lightning-base-components 1.21.9-alpha → 1.22.2-alpha

package/src/lightning/purifyLib/purify.js

@@ -1,3 +1,4 @@
+/*! @license DOMPurify 3.0.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.11/LICENSE */
 /**
  * This library is copied from https://github.com/cure53/DOMPurify
  *
@@ -7,7 +8,7 @@
  *
  * How?
  * In order to update this library, follow the steps:
- * Current version: 2.2.6
+ * Current version: 3.0.11
  *
  * 1. Check if there is a new version published at https://github.com/cure53/DOMPurify/releases or find the specific release you need.
  * 2. Download the Source Code zip of that release.
@@ -18,169 +19,197 @@
  *      5.2 Default export the variable `purify`
  */
 
-function _toConsumableArray(arr) {
-    if (Array.isArray(arr)) {
-        for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) {
-            arr2[i] = arr[i];
-        }
-        return arr2;
-    } else {
-        return Array.from(arr);
-    }
-}
-
-var hasOwnProperty = Object.hasOwnProperty,
-    setPrototypeOf = Object.setPrototypeOf,
-    isFrozen = Object.isFrozen,
-    getPrototypeOf = Object.getPrototypeOf,
-    getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
-var freeze = Object.freeze,
-    seal = Object.seal,
-    create = Object.create; // eslint-disable-line import/no-mutable-exports
-
-var _ref = typeof Reflect !== 'undefined' && Reflect,
-    apply = _ref.apply,
-    construct = _ref.construct;
-
-if (!apply) {
-    apply = function apply(fun, thisValue, args) {
-        return fun.apply(thisValue, args);
-    };
-}
-
+'use strict';
+
+const {
+    entries,
+    setPrototypeOf,
+    isFrozen,
+    getPrototypeOf,
+    getOwnPropertyDescriptor,
+} = Object;
+let { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports
+let { apply, construct } = typeof Reflect !== 'undefined' && Reflect;
 if (!freeze) {
     freeze = function freeze(x) {
         return x;
     };
 }
-
 if (!seal) {
     seal = function seal(x) {
         return x;
     };
 }
-
+if (!apply) {
+    apply = function apply(fun, thisValue, args) {
+        return fun.apply(thisValue, args);
+    };
+}
 if (!construct) {
     construct = function construct(Func, args) {
-        return new (Function.prototype.bind.apply(
-            Func,
-            [null].concat(_toConsumableArray(args))
-        ))();
+        return new Func(...args);
     };
 }
+const arrayForEach = unapply(Array.prototype.forEach);
+const arrayPop = unapply(Array.prototype.pop);
+const arrayPush = unapply(Array.prototype.push);
+const stringToLowerCase = unapply(String.prototype.toLowerCase);
+const stringToString = unapply(String.prototype.toString);
+const stringMatch = unapply(String.prototype.match);
+const stringReplace = unapply(String.prototype.replace);
+const stringIndexOf = unapply(String.prototype.indexOf);
+const stringTrim = unapply(String.prototype.trim);
+const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
+const regExpTest = unapply(RegExp.prototype.test);
+const typeErrorCreate = unconstruct(TypeError);
 
-var arrayForEach = unapply(Array.prototype.forEach);
-var arrayPop = unapply(Array.prototype.pop);
-var arrayPush = unapply(Array.prototype.push);
-
-var stringToLowerCase = unapply(String.prototype.toLowerCase);
-var stringMatch = unapply(String.prototype.match);
-var stringReplace = unapply(String.prototype.replace);
-var stringIndexOf = unapply(String.prototype.indexOf);
-var stringTrim = unapply(String.prototype.trim);
-
-var regExpTest = unapply(RegExp.prototype.test);
-
-var typeErrorCreate = unconstruct(TypeError);
-
+/**
+ * Creates a new function that calls the given function with a specified thisArg and arguments.
+ *
+ * @param {Function} func - The function to be wrapped and called.
+ * @returns {Function} A new function that calls the given function with a specified thisArg and arguments.
+ */
 function unapply(func) {
     return function (thisArg) {
         for (
             var _len = arguments.length,
-                args = Array(_len > 1 ? _len - 1 : 0),
+                args = new Array(_len > 1 ? _len - 1 : 0),
                 _key = 1;
             _key < _len;
             _key++
         ) {
             args[_key - 1] = arguments[_key];
         }
-
         return apply(func, thisArg, args);
     };
 }
 
+/**
+ * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
+ *
+ * @param {Function} func - The constructor function to be wrapped and called.
+ * @returns {Function} A new function that constructs an instance of the given constructor function with the provided arguments.
+ */
 function unconstruct(func) {
     return function () {
         for (
-            var _len2 = arguments.length, args = Array(_len2), _key2 = 0;
+            var _len2 = arguments.length, args = new Array(_len2), _key2 = 0;
             _key2 < _len2;
             _key2++
         ) {
             args[_key2] = arguments[_key2];
         }
-
         return construct(func, args);
     };
 }
 
-/* Add properties to a lookup table */
+/**
+ * Add properties to a lookup table
+ *
+ * @param {Object} set - The set to which elements will be added.
+ * @param {Array} array - The array containing elements to be added to the set.
+ * @param {Function} transformCaseFunc - An optional function to transform the case of each element before adding to the set.
+ * @returns {Object} The modified set with added elements.
+ */
 function addToSet(set, array) {
+    let transformCaseFunc =
+        arguments.length > 2 && arguments[2] !== undefined
+            ? arguments[2]
+            : stringToLowerCase;
     if (setPrototypeOf) {
         // Make 'in' and truthy checks like Boolean(set.constructor)
         // independent of any properties defined on Object.prototype.
         // Prevent prototype setters from intercepting set as a this value.
         setPrototypeOf(set, null);
     }
-
-    var l = array.length;
+    let l = array.length;
     while (l--) {
-        var element = array[l];
+        let element = array[l];
         if (typeof element === 'string') {
-            var lcElement = stringToLowerCase(element);
+            const lcElement = transformCaseFunc(element);
             if (lcElement !== element) {
                 // Config presets (e.g. tags.js, attrs.js) are immutable.
                 if (!isFrozen(array)) {
                     array[l] = lcElement;
                 }
-
                 element = lcElement;
             }
         }
-
         set[element] = true;
     }
-
     return set;
 }
 
-/* Shallow clone an object */
-function clone(object) {
-    var newObject = create(null);
-
-    var property = void 0;
-    for (property in object) {
-        if (apply(hasOwnProperty, object, [property])) {
-            newObject[property] = object[property];
+/**
+ * Clean up an array to harden against CSPP
+ *
+ * @param {Array} array - The array to be cleaned.
+ * @returns {Array} The cleaned version of the array
+ */
+function cleanArray(array) {
+    for (let index = 0; index < array.length; index++) {
+        const isPropertyExist = objectHasOwnProperty(array, index);
+        if (!isPropertyExist) {
+            array[index] = null;
         }
     }
+    return array;
+}
 
+/**
+ * Shallow clone an object
+ *
+ * @param {Object} object - The object to be cloned.
+ * @returns {Object} A new object that copies the original.
+ */
+function clone(object) {
+    const newObject = create(null);
+    for (const [property, value] of entries(object)) {
+        const isPropertyExist = objectHasOwnProperty(object, property);
+        if (isPropertyExist) {
+            if (Array.isArray(value)) {
+                newObject[property] = cleanArray(value);
+            } else if (
+                value &&
+                typeof value === 'object' &&
+                value.constructor === Object
+            ) {
+                newObject[property] = clone(value);
+            } else {
+                newObject[property] = value;
+            }
+        }
+    }
     return newObject;
 }
 
-/* IE10 doesn't support __lookupGetter__ so lets'
- * simulate it. It also automatically checks
- * if the prop is function or getter and behaves
- * accordingly. */
+/**
+ * This method automatically checks if the prop is function or getter and behaves accordingly.
+ *
+ * @param {Object} object - The object to look up the getter function in its prototype chain.
+ * @param {String} prop - The property name for which to find the getter function.
+ * @returns {Function} The getter function found in the prototype chain or a fallback function.
+ */
 function lookupGetter(object, prop) {
     while (object !== null) {
-        var desc = getOwnPropertyDescriptor(object, prop);
+        const desc = getOwnPropertyDescriptor(object, prop);
         if (desc) {
             if (desc.get) {
                 return unapply(desc.get);
             }
-
             if (typeof desc.value === 'function') {
                 return unapply(desc.value);
             }
         }
-
         object = getPrototypeOf(object);
     }
-
-    return null;
+    function fallbackValue() {
+        return null;
+    }
+    return fallbackValue;
 }
 
-var html = freeze([
+const html$1 = freeze([
     'a',
     'abbr',
     'acronym',
@@ -301,7 +330,7 @@ var html = freeze([
 ]);
 
 // SVG
-var svg = freeze([
+const svg$1 = freeze([
     'svg',
     'a',
     'altglyph',
@@ -346,8 +375,7 @@ var svg = freeze([
     'view',
     'vkern',
 ]);
-
-var svgFilters = freeze([
+const svgFilters = freeze([
     'feBlend',
     'feColorMatrix',
     'feComponentTransfer',
@@ -356,12 +384,14 @@ var svgFilters = freeze([
     'feDiffuseLighting',
     'feDisplacementMap',
     'feDistantLight',
+    'feDropShadow',
     'feFlood',
     'feFuncA',
     'feFuncB',
     'feFuncG',
     'feFuncR',
     'feGaussianBlur',
+    'feImage',
     'feMerge',
     'feMergeNode',
     'feMorphology',
@@ -377,13 +407,11 @@ var svgFilters = freeze([
 // We still need to know them so that we can do namespace
 // checks properly in case one wants to add them to
 // allow-list.
-var svgDisallowed = freeze([
+const svgDisallowed = freeze([
     'animate',
     'color-profile',
     'cursor',
     'discard',
-    'fedropshadow',
-    'feimage',
     'font-face',
     'font-face-format',
     'font-face-name',
@@ -403,8 +431,7 @@ var svgDisallowed = freeze([
     'unknown',
     'use',
 ]);
-
-var mathMl = freeze([
+const mathMl$1 = freeze([
     'math',
     'menclose',
     'merror',
@@ -434,11 +461,12 @@ var mathMl = freeze([
     'mtr',
     'munder',
     'munderover',
+    'mprescripts',
 ]);
 
 // Similarly to SVG, we want to know all MathML elements,
 // even those that we disallow by default.
-var mathMlDisallowed = freeze([
+const mathMlDisallowed = freeze([
     'maction',
     'maligngroup',
     'malignmark',
@@ -455,10 +483,9 @@ var mathMlDisallowed = freeze([
     'mprescripts',
     'none',
 ]);
+const text = freeze(['#text']);
 
-var text = freeze(['#text']);
-
-var html$1 = freeze([
+const html = freeze([
     'accept',
     'action',
     'align',
@@ -523,6 +550,7 @@ var html$1 = freeze([
     'multiple',
     'muted',
     'name',
+    'nonce',
     'noshade',
     'novalidate',
     'nowrap',
@@ -566,9 +594,9 @@ var html$1 = freeze([
     'value',
     'width',
     'xmlns',
+    'slot',
 ]);
-
-var svg$1 = freeze([
+const svg = freeze([
     'accent-height',
     'accumulate',
     'additive',
@@ -720,6 +748,7 @@ var svg$1 = freeze([
     'targetx',
     'targety',
     'transform',
+    'transform-origin',
     'text-anchor',
     'text-decoration',
     'text-rendering',
@@ -751,8 +780,7 @@ var svg$1 = freeze([
     'z',
     'zoomandpan',
 ]);
-
-var mathMl$1 = freeze([
+const mathMl = freeze([
     'accent',
     'accentunder',
     'align',
@@ -807,8 +835,7 @@ var mathMl$1 = freeze([
     'width',
     'xmlns',
 ]);
-
-var xml = freeze([
+const xml = freeze([
     'xlink:href',
     'xml:id',
     'xlink:title',
@@ -817,63 +844,55 @@ var xml = freeze([
 ]);
 
 // eslint-disable-next-line unicorn/better-regex
-var MUSTACHE_EXPR = seal(/\{\{[\s\S]*|[\s\S]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
-var ERB_EXPR = seal(/<%[\s\S]*|[\s\S]*%>/gm);
-var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
-var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
-var IS_ALLOWED_URI = seal(
-    /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
+const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
+const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
+const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
+const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
+const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
+const IS_ALLOWED_URI = seal(
+    /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
 );
-var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
-var ATTR_WHITESPACE = seal(
+
+const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
+const ATTR_WHITESPACE = seal(
     /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
 );
 
-var _typeof =
-    typeof Symbol === 'function' && typeof Symbol.iterator === 'symbol'
-        ? function (obj) {
-              return typeof obj;
-          }
-        : function (obj) {
-              return obj &&
-                  typeof Symbol === 'function' &&
-                  obj.constructor === Symbol &&
-                  obj !== Symbol.prototype
-                  ? 'symbol'
-                  : typeof obj;
-          };
-
-function _toConsumableArray$1(arr) {
-    if (Array.isArray(arr)) {
-        for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) {
-            arr2[i] = arr[i];
-        }
-        return arr2;
-    } else {
-        return Array.from(arr);
-    }
-}
-
-var getGlobal = function getGlobal() {
+const DOCTYPE_NAME = seal(/^html$/i);
+const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
+
+var EXPRESSIONS = /*#__PURE__*/ Object.freeze({
+    __proto__: null,
+    MUSTACHE_EXPR: MUSTACHE_EXPR,
+    ERB_EXPR: ERB_EXPR,
+    TMPLIT_EXPR: TMPLIT_EXPR,
+    DATA_ATTR: DATA_ATTR,
+    ARIA_ATTR: ARIA_ATTR,
+    IS_ALLOWED_URI: IS_ALLOWED_URI,
+    IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
+    ATTR_WHITESPACE: ATTR_WHITESPACE,
+    DOCTYPE_NAME: DOCTYPE_NAME,
+    CUSTOM_ELEMENT: CUSTOM_ELEMENT,
+});
+
+const getGlobal = function getGlobal() {
     return typeof window === 'undefined' ? null : window;
 };
 
 /**
  * Creates a no-op policy for internal use only.
  * Don't export this function outside this module!
- * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
- * @param {Document} document The document object (to determine policy name suffix)
- * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
- * are not supported).
+ * @param {TrustedTypePolicyFactory} trustedTypes The policy factory.
+ * @param {HTMLScriptElement} purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
+ * @return {TrustedTypePolicy} The policy created (or null, if Trusted Types
+ * are not supported or creating the policy failed).
  */
-var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(
+const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(
     trustedTypes,
-    document
+    purifyHostElement
 ) {
     if (
-        (typeof trustedTypes === 'undefined'
-            ? 'undefined'
-            : _typeof(trustedTypes)) !== 'object' ||
+        typeof trustedTypes !== 'object' ||
         typeof trustedTypes.createPolicy !== 'function'
     ) {
         return null;
@@ -882,21 +901,19 @@ var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(
     // Allow the callers to control the unique policy name
     // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
     // Policy creation with duplicate names throws in Trusted Types.
-    var suffix = null;
-    var ATTR_NAME = 'data-tt-policy-suffix';
-    if (
-        document.currentScript &&
-        document.currentScript.hasAttribute(ATTR_NAME)
-    ) {
-        suffix = document.currentScript.getAttribute(ATTR_NAME);
+    let suffix = null;
+    const ATTR_NAME = 'data-tt-policy-suffix';
+    if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
+        suffix = purifyHostElement.getAttribute(ATTR_NAME);
     }
-
-    var policyName = 'dompurify' + (suffix ? '#' + suffix : '');
-
+    const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
     try {
         return trustedTypes.createPolicy(policyName, {
-            createHTML: function createHTML(html$$1) {
-                return html$$1;
+            createHTML(html) {
+                return html;
+            },
+            createScriptURL(scriptUrl) {
+                return scriptUrl;
             },
         });
     } catch (_) {
@@ -909,61 +926,49 @@ var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(
         return null;
     }
 };
-
 function createDOMPurify() {
-    var window =
+    let window =
         arguments.length > 0 && arguments[0] !== undefined
             ? arguments[0]
             : getGlobal();
-
-    var DOMPurify = function DOMPurify(root) {
-        return createDOMPurify(root);
-    };
+    const DOMPurify = (root) => createDOMPurify(root);
 
     /**
      * Version label, exposed for easier checks
      * if DOMPurify is up to date or not
      */
-    DOMPurify.version = '2.2.6';
+    DOMPurify.version = '3.0.11';
 
     /**
      * Array of elements that DOMPurify removed during sanitation.
      * Empty if nothing was removed.
      */
     DOMPurify.removed = [];
-
     if (!window || !window.document || window.document.nodeType !== 9) {
         // Not running in a browser, provide a factory function
         // so that you can pass your own Window
         DOMPurify.isSupported = false;
-
         return DOMPurify;
     }
-
-    var originalDocument = window.document;
-
-    var document = window.document;
-    var DocumentFragment = window.DocumentFragment,
-        HTMLTemplateElement = window.HTMLTemplateElement,
-        Node = window.Node,
-        Element = window.Element,
-        NodeFilter = window.NodeFilter,
-        _window$NamedNodeMap = window.NamedNodeMap,
-        NamedNodeMap =
-            _window$NamedNodeMap === undefined
-                ? window.NamedNodeMap || window.MozNamedAttrMap
-                : _window$NamedNodeMap,
-        Text = window.Text,
-        Comment = window.Comment,
-        DOMParser = window.DOMParser,
-        trustedTypes = window.trustedTypes;
-
-    var ElementPrototype = Element.prototype;
-
-    var cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
-    var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
-    var getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
-    var getParentNode = lookupGetter(ElementPrototype, 'parentNode');
+    let { document } = window;
+    const originalDocument = document;
+    const currentScript = originalDocument.currentScript;
+    const {
+        DocumentFragment,
+        HTMLTemplateElement,
+        Node,
+        Element,
+        NodeFilter,
+        NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,
+        HTMLFormElement,
+        DOMParser,
+        trustedTypes,
+    } = window;
+    const ElementPrototype = Element.prototype;
+    const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
+    const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
+    const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
+    const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
 
     // As per issue #47, the web-components registry is inherited by a
     // new document created via createHTMLDocument. As per the spec
@@ -972,52 +977,41 @@ function createDOMPurify() {
     // document, so we use that as our parent document to ensure nothing
     // is inherited.
     if (typeof HTMLTemplateElement === 'function') {
-        var template = document.createElement('template');
+        const template = document.createElement('template');
         if (template.content && template.content.ownerDocument) {
             document = template.content.ownerDocument;
         }
     }
-
-    var trustedTypesPolicy = _createTrustedTypesPolicy(
-        trustedTypes,
-        originalDocument
-    );
-    var emptyHTML =
-        trustedTypesPolicy && RETURN_TRUSTED_TYPE
-            ? trustedTypesPolicy.createHTML('')
-            : '';
-
-    var _document = document,
-        implementation = _document.implementation,
-        createNodeIterator = _document.createNodeIterator,
-        getElementsByTagName = _document.getElementsByTagName,
-        createDocumentFragment = _document.createDocumentFragment;
-    var importNode = originalDocument.importNode;
-
-    var documentMode = {};
-    try {
-        documentMode = clone(document).documentMode
-            ? document.documentMode
-            : {};
-    } catch (_) {}
-
-    var hooks = {};
+    let trustedTypesPolicy;
+    let emptyHTML = '';
+    const {
+        implementation,
+        createNodeIterator,
+        createDocumentFragment,
+        getElementsByTagName,
+    } = document;
+    const { importNode } = originalDocument;
+    let hooks = {};
 
     /**
      * Expose whether this browser supports running the full DOMPurify.
      */
     DOMPurify.isSupported =
+        typeof entries === 'function' &&
+        typeof getParentNode === 'function' &&
         implementation &&
-        typeof implementation.createHTMLDocument !== 'undefined' &&
-        documentMode !== 9;
-
-    var MUSTACHE_EXPR$$1 = MUSTACHE_EXPR,
-        ERB_EXPR$$1 = ERB_EXPR,
-        DATA_ATTR$$1 = DATA_ATTR,
-        ARIA_ATTR$$1 = ARIA_ATTR,
-        IS_SCRIPT_OR_DATA$$1 = IS_SCRIPT_OR_DATA,
-        ATTR_WHITESPACE$$1 = ATTR_WHITESPACE;
-    var IS_ALLOWED_URI$$1 = IS_ALLOWED_URI;
+        implementation.createHTMLDocument !== undefined;
+    const {
+        MUSTACHE_EXPR,
+        ERB_EXPR,
+        TMPLIT_EXPR,
+        DATA_ATTR,
+        ARIA_ATTR,
+        IS_SCRIPT_OR_DATA,
+        ATTR_WHITESPACE,
+        CUSTOM_ELEMENT,
+    } = EXPRESSIONS;
+    let { IS_ALLOWED_URI: IS_ALLOWED_URI$1 } = EXPRESSIONS;
 
     /**
      * We consider the elements and attributes below to be safe. Ideally
@@ -1025,101 +1019,135 @@ function createDOMPurify() {
      */
 
     /* allowed element names */
-
-    var ALLOWED_TAGS = null;
-    var DEFAULT_ALLOWED_TAGS = addToSet(
-        {},
-        [].concat(
-            _toConsumableArray$1(html),
-            _toConsumableArray$1(svg),
-            _toConsumableArray$1(svgFilters),
-            _toConsumableArray$1(mathMl),
-            _toConsumableArray$1(text)
-        )
-    );
+    let ALLOWED_TAGS = null;
+    const DEFAULT_ALLOWED_TAGS = addToSet({}, [
+        ...html$1,
+        ...svg$1,
+        ...svgFilters,
+        ...mathMl$1,
+        ...text,
+    ]);
 
     /* Allowed attribute names */
-    var ALLOWED_ATTR = null;
-    var DEFAULT_ALLOWED_ATTR = addToSet(
-        {},
-        [].concat(
-            _toConsumableArray$1(html$1),
-            _toConsumableArray$1(svg$1),
-            _toConsumableArray$1(mathMl$1),
-            _toConsumableArray$1(xml)
-        )
+    let ALLOWED_ATTR = null;
+    const DEFAULT_ALLOWED_ATTR = addToSet({}, [
+        ...html,
+        ...svg,
+        ...mathMl,
+        ...xml,
+    ]);
+
+    /*
+     * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
+     * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
+     * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
+     * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
+     */
+    let CUSTOM_ELEMENT_HANDLING = Object.seal(
+        create(null, {
+            tagNameCheck: {
+                writable: true,
+                configurable: false,
+                enumerable: true,
+                value: null,
+            },
+            attributeNameCheck: {
+                writable: true,
+                configurable: false,
+                enumerable: true,
+                value: null,
+            },
+            allowCustomizedBuiltInElements: {
+                writable: true,
+                configurable: false,
+                enumerable: true,
+                value: false,
+            },
+        })
     );
 
     /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
-    var FORBID_TAGS = null;
+    let FORBID_TAGS = null;
 
     /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
-    var FORBID_ATTR = null;
+    let FORBID_ATTR = null;
 
     /* Decide if ARIA attributes are okay */
-    var ALLOW_ARIA_ATTR = true;
+    let ALLOW_ARIA_ATTR = true;
 
     /* Decide if custom data attributes are okay */
-    var ALLOW_DATA_ATTR = true;
+    let ALLOW_DATA_ATTR = true;
 
     /* Decide if unknown protocols are okay */
-    var ALLOW_UNKNOWN_PROTOCOLS = false;
+    let ALLOW_UNKNOWN_PROTOCOLS = false;
+
+    /* Decide if self-closing tags in attributes are allowed.
+     * Usually removed due to a mXSS issue in jQuery 3.0 */
+    let ALLOW_SELF_CLOSE_IN_ATTR = true;
 
     /* Output should be safe for common template engines.
      * This means, DOMPurify removes data attributes, mustaches and ERB
      */
-    var SAFE_FOR_TEMPLATES = false;
+    let SAFE_FOR_TEMPLATES = false;
 
     /* Decide if document with <html>... should be returned */
-    var WHOLE_DOCUMENT = false;
+    let WHOLE_DOCUMENT = false;
 
     /* Track whether config is already set on this instance of DOMPurify. */
-    var SET_CONFIG = false;
+    let SET_CONFIG = false;
 
     /* Decide if all elements (e.g. style, script) must be children of
      * document.body. By default, browsers might move them to document.head */
-    var FORCE_BODY = false;
+    let FORCE_BODY = false;
 
     /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
      * string (or a TrustedHTML object if Trusted Types are supported).
      * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
      */
-    var RETURN_DOM = false;
+    let RETURN_DOM = false;
 
     /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
      * string  (or a TrustedHTML object if Trusted Types are supported) */
-    var RETURN_DOM_FRAGMENT = false;
-
-    /* If `RETURN_DOM` or `RETURN_DOM_FRAGMENT` is enabled, decide if the returned DOM
-     * `Node` is imported into the current `Document`. If this flag is not enabled the
-     * `Node` will belong (its ownerDocument) to a fresh `HTMLDocument`, created by
-     * DOMPurify.
-     *
-     * This defaults to `true` starting DOMPurify 2.2.0. Note that setting it to `false`
-     * might cause XSS from attacks hidden in closed shadowroots in case the browser
-     * supports Declarative Shadow: DOM https://web.dev/declarative-shadow-dom/
-     */
-    var RETURN_DOM_IMPORT = true;
+    let RETURN_DOM_FRAGMENT = false;
 
     /* Try to return a Trusted Type object instead of a string, return a string in
      * case Trusted Types are not supported  */
-    var RETURN_TRUSTED_TYPE = false;
+    let RETURN_TRUSTED_TYPE = false;
 
-    /* Output should be free from DOM clobbering attacks? */
-    var SANITIZE_DOM = true;
+    /* Output should be free from DOM clobbering attacks?
+     * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
+     */
+    let SANITIZE_DOM = true;
+
+    /* Achieve full DOM Clobbering protection by isolating the namespace of named
+     * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
+     *
+     * HTML/DOM spec rules that enable DOM Clobbering:
+     *   - Named Access on Window (§7.3.3)
+     *   - DOM Tree Accessors (§3.1.5)
+     *   - Form Element Parent-Child Relations (§4.10.3)
+     *   - Iframe srcdoc / Nested WindowProxies (§4.8.5)
+     *   - HTMLCollection (§4.2.10.2)
+     *
+     * Namespace isolation is implemented by prefixing `id` and `name` attributes
+     * with a constant string, i.e., `user-content-`
+     */
+    let SANITIZE_NAMED_PROPS = false;
+    const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
 
     /* Keep element content when removing element? */
-    var KEEP_CONTENT = true;
+    let KEEP_CONTENT = true;
 
     /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
      * of importing it into a new Document and returning a sanitized copy */
-    var IN_PLACE = false;
+    let IN_PLACE = false;
 
     /* Allow usage of profiles like html, svg and mathMl */
-    var USE_PROFILES = {};
+    let USE_PROFILES = {};
 
     /* Tags to ignore content of when KEEP_CONTENT is true */
-    var FORBID_CONTENTS = addToSet({}, [
+    let FORBID_CONTENTS = null;
+    const DEFAULT_FORBID_CONTENTS = addToSet({}, [
         'annotation-xml',
         'audio',
         'colgroup',
@@ -1148,8 +1176,8 @@ function createDOMPurify() {
     ]);
 
     /* Tags that are safe for data: URIs */
-    var DATA_URI_TAGS = null;
-    var DEFAULT_DATA_URI_TAGS = addToSet({}, [
+    let DATA_URI_TAGS = null;
+    const DEFAULT_DATA_URI_TAGS = addToSet({}, [
         'audio',
         'video',
         'img',
@@ -1159,8 +1187,8 @@ function createDOMPurify() {
     ]);
 
     /* Attributes safe for values like "javascript:" */
-    var URI_SAFE_ATTRIBUTES = null;
-    var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, [
+    let URI_SAFE_ATTRIBUTES = null;
+    const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, [
         'alt',
         'class',
         'for',
@@ -1169,20 +1197,44 @@ function createDOMPurify() {
         'name',
         'pattern',
         'placeholder',
+        'role',
         'summary',
         'title',
         'value',
         'style',
         'xmlns',
     ]);
+    const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
+    const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
+    const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+    /* Document namespace */
+    let NAMESPACE = HTML_NAMESPACE;
+    let IS_EMPTY_INPUT = false;
+
+    /* Allowed XHTML+XML namespaces */
+    let ALLOWED_NAMESPACES = null;
+    const DEFAULT_ALLOWED_NAMESPACES = addToSet(
+        {},
+        [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE],
+        stringToString
+    );
+
+    /* Parsing of strict XHTML documents */
+    let PARSER_MEDIA_TYPE = null;
+    const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
+    const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
+    let transformCaseFunc = null;
 
     /* Keep a reference to config to pass to hooks */
-    var CONFIG = null;
+    let CONFIG = null;
 
     /* Ideally, do not touch anything below this line */
     /* ______________________________________________ */
 
-    var formElement = document.createElement('form');
+    const formElement = document.createElement('form');
+    const isRegexOrFunction = function isRegexOrFunction(testValue) {
+        return testValue instanceof RegExp || testValue instanceof Function;
+    };
 
     /**
      * _parseConfig
@@ -1190,92 +1242,141 @@ function createDOMPurify() {
      * @param  {Object} cfg optional config literal
      */
     // eslint-disable-next-line complexity
-    var _parseConfig = function _parseConfig(cfg) {
+    const _parseConfig = function _parseConfig() {
+        let cfg =
+            arguments.length > 0 && arguments[0] !== undefined
+                ? arguments[0]
+                : {};
         if (CONFIG && CONFIG === cfg) {
             return;
         }
 
         /* Shield configuration object from tampering */
-        if (
-            !cfg ||
-            (typeof cfg === 'undefined' ? 'undefined' : _typeof(cfg)) !==
-                'object'
-        ) {
+        if (!cfg || typeof cfg !== 'object') {
             cfg = {};
         }
 
         /* Shield configuration object from prototype pollution */
         cfg = clone(cfg);
+        PARSER_MEDIA_TYPE =
+            // eslint-disable-next-line unicorn/prefer-includes
+            SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1
+                ? DEFAULT_PARSER_MEDIA_TYPE
+                : cfg.PARSER_MEDIA_TYPE;
+
+        // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
+        transformCaseFunc =
+            PARSER_MEDIA_TYPE === 'application/xhtml+xml'
+                ? stringToString
+                : stringToLowerCase;
 
         /* Set configuration parameters */
-        ALLOWED_TAGS =
-            'ALLOWED_TAGS' in cfg
-                ? addToSet({}, cfg.ALLOWED_TAGS)
-                : DEFAULT_ALLOWED_TAGS;
-        ALLOWED_ATTR =
-            'ALLOWED_ATTR' in cfg
-                ? addToSet({}, cfg.ALLOWED_ATTR)
-                : DEFAULT_ALLOWED_ATTR;
-        URI_SAFE_ATTRIBUTES =
-            'ADD_URI_SAFE_ATTR' in cfg
-                ? addToSet(
-                      clone(DEFAULT_URI_SAFE_ATTRIBUTES),
-                      cfg.ADD_URI_SAFE_ATTR
-                  )
-                : DEFAULT_URI_SAFE_ATTRIBUTES;
-        DATA_URI_TAGS =
-            'ADD_DATA_URI_TAGS' in cfg
-                ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS)
-                : DEFAULT_DATA_URI_TAGS;
-        FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS) : {};
-        FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR) : {};
-        USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
+        ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS')
+            ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc)
+            : DEFAULT_ALLOWED_TAGS;
+        ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR')
+            ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc)
+            : DEFAULT_ALLOWED_ATTR;
+        ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES')
+            ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString)
+            : DEFAULT_ALLOWED_NAMESPACES;
+        URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR')
+            ? addToSet(
+                  clone(DEFAULT_URI_SAFE_ATTRIBUTES),
+                  // eslint-disable-line indent
+                  cfg.ADD_URI_SAFE_ATTR,
+                  // eslint-disable-line indent
+                  transformCaseFunc // eslint-disable-line indent
+              ) // eslint-disable-line indent
+            : DEFAULT_URI_SAFE_ATTRIBUTES;
+        DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS')
+            ? addToSet(
+                  clone(DEFAULT_DATA_URI_TAGS),
+                  // eslint-disable-line indent
+                  cfg.ADD_DATA_URI_TAGS,
+                  // eslint-disable-line indent
+                  transformCaseFunc // eslint-disable-line indent
+              ) // eslint-disable-line indent
+            : DEFAULT_DATA_URI_TAGS;
+        FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS')
+            ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc)
+            : DEFAULT_FORBID_CONTENTS;
+        FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS')
+            ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc)
+            : {};
+        FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR')
+            ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc)
+            : {};
+        USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES')
+            ? cfg.USE_PROFILES
+            : false;
         ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
         ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
         ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
+        ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
         SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
         WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
         RETURN_DOM = cfg.RETURN_DOM || false; // Default false
         RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
-        RETURN_DOM_IMPORT = cfg.RETURN_DOM_IMPORT !== false; // Default true
         RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
         FORCE_BODY = cfg.FORCE_BODY || false; // Default false
         SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
+        SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
         KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
         IN_PLACE = cfg.IN_PLACE || false; // Default false
-        IS_ALLOWED_URI$$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$$1;
+        IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
+        NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
+        CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
+        if (
+            cfg.CUSTOM_ELEMENT_HANDLING &&
+            isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)
+        ) {
+            CUSTOM_ELEMENT_HANDLING.tagNameCheck =
+                cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
+        }
+        if (
+            cfg.CUSTOM_ELEMENT_HANDLING &&
+            isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)
+        ) {
+            CUSTOM_ELEMENT_HANDLING.attributeNameCheck =
+                cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
+        }
+        if (
+            cfg.CUSTOM_ELEMENT_HANDLING &&
+            typeof cfg.CUSTOM_ELEMENT_HANDLING
+                .allowCustomizedBuiltInElements === 'boolean'
+        ) {
+            CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements =
+                cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
+        }
         if (SAFE_FOR_TEMPLATES) {
             ALLOW_DATA_ATTR = false;
         }
-
         if (RETURN_DOM_FRAGMENT) {
             RETURN_DOM = true;
         }
 
         /* Parse profile info */
         if (USE_PROFILES) {
-            ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(text)));
+            ALLOWED_TAGS = addToSet({}, text);
             ALLOWED_ATTR = [];
             if (USE_PROFILES.html === true) {
-                addToSet(ALLOWED_TAGS, html);
-                addToSet(ALLOWED_ATTR, html$1);
+                addToSet(ALLOWED_TAGS, html$1);
+                addToSet(ALLOWED_ATTR, html);
             }
-
             if (USE_PROFILES.svg === true) {
-                addToSet(ALLOWED_TAGS, svg);
-                addToSet(ALLOWED_ATTR, svg$1);
+                addToSet(ALLOWED_TAGS, svg$1);
+                addToSet(ALLOWED_ATTR, svg);
                 addToSet(ALLOWED_ATTR, xml);
             }
-
             if (USE_PROFILES.svgFilters === true) {
                 addToSet(ALLOWED_TAGS, svgFilters);
-                addToSet(ALLOWED_ATTR, svg$1);
+                addToSet(ALLOWED_ATTR, svg);
                 addToSet(ALLOWED_ATTR, xml);
             }
-
             if (USE_PROFILES.mathMl === true) {
-                addToSet(ALLOWED_TAGS, mathMl);
-                addToSet(ALLOWED_ATTR, mathMl$1);
+                addToSet(ALLOWED_TAGS, mathMl$1);
+                addToSet(ALLOWED_ATTR, mathMl);
                 addToSet(ALLOWED_ATTR, xml);
             }
         }
@@ -1285,20 +1386,26 @@ function createDOMPurify() {
             if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
                 ALLOWED_TAGS = clone(ALLOWED_TAGS);
             }
-
-            addToSet(ALLOWED_TAGS, cfg.ADD_TAGS);
+            addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
         }
-
         if (cfg.ADD_ATTR) {
             if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
                 ALLOWED_ATTR = clone(ALLOWED_ATTR);
             }
-
-            addToSet(ALLOWED_ATTR, cfg.ADD_ATTR);
+            addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
         }
-
         if (cfg.ADD_URI_SAFE_ATTR) {
-            addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR);
+            addToSet(
+                URI_SAFE_ATTRIBUTES,
+                cfg.ADD_URI_SAFE_ATTR,
+                transformCaseFunc
+            );
+        }
+        if (cfg.FORBID_CONTENTS) {
+            if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
+                FORBID_CONTENTS = clone(FORBID_CONTENTS);
+            }
+            addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
         }
 
         /* Add #text in case KEEP_CONTENT is set to true */
@@ -1316,68 +1423,105 @@ function createDOMPurify() {
             addToSet(ALLOWED_TAGS, ['tbody']);
             delete FORBID_TAGS.tbody;
         }
+        if (cfg.TRUSTED_TYPES_POLICY) {
+            if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
+                throw typeErrorCreate(
+                    'TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.'
+                );
+            }
+            if (
+                typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function'
+            ) {
+                throw typeErrorCreate(
+                    'TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.'
+                );
+            }
+
+            // Overwrite existing TrustedTypes policy.
+            trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
+
+            // Sign local variables required by `sanitize`.
+            emptyHTML = trustedTypesPolicy.createHTML('');
+        } else {
+            // Uninitialized policy, attempt to initialize the internal dompurify policy.
+            if (trustedTypesPolicy === undefined) {
+                trustedTypesPolicy = _createTrustedTypesPolicy(
+                    trustedTypes,
+                    currentScript
+                );
+            }
+
+            // If creating the internal policy succeeded sign internal variables.
+            if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
+                emptyHTML = trustedTypesPolicy.createHTML('');
+            }
+        }
 
         // Prevent further manipulation of configuration.
         // Not available in IE8, Safari 5, etc.
         if (freeze) {
             freeze(cfg);
         }
-
         CONFIG = cfg;
     };
-
-    var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [
+    const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [
         'mi',
         'mo',
         'mn',
         'ms',
         'mtext',
     ]);
-
-    var HTML_INTEGRATION_POINTS = addToSet({}, [
+    const HTML_INTEGRATION_POINTS = addToSet({}, [
         'foreignobject',
         'desc',
         'title',
         'annotation-xml',
     ]);
 
+    // Certain elements are allowed in both SVG and HTML
+    // namespace. We need to specify them explicitly
+    // so that they don't get erroneously deleted from
+    // HTML namespace.
+    const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, [
+        'title',
+        'style',
+        'font',
+        'a',
+        'script',
+    ]);
+
     /* Keep track of all possible SVG and MathML tags
      * so that we can perform the namespace checks
      * correctly. */
-    var ALL_SVG_TAGS = addToSet({}, svg);
-    addToSet(ALL_SVG_TAGS, svgFilters);
-    addToSet(ALL_SVG_TAGS, svgDisallowed);
-
-    var ALL_MATHML_TAGS = addToSet({}, mathMl);
-    addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
-
-    var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
-    var SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
-    var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+    const ALL_SVG_TAGS = addToSet({}, [
+        ...svg$1,
+        ...svgFilters,
+        ...svgDisallowed,
+    ]);
+    const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
 
     /**
-     *
-     *
      * @param  {Element} element a DOM element whose namespace is being checked
      * @returns {boolean} Return false if the element has a
      *  namespace that a spec-compliant parser would never
      *  return. Return true otherwise.
      */
-    var _checkValidNamespace = function _checkValidNamespace(element) {
-        var parent = getParentNode(element);
+    const _checkValidNamespace = function _checkValidNamespace(element) {
+        let parent = getParentNode(element);
 
         // In JSDOM, if we're inside shadow DOM, then parentNode
         // can be null. We just simulate parent in this case.
         if (!parent || !parent.tagName) {
             parent = {
-                namespaceURI: HTML_NAMESPACE,
+                namespaceURI: NAMESPACE,
                 tagName: 'template',
             };
         }
-
-        var tagName = stringToLowerCase(element.tagName);
-        var parentTagName = stringToLowerCase(parent.tagName);
-
+        const tagName = stringToLowerCase(element.tagName);
+        const parentTagName = stringToLowerCase(parent.tagName);
+        if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
+            return false;
+        }
         if (element.namespaceURI === SVG_NAMESPACE) {
             // The only way to switch from HTML namespace to SVG
             // is via <svg>. If it happens via any other tag, then
@@ -1386,7 +1530,7 @@ function createDOMPurify() {
                 return tagName === 'svg';
             }
 
-            // The only way to switch from MathML to SVG is via
+            // The only way to switch from MathML to SVG is via`
             // svg if parent is either <annotation-xml> or MathML
             // text integration points.
             if (parent.namespaceURI === MATHML_NAMESPACE) {
@@ -1401,7 +1545,6 @@ function createDOMPurify() {
             // spec. All others are disallowed in SVG namespace.
             return Boolean(ALL_SVG_TAGS[tagName]);
         }
-
         if (element.namespaceURI === MATHML_NAMESPACE) {
             // The only way to switch from HTML namespace to MathML
             // is via <math>. If it happens via any other tag, then
@@ -1422,7 +1565,6 @@ function createDOMPurify() {
             // spec. All others are disallowed in MathML namespace.
             return Boolean(ALL_MATHML_TAGS[tagName]);
         }
-
         if (element.namespaceURI === HTML_NAMESPACE) {
             // The only way to switch from SVG to HTML is via
             // HTML integration points, and from MathML to HTML
@@ -1433,7 +1575,6 @@ function createDOMPurify() {
             ) {
                 return false;
             }
-
             if (
                 parent.namespaceURI === MATHML_NAMESPACE &&
                 !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]
@@ -1441,29 +1582,27 @@ function createDOMPurify() {
                 return false;
             }
 
-            // Certain elements are allowed in both SVG and HTML
-            // namespace. We need to specify them explicitly
-            // so that they don't get erronously deleted from
-            // HTML namespace.
-            var commonSvgAndHTMLElements = addToSet({}, [
-                'title',
-                'style',
-                'font',
-                'a',
-                'script',
-            ]);
-
             // We disallow tags that are specific for MathML
             // or SVG and should never appear in HTML namespace
             return (
                 !ALL_MATHML_TAGS[tagName] &&
-                (commonSvgAndHTMLElements[tagName] || !ALL_SVG_TAGS[tagName])
+                (COMMON_SVG_AND_HTML_ELEMENTS[tagName] ||
+                    !ALL_SVG_TAGS[tagName])
             );
         }
 
+        // For XHTML and XML documents that support custom namespaces
+        if (
+            PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&
+            ALLOWED_NAMESPACES[element.namespaceURI]
+        ) {
+            return true;
+        }
+
         // The code should never reach this place (this means
         // that the element somehow got namespace that is not
-        // HTML, SVG or MathML). Return false just in case.
+        // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
+        // Return false just in case.
         return false;
     };
 
@@ -1472,16 +1611,15 @@ function createDOMPurify() {
      *
      * @param  {Node} node a DOM node
      */
-    var _forceRemove = function _forceRemove(node) {
-        arrayPush(DOMPurify.removed, { element: node });
+    const _forceRemove = function _forceRemove(node) {
+        arrayPush(DOMPurify.removed, {
+            element: node,
+        });
         try {
+            // eslint-disable-next-line unicorn/prefer-dom-node-remove
             node.parentNode.removeChild(node);
         } catch (_) {
-            try {
-                node.outerHTML = emptyHTML;
-            } catch (_) {
-                node.remove();
-            }
+            node.remove();
         }
     };
 
@@ -1491,7 +1629,7 @@ function createDOMPurify() {
      * @param  {String} name an Attribute name
      * @param  {Node} node a DOM node
      */
-    var _removeAttribute = function _removeAttribute(name, node) {
+    const _removeAttribute = function _removeAttribute(name, node) {
         try {
             arrayPush(DOMPurify.removed, {
                 attribute: node.getAttributeNode(name),
@@ -1503,8 +1641,20 @@ function createDOMPurify() {
                 from: node,
             });
         }
-
         node.removeAttribute(name);
+
+        // We void attribute values for unremovable "is"" attributes
+        if (name === 'is' && !ALLOWED_ATTR[name]) {
+            if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
+                try {
+                    _forceRemove(node);
+                } catch (_) {}
+            } else {
+                try {
+                    node.setAttribute(name, '');
+                } catch (_) {}
+            }
+        }
     };
 
     /**
@@ -1513,68 +1663,89 @@ function createDOMPurify() {
      * @param  {String} dirty a string of dirty markup
      * @return {Document} a DOM, filled with the dirty markup
      */
-    var _initDocument = function _initDocument(dirty) {
+    const _initDocument = function _initDocument(dirty) {
         /* Create a HTML document */
-        var doc = void 0;
-        var leadingWhitespace = void 0;
-
+        let doc = null;
+        let leadingWhitespace = null;
         if (FORCE_BODY) {
             dirty = '<remove></remove>' + dirty;
         } else {
             /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
-            var matches = stringMatch(dirty, /^[\r\n\t ]+/);
+            const matches = stringMatch(dirty, /^[\r\n\t ]+/);
             leadingWhitespace = matches && matches[0];
         }
-
-        var dirtyPayload = trustedTypesPolicy
+        if (
+            PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&
+            NAMESPACE === HTML_NAMESPACE
+        ) {
+            // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
+            dirty =
+                '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' +
+                dirty +
+                '</body></html>';
+        }
+        const dirtyPayload = trustedTypesPolicy
             ? trustedTypesPolicy.createHTML(dirty)
             : dirty;
-        /* Use the DOMParser API by default, fallback later if needs be */
-        try {
-            doc = new DOMParser().parseFromString(dirtyPayload, 'text/html');
-        } catch (_) {}
+        /*
+         * Use the DOMParser API by default, fallback later if needs be
+         * DOMParser not work for svg when has multiple root element.
+         */
+        if (NAMESPACE === HTML_NAMESPACE) {
+            try {
+                doc = new DOMParser().parseFromString(
+                    dirtyPayload,
+                    PARSER_MEDIA_TYPE
+                );
+            } catch (_) {}
+        }
 
         /* Use createHTMLDocument in case DOMParser is not available */
         if (!doc || !doc.documentElement) {
-            doc = implementation.createHTMLDocument('');
-            var _doc = doc,
-                body = _doc.body;
-
-            body.parentNode.removeChild(body.parentNode.firstElementChild);
-            body.outerHTML = dirtyPayload;
+            doc = implementation.createDocument(NAMESPACE, 'template', null);
+            try {
+                doc.documentElement.innerHTML = IS_EMPTY_INPUT
+                    ? emptyHTML
+                    : dirtyPayload;
+            } catch (_) {
+                // Syntax error if dirtyPayload is invalid xml
+            }
         }
-
+        const body = doc.body || doc.documentElement;
         if (dirty && leadingWhitespace) {
-            doc.body.insertBefore(
+            body.insertBefore(
                 document.createTextNode(leadingWhitespace),
-                doc.body.childNodes[0] || null
+                body.childNodes[0] || null
             );
         }
 
         /* Work on whole document or just its body */
-        return getElementsByTagName.call(
-            doc,
-            WHOLE_DOCUMENT ? 'html' : 'body'
-        )[0];
+        if (NAMESPACE === HTML_NAMESPACE) {
+            return getElementsByTagName.call(
+                doc,
+                WHOLE_DOCUMENT ? 'html' : 'body'
+            )[0];
+        }
+        return WHOLE_DOCUMENT ? doc.documentElement : body;
     };
 
     /**
-     * _createIterator
+     * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
      *
-     * @param  {Document} root document/fragment to create iterator for
-     * @return {Iterator} iterator instance
+     * @param  {Node} root The root element or node to start traversing on.
+     * @return {NodeIterator} The created NodeIterator
      */
-    var _createIterator = function _createIterator(root) {
+    const _createNodeIterator = function _createNodeIterator(root) {
         return createNodeIterator.call(
             root.ownerDocument || root,
             root,
+            // eslint-disable-next-line no-bitwise
             NodeFilter.SHOW_ELEMENT |
                 NodeFilter.SHOW_COMMENT |
-                NodeFilter.SHOW_TEXT,
-            function () {
-                return NodeFilter.FILTER_ACCEPT;
-            },
-            false
+                NodeFilter.SHOW_TEXT |
+                NodeFilter.SHOW_PROCESSING_INSTRUCTION |
+                NodeFilter.SHOW_CDATA_SECTION,
+            null
         );
     };
 
@@ -1584,43 +1755,29 @@ function createDOMPurify() {
      * @param  {Node} elm element to check for clobbering attacks
      * @return {Boolean} true if clobbered, false if safe
      */
-    var _isClobbered = function _isClobbered(elm) {
-        if (elm instanceof Text || elm instanceof Comment) {
-            return false;
-        }
-
-        if (
-            typeof elm.nodeName !== 'string' ||
-            typeof elm.textContent !== 'string' ||
-            typeof elm.removeChild !== 'function' ||
-            !(elm.attributes instanceof NamedNodeMap) ||
-            typeof elm.removeAttribute !== 'function' ||
-            typeof elm.setAttribute !== 'function' ||
-            typeof elm.namespaceURI !== 'string' ||
-            typeof elm.insertBefore !== 'function'
-        ) {
-            return true;
-        }
-
-        return false;
+    const _isClobbered = function _isClobbered(elm) {
+        return (
+            elm instanceof HTMLFormElement &&
+            (typeof elm.nodeName !== 'string' ||
+                typeof elm.textContent !== 'string' ||
+                typeof elm.removeChild !== 'function' ||
+                !(elm.attributes instanceof NamedNodeMap) ||
+                typeof elm.removeAttribute !== 'function' ||
+                typeof elm.setAttribute !== 'function' ||
+                typeof elm.namespaceURI !== 'string' ||
+                typeof elm.insertBefore !== 'function' ||
+                typeof elm.hasChildNodes !== 'function')
+        );
     };
 
     /**
-     * _isNode
+     * Checks whether the given object is a DOM node.
      *
-     * @param  {Node} obj object to check whether it's a DOM node
+     * @param  {Node} object object to check whether it's a DOM node
      * @return {Boolean} true is object is a DOM node
      */
-    var _isNode = function _isNode(object) {
-        return (typeof Node === 'undefined' ? 'undefined' : _typeof(Node)) ===
-            'object'
-            ? object instanceof Node
-            : object &&
-                  (typeof object === 'undefined'
-                      ? 'undefined'
-                      : _typeof(object)) === 'object' &&
-                  typeof object.nodeType === 'number' &&
-                  typeof object.nodeName === 'string';
+    const _isNode = function _isNode(object) {
+        return typeof Node === 'function' && object instanceof Node;
     };
 
     /**
@@ -1631,12 +1788,11 @@ function createDOMPurify() {
      * @param  {Node} currentNode node to work on with the hook
      * @param  {Object} data additional hook parameters
      */
-    var _executeHook = function _executeHook(entryPoint, currentNode, data) {
+    const _executeHook = function _executeHook(entryPoint, currentNode, data) {
         if (!hooks[entryPoint]) {
             return;
         }
-
-        arrayForEach(hooks[entryPoint], function (hook) {
+        arrayForEach(hooks[entryPoint], (hook) => {
             hook.call(DOMPurify, currentNode, data, CONFIG);
         });
     };
@@ -1651,8 +1807,8 @@ function createDOMPurify() {
      * @param   {Node} currentNode to check for permission to exist
      * @return  {Boolean} true if node was killed, false if left alive
      */
-    var _sanitizeElements = function _sanitizeElements(currentNode) {
-        var content = void 0;
+    const _sanitizeElements = function _sanitizeElements(currentNode) {
+        let content = null;
 
         /* Execute a hook if present */
         _executeHook('beforeSanitizeElements', currentNode, null);
@@ -1663,26 +1819,19 @@ function createDOMPurify() {
             return true;
         }
 
-        /* Check if tagname contains Unicode */
-        if (stringMatch(currentNode.nodeName, /[\u0080-\uFFFF]/)) {
-            _forceRemove(currentNode);
-            return true;
-        }
-
         /* Now let's check the element's type and name */
-        var tagName = stringToLowerCase(currentNode.nodeName);
+        const tagName = transformCaseFunc(currentNode.nodeName);
 
         /* Execute a hook if present */
         _executeHook('uponSanitizeElement', currentNode, {
-            tagName: tagName,
+            tagName,
             allowedTags: ALLOWED_TAGS,
         });
 
         /* Detect mXSS attempts abusing namespace confusion */
         if (
+            currentNode.hasChildNodes() &&
             !_isNode(currentNode.firstElementChild) &&
-            (!_isNode(currentNode.content) ||
-                !_isNode(currentNode.content.firstElementChild)) &&
             regExpTest(/<[/\w]/g, currentNode.innerHTML) &&
             regExpTest(/<[/\w]/g, currentNode.textContent)
         ) {
@@ -1690,21 +1839,46 @@ function createDOMPurify() {
             return true;
         }
 
+        /* Remove any ocurrence of processing instructions */
+        if (currentNode.nodeType === 7) {
+            _forceRemove(currentNode);
+            return true;
+        }
+
         /* Remove element if anything forbids its presence */
         if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
+            /* Check if we have a custom element to handle */
+            if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
+                if (
+                    CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
+                    regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)
+                ) {
+                    return false;
+                }
+                if (
+                    CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&
+                    CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)
+                ) {
+                    return false;
+                }
+            }
+
             /* Keep content except for bad-listed elements */
             if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
-                var parentNode = getParentNode(currentNode);
-                var childNodes = getChildNodes(currentNode);
-                var childCount = childNodes.length;
-                for (var i = childCount - 1; i >= 0; --i) {
-                    parentNode.insertBefore(
-                        cloneNode(childNodes[i], true),
-                        getNextSibling(currentNode)
-                    );
+                const parentNode =
+                    getParentNode(currentNode) || currentNode.parentNode;
+                const childNodes =
+                    getChildNodes(currentNode) || currentNode.childNodes;
+                if (childNodes && parentNode) {
+                    const childCount = childNodes.length;
+                    for (let i = childCount - 1; i >= 0; --i) {
+                        parentNode.insertBefore(
+                            cloneNode(childNodes[i], true),
+                            getNextSibling(currentNode)
+                        );
+                    }
                 }
             }
-
             _forceRemove(currentNode);
             return true;
         }
@@ -1718,9 +1892,12 @@ function createDOMPurify() {
             return true;
         }
 
+        /* Make sure that older browsers don't get fallback-tag mXSS */
         if (
-            (tagName === 'noscript' || tagName === 'noembed') &&
-            regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)
+            (tagName === 'noscript' ||
+                tagName === 'noembed' ||
+                tagName === 'noframes') &&
+            regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)
         ) {
             _forceRemove(currentNode);
             return true;
@@ -1730,8 +1907,9 @@ function createDOMPurify() {
         if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
             /* Get the element's text content */
             content = currentNode.textContent;
-            content = stringReplace(content, MUSTACHE_EXPR$$1, ' ');
-            content = stringReplace(content, ERB_EXPR$$1, ' ');
+            arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr) => {
+                content = stringReplace(content, expr, ' ');
+            });
             if (currentNode.textContent !== content) {
                 arrayPush(DOMPurify.removed, {
                     element: currentNode.cloneNode(),
@@ -1742,7 +1920,6 @@ function createDOMPurify() {
 
         /* Execute a hook if present */
         _executeHook('afterSanitizeElements', currentNode, null);
-
         return false;
     };
 
@@ -1755,7 +1932,7 @@ function createDOMPurify() {
      * @return {Boolean} Returns true if `value` is valid, otherwise false.
      */
     // eslint-disable-next-line complexity
-    var _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
+    const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
         /* Make sure attribute cannot clobber */
         if (
             SANITIZE_DOM &&
@@ -1769,17 +1946,59 @@ function createDOMPurify() {
             (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
             XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
             We don't need to check the value; it's always URI safe. */
-        if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$$1, lcName));
-        else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$$1, lcName));
+        if (
+            ALLOW_DATA_ATTR &&
+            !FORBID_ATTR[lcName] &&
+            regExpTest(DATA_ATTR, lcName)
+        );
+        else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName));
         else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
-            return false;
-
+            if (
+                // First condition does a very basic check if a) it's basically a valid custom element tagname AND
+                // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
+                // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
+                (_isBasicCustomElement(lcTag) &&
+                    ((CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
+                        regExpTest(
+                            CUSTOM_ELEMENT_HANDLING.tagNameCheck,
+                            lcTag
+                        )) ||
+                        (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof
+                            Function &&
+                            CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag))) &&
+                    ((CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof
+                        RegExp &&
+                        regExpTest(
+                            CUSTOM_ELEMENT_HANDLING.attributeNameCheck,
+                            lcName
+                        )) ||
+                        (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof
+                            Function &&
+                            CUSTOM_ELEMENT_HANDLING.attributeNameCheck(
+                                lcName
+                            )))) ||
+                // Alternative, second condition checks if it's an `is`-attribute, AND
+                // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
+                (lcName === 'is' &&
+                    CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements &&
+                    ((CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
+                        regExpTest(
+                            CUSTOM_ELEMENT_HANDLING.tagNameCheck,
+                            value
+                        )) ||
+                        (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof
+                            Function &&
+                            CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))))
+            );
+            else {
+                return false;
+            }
             /* Check value is safe. First, is attr inert? If so, is safe */
         } else if (URI_SAFE_ATTRIBUTES[lcName]);
         else if (
             regExpTest(
-                IS_ALLOWED_URI$$1,
-                stringReplace(value, ATTR_WHITESPACE$$1, '')
+                IS_ALLOWED_URI$1,
+                stringReplace(value, ATTR_WHITESPACE, '')
             )
         );
         else if (
@@ -1793,18 +2012,30 @@ function createDOMPurify() {
         else if (
             ALLOW_UNKNOWN_PROTOCOLS &&
             !regExpTest(
-                IS_SCRIPT_OR_DATA$$1,
-                stringReplace(value, ATTR_WHITESPACE$$1, '')
+                IS_SCRIPT_OR_DATA,
+                stringReplace(value, ATTR_WHITESPACE, '')
             )
         );
-        else if (!value);
-        else {
+        else if (value) {
             return false;
-        }
-
+        } else;
         return true;
     };
 
+    /**
+     * _isBasicCustomElement
+     * checks if at least one dash is included in tagName, and it's not the first char
+     * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
+     *
+     * @param {string} tagName name of the tag of the node to sanitize
+     * @returns {boolean} Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
+     */
+    const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
+        return (
+            tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT)
+        );
+    };
+
     /**
      * _sanitizeAttributes
      *
@@ -1815,39 +2046,29 @@ function createDOMPurify() {
      *
      * @param  {Node} currentNode to sanitize
      */
-    var _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
-        var attr = void 0;
-        var value = void 0;
-        var lcName = void 0;
-        var l = void 0;
+    const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
         /* Execute a hook if present */
         _executeHook('beforeSanitizeAttributes', currentNode, null);
-
-        var attributes = currentNode.attributes;
+        const { attributes } = currentNode;
 
         /* Check if we have attributes; if not we might have a text node */
-
         if (!attributes) {
             return;
         }
-
-        var hookEvent = {
+        const hookEvent = {
             attrName: '',
             attrValue: '',
             keepAttr: true,
             allowedAttributes: ALLOWED_ATTR,
         };
-        l = attributes.length;
+        let l = attributes.length;
 
         /* Go backwards over all attributes; safely remove bad ones */
         while (l--) {
-            attr = attributes[l];
-            var _attr = attr,
-                name = _attr.name,
-                namespaceURI = _attr.namespaceURI;
-
-            value = stringTrim(attr.value);
-            lcName = stringToLowerCase(name);
+            const attr = attributes[l];
+            const { name, namespaceURI, value: attrValue } = attr;
+            const lcName = transformCaseFunc(name);
+            let value = name === 'value' ? attrValue : stringTrim(attrValue);
 
             /* Execute a hook if present */
             hookEvent.attrName = lcName;
@@ -1870,23 +2091,59 @@ function createDOMPurify() {
             }
 
             /* Work around a security issue in jQuery 3.0 */
-            if (regExpTest(/\/>/i, value)) {
+            if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
                 _removeAttribute(name, currentNode);
                 continue;
             }
 
             /* Sanitize attribute content to be template-safe */
             if (SAFE_FOR_TEMPLATES) {
-                value = stringReplace(value, MUSTACHE_EXPR$$1, ' ');
-                value = stringReplace(value, ERB_EXPR$$1, ' ');
+                arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr) => {
+                    value = stringReplace(value, expr, ' ');
+                });
             }
 
             /* Is `value` valid for this attribute? */
-            var lcTag = currentNode.nodeName.toLowerCase();
+            const lcTag = transformCaseFunc(currentNode.nodeName);
             if (!_isValidAttribute(lcTag, lcName, value)) {
                 continue;
             }
 
+            /* Full DOM Clobbering protection via namespace isolation,
+             * Prefix id and name attributes with `user-content-`
+             */
+            if (
+                SANITIZE_NAMED_PROPS &&
+                (lcName === 'id' || lcName === 'name')
+            ) {
+                // Remove the attribute with this value
+                _removeAttribute(name, currentNode);
+
+                // Prefix the value and later re-create the attribute with the sanitized value
+                value = SANITIZE_NAMED_PROPS_PREFIX + value;
+            }
+
+            /* Handle attributes that require Trusted Types */
+            if (
+                trustedTypesPolicy &&
+                typeof trustedTypes === 'object' &&
+                typeof trustedTypes.getAttributeType === 'function'
+            ) {
+                if (namespaceURI);
+                else {
+                    switch (trustedTypes.getAttributeType(lcTag, lcName)) {
+                        case 'TrustedHTML': {
+                            value = trustedTypesPolicy.createHTML(value);
+                            break;
+                        }
+                        case 'TrustedScriptURL': {
+                            value = trustedTypesPolicy.createScriptURL(value);
+                            break;
+                        }
+                    }
+                }
+            }
+
             /* Handle invalid data-* attribute set by try-catching it */
             try {
                 if (namespaceURI) {
@@ -1895,7 +2152,6 @@ function createDOMPurify() {
                     /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
                     currentNode.setAttribute(name, value);
                 }
-
                 arrayPop(DOMPurify.removed);
             } catch (_) {}
         }
@@ -1909,13 +2165,12 @@ function createDOMPurify() {
      *
      * @param  {DocumentFragment} fragment to iterate over recursively
      */
-    var _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
-        var shadowNode = void 0;
-        var shadowIterator = _createIterator(fragment);
+    const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
+        let shadowNode = null;
+        const shadowIterator = _createNodeIterator(fragment);
 
         /* Execute a hook if present */
         _executeHook('beforeSanitizeShadowDOM', fragment, null);
-
         while ((shadowNode = shadowIterator.nextNode())) {
             /* Execute a hook if present */
             _executeHook('uponSanitizeShadowNode', shadowNode, null);
@@ -1943,50 +2198,40 @@ function createDOMPurify() {
      * Public method providing core sanitation functionality
      *
      * @param {String|Node} dirty string or DOM node
-     * @param {Object} configuration object
+     * @param {Object} cfg object
      */
     // eslint-disable-next-line complexity
-    DOMPurify.sanitize = function (dirty, cfg) {
-        var body = void 0;
-        var importedNode = void 0;
-        var currentNode = void 0;
-        var oldNode = void 0;
-        var returnNode = void 0;
+    DOMPurify.sanitize = function (dirty) {
+        let cfg =
+            arguments.length > 1 && arguments[1] !== undefined
+                ? arguments[1]
+                : {};
+        let body = null;
+        let importedNode = null;
+        let currentNode = null;
+        let returnNode = null;
         /* Make sure we have a string to sanitize.
           DO NOT return early, as this will return the wrong type if
           the user has requested a DOM object rather than a string */
-        if (!dirty) {
+        IS_EMPTY_INPUT = !dirty;
+        if (IS_EMPTY_INPUT) {
             dirty = '<!-->';
         }
 
         /* Stringify, in case dirty is an object */
         if (typeof dirty !== 'string' && !_isNode(dirty)) {
-            // eslint-disable-next-line no-negated-condition
-            if (typeof dirty.toString !== 'function') {
-                throw typeErrorCreate('toString is not a function');
-            } else {
+            if (typeof dirty.toString === 'function') {
                 dirty = dirty.toString();
                 if (typeof dirty !== 'string') {
                     throw typeErrorCreate('dirty is not a string, aborting');
                 }
+            } else {
+                throw typeErrorCreate('toString is not a function');
             }
         }
 
-        /* Check we can run. Otherwise fall back or ignore */
+        /* Return dirty HTML if DOMPurify cannot run */
         if (!DOMPurify.isSupported) {
-            if (
-                _typeof(window.toStaticHTML) === 'object' ||
-                typeof window.toStaticHTML === 'function'
-            ) {
-                if (typeof dirty === 'string') {
-                    return window.toStaticHTML(dirty);
-                }
-
-                if (_isNode(dirty)) {
-                    return window.toStaticHTML(dirty.outerHTML);
-                }
-            }
-
             return dirty;
         }
 
@@ -2002,11 +2247,19 @@ function createDOMPurify() {
         if (typeof dirty === 'string') {
             IN_PLACE = false;
         }
-
-        if (IN_PLACE);
-        else if (dirty instanceof Node) {
+        if (IN_PLACE) {
+            /* Do some early pre-sanitization to avoid unsafe root nodes */
+            if (dirty.nodeName) {
+                const tagName = transformCaseFunc(dirty.nodeName);
+                if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
+                    throw typeErrorCreate(
+                        'root node is forbidden and cannot be sanitized in-place'
+                    );
+                }
+            }
+        } else if (dirty instanceof Node) {
             /* If dirty is a DOM element, append to an empty document to avoid
-               elements being stripped by the parser */
+             elements being stripped by the parser */
             body = _initDocument('<!---->');
             importedNode = body.ownerDocument.importNode(dirty, true);
             if (
@@ -2018,7 +2271,7 @@ function createDOMPurify() {
             } else if (importedNode.nodeName === 'HTML') {
                 body = importedNode;
             } else {
-                // eslint-disable-next-line unicorn/prefer-node-append
+                // eslint-disable-next-line unicorn/prefer-dom-node-append
                 body.appendChild(importedNode);
             }
         } else {
@@ -2040,7 +2293,7 @@ function createDOMPurify() {
 
             /* Check we have a DOM node from the data */
             if (!body) {
-                return RETURN_DOM ? null : emptyHTML;
+                return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
             }
         }
 
@@ -2050,15 +2303,10 @@ function createDOMPurify() {
         }
 
         /* Get node iterator */
-        var nodeIterator = _createIterator(IN_PLACE ? dirty : body);
+        const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
 
         /* Now start iterating over the created document */
         while ((currentNode = nodeIterator.nextNode())) {
-            /* Fix IE's strange behavior with manipulated textNodes #89 */
-            if (currentNode.nodeType === 3 && currentNode === oldNode) {
-                continue;
-            }
-
             /* Sanitize tags and elements */
             if (_sanitizeElements(currentNode)) {
                 continue;
@@ -2071,12 +2319,8 @@ function createDOMPurify() {
 
             /* Check attributes, sanitize if necessary */
             _sanitizeAttributes(currentNode);
-
-            oldNode = currentNode;
         }
 
-        oldNode = null;
-
         /* If we sanitized `dirty` in-place, return it. */
         if (IN_PLACE) {
             return dirty;
@@ -2086,45 +2330,53 @@ function createDOMPurify() {
         if (RETURN_DOM) {
             if (RETURN_DOM_FRAGMENT) {
                 returnNode = createDocumentFragment.call(body.ownerDocument);
-
                 while (body.firstChild) {
-                    // eslint-disable-next-line unicorn/prefer-node-append
+                    // eslint-disable-next-line unicorn/prefer-dom-node-append
                     returnNode.appendChild(body.firstChild);
                 }
             } else {
                 returnNode = body;
             }
-
-            if (RETURN_DOM_IMPORT) {
+            if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
                 /*
-                  AdoptNode() is not used because internal state is not reset
-                  (e.g. the past names map of a HTMLFormElement), this is safe
-                  in theory but we would rather not risk another attack vector.
-                  The state that is cloned by importNode() is explicitly defined
-                  by the specs.
-                */
+              AdoptNode() is not used because internal state is not reset
+              (e.g. the past names map of a HTMLFormElement), this is safe
+              in theory but we would rather not risk another attack vector.
+              The state that is cloned by importNode() is explicitly defined
+              by the specs.
+            */
                 returnNode = importNode.call(
                     originalDocument,
                     returnNode,
                     true
                 );
             }
-
             return returnNode;
         }
+        let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
 
-        var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
+        /* Serialize doctype if allowed */
+        if (
+            WHOLE_DOCUMENT &&
+            ALLOWED_TAGS['!doctype'] &&
+            body.ownerDocument &&
+            body.ownerDocument.doctype &&
+            body.ownerDocument.doctype.name &&
+            regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)
+        ) {
+            serializedHTML =
+                '<!DOCTYPE ' +
+                body.ownerDocument.doctype.name +
+                '>\n' +
+                serializedHTML;
+        }
 
         /* Sanitize final string template-safe */
         if (SAFE_FOR_TEMPLATES) {
-            serializedHTML = stringReplace(
-                serializedHTML,
-                MUSTACHE_EXPR$$1,
-                ' '
-            );
-            serializedHTML = stringReplace(serializedHTML, ERB_EXPR$$1, ' ');
+            arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr) => {
+                serializedHTML = stringReplace(serializedHTML, expr, ' ');
+            });
         }
-
         return trustedTypesPolicy && RETURN_TRUSTED_TYPE
             ? trustedTypesPolicy.createHTML(serializedHTML)
             : serializedHTML;
@@ -2136,7 +2388,11 @@ function createDOMPurify() {
      *
      * @param {Object} cfg configuration object
      */
-    DOMPurify.setConfig = function (cfg) {
+    DOMPurify.setConfig = function () {
+        let cfg =
+            arguments.length > 0 && arguments[0] !== undefined
+                ? arguments[0]
+                : {};
         _parseConfig(cfg);
         SET_CONFIG = true;
     };
@@ -2156,9 +2412,9 @@ function createDOMPurify() {
      * Uses last set config, if any. Otherwise, uses config defaults.
      * isValidAttribute
      *
-     * @param  {string} tag Tag name of containing element.
-     * @param  {string} attr Attribute name.
-     * @param  {string} value Attribute value.
+     * @param  {String} tag Tag name of containing element.
+     * @param  {String} attr Attribute name.
+     * @param  {String} value Attribute value.
      * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
      */
     DOMPurify.isValidAttribute = function (tag, attr, value) {
@@ -2166,9 +2422,8 @@ function createDOMPurify() {
         if (!CONFIG) {
             _parseConfig({});
         }
-
-        var lcTag = stringToLowerCase(tag);
-        var lcName = stringToLowerCase(attr);
+        const lcTag = transformCaseFunc(tag);
+        const lcName = transformCaseFunc(attr);
         return _isValidAttribute(lcTag, lcName, value);
     };
 
@@ -2183,7 +2438,6 @@ function createDOMPurify() {
         if (typeof hookFunction !== 'function') {
             return;
         }
-
         hooks[entryPoint] = hooks[entryPoint] || [];
         arrayPush(hooks[entryPoint], hookFunction);
     };
@@ -2194,10 +2448,11 @@ function createDOMPurify() {
      * (pops it from the stack of hooks if more are present)
      *
      * @param {String} entryPoint entry point for the hook to remove
+     * @return {Function} removed(popped) hook
      */
     DOMPurify.removeHook = function (entryPoint) {
         if (hooks[entryPoint]) {
-            arrayPop(hooks[entryPoint]);
+            return arrayPop(hooks[entryPoint]);
         }
     };
 
@@ -2216,15 +2471,12 @@ function createDOMPurify() {
     /**
      * RemoveAllHooks
      * Public method to remove all DOMPurify hooks
-     *
      */
     DOMPurify.removeAllHooks = function () {
         hooks = {};
     };
-
     return DOMPurify;
 }
-
 var purify = createDOMPurify();
 
 export default purify;