/i},{id:"shell-null-byte",description:"Null byte injection: \\x00 or %00 — truncates strings in C-backed functions",pattern:/\x00|%00/},{id:"shell-semicolon",description:"Semicolon command separator: cmd1; cmd2",pattern:/;/},{id:"shell-pipe",description:"Pipe operator: cmd1 | cmd2",pattern:/\|/},{id:"shell-and-operator",description:"AND operator: cmd1 && cmd2",pattern:/&&/},{id:"shell-or-operator",description:"OR operator: cmd1 || cmd2",pattern:/\|\|/},{id:"shell-backtick",description:"Backtick command substitution: `cmd`",pattern:/`/},{id:"shell-dollar-paren",description:"Dollar-paren command substitution: $(cmd)",pattern:/\$\(/},{id:"shell-dollar-brace",description:"Dollar-brace variable expansion: ${var} — can be abused for injection",pattern:/\$\{/},{id:"shell-redirect-out",description:"Output redirection: cmd > file or cmd >> file",pattern:/>{1,2}/},{id:"shell-redirect-in",description:"Input redirection: cmd < file",pattern:/</},{id:"shell-newline-injection",description:"Newline injection: \\n or \\r — can inject new shell commands",pattern:/[\n\r]/},{id:"shell-glob-star",description:"Glob expansion: * or ? — can expand to unintended files",pattern:/[/\\][*?]/},{id:"shell-absolute-root",description:"Absolute root path injection: string starting with / or \\ (Windows UNC)",pattern:/^(?:\/|\\\\)/},{id:"shell-windows-drive",description:"Windows drive letter path injection: C:\\ or D:/",pattern:/^[a-zA-Z]:[/\\]/},{id:"shell-curl-wget",description:"curl/wget with URL or flags — can exfiltrate data or download payloads",pattern:/\b(?:curl|wget)\s+(?:https?:\/\/|ftp:\/\/|-)/i}],ct=[{id:"redos-nested-quantifier-plus",description:"Nested + quantifier inside a group with outer quantifier: (a+)+, (.+b)*, etc.",pattern:/\([^)]*\+[^)]*\)[+*]/},{id:"redos-nested-quantifier-star",description:"Nested * quantifier: (a*)* or (a*)+ — catastrophic backtracking",pattern:/\([^)]*\*[^)]*\)[*+]/},{id:"redos-nested-groups",description:"Doubly nested quantified groups: ((a+)+) — guaranteed catastrophic",pattern:/\(\([^)]{0,40}\)[+*]\)[+*]/},{id:"redos-alternation-overlap",description:"Overlapping alternation under quantifier: (a|a)+ — ambiguous NFA paths",pattern:/\(([^|()]{1,20})\|(?:\1)(?:\|[^|()]{1,20}){0,5}\)[+*?]{1,2}/},{id:"redos-star-plus-concat",description:"(x*x)+ pattern — triggers super-linear backtracking",pattern:/\([^)]{0,10}\*[^)]{0,10}\)[+*]/},{id:"redos-dot-star-greedy",description:"(.*){n,} or (.+){n,} — repeated greedy dot quantifiers",pattern:/\(\.[*+]\)\{?\d/},{id:"redos-large-repetition",description:"Very large fixed or range repetition count {1000,} or {1000,n} — denial of service via backtracking",pattern:/\{\d{4,}(?:,\d*)?\}/},{id:"redos-catastrophic-alternation",description:"Long alternation with many similar branches — polynomial backtracking risk",pattern:/\([^)]{0,200}(?:\|[^|)]{0,50}){9,}\)/}],dt="[\"'\\s]*:",ht=[{id:"nosql-where-operator",description:"$where — executes arbitrary JavaScript server-side in MongoDB",pattern:new RegExp(`\\$where${dt}`,"i")},{id:"nosql-ne-operator",description:'$ne — "not equal" operator used to bypass equality checks',pattern:new RegExp(`\\$ne${dt}`,"i")},{id:"nosql-gt-operator",description:'$gt — "greater than" used to bypass password/value checks',pattern:new RegExp(`\\$gte?${dt}`,"i")},{id:"nosql-lt-operator",description:'$lt / $lte — "less than" bypass variants',pattern:new RegExp(`\\$lte?${dt}`,"i")},{id:"nosql-regex-operator",description:"$regex — can be used to extract data character by character (blind injection)",pattern:new RegExp(`\\$regex${dt}`,"i")},{id:"nosql-or-operator",description:"$or — logical OR; used to create always-true conditions",pattern:new RegExp(`\\$or${dt}\\s*\\[`,"i")},{id:"nosql-and-operator",description:"$and — logical AND operator injection",pattern:new RegExp(`\\$and${dt}\\s*\\[`,"i")},{id:"nosql-nor-operator",description:"$nor — logical NOR operator injection",pattern:new RegExp(`\\$nor${dt}\\s*\\[`,"i")},{id:"nosql-exists-operator",description:"$exists — can enumerate fields to determine schema",pattern:new RegExp(`\\$exists${dt}`,"i")},{id:"nosql-in-operator",description:"$in — matches any value in a list; can enumerate values",pattern:new RegExp(`\\$in${dt}\\s*\\[`,"i")},{id:"nosql-expr-operator",description:"$expr — allows aggregation expressions in queries (MongoDB 3.6+)",pattern:new RegExp(`\\$expr${dt}`,"i")},{id:"nosql-function-operator",description:"$function — executes arbitrary JavaScript in MongoDB 4.4+",pattern:new RegExp(`\\$function${dt}`,"i")},{id:"nosql-accumulator-operator",description:"$accumulator — custom aggregation with arbitrary JS execution",pattern:new RegExp(`\\$accumulator${dt}`,"i")},{id:"nosql-proto-pollution",description:"__proto__ — prototype pollution via object key injection",pattern:/__proto__/},{id:"nosql-constructor-prototype",description:"constructor.prototype — alternative prototype pollution vector (dot notation or JSON key)",pattern:/constructor[\s"':.,{\[]*prototype/i},{id:"nosql-proto-bracket",description:'["__proto__"] — bracket-notation prototype pollution',pattern:/\[["']__proto__["']\]/}],ut=[{id:"log-crlf-injection",description:"CRLF injection: literal \\r or \\n embeds fake log lines",pattern:/[\r\n]/},{id:"log-url-encoded-crlf",description:"URL-encoded CRLF: %0d, %0a, %0D, %0A — decoded by some log parsers",pattern:/%0[dDaA]/},{id:"log-unicode-newline",description:"Unicode newline variants: U+2028 (line separator), U+2029 (paragraph separator)",pattern:/[\u2028\u2029]/},{id:"log-log4shell-jndi",description:"Log4Shell: ${jndi:...} triggers remote code execution in Apache Log4j",pattern:/\$\{jndi\s*:/i},{id:"log-log4shell-obfuscated",description:"Obfuscated Log4Shell: ${::-j}... lookup-bypass prefix used to evade WAF detection",pattern:/\$\{::-/},{id:"log-log4j-lookup",description:"Log4j lookup syntax: ${env:...}, ${sys:...}, ${ctx:...} — data exfiltration",pattern:/\$\{(?:env|sys|ctx|main|map|sd|web|docker|k8s|spring)\s*:/i},{id:"log-ssti-double-brace",description:"SSTI double-brace: {{expression}} — Jinja2, Twig, Handlebars, etc.",pattern:/\{\{[\s\S]{0,80}\}\}/},{id:"log-ssti-hash-brace",description:"SSTI hash-brace: #{expression} — Thymeleaf, Velocity, Ruby ERB",pattern:/#\{[\s\S]{0,80}\}/},{id:"log-ssti-dollar-brace",description:"SSTI/EL injection: ${expression with operators or method calls} — JSP EL, Freemarker, SpEL",pattern:/\$\{[^}]*(?:\.|\(|\*|\+|\bclass\b|\bruntime\b|\bprocess\b|\bexec\b)[^}]{0,80}\}/i},{id:"log-ssti-percent-tag",description:"SSTI ERB/ASP tag: <%= expression %> — Ruby ERB, ASP",pattern:/<%=[\s\S]{0,80}%>/},{id:"log-null-byte",description:"Null byte: \\x00 or %00 — can truncate log entries in C-backed loggers",pattern:/\x00|%00/},{id:"log-ansi-escape",description:"ANSI escape sequence: ESC[ — can manipulate terminal output when logs are tailed",pattern:/\x1b\[/}];function ft(t,e){const r=e.label??"CUSTOM";for(const n of e)if(n.pattern.test(t))return{context:r,id:n.id,description:n.description,pattern:n.pattern};return null}function gt(t,e){(function(t){if("string"!=typeof t)throw new TypeError("is-unsafe: first argument must be a string, got "+typeof t)})(t),function(t){if(!(t instanceof RegExp)){if(!Array.isArray(t))throw new TypeError("is-unsafe: second argument must be a PatternList (e.g. HTML), an array of PatternLists (e.g. [HTML, XML]), or a RegExp. Got: "+typeof t);if(0===t.length)throw new TypeError("is-unsafe: context must not be an empty array");if(Array.isArray(t[0]))for(const e of t)if(!Array.isArray(e)||0===e.length)throw new TypeError("is-unsafe: each context in the array must be a non-empty pattern array (PatternList)")}}(e);const{lists:r,regex:n}=function(t){return t instanceof RegExp?{lists:null,regex:t}:Array.isArray(t[0])?{lists:t,regex:null}:{lists:[t],regex:null}}(e);if(n)return n.test(t);for(const e of r)if(null!==ft(t,e))return!0;return!1}function mt(){return mt=Object.assign?Object.assign.bind():function(t){for(var e=1;e<arguments.length;e++){var r=arguments[e];for(var n in r)({}).hasOwnProperty.call(r,n)&&(t[n]=r[n])}return t},mt.apply(null,arguments)}function vt(t,e){if(!t)return{};var r=e.attributesGroupName?t[e.attributesGroupName]:t;if(!r)return{};var n={};for(var i in r)i.startsWith(e.attributeNamePrefix)?n[i.substring(e.attributeNamePrefix.length)]=r[i]:n[i]=r[i];return n}function xt(t){if(t&&"string"==typeof t){var e=t.indexOf(":");if(-1!==e&&e>0){var r=t.substring(0,e);if("xmlns"!==r)return r}}}st.label="HTML",ot.label="XML",lt.label="SVG",it.label="SQL",at.label="SQL-STRICT",pt.label="SHELL",ct.label="REDOS",ht.label="NOSQL",ut.label="LOG",Object.freeze({HTML:st,XML:ot,SVG:lt,SQL:it,"SQL-STRICT":at,SHELL:pt,REDOS:ct,NOSQL:ht,LOG:ut});var bt=function(t,e){var r;this.options=t,this.currentNode=null,this.tagsNodeStack=[],this.parseXml=Nt,this.parseTextData=yt,this.resolveNameSpace=Et,this.buildAttributesMap=St,this.isItStopNode=Ct,this.replaceEntitiesValue=Tt,this.readStopNodeData=kt,this.saveTextToParentTag=At,this.addChild=_t,this.ignoreAttributesFn="function"==typeof(r=this.options.ignoreAttributes)?r:Array.isArray(r)?function(t){for(var e,n=function(t,e){var r="undefined"!=typeof Symbol&&t[Symbol.iterator]||t["@@iterator"];if(r)return(r=r.call(t)).next.bind(r);if(Array.isArray(t)||(r=function(t,e){if(t){if("string"==typeof t)return q(t,e);var r={}.toString.call(t).slice(8,-1);return"Object"===r&&t.constructor&&(r=t.constructor.name),"Map"===r||"Set"===r?Array.from(t):"Arguments"===r||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r)?q(t,e):void 0}}(t))||e&&t&&"number"==typeof t.length){r&&(t=r);var n=0;return function(){return n>=t.length?{done:!0}:{done:!1,value:t[n++]}}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}(r);!(e=n()).done;){var i=e.value;if("string"==typeof i&&t===i)return!0;if(i instanceof RegExp&&i.test(t))return!0}}:function(){return!1},this.entityExpansionCount=0,this.currentExpandedLength=0,this.doctypefound=!1;var n=mt({},Y);this.options.entityDecoder?this.entityDecoder=this.options.entityDecoder:("object"==typeof this.options.htmlEntities?n=this.options.htmlEntities:!0===this.options.htmlEntities&&(n=mt({},H,W)),this.entityDecoder=new nt({namedEntities:mt({},n,e),numericAllowed:this.options.htmlEntities,limit:{maxTotalExpansions:this.options.processEntities.maxTotalExpansions,maxExpandedLength:this.options.processEntities.maxExpandedLength,applyLimitsTo:this.options.processEntities.appliesTo},onInputEntity:function(t,e){return gt(e,[st,ot])?G.BLOCK:G.ALLOW}})),this.matcher=new F,this.readonlyMatcher=this.matcher.readOnly(),this.isCurrentNodeStopNode=!1,this.stopNodeExpressionsSet=new X;var i=this.options.stopNodes;if(i&&i.length>0){for(var a=0;a<i.length;a++){var s=i[a];"string"==typeof s?this.stopNodeExpressionsSet.add(new B(s)):s instanceof B&&this.stopNodeExpressionsSet.add(s)}this.stopNodeExpressionsSet.seal()}};function yt(t,e,r,n,i,a,s){var o=this.options;if(void 0!==t&&(o.trimValues&&!n&&(t=t.trim()),t.length>0)){s||(t=this.replaceEntitiesValue(t,e,r));var l=o.jPath?r.toString():r,p=o.tagValueProcessor(e,t,l,i,a);return null==p?t:typeof p!=typeof t||p!==t?p:o.trimValues||t.trim()===t?Lt(t,o.parseTagValue,o.numberParseOptions):t}}function Et(t){if(this.options.removeNSPrefix){var e=t.split(":"),r="/"===t.charAt(0)?"/":"";if("xmlns"===e[0])return"";2===e.length&&(t=r+e[1])}return t}var wt=new RegExp("([^\\s=]+)\\s*(=\\s*(['\"])([\\s\\S]*?)\\3)?","gm");function St(t,e,r,n){void 0===n&&(n=!1);var i=this.options;if(!0===n||!0!==i.ignoreAttributes&&"string"==typeof t){for(var a=function(t,e){for(var r=[],n=e.exec(t);n;){var i=[];i.startIndex=e.lastIndex-n[0].length;for(var a=n.length,s=0;s<a;s++)i.push(n[s]);r.push(i),n=e.exec(t)}return r}(t,wt),s=a.length,o={},l=new Array(s),p=!1,c={},d=0;d<s;d++){var h=this.resolveNameSpace(a[d][1]),u=a[d][4];if(h.length&&void 0!==u){var f=u;i.trimValues&&(f=f.trim()),f=this.replaceEntitiesValue(f,r,this.readonlyMatcher),l[d]=f,c[h]=f,p=!0}}p&&"object"==typeof e&&e.updateCurrent&&e.updateCurrent(c);for(var g=i.jPath?e.toString():this.readonlyMatcher,m=!1,v=0;v<s;v++){var x=this.resolveNameSpace(a[v][1]);if(!this.ignoreAttributesFn(x,g)){var b=i.attributeNamePrefix+x;if(x.length)if(i.transformAttributeName&&(b=i.transformAttributeName(b)),b=Pt(b,i),void 0!==a[v][4]){var y=l[v],E=i.attributeValueProcessor(x,y,g);o[b]=null==E?y:typeof E!=typeof y||E!==y?E:Lt(y,i.parseAttributeValue,i.numberParseOptions),m=!0}else i.allowBooleanAttributes&&(o[b]=!0,m=!0)}}if(!m)return;if(i.attributesGroupName&&!i.preserveOrder){var w={};return w[i.attributesGroupName]=o,w}return o}}var Nt=function(t){t=t.replace(/\r\n?/g,"\n");var e=new u("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0,this.doctypefound=!1;for(var i=this.options,a=new S(i.processEntities),s=t.length,o=0;o<s;o++)if("<"===t[o]){var l=t.charCodeAt(o+1);if(47===l){var p=It(t,">",o,"Closing Tag is not closed."),c=t.substring(o+2,p).trim();if(i.removeNSPrefix){var d=c.indexOf(":");-1!==d&&(c=c.substr(d+1))}c=Dt(i.transformTagName,c,"",i).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMatcher));var h=this.matcher.getCurrentTag();if(c&&i.unpairedTagsSet.has(c))throw new Error("Unpaired tag can not be used as closing tag: </"+c+">");h&&i.unpairedTagsSet.has(h)&&(this.matcher.pop(),this.tagsNodeStack.pop()),this.matcher.pop(),this.isCurrentNodeStopNode=!1,r=this.tagsNodeStack.pop()||e,i.captureMetaData&&r&&r.addEndIndex(p+1),n="",o=p}else if(63===l){var f=jt(t,o,!1,"?>");if(!f)throw new Error("Pi Tag is not closed.");n=this.saveTextToParentTag(n,r,this.readonlyMatcher);var g=this.buildAttributesMap(f.tagExp,this.matcher,f.tagName,!0);if(g){var m=g[this.options.attributeNamePrefix+"version"];this.entityDecoder.setXmlVersion(Number(m)||1),a.setXmlVersion(Number(m)||1)}if(i.ignoreDeclaration&&"?xml"===f.tagName||i.ignorePiTags);else{var v=new u(f.tagName);v.add(i.textNodeName,""),f.tagName!==f.tagExp&&f.attrExpPresent&&!0!==i.ignoreAttributes&&(v[":@"]=g),this.addChild(r,v,this.readonlyMatcher,o),i.captureMetaData&&r.addEndIndex(f.closeIndex+2)}o=f.closeIndex+1}else if(33===l&&45===t.charCodeAt(o+2)&&45===t.charCodeAt(o+3)){var x=It(t,"--\x3e",o+4,"Comment is not closed.");if(i.commentPropName){var b,y=t.substring(o+4,x-2);n=this.saveTextToParentTag(n,r,this.readonlyMatcher),r.add(i.commentPropName,[(b={},b[i.textNodeName]=y,b)])}o=x}else if(33===l&&68===t.charCodeAt(o+2)){if(this.doctypefound)throw new Error("Multiple DOCTYPE declarations found.");this.doctypefound=!0;var E=a.readDocType(t,o);this.entityDecoder.addInputEntities(E.entities),o=E.i}else if(33===l&&91===t.charCodeAt(o+2)){var w=It(t,"]]>",o,"CDATA is not closed.")-2,N=t.substring(o+9,w);n=this.saveTextToParentTag(n,r,this.readonlyMatcher);var _,T=this.parseTextData(N,r.tagname,this.readonlyMatcher,!0,!1,!0,!0);null==T&&(T=""),i.cdataPropName?r.add(i.cdataPropName,[(_={},_[i.textNodeName]=N,_)]):r.add(i.textNodeName,T),o=w+2}else{var A=jt(t,o,i.removeNSPrefix);if(!A){var C=t.substring(Math.max(0,o-50),Math.min(s,o+50));throw new Error("readTagExp returned undefined at position "+o+'. Context: "'+C+'"')}var I=A.tagName,O=A.rawTagName,j=A.tagExp,k=A.attrExpPresent,L=A.closeIndex,D=Dt(i.transformTagName,I,j,i);if(I=D.tagName,j=D.tagExp,i.strictReservedNames&&(I===i.commentPropName||I===i.cdataPropName||I===i.textNodeName||I===i.attributesGroupName))throw new Error("Invalid tag name: "+I);r&&n&&"!xml"!==r.tagname&&(n=this.saveTextToParentTag(n,r,this.readonlyMatcher,!1));var P=r;P&&i.unpairedTagsSet.has(P.tagname)&&(r=this.tagsNodeStack.pop(),this.matcher.pop());var M=!1;j.length>0&&j.lastIndexOf("/")===j.length-1&&(M=!0,j="/"===I[I.length-1]?I=I.substr(0,I.length-1):j.substr(0,j.length-1),k=I!==j);var $,R=null;$=xt(O),I!==e.tagname&&this.matcher.push(I,{},$),I!==j&&k&&(R=this.buildAttributesMap(j,this.matcher,I))&&vt(R,i),I!==e.tagname&&(this.isCurrentNodeStopNode=this.isItStopNode());var V=o;if(this.isCurrentNodeStopNode){var q="";if(M)o=A.closeIndex;else if(i.unpairedTagsSet.has(I))o=A.closeIndex;else{var U=this.readStopNodeData(t,O,L+1);if(!U)throw new Error("Unexpected end of "+O);o=U.i,q=U.tagContent}var F=new u(I);R&&(F[":@"]=R),F.add(i.textNodeName,q),this.matcher.pop(),this.isCurrentNodeStopNode=!1,this.addChild(r,F,this.readonlyMatcher,V),i.captureMetaData&&r.addEndIndex(o+1)}else{if(M){var B=Dt(i.transformTagName,I,j,i);I=B.tagName,j=B.tagExp;var X=new u(I);R&&(X[":@"]=R),this.addChild(r,X,this.readonlyMatcher,V),i.captureMetaData&&r.addEndIndex(L+1),this.matcher.pop(),this.isCurrentNodeStopNode=!1}else{if(i.unpairedTagsSet.has(I)){var W=new u(I);R&&(W[":@"]=R),this.addChild(r,W,this.readonlyMatcher,V),i.captureMetaData&&r.addEndIndex(A.closeIndex+1),this.matcher.pop(),this.isCurrentNodeStopNode=!1,o=A.closeIndex;continue}var Y=new u(I);if(this.tagsNodeStack.length>i.maxNestedTags)throw new Error("Maximum nested tags exceeded");this.tagsNodeStack.push(r),R&&(Y[":@"]=R),this.addChild(r,Y,this.readonlyMatcher,V),r=Y}n="",o=L}}}else n+=t[o];return e.child};function _t(t,e,r,n){this.options.captureMetaData||(n=void 0);var i=this.options.jPath?r.toString():r,a=this.options.updateTag(e.tagname,i,e[":@"]);!1===a||("string"==typeof a?(e.tagname=a,t.addChild(e,n)):t.addChild(e,n))}function Tt(t,e,r){var n=this.options.processEntities;if(!n||!n.enabled)return t;if(n.allowedTags){var i=this.options.jPath?r.toString():r;if(!(Array.isArray(n.allowedTags)?n.allowedTags.includes(e):n.allowedTags(e,i)))return t}if(n.tagFilter){var a=this.options.jPath?r.toString():r;if(!n.tagFilter(e,a))return t}return this.entityDecoder.decode(t)}function At(t,e,r,n){return t&&(void 0===n&&(n=0===e.child.length),void 0!==(t=this.parseTextData(t,e.tagname,r,!1,!!e[":@"]&&0!==Object.keys(e[":@"]).length,n))&&""!==t&&e.add(this.options.textNodeName,t),t=""),t}function Ct(){return 0!==this.stopNodeExpressionsSet.size&&this.matcher.matchesAny(this.stopNodeExpressionsSet)}function It(t,e,r,n){var i=t.indexOf(e,r);if(-1===i)throw new Error(n);return i+e.length-1}function Ot(t,e,r,n){var i=t.indexOf(e,r);if(-1===i)throw new Error(n);return i}function jt(t,e,r,n){void 0===n&&(n=">");var i=function(t,e,r){void 0===r&&(r=">");for(var n=0,i=t.length,a=r.charCodeAt(0),s=r.length>1?r.charCodeAt(1):-1,o="",l=e,p=e;p<i;p++){var c=t.charCodeAt(p);if(n)c===n&&(n=0);else if(34===c||39===c)n=c;else if(c===a){if(-1===s)return{data:o+=t.substring(l,p),index:p};if(t.charCodeAt(p+1)===s)return{data:o+=t.substring(l,p),index:p}}else 9!==c||n||(o+=t.substring(l,p)+" ",l=p+1)}}(t,e+1,n);if(i){var a=i.data,s=i.index,o=a.search(/\s/),l=a,p=!0;-1!==o&&(l=a.substring(0,o),a=a.substring(o+1).trimStart());var c=l;if(r){var d=l.indexOf(":");-1!==d&&(p=(l=l.substr(d+1))!==i.data.substr(d+1))}return{tagName:l,tagExp:a,closeIndex:s,attrExpPresent:p,rawTagName:c}}}function kt(t,e,r){for(var n=r,i=1,a=t.length;r<a;r++)if("<"===t[r]){var s=t.charCodeAt(r+1);if(47===s){var o=Ot(t,">",r,e+" is not closed");if(t.substring(r+2,o).trim()===e&&0===--i)return{tagContent:t.substring(n,r),i:o};r=o}else if(63===s)r=It(t,"?>",r+1,"StopNode is not closed.");else if(33===s&&45===t.charCodeAt(r+2)&&45===t.charCodeAt(r+3))r=It(t,"--\x3e",r+3,"StopNode is not closed.");else if(33===s&&91===t.charCodeAt(r+2))r=It(t,"]]>",r,"StopNode is not closed.")-2;else{var l=jt(t,r,!1);l&&((l&&l.tagName)===e&&"/"!==l.tagExp[l.tagExp.length-1]&&i++,r=l.closeIndex)}}}function Lt(t,e,r){if(e&&"string"==typeof t){var n=t.trim();return"true"===n||"false"!==n&&$(t,r)}return void 0!==t?t:""}function Dt(t,e,r,n){if(t){var i=t(e);r===e&&(r=i),e=i}return{tagName:e=Pt(e,n),tagExp:r}}function Pt(t,e){if(s.includes(t))throw new Error('[SECURITY] Invalid name: "'+t+'" is a reserved JavaScript keyword that could cause prototype pollution');return a.includes(t)?e.onDangerousProperty(t):t}var Mt=u.getMetaDataSymbol();function $t(t,e){if(!t||"object"!=typeof t)return{};if(!e)return t;var r={};for(var n in t)n.startsWith(e)?r[n.substring(e.length)]=t[n]:r[n]=t[n];return r}function Rt(t,e,r,n){return Vt(t,e,r,n)}function Vt(t,e,r,n){for(var i,a={},s=0;s<t.length;s++){var o=t[s],l=qt(o);if(void 0!==l&&l!==e.textNodeName){var p=$t(o[":@"]||{},e.attributeNamePrefix);r.push(l,p)}if(l===e.textNodeName)void 0===i?i=o[l]:i+=""+o[l];else{if(void 0===l)continue;if(o[l]){var c=Vt(o[l],e,r,n),d=Ft(c,e);if(0===Object.keys(c).length&&e.alwaysCreateTextNode&&(c[e.textNodeName]=""),o[":@"]?Ut(c,o[":@"],n,e):1!==Object.keys(c).length||void 0===c[e.textNodeName]||e.alwaysCreateTextNode?0===Object.keys(c).length&&(e.alwaysCreateTextNode?c[e.textNodeName]="":c=""):c=c[e.textNodeName],void 0!==o[Mt]&&"object"==typeof c&&null!==c&&(c[Mt]=o[Mt]),void 0!==a[l]&&Object.prototype.hasOwnProperty.call(a,l))Array.isArray(a[l])||(a[l]=[a[l]]),a[l].push(c);else{var h=e.jPath?n.toString():n;e.isArray(l,h,d)?a[l]=[c]:a[l]=c}void 0!==l&&l!==e.textNodeName&&r.pop()}}}return"string"==typeof i?i.length>0&&(a[e.textNodeName]=i):void 0!==i&&(a[e.textNodeName]=i),a}function qt(t){for(var e=Object.keys(t),r=0;r<e.length;r++){var n=e[r];if(":@"!==n)return n}}function Ut(t,e,r,n){if(e)for(var i=Object.keys(e),a=i.length,s=0;s<a;s++){var o=i[s],l=o.startsWith(n.attributeNamePrefix)?o.substring(n.attributeNamePrefix.length):o,p=n.jPath?r.toString()+"."+l:r;n.isArray(o,p,!0,!0)?t[o]=[e[o]]:t[o]=e[o]}}function Ft(t,e){var r=e.textNodeName,n=Object.keys(t).length;return 0===n||!(1!==n||!t[r]&&"boolean"!=typeof t[r]&&0!==t[r])}var Bt={allowBooleanAttributes:!1,unpairedTags:[]};function Xt(t){return" "===t||"\t"===t||"\n"===t||"\r"===t}function Wt(t,e){for(var r=e;e<t.length;e++)if("?"!=t[e]&&" "!=t[e]);else{var n=t.substr(r,e-r);if(e>5&&"xml"===n)return Qt("InvalidXml","XML declaration allowed only at the start of the document.",Kt(t,e));if("?"==t[e]&&">"==t[e+1]){e++;break}}return e}function Yt(t,e){if(t.length>e+5&&"-"===t[e+1]&&"-"===t[e+2]){for(e+=3;e<t.length;e++)if("-"===t[e]&&"-"===t[e+1]&&">"===t[e+2]){e+=2;break}}else if(t.length>e+8&&"D"===t[e+1]&&"O"===t[e+2]&&"C"===t[e+3]&&"T"===t[e+4]&&"Y"===t[e+5]&&"P"===t[e+6]&&"E"===t[e+7]){var r=1;for(e+=8;e<t.length;e++)if("<"===t[e])r++;else if(">"===t[e]&&0===--r)break}else if(t.length>e+9&&"["===t[e+1]&&"C"===t[e+2]&&"D"===t[e+3]&&"A"===t[e+4]&&"T"===t[e+5]&&"A"===t[e+6]&&"["===t[e+7])for(e+=8;e<t.length;e++)if("]"===t[e]&&"]"===t[e+1]&&">"===t[e+2]){e+=2;break}return e}function Ht(t,e){for(var r="",n="",i=!1;e<t.length;e++){if('"'===t[e]||"'"===t[e])""===n?n=t[e]:n!==t[e]||(n="");else if(">"===t[e]&&""===n){i=!0;break}r+=t[e]}return""===n&&{value:r,index:e,tagClosed:i}}function Gt(t,e){for(var r=function(t){for(var e=[],r=t.length,n=0;n<r;){for(var i=n;n<r&&Xt(t[n]);)n++;if(n>=r)break;if("="!==t[n]){for(var a=t.slice(i,n),s=n;n<r&&!Xt(t[n])&&"="!==t[n];)n++;for(var o=t.slice(s,n),l=void 0,p=n;p<r&&Xt(t[p]);)p++;p<r&&"="===t[p]&&(l=t.slice(n,p+1),n=p+1);for(var c=void 0,d=void 0,h=n;h<r&&Xt(t[h]);)h++;if(h<r&&('"'===t[h]||"'"===t[h])){var u=h+1,f=t.indexOf(t[h],u);-1!==f&&(c=t[h],d=t.slice(u,f),n=f+1)}var g={startIndex:i};g[1]=a,g[2]=o,g[3]=l,g[4]=void 0!==c||void 0,g[5]=c,g[6]=d,e.push(g)}else n=i+1}return e}(t),n={},i=0;i<r.length;i++){if(0===r[i][1].length)return Qt("InvalidAttr","Attribute '"+r[i][2]+"' has no space in starting.",te(r[i]));if(void 0!==r[i][3]&&void 0===r[i][4])return Qt("InvalidAttr","Attribute '"+r[i][2]+"' is without value.",te(r[i]));if(void 0===r[i][3]&&!e.allowBooleanAttributes)return Qt("InvalidAttr","boolean attribute '"+r[i][2]+"' is not allowed.",te(r[i]));var a=r[i][2];if(!Jt(a))return Qt("InvalidAttr","Attribute '"+a+"' is an invalid name.",te(r[i]));if(Object.prototype.hasOwnProperty.call(n,a))return Qt("InvalidAttr","Attribute '"+a+"' is repeated.",te(r[i]));n[a]=1}return!0}function zt(t,e){if(";"===t[++e])return-1;if("#"===t[e])return function(t,e){var r=/\d/;for("x"===t[e]&&(e++,r=/[\da-fA-F]/);e<t.length;e++){if(";"===t[e])return e;if(!t[e].match(r))break}return-1}(t,++e);for(var r=0;e<t.length;e++,r++)if(!(t[e].match(/\w/)&&r<20)){if(";"===t[e])break;return-1}return e}function Qt(t,e,r){return{err:{code:t,msg:e,line:r.line||r,col:r.col}}}function Jt(t){return i(t)}function Zt(t){return i(t)}function Kt(t,e){var r=t.substring(0,e).split(/\r?\n/);return{line:r.length,col:r[r.length-1].length+1}}function te(t){return t.startIndex+t[1].length}var ee=function(){function t(t){this.externalEntities={},this.options=h(t)}var e=t.prototype;return e.parse=function(t,e){if("string"!=typeof t&&t.toString)t=t.toString();else if("string"!=typeof t)throw new Error("XML data is accepted in String or Bytes[] form.");if(e){!0===e&&(e={});var r=function(t,e){e=Object.assign({},Bt,e);var r=[],n=!1,i=!1;"\ufeff"===t[0]&&(t=t.substr(1));for(var a=0;a<t.length;a++)if("<"===t[a]&&"?"===t[a+1]){if((a=Wt(t,a+=2)).err)return a}else{if("<"!==t[a]){if(Xt(t[a]))continue;return Qt("InvalidChar","char '"+t[a]+"' is not expected.",Kt(t,a))}var s=a;if("!"===t[++a]){a=Yt(t,a);continue}var o=!1;"/"===t[a]&&(o=!0,a++);for(var l="";a<t.length&&">"!==t[a]&&" "!==t[a]&&"\t"!==t[a]&&"\n"!==t[a]&&"\r"!==t[a];a++)l+=t[a];if("/"===(l=l.trim())[l.length-1]&&(l=l.substring(0,l.length-1),a--),!Zt(l))return Qt("InvalidTag",0===l.trim().length?"Invalid space after '<'.":"Tag '"+l+"' is an invalid name.",Kt(t,a));var p=Ht(t,a);if(!1===p)return Qt("InvalidAttr","Attributes for '"+l+"' have open quote.",Kt(t,a));var c=p.value;if(a=p.index,"/"===c[c.length-1]){var d=a-c.length,h=Gt(c=c.substring(0,c.length-1),e);if(!0!==h)return Qt(h.err.code,h.err.msg,Kt(t,d+h.err.line));n=!0}else if(o){if(!p.tagClosed)return Qt("InvalidTag","Closing tag '"+l+"' doesn't have proper closing.",Kt(t,a));if(c.trim().length>0)return Qt("InvalidTag","Closing tag '"+l+"' can't have attributes or invalid starting.",Kt(t,s));if(0===r.length)return Qt("InvalidTag","Closing tag '"+l+"' has not been opened.",Kt(t,s));var u=r.pop();if(l!==u.tagName){var f=Kt(t,u.tagStartPos);return Qt("InvalidTag","Expected closing tag '"+u.tagName+"' (opened in line "+f.line+", col "+f.col+") instead of closing tag '"+l+"'.",Kt(t,s))}0==r.length&&(i=!0)}else{var g=Gt(c,e);if(!0!==g)return Qt(g.err.code,g.err.msg,Kt(t,a-c.length+g.err.line));if(!0===i)return Qt("InvalidXml","Multiple possible root nodes found.",Kt(t,a));-1!==e.unpairedTags.indexOf(l)||r.push({tagName:l,tagStartPos:s}),n=!0}for(a++;a<t.length;a++)if("<"===t[a]){if("!"===t[a+1]){a=Yt(t,++a);continue}if("?"!==t[a+1])break;if((a=Wt(t,++a)).err)return a}else if("&"===t[a]){var m=zt(t,a);if(-1==m)return Qt("InvalidChar","char '&' is not expected.",Kt(t,a));a=m}else if(!0===i&&!Xt(t[a]))return Qt("InvalidXml","Extra text at the end",Kt(t,a));"<"===t[a]&&a--}return n?1==r.length?Qt("InvalidTag","Unclosed tag '"+r[0].tagName+"'.",Kt(t,r[0].tagStartPos)):!(r.length>0)||Qt("InvalidXml","Invalid '"+JSON.stringify(r.map(function(t){return t.tagName}),null,4).replace(/\r?\n/g,"")+"' found.",{line:1,col:1}):Qt("InvalidXml","Start tag expected.",1)}(t,e);if(!0!==r)throw Error(r.err.msg+":"+r.err.line+":"+r.err.col)}var n=new bt(this.options,this.externalEntities),i=n.parseXml(t);return this.options.preserveOrder||void 0===i?i:Rt(i,this.options,n.matcher,n.readonlyMatcher)},e.addEntity=function(t,e){if(-1!==e.indexOf("&"))throw new Error("Entity value can't have '&'");if(-1!==t.indexOf("&")||-1!==t.indexOf(";"))throw new Error("An entity must be set without '&' and ';'. Eg. use '#xD' for '&#xD;'");if("&"===e)throw new Error("An entity with value '&' is not permitted");this.externalEntities[t]=e},t.getMetaDataSymbol=function(){return u.getMetaDataSymbol()},t}();return e})());
 //# sourceMappingURL=fxparser.min.js.map