q2-tecton-elements 1.60.2 → 1.61.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bundle-report.json +16580 -15448
- package/dist/cjs/loader.cjs.js +1 -1
- package/dist/cjs/q2-action-group_2.cjs.entry.js +1 -1
- package/dist/cjs/q2-action-sheet.cjs.entry.js +1 -1
- package/dist/cjs/q2-badge.cjs.entry.js +82 -0
- package/dist/cjs/q2-badge.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-badge.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-btn.q2-loading.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-btn_2.cjs.entry.js +432 -0
- package/dist/cjs/q2-btn_2.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-data-table.cjs.entry.js +1 -1
- package/dist/cjs/q2-data-table.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-data-table.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-file-picker.cjs.entry.js +15 -3
- package/dist/cjs/q2-file-picker.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-file-picker.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-grid-area.cjs.entry.js +2 -2
- package/dist/cjs/q2-grid-area.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-grid-area.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-icon.cjs.entry.js +715 -0
- package/dist/cjs/q2-icon.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-icon.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-input.cjs.entry.js +3556 -0
- package/dist/cjs/q2-input.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-input.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-legend.cjs.entry.js +1 -1
- package/dist/cjs/q2-legend.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-legend.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-link.q2-list.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-link_2.cjs.entry.js +1 -1
- package/dist/cjs/q2-link_2.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-meter.cjs.entry.js +109 -0
- package/dist/cjs/q2-meter.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-meter.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-modal.cjs.entry.js +2 -2
- package/dist/cjs/q2-optgroup.cjs.entry.js +1 -1
- package/dist/cjs/q2-pagination.cjs.entry.js +23 -10
- package/dist/cjs/q2-pagination.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-pagination.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-pill.cjs.entry.js +36 -12
- package/dist/cjs/q2-pill.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-pill.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-relative-time.cjs.entry.js +1 -1
- package/dist/cjs/q2-section.cjs.entry.js +2 -2
- package/dist/cjs/q2-select.cjs.entry.js +6 -3
- package/dist/cjs/q2-select.cjs.entry.js.map +1 -1
- package/dist/cjs/q2-select.entry.cjs.js.map +1 -1
- package/dist/cjs/q2-stepper-vertical.cjs.entry.js +1 -1
- package/dist/cjs/q2-stepper.cjs.entry.js +1 -1
- package/dist/cjs/q2-tab-container.cjs.entry.js +280 -0
- package/dist/cjs/q2-tab-container.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-tab-container.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-tab-pane.cjs.entry.js +34 -0
- package/dist/cjs/q2-tab-pane.cjs.entry.js.map +1 -0
- package/dist/cjs/q2-tab-pane.entry.cjs.js.map +1 -0
- package/dist/cjs/q2-tag.cjs.entry.js +1 -1
- package/dist/cjs/q2-tecton-elements.cjs.js +1 -1
- package/dist/cjs/{sanitize-html-string-BtI99lfg.js → sanitize-html-string-DPqrzfM9.js} +61 -27
- package/dist/cjs/sanitize-html-string-DPqrzfM9.js.map +1 -0
- package/dist/cjs/sprites-DZZE7UFT.js +22 -0
- package/dist/cjs/sprites-DZZE7UFT.js.map +1 -0
- package/dist/cjs/tecton-tab-pane.cjs.entry.js +2 -2
- package/dist/collection/collection-manifest.json +1 -0
- package/dist/collection/components/q2-data-table/q2-data-table.css +23 -2
- package/dist/collection/components/q2-file-picker/q2-file-picker.css +5 -0
- package/dist/collection/components/q2-file-picker/q2-file-picker.js +33 -2
- package/dist/collection/components/q2-file-picker/q2-file-picker.js.map +1 -1
- package/dist/collection/components/q2-grid-area/q2-grid-area.js +15 -15
- package/dist/collection/components/q2-grid-area/q2-grid-area.js.map +1 -1
- package/dist/collection/components/q2-icon/assets/brand.symbol.svg +1 -1
- package/dist/collection/components/q2-icon/assets/standard.symbol.svg +1 -1
- package/dist/collection/components/q2-legend/q2-legend.css +7 -7
- package/dist/collection/components/q2-link/q2-link.css +3 -3
- package/dist/collection/components/q2-meter/q2-meter.css +230 -0
- package/dist/collection/components/q2-meter/q2-meter.js +384 -0
- package/dist/collection/components/q2-meter/q2-meter.js.map +1 -0
- package/dist/collection/components/q2-modal/q2-modal.js +1 -1
- package/dist/collection/components/q2-optgroup/q2-optgroup.js +1 -1
- package/dist/collection/components/q2-pagination/q2-pagination.js +29 -15
- package/dist/collection/components/q2-pagination/q2-pagination.js.map +1 -1
- package/dist/collection/components/q2-pill/q2-pill.css +10 -4
- package/dist/collection/components/q2-pill/q2-pill.js +35 -11
- package/dist/collection/components/q2-pill/q2-pill.js.map +1 -1
- package/dist/collection/components/q2-relative-time/q2-relative-time.js +1 -1
- package/dist/collection/components/q2-resize-observer/q2-resize-observer.js +1 -1
- package/dist/collection/components/q2-section/q2-section.js +2 -2
- package/dist/collection/components/q2-select/q2-select.js +6 -3
- package/dist/collection/components/q2-select/q2-select.js.map +1 -1
- package/dist/collection/components/q2-stepper/q2-stepper.js +1 -1
- package/dist/collection/components/q2-stepper-vertical/q2-stepper-vertical.js +1 -1
- package/dist/collection/components/q2-tab-container/q2-tab-container.js +1 -1
- package/dist/collection/components/q2-tab-pane/q2-tab-pane.js +1 -1
- package/dist/collection/components/q2-tag/q2-tag.js +1 -1
- package/dist/collection/components/tecton-tab-pane/tecton-tab-pane.js +2 -2
- package/dist/components/index.js +2 -0
- package/dist/components/index.js.map +1 -1
- package/dist/components/q2-data-table.js +1 -1
- package/dist/components/q2-data-table.js.map +1 -1
- package/dist/components/q2-file-picker.js +16 -3
- package/dist/components/q2-file-picker.js.map +1 -1
- package/dist/components/q2-grid-area.js +8 -8
- package/dist/components/q2-grid-area.js.map +1 -1
- package/dist/components/q2-legend2.js +1 -1
- package/dist/components/q2-legend2.js.map +1 -1
- package/dist/components/q2-link2.js +1 -1
- package/dist/components/q2-link2.js.map +1 -1
- package/dist/components/q2-meter.d.ts +11 -0
- package/dist/components/q2-meter.js +145 -0
- package/dist/components/q2-meter.js.map +1 -0
- package/dist/components/q2-modal.js +1 -1
- package/dist/components/q2-optgroup2.js +1 -1
- package/dist/components/q2-pagination.js +24 -11
- package/dist/components/q2-pagination.js.map +1 -1
- package/dist/components/q2-pill.js +36 -12
- package/dist/components/q2-pill.js.map +1 -1
- package/dist/components/q2-relative-time.js +1 -1
- package/dist/components/q2-resize-observer2.js +1 -1
- package/dist/components/q2-section.js +2 -2
- package/dist/components/q2-select2.js +6 -3
- package/dist/components/q2-select2.js.map +1 -1
- package/dist/components/q2-stepper-vertical.js +1 -1
- package/dist/components/q2-stepper.js +1 -1
- package/dist/components/q2-tab-container.js +1 -1
- package/dist/components/q2-tab-pane.js +1 -1
- package/dist/components/q2-tag.js +1 -1
- package/dist/components/q2-tooltip.js +1 -127
- package/dist/components/q2-tooltip.js.map +1 -1
- package/dist/components/q2-tooltip2.js +132 -0
- package/dist/components/q2-tooltip2.js.map +1 -0
- package/dist/components/sanitize-html-string.js +59 -25
- package/dist/components/sanitize-html-string.js.map +1 -1
- package/dist/components/tecton-tab-pane.js +2 -2
- package/dist/esm/{index-xCuy-dFb.js → index-LNnzUeDP.js} +3 -3
- package/dist/esm/{index-xCuy-dFb.js.map → index-LNnzUeDP.js.map} +1 -1
- package/dist/esm/loader.js +1 -1
- package/dist/esm/q2-action-group_2.entry.js +2 -2
- package/dist/esm/q2-action-sheet.entry.js +2 -2
- package/dist/esm/q2-badge.entry.js +80 -0
- package/dist/esm/q2-badge.entry.js.map +1 -0
- package/dist/esm/q2-btn.q2-loading.entry.js.map +1 -0
- package/dist/esm/q2-btn_2.entry.js +429 -0
- package/dist/esm/q2-btn_2.entry.js.map +1 -0
- package/dist/esm/q2-calendar.entry.js +1 -1
- package/dist/esm/q2-card.entry.js +1 -1
- package/dist/esm/q2-carousel-pane.entry.js +1 -1
- package/dist/esm/q2-carousel.entry.js +1 -1
- package/dist/esm/q2-chart-area.entry.js +1 -1
- package/dist/esm/q2-chart-bar.entry.js +1 -1
- package/dist/esm/q2-chart-donut.entry.js +1 -1
- package/dist/esm/q2-checkbox-group.entry.js +1 -1
- package/dist/esm/q2-checkbox.entry.js +1 -1
- package/dist/esm/q2-context.entry.js +1 -1
- package/dist/esm/q2-data-table.entry.js +2 -2
- package/dist/esm/q2-data-table.entry.js.map +1 -1
- package/dist/esm/q2-detail.entry.js +1 -1
- package/dist/esm/q2-dropdown-item.entry.js +1 -1
- package/dist/esm/q2-dropdown.entry.js +1 -1
- package/dist/esm/q2-editable-field.entry.js +1 -1
- package/dist/esm/q2-file-picker.entry.js +16 -4
- package/dist/esm/q2-file-picker.entry.js.map +1 -1
- package/dist/esm/q2-grid-area.entry.js +2 -2
- package/dist/esm/q2-grid-area.entry.js.map +1 -1
- package/dist/esm/q2-icon.entry.js +713 -0
- package/dist/esm/q2-icon.entry.js.map +1 -0
- package/dist/esm/q2-input.entry.js +3554 -0
- package/dist/esm/q2-input.entry.js.map +1 -0
- package/dist/esm/q2-item.entry.js +1 -1
- package/dist/esm/q2-legend.entry.js +1 -1
- package/dist/esm/q2-legend.entry.js.map +1 -1
- package/dist/esm/q2-link.q2-list.entry.js.map +1 -1
- package/dist/esm/q2-link_2.entry.js +2 -2
- package/dist/esm/q2-link_2.entry.js.map +1 -1
- package/dist/esm/q2-loc.entry.js +1 -1
- package/dist/esm/q2-message.entry.js +1 -1
- package/dist/esm/q2-meter.entry.js +107 -0
- package/dist/esm/q2-meter.entry.js.map +1 -0
- package/dist/esm/q2-modal.entry.js +3 -3
- package/dist/esm/q2-month-picker.entry.js +1 -1
- package/dist/esm/q2-optgroup.entry.js +2 -2
- package/dist/esm/q2-option-list_2.entry.js +1 -1
- package/dist/esm/q2-option.entry.js +1 -1
- package/dist/esm/q2-pagination.entry.js +24 -11
- package/dist/esm/q2-pagination.entry.js.map +1 -1
- package/dist/esm/q2-pill.entry.js +37 -13
- package/dist/esm/q2-pill.entry.js.map +1 -1
- package/dist/esm/q2-radio-group.entry.js +1 -1
- package/dist/esm/q2-radio.entry.js +1 -1
- package/dist/esm/q2-relative-time.entry.js +2 -2
- package/dist/esm/q2-section.entry.js +3 -3
- package/dist/esm/q2-select.entry.js +7 -4
- package/dist/esm/q2-select.entry.js.map +1 -1
- package/dist/esm/q2-stepper-pane.entry.js +1 -1
- package/dist/esm/q2-stepper-vertical.entry.js +2 -2
- package/dist/esm/q2-stepper.entry.js +2 -2
- package/dist/esm/q2-tab-container.entry.js +278 -0
- package/dist/esm/q2-tab-container.entry.js.map +1 -0
- package/dist/esm/q2-tab-pane.entry.js +32 -0
- package/dist/esm/q2-tab-pane.entry.js.map +1 -0
- package/dist/esm/q2-tag.entry.js +2 -2
- package/dist/esm/q2-tecton-elements.js +1 -1
- package/dist/esm/q2-textarea.entry.js +1 -1
- package/dist/esm/q2-tooltip.entry.js +1 -1
- package/dist/esm/{sanitize-html-string-DL0kgllh.js → sanitize-html-string-DOVERJq5.js} +61 -27
- package/dist/esm/sanitize-html-string-DOVERJq5.js.map +1 -0
- package/dist/esm/sprites-jG2RmiwF.js +20 -0
- package/dist/esm/sprites-jG2RmiwF.js.map +1 -0
- package/dist/esm/tecton-tab-pane.entry.js +2 -2
- package/dist/q2-tecton-elements/assets/brand.symbol.svg +1 -1
- package/dist/q2-tecton-elements/assets/standard.symbol.svg +1 -1
- package/dist/q2-tecton-elements/{index-xCuy-dFb.js → index-LNnzUeDP.js} +3 -3
- package/dist/q2-tecton-elements/{index-xCuy-dFb.js.map → index-LNnzUeDP.js.map} +1 -1
- package/dist/q2-tecton-elements/q2-action-group_2.entry.js +2 -2
- package/dist/q2-tecton-elements/q2-action-sheet.entry.js +2 -2
- package/dist/q2-tecton-elements/q2-badge.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-badge.entry.js +84 -0
- package/dist/q2-tecton-elements/q2-badge.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-btn.q2-loading.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-btn_2.entry.js +453 -0
- package/dist/q2-tecton-elements/q2-btn_2.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-calendar.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-card.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-carousel-pane.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-carousel.entry.js +5 -5
- package/dist/q2-tecton-elements/q2-chart-area.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-chart-bar.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-chart-donut.entry.js +9 -9
- package/dist/q2-tecton-elements/q2-checkbox-group.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-checkbox.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-context.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-data-table.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-data-table.entry.js +109 -109
- package/dist/q2-tecton-elements/q2-data-table.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-detail.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-dropdown-item.entry.js +4 -4
- package/dist/q2-tecton-elements/q2-dropdown.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-editable-field.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-file-picker.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-file-picker.entry.js +112 -93
- package/dist/q2-tecton-elements/q2-file-picker.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-grid-area.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-grid-area.entry.js +3 -3
- package/dist/q2-tecton-elements/q2-grid-area.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-icon.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-icon.entry.js +870 -0
- package/dist/q2-tecton-elements/q2-icon.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-input.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-input.entry.js +3883 -0
- package/dist/q2-tecton-elements/q2-input.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-item.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-legend.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-legend.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-legend.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-link.q2-list.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-link_2.entry.js +2 -2
- package/dist/q2-tecton-elements/q2-link_2.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-loc.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-message.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-meter.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-meter.entry.js +176 -0
- package/dist/q2-tecton-elements/q2-meter.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-modal.entry.js +24 -24
- package/dist/q2-tecton-elements/q2-month-picker.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-optgroup.entry.js +5 -5
- package/dist/q2-tecton-elements/q2-option-list_2.entry.js +15 -15
- package/dist/q2-tecton-elements/q2-option.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-pagination.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-pagination.entry.js +43 -33
- package/dist/q2-tecton-elements/q2-pagination.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-pill.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-pill.entry.js +57 -36
- package/dist/q2-tecton-elements/q2-pill.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-radio-group.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-radio.entry.js +4 -4
- package/dist/q2-tecton-elements/q2-relative-time.entry.js +2 -2
- package/dist/q2-tecton-elements/q2-section.entry.js +21 -21
- package/dist/q2-tecton-elements/q2-select.entry.esm.js.map +1 -1
- package/dist/q2-tecton-elements/q2-select.entry.js +7 -4
- package/dist/q2-tecton-elements/q2-select.entry.js.map +1 -1
- package/dist/q2-tecton-elements/q2-stepper-pane.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-stepper-vertical.entry.js +19 -19
- package/dist/q2-tecton-elements/q2-stepper.entry.js +13 -13
- package/dist/q2-tecton-elements/q2-tab-container.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-tab-container.entry.js +348 -0
- package/dist/q2-tecton-elements/q2-tab-container.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-tab-pane.entry.esm.js.map +1 -0
- package/dist/q2-tecton-elements/q2-tab-pane.entry.js +44 -0
- package/dist/q2-tecton-elements/q2-tab-pane.entry.js.map +1 -0
- package/dist/q2-tecton-elements/q2-tag.entry.js +57 -57
- package/dist/q2-tecton-elements/q2-tecton-elements.esm.js +1 -1
- package/dist/q2-tecton-elements/q2-textarea.entry.js +1 -1
- package/dist/q2-tecton-elements/q2-tooltip.entry.js +1 -1
- package/dist/q2-tecton-elements/{sanitize-html-string-DL0kgllh.js → sanitize-html-string-DOVERJq5.js} +314 -282
- package/dist/q2-tecton-elements/sanitize-html-string-DOVERJq5.js.map +1 -0
- package/dist/q2-tecton-elements/sprites-jG2RmiwF.js +18 -0
- package/dist/q2-tecton-elements/sprites-jG2RmiwF.js.map +1 -0
- package/dist/q2-tecton-elements/tecton-tab-pane.entry.js +6 -6
- package/dist/types/components/q2-file-picker/q2-file-picker.d.ts +5 -0
- package/dist/types/components/q2-grid-area/q2-grid-area.d.ts +6 -6
- package/dist/types/components/q2-meter/q2-meter.d.ts +70 -0
- package/dist/types/components/q2-pagination/q2-pagination.d.ts +2 -1
- package/dist/types/components/q2-pill/q2-pill.d.ts +8 -1
- package/dist/types/components.d.ts +147 -4
- package/package.json +3 -3
- package/dist/cjs/q2-badge.q2-btn.q2-icon.q2-input.q2-loading.q2-tab-container.q2-tab-pane.entry.cjs.js.map +0 -1
- package/dist/cjs/q2-badge_7.cjs.entry.js +0 -5074
- package/dist/cjs/q2-badge_7.cjs.entry.js.map +0 -1
- package/dist/cjs/sanitize-html-string-BtI99lfg.js.map +0 -1
- package/dist/esm/q2-badge.q2-btn.q2-icon.q2-input.q2-loading.q2-tab-container.q2-tab-pane.entry.js.map +0 -1
- package/dist/esm/q2-badge_7.entry.js +0 -5066
- package/dist/esm/q2-badge_7.entry.js.map +0 -1
- package/dist/esm/sanitize-html-string-DL0kgllh.js.map +0 -1
- package/dist/q2-tecton-elements/q2-badge.q2-btn.q2-icon.q2-input.q2-loading.q2-tab-container.q2-tab-pane.entry.esm.js.map +0 -1
- package/dist/q2-tecton-elements/q2-badge_7.entry.js +0 -5659
- package/dist/q2-tecton-elements/q2-badge_7.entry.js.map +0 -1
- package/dist/q2-tecton-elements/sanitize-html-string-DL0kgllh.js.map +0 -1
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @license DOMPurify 3.
|
|
1
|
+
/*! @license DOMPurify 3.3.0 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.0/LICENSE */
|
|
2
2
|
const {entries: e, setPrototypeOf: t, isFrozen: n, getPrototypeOf: o, getOwnPropertyDescriptor: i} = Object;
|
|
3
3
|
|
|
4
4
|
let {freeze: r, seal: a, create: l} = Object;
|
|
@@ -19,14 +19,20 @@ if (!a) {
|
|
|
19
19
|
}
|
|
20
20
|
|
|
21
21
|
if (!s) {
|
|
22
|
-
s = function apply(e, t
|
|
23
|
-
|
|
22
|
+
s = function apply(e, t) {
|
|
23
|
+
for (var n = arguments.length, o = new Array(n > 2 ? n - 2 : 0), i = 2; i < n; i++) {
|
|
24
|
+
o[i - 2] = arguments[i];
|
|
25
|
+
}
|
|
26
|
+
return e.apply(t, o);
|
|
24
27
|
};
|
|
25
28
|
}
|
|
26
29
|
|
|
27
30
|
if (!c) {
|
|
28
|
-
c = function construct(e
|
|
29
|
-
|
|
31
|
+
c = function construct(e) {
|
|
32
|
+
for (var t = arguments.length, n = new Array(t > 1 ? t - 1 : 0), o = 1; o < t; o++) {
|
|
33
|
+
n[o - 1] = arguments[o];
|
|
34
|
+
}
|
|
35
|
+
return new e(...n);
|
|
30
36
|
};
|
|
31
37
|
}
|
|
32
38
|
|
|
@@ -34,9 +40,9 @@ const f = unapply(Array.prototype.forEach);
|
|
|
34
40
|
|
|
35
41
|
const u = unapply(Array.prototype.lastIndexOf);
|
|
36
42
|
|
|
37
|
-
const
|
|
43
|
+
const p = unapply(Array.prototype.pop);
|
|
38
44
|
|
|
39
|
-
const
|
|
45
|
+
const d = unapply(Array.prototype.push);
|
|
40
46
|
|
|
41
47
|
const m = unapply(Array.prototype.splice);
|
|
42
48
|
|
|
@@ -46,15 +52,15 @@ const h = unapply(String.prototype.toString);
|
|
|
46
52
|
|
|
47
53
|
const y = unapply(String.prototype.match);
|
|
48
54
|
|
|
49
|
-
const
|
|
55
|
+
const b = unapply(String.prototype.replace);
|
|
50
56
|
|
|
51
|
-
const
|
|
57
|
+
const T = unapply(String.prototype.indexOf);
|
|
52
58
|
|
|
53
|
-
const
|
|
59
|
+
const w = unapply(String.prototype.trim);
|
|
54
60
|
|
|
55
|
-
const
|
|
61
|
+
const x = unapply(Object.prototype.hasOwnProperty);
|
|
56
62
|
|
|
57
|
-
const
|
|
63
|
+
const S = unapply(RegExp.prototype.test);
|
|
58
64
|
|
|
59
65
|
const k = unconstruct(TypeError);
|
|
60
66
|
|
|
@@ -129,7 +135,7 @@ const k = unconstruct(TypeError);
|
|
|
129
135
|
* @returns The cleaned version of the array
|
|
130
136
|
*/ function cleanArray(e) {
|
|
131
137
|
for (let t = 0; t < e.length; t++) {
|
|
132
|
-
const n =
|
|
138
|
+
const n = x(e, t);
|
|
133
139
|
if (!n) {
|
|
134
140
|
e[t] = null;
|
|
135
141
|
}
|
|
@@ -145,7 +151,7 @@ const k = unconstruct(TypeError);
|
|
|
145
151
|
*/ function clone(t) {
|
|
146
152
|
const n = l(null);
|
|
147
153
|
for (const [o, i] of e(t)) {
|
|
148
|
-
const e =
|
|
154
|
+
const e = x(t, o);
|
|
149
155
|
if (e) {
|
|
150
156
|
if (Array.isArray(i)) {
|
|
151
157
|
n[o] = cleanArray(i);
|
|
@@ -184,9 +190,9 @@ const k = unconstruct(TypeError);
|
|
|
184
190
|
return fallbackValue;
|
|
185
191
|
}
|
|
186
192
|
|
|
187
|
-
const _ = r([ "a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "shadow", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr" ]);
|
|
193
|
+
const _ = r([ "a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "search", "section", "select", "shadow", "slot", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr" ]);
|
|
188
194
|
|
|
189
|
-
const v = r([ "svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern" ]);
|
|
195
|
+
const v = r([ "svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "enterkeyhint", "exportparts", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "inputmode", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "part", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern" ]);
|
|
190
196
|
|
|
191
197
|
const A = r([ "feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence" ]);
|
|
192
198
|
|
|
@@ -200,13 +206,13 @@ const R = r([ "math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi",
|
|
|
200
206
|
|
|
201
207
|
// Similarly to SVG, we want to know all MathML elements,
|
|
202
208
|
// even those that we disallow by default.
|
|
203
|
-
const
|
|
209
|
+
const O = r([ "maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none" ]);
|
|
204
210
|
|
|
205
|
-
const
|
|
211
|
+
const D = r([ "#text" ]);
|
|
206
212
|
|
|
207
|
-
const M = r([ "accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns", "slot" ]);
|
|
213
|
+
const M = r([ "accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns", "slot" ]);
|
|
208
214
|
|
|
209
|
-
const z = r([ "accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan" ]);
|
|
215
|
+
const z = r([ "accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan" ]);
|
|
210
216
|
|
|
211
217
|
const L = r([ "accent", "accentunder", "align", "bevelled", "close", "columnsalign", "columnlines", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lspace", "lquote", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns" ]);
|
|
212
218
|
|
|
@@ -216,9 +222,9 @@ const I = r([ "xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"
|
|
|
216
222
|
const N = a(/\{\{[\w\W]*|[\w\W]*\}\}/gm);
|
|
217
223
|
|
|
218
224
|
// Specify template detection regex for SAFE_FOR_TEMPLATES mode
|
|
219
|
-
const
|
|
225
|
+
const F = a(/<%[\w\W]*|[\w\W]*%>/gm);
|
|
220
226
|
|
|
221
|
-
const
|
|
227
|
+
const P = a(/\$\{[\w\W]*/gm);
|
|
222
228
|
|
|
223
229
|
// eslint-disable-line unicorn/better-regex
|
|
224
230
|
const C = a(/^data-[\-\w.\u00B7-\uFFFF]+$/);
|
|
@@ -229,9 +235,9 @@ const H = a(/^aria-[\-\w]+$/);
|
|
|
229
235
|
// eslint-disable-line no-useless-escape
|
|
230
236
|
const U = a(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i);
|
|
231
237
|
|
|
232
|
-
const
|
|
238
|
+
const j = a(/^(?:\w+script|data):/i);
|
|
233
239
|
|
|
234
|
-
const
|
|
240
|
+
const B = a(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g);
|
|
235
241
|
|
|
236
242
|
const G = a(/^html$/i);
|
|
237
243
|
|
|
@@ -240,15 +246,15 @@ const W = a(/^[a-z][.\w]*(-[.\w]+)+$/i);
|
|
|
240
246
|
var q = Object.freeze({
|
|
241
247
|
__proto__: null,
|
|
242
248
|
ARIA_ATTR: H,
|
|
243
|
-
ATTR_WHITESPACE:
|
|
249
|
+
ATTR_WHITESPACE: B,
|
|
244
250
|
CUSTOM_ELEMENT: W,
|
|
245
251
|
DATA_ATTR: C,
|
|
246
252
|
DOCTYPE_NAME: G,
|
|
247
|
-
ERB_EXPR:
|
|
253
|
+
ERB_EXPR: F,
|
|
248
254
|
IS_ALLOWED_URI: U,
|
|
249
|
-
IS_SCRIPT_OR_DATA:
|
|
255
|
+
IS_SCRIPT_OR_DATA: j,
|
|
250
256
|
MUSTACHE_EXPR: N,
|
|
251
|
-
TMPLIT_EXPR:
|
|
257
|
+
TMPLIT_EXPR: P
|
|
252
258
|
});
|
|
253
259
|
|
|
254
260
|
/* eslint-disable @typescript-eslint/indent */
|
|
@@ -321,7 +327,7 @@ const V = function _createHooksMap() {
|
|
|
321
327
|
function createDOMPurify() {
|
|
322
328
|
let t = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : X();
|
|
323
329
|
const DOMPurify = e => createDOMPurify(e);
|
|
324
|
-
DOMPurify.version = "3.
|
|
330
|
+
DOMPurify.version = "3.3.0";
|
|
325
331
|
DOMPurify.removed = [];
|
|
326
332
|
if (!t || !t.document || t.document.nodeType !== Y.document || !t.Element) {
|
|
327
333
|
// Not running in a browser, provide a factory function
|
|
@@ -332,13 +338,13 @@ function createDOMPurify() {
|
|
|
332
338
|
let {document: n} = t;
|
|
333
339
|
const o = n;
|
|
334
340
|
const i = o.currentScript;
|
|
335
|
-
const {DocumentFragment: a, HTMLTemplateElement: s, Node: c, Element: N, NodeFilter:
|
|
336
|
-
const
|
|
337
|
-
const W = lookupGetter(
|
|
338
|
-
const K = lookupGetter(
|
|
339
|
-
const J = lookupGetter(
|
|
340
|
-
const Q = lookupGetter(
|
|
341
|
-
const Z = lookupGetter(
|
|
341
|
+
const {DocumentFragment: a, HTMLTemplateElement: s, Node: c, Element: N, NodeFilter: F, NamedNodeMap: P = t.NamedNodeMap || t.MozNamedAttrMap, HTMLFormElement: C, DOMParser: H, trustedTypes: j} = t;
|
|
342
|
+
const B = N.prototype;
|
|
343
|
+
const W = lookupGetter(B, "cloneNode");
|
|
344
|
+
const K = lookupGetter(B, "remove");
|
|
345
|
+
const J = lookupGetter(B, "nextSibling");
|
|
346
|
+
const Q = lookupGetter(B, "childNodes");
|
|
347
|
+
const Z = lookupGetter(B, "parentNode");
|
|
342
348
|
// As per issue #47, the web-components registry is inherited by a
|
|
343
349
|
// new document created via createHTMLDocument. As per the spec
|
|
344
350
|
// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
|
|
@@ -359,22 +365,22 @@ function createDOMPurify() {
|
|
|
359
365
|
/**
|
|
360
366
|
* Expose whether this browser supports running the full DOMPurify.
|
|
361
367
|
*/ DOMPurify.isSupported = typeof e === "function" && typeof Z === "function" && ne && ne.createHTMLDocument !== undefined;
|
|
362
|
-
const {MUSTACHE_EXPR: se, ERB_EXPR: ce, TMPLIT_EXPR: fe, DATA_ATTR: ue, ARIA_ATTR:
|
|
368
|
+
const {MUSTACHE_EXPR: se, ERB_EXPR: ce, TMPLIT_EXPR: fe, DATA_ATTR: ue, ARIA_ATTR: pe, IS_SCRIPT_OR_DATA: de, ATTR_WHITESPACE: me, CUSTOM_ELEMENT: ge} = q;
|
|
363
369
|
let {IS_ALLOWED_URI: he} = q;
|
|
364
370
|
/**
|
|
365
371
|
* We consider the elements and attributes below to be safe. Ideally
|
|
366
372
|
* don't add any new ones but feel free to remove unwanted ones.
|
|
367
373
|
*/
|
|
368
374
|
/* allowed element names */ let ye = null;
|
|
369
|
-
const
|
|
370
|
-
/* Allowed attribute names */ let
|
|
371
|
-
const
|
|
375
|
+
const be = addToSet({}, [ ..._, ...v, ...A, ...R, ...D ]);
|
|
376
|
+
/* Allowed attribute names */ let Te = null;
|
|
377
|
+
const we = addToSet({}, [ ...M, ...z, ...L, ...I ]);
|
|
372
378
|
/*
|
|
373
379
|
* Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
|
|
374
380
|
* @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
|
|
375
381
|
* @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
|
|
376
382
|
* @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
|
|
377
|
-
*/ let
|
|
383
|
+
*/ let xe = Object.seal(l(null, {
|
|
378
384
|
tagNameCheck: {
|
|
379
385
|
writable: true,
|
|
380
386
|
configurable: false,
|
|
@@ -394,31 +400,45 @@ function createDOMPurify() {
|
|
|
394
400
|
value: false
|
|
395
401
|
}
|
|
396
402
|
}));
|
|
397
|
-
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */ let
|
|
403
|
+
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */ let Se = null;
|
|
398
404
|
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */ let ke = null;
|
|
399
|
-
/*
|
|
400
|
-
|
|
401
|
-
|
|
405
|
+
/* Config object to store ADD_TAGS/ADD_ATTR functions (when used as functions) */ const _e = Object.seal(l(null, {
|
|
406
|
+
tagCheck: {
|
|
407
|
+
writable: true,
|
|
408
|
+
configurable: false,
|
|
409
|
+
enumerable: true,
|
|
410
|
+
value: null
|
|
411
|
+
},
|
|
412
|
+
attributeCheck: {
|
|
413
|
+
writable: true,
|
|
414
|
+
configurable: false,
|
|
415
|
+
enumerable: true,
|
|
416
|
+
value: null
|
|
417
|
+
}
|
|
418
|
+
}));
|
|
419
|
+
/* Decide if ARIA attributes are okay */ let ve = true;
|
|
420
|
+
/* Decide if custom data attributes are okay */ let Ae = true;
|
|
421
|
+
/* Decide if unknown protocols are okay */ let Ee = false;
|
|
402
422
|
/* Decide if self-closing tags in attributes are allowed.
|
|
403
|
-
* Usually removed due to a mXSS issue in jQuery 3.0 */ let
|
|
423
|
+
* Usually removed due to a mXSS issue in jQuery 3.0 */ let Re = true;
|
|
404
424
|
/* Output should be safe for common template engines.
|
|
405
425
|
* This means, DOMPurify removes data attributes, mustaches and ERB
|
|
406
|
-
*/ let
|
|
426
|
+
*/ let Oe = false;
|
|
407
427
|
/* Output should be safe even for XML used within HTML and alike.
|
|
408
428
|
* This means, DOMPurify removes comments when containing risky content.
|
|
409
429
|
*/ let De = true;
|
|
410
|
-
/* Decide if document with <html>... should be returned */ let
|
|
411
|
-
/* Track whether config is already set on this instance of DOMPurify. */ let
|
|
430
|
+
/* Decide if document with <html>... should be returned */ let Me = false;
|
|
431
|
+
/* Track whether config is already set on this instance of DOMPurify. */ let ze = false;
|
|
412
432
|
/* Decide if all elements (e.g. style, script) must be children of
|
|
413
|
-
* document.body. By default, browsers might move them to document.head */ let
|
|
433
|
+
* document.body. By default, browsers might move them to document.head */ let Le = false;
|
|
414
434
|
/* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
|
|
415
435
|
* string (or a TrustedHTML object if Trusted Types are supported).
|
|
416
436
|
* If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
|
|
417
|
-
*/ let
|
|
437
|
+
*/ let Ie = false;
|
|
418
438
|
/* Decide if a DOM `DocumentFragment` should be returned, instead of a html
|
|
419
|
-
* string (or a TrustedHTML object if Trusted Types are supported) */ let
|
|
439
|
+
* string (or a TrustedHTML object if Trusted Types are supported) */ let Ne = false;
|
|
420
440
|
/* Try to return a Trusted Type object instead of a string, return a string in
|
|
421
|
-
* case Trusted Types are not supported */ let
|
|
441
|
+
* case Trusted Types are not supported */ let Fe = false;
|
|
422
442
|
/* Output should be free from DOM clobbering attacks?
|
|
423
443
|
* This sanitizes markups named with colliding, clobberable built-in DOM APIs.
|
|
424
444
|
*/ let Pe = true;
|
|
@@ -434,40 +454,40 @@ function createDOMPurify() {
|
|
|
434
454
|
*
|
|
435
455
|
* Namespace isolation is implemented by prefixing `id` and `name` attributes
|
|
436
456
|
* with a constant string, i.e., `user-content-`
|
|
437
|
-
*/ let
|
|
438
|
-
const
|
|
439
|
-
/* Keep element content when removing element? */ let
|
|
457
|
+
*/ let Ce = false;
|
|
458
|
+
const He = "user-content-";
|
|
459
|
+
/* Keep element content when removing element? */ let Ue = true;
|
|
440
460
|
/* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
|
|
441
|
-
* of importing it into a new Document and returning a sanitized copy */ let
|
|
461
|
+
* of importing it into a new Document and returning a sanitized copy */ let je = false;
|
|
442
462
|
/* Allow usage of profiles like html, svg and mathMl */ let Be = {};
|
|
443
|
-
/* Tags to ignore content of when KEEP_CONTENT is true */ let
|
|
444
|
-
const
|
|
445
|
-
/* Tags that are safe for data: URIs */ let
|
|
446
|
-
const
|
|
447
|
-
/* Attributes safe for values like "javascript:" */ let
|
|
448
|
-
const
|
|
449
|
-
const
|
|
450
|
-
const
|
|
451
|
-
const
|
|
452
|
-
/* Document namespace */ let
|
|
453
|
-
let
|
|
454
|
-
/* Allowed XHTML+XML namespaces */ let
|
|
455
|
-
const
|
|
456
|
-
let
|
|
457
|
-
let
|
|
463
|
+
/* Tags to ignore content of when KEEP_CONTENT is true */ let Ge = null;
|
|
464
|
+
const We = addToSet({}, [ "annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp" ]);
|
|
465
|
+
/* Tags that are safe for data: URIs */ let qe = null;
|
|
466
|
+
const Ye = addToSet({}, [ "audio", "video", "img", "source", "image", "track" ]);
|
|
467
|
+
/* Attributes safe for values like "javascript:" */ let Xe = null;
|
|
468
|
+
const $e = addToSet({}, [ "alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns" ]);
|
|
469
|
+
const Ve = "http://www.w3.org/1998/Math/MathML";
|
|
470
|
+
const Ke = "http://www.w3.org/2000/svg";
|
|
471
|
+
const Je = "http://www.w3.org/1999/xhtml";
|
|
472
|
+
/* Document namespace */ let Qe = Je;
|
|
473
|
+
let Ze = false;
|
|
474
|
+
/* Allowed XHTML+XML namespaces */ let et = null;
|
|
475
|
+
const tt = addToSet({}, [ Ve, Ke, Je ], h);
|
|
476
|
+
let nt = addToSet({}, [ "mi", "mo", "mn", "ms", "mtext" ]);
|
|
477
|
+
let ot = addToSet({}, [ "annotation-xml" ]);
|
|
458
478
|
// Certain elements are allowed in both SVG and HTML
|
|
459
479
|
// namespace. We need to specify them explicitly
|
|
460
480
|
// so that they don't get erroneously deleted from
|
|
461
481
|
// HTML namespace.
|
|
462
|
-
const
|
|
463
|
-
/* Parsing of strict XHTML documents */ let
|
|
464
|
-
const
|
|
465
|
-
const
|
|
466
|
-
let
|
|
467
|
-
/* Keep a reference to config to pass to hooks */ let
|
|
482
|
+
const it = addToSet({}, [ "title", "style", "font", "a", "script" ]);
|
|
483
|
+
/* Parsing of strict XHTML documents */ let rt = null;
|
|
484
|
+
const at = [ "application/xhtml+xml", "text/html" ];
|
|
485
|
+
const lt = "text/html";
|
|
486
|
+
let st = null;
|
|
487
|
+
/* Keep a reference to config to pass to hooks */ let ct = null;
|
|
468
488
|
/* Ideally, do not touch anything below this line */
|
|
469
|
-
/* ______________________________________________ */ const
|
|
470
|
-
const
|
|
489
|
+
/* ______________________________________________ */ const ft = n.createElement("form");
|
|
490
|
+
const ut = function isRegexOrFunction(e) {
|
|
471
491
|
return e instanceof RegExp || e instanceof Function;
|
|
472
492
|
};
|
|
473
493
|
/**
|
|
@@ -476,132 +496,140 @@ function createDOMPurify() {
|
|
|
476
496
|
* @param cfg optional config literal
|
|
477
497
|
*/
|
|
478
498
|
// eslint-disable-next-line complexity
|
|
479
|
-
const
|
|
499
|
+
const pt = function _parseConfig() {
|
|
480
500
|
let e = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
481
|
-
if (
|
|
501
|
+
if (ct && ct === e) {
|
|
482
502
|
return;
|
|
483
503
|
}
|
|
484
504
|
/* Shield configuration object from tampering */ if (!e || typeof e !== "object") {
|
|
485
505
|
e = {};
|
|
486
506
|
}
|
|
487
507
|
/* Shield configuration object from prototype pollution */ e = clone(e);
|
|
488
|
-
|
|
508
|
+
rt =
|
|
489
509
|
// eslint-disable-next-line unicorn/prefer-includes
|
|
490
|
-
|
|
510
|
+
at.indexOf(e.PARSER_MEDIA_TYPE) === -1 ? lt : e.PARSER_MEDIA_TYPE;
|
|
491
511
|
// HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
|
|
492
|
-
|
|
493
|
-
/* Set configuration parameters */ ye =
|
|
494
|
-
|
|
495
|
-
|
|
496
|
-
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
500
|
-
ke =
|
|
501
|
-
Be =
|
|
502
|
-
|
|
512
|
+
st = rt === "application/xhtml+xml" ? h : g;
|
|
513
|
+
/* Set configuration parameters */ ye = x(e, "ALLOWED_TAGS") ? addToSet({}, e.ALLOWED_TAGS, st) : be;
|
|
514
|
+
Te = x(e, "ALLOWED_ATTR") ? addToSet({}, e.ALLOWED_ATTR, st) : we;
|
|
515
|
+
et = x(e, "ALLOWED_NAMESPACES") ? addToSet({}, e.ALLOWED_NAMESPACES, h) : tt;
|
|
516
|
+
Xe = x(e, "ADD_URI_SAFE_ATTR") ? addToSet(clone($e), e.ADD_URI_SAFE_ATTR, st) : $e;
|
|
517
|
+
qe = x(e, "ADD_DATA_URI_TAGS") ? addToSet(clone(Ye), e.ADD_DATA_URI_TAGS, st) : Ye;
|
|
518
|
+
Ge = x(e, "FORBID_CONTENTS") ? addToSet({}, e.FORBID_CONTENTS, st) : We;
|
|
519
|
+
Se = x(e, "FORBID_TAGS") ? addToSet({}, e.FORBID_TAGS, st) : clone({});
|
|
520
|
+
ke = x(e, "FORBID_ATTR") ? addToSet({}, e.FORBID_ATTR, st) : clone({});
|
|
521
|
+
Be = x(e, "USE_PROFILES") ? e.USE_PROFILES : false;
|
|
522
|
+
ve = e.ALLOW_ARIA_ATTR !== false;
|
|
503
523
|
// Default true
|
|
504
|
-
|
|
524
|
+
Ae = e.ALLOW_DATA_ATTR !== false;
|
|
505
525
|
// Default true
|
|
506
|
-
|
|
526
|
+
Ee = e.ALLOW_UNKNOWN_PROTOCOLS || false;
|
|
507
527
|
// Default false
|
|
508
|
-
|
|
528
|
+
Re = e.ALLOW_SELF_CLOSE_IN_ATTR !== false;
|
|
509
529
|
// Default true
|
|
510
|
-
|
|
530
|
+
Oe = e.SAFE_FOR_TEMPLATES || false;
|
|
511
531
|
// Default false
|
|
512
532
|
De = e.SAFE_FOR_XML !== false;
|
|
513
533
|
// Default true
|
|
514
|
-
|
|
534
|
+
Me = e.WHOLE_DOCUMENT || false;
|
|
515
535
|
// Default false
|
|
516
|
-
|
|
536
|
+
Ie = e.RETURN_DOM || false;
|
|
517
537
|
// Default false
|
|
518
|
-
|
|
538
|
+
Ne = e.RETURN_DOM_FRAGMENT || false;
|
|
519
539
|
// Default false
|
|
520
|
-
|
|
540
|
+
Fe = e.RETURN_TRUSTED_TYPE || false;
|
|
521
541
|
// Default false
|
|
522
|
-
|
|
542
|
+
Le = e.FORCE_BODY || false;
|
|
523
543
|
// Default false
|
|
524
544
|
Pe = e.SANITIZE_DOM !== false;
|
|
525
545
|
// Default true
|
|
526
|
-
|
|
546
|
+
Ce = e.SANITIZE_NAMED_PROPS || false;
|
|
527
547
|
// Default false
|
|
528
|
-
|
|
548
|
+
Ue = e.KEEP_CONTENT !== false;
|
|
529
549
|
// Default true
|
|
530
|
-
|
|
550
|
+
je = e.IN_PLACE || false;
|
|
531
551
|
// Default false
|
|
532
552
|
he = e.ALLOWED_URI_REGEXP || U;
|
|
533
|
-
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
537
|
-
if (e.CUSTOM_ELEMENT_HANDLING &&
|
|
538
|
-
|
|
553
|
+
Qe = e.NAMESPACE || Je;
|
|
554
|
+
nt = e.MATHML_TEXT_INTEGRATION_POINTS || nt;
|
|
555
|
+
ot = e.HTML_INTEGRATION_POINTS || ot;
|
|
556
|
+
xe = e.CUSTOM_ELEMENT_HANDLING || {};
|
|
557
|
+
if (e.CUSTOM_ELEMENT_HANDLING && ut(e.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
|
|
558
|
+
xe.tagNameCheck = e.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
|
|
539
559
|
}
|
|
540
|
-
if (e.CUSTOM_ELEMENT_HANDLING &&
|
|
541
|
-
|
|
560
|
+
if (e.CUSTOM_ELEMENT_HANDLING && ut(e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
|
|
561
|
+
xe.attributeNameCheck = e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
|
|
542
562
|
}
|
|
543
563
|
if (e.CUSTOM_ELEMENT_HANDLING && typeof e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === "boolean") {
|
|
544
|
-
|
|
564
|
+
xe.allowCustomizedBuiltInElements = e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
|
|
545
565
|
}
|
|
546
|
-
if (
|
|
547
|
-
|
|
566
|
+
if (Oe) {
|
|
567
|
+
Ae = false;
|
|
548
568
|
}
|
|
549
|
-
if (
|
|
550
|
-
|
|
569
|
+
if (Ne) {
|
|
570
|
+
Ie = true;
|
|
551
571
|
}
|
|
552
572
|
/* Parse profile info */ if (Be) {
|
|
553
|
-
ye = addToSet({},
|
|
554
|
-
|
|
573
|
+
ye = addToSet({}, D);
|
|
574
|
+
Te = [];
|
|
555
575
|
if (Be.html === true) {
|
|
556
576
|
addToSet(ye, _);
|
|
557
|
-
addToSet(
|
|
577
|
+
addToSet(Te, M);
|
|
558
578
|
}
|
|
559
579
|
if (Be.svg === true) {
|
|
560
580
|
addToSet(ye, v);
|
|
561
|
-
addToSet(
|
|
562
|
-
addToSet(
|
|
581
|
+
addToSet(Te, z);
|
|
582
|
+
addToSet(Te, I);
|
|
563
583
|
}
|
|
564
584
|
if (Be.svgFilters === true) {
|
|
565
585
|
addToSet(ye, A);
|
|
566
|
-
addToSet(
|
|
567
|
-
addToSet(
|
|
586
|
+
addToSet(Te, z);
|
|
587
|
+
addToSet(Te, I);
|
|
568
588
|
}
|
|
569
589
|
if (Be.mathMl === true) {
|
|
570
590
|
addToSet(ye, R);
|
|
571
|
-
addToSet(
|
|
572
|
-
addToSet(
|
|
591
|
+
addToSet(Te, L);
|
|
592
|
+
addToSet(Te, I);
|
|
573
593
|
}
|
|
574
594
|
}
|
|
575
595
|
/* Merge configuration parameters */ if (e.ADD_TAGS) {
|
|
576
|
-
if (
|
|
577
|
-
|
|
596
|
+
if (typeof e.ADD_TAGS === "function") {
|
|
597
|
+
_e.tagCheck = e.ADD_TAGS;
|
|
598
|
+
} else {
|
|
599
|
+
if (ye === be) {
|
|
600
|
+
ye = clone(ye);
|
|
601
|
+
}
|
|
602
|
+
addToSet(ye, e.ADD_TAGS, st);
|
|
578
603
|
}
|
|
579
|
-
addToSet(ye, e.ADD_TAGS, lt);
|
|
580
604
|
}
|
|
581
605
|
if (e.ADD_ATTR) {
|
|
582
|
-
if (
|
|
583
|
-
|
|
606
|
+
if (typeof e.ADD_ATTR === "function") {
|
|
607
|
+
_e.attributeCheck = e.ADD_ATTR;
|
|
608
|
+
} else {
|
|
609
|
+
if (Te === we) {
|
|
610
|
+
Te = clone(Te);
|
|
611
|
+
}
|
|
612
|
+
addToSet(Te, e.ADD_ATTR, st);
|
|
584
613
|
}
|
|
585
|
-
addToSet(be, e.ADD_ATTR, lt);
|
|
586
614
|
}
|
|
587
615
|
if (e.ADD_URI_SAFE_ATTR) {
|
|
588
|
-
addToSet(
|
|
616
|
+
addToSet(Xe, e.ADD_URI_SAFE_ATTR, st);
|
|
589
617
|
}
|
|
590
618
|
if (e.FORBID_CONTENTS) {
|
|
591
|
-
if (
|
|
592
|
-
|
|
619
|
+
if (Ge === We) {
|
|
620
|
+
Ge = clone(Ge);
|
|
593
621
|
}
|
|
594
|
-
addToSet(
|
|
622
|
+
addToSet(Ge, e.FORBID_CONTENTS, st);
|
|
595
623
|
}
|
|
596
|
-
/* Add #text in case KEEP_CONTENT is set to true */ if (
|
|
624
|
+
/* Add #text in case KEEP_CONTENT is set to true */ if (Ue) {
|
|
597
625
|
ye["#text"] = true;
|
|
598
626
|
}
|
|
599
|
-
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */ if (
|
|
627
|
+
/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */ if (Me) {
|
|
600
628
|
addToSet(ye, [ "html", "head", "body" ]);
|
|
601
629
|
}
|
|
602
630
|
/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */ if (ye.table) {
|
|
603
631
|
addToSet(ye, [ "tbody" ]);
|
|
604
|
-
delete
|
|
632
|
+
delete Se.tbody;
|
|
605
633
|
}
|
|
606
634
|
if (e.TRUSTED_TYPES_POLICY) {
|
|
607
635
|
if (typeof e.TRUSTED_TYPES_POLICY.createHTML !== "function") {
|
|
@@ -617,7 +645,7 @@ function createDOMPurify() {
|
|
|
617
645
|
} else {
|
|
618
646
|
// Uninitialized policy, attempt to initialize the internal dompurify policy.
|
|
619
647
|
if (ee === undefined) {
|
|
620
|
-
ee = $(
|
|
648
|
+
ee = $(j, i);
|
|
621
649
|
}
|
|
622
650
|
// If creating the internal policy succeeded sign internal variables.
|
|
623
651
|
if (ee !== null && typeof te === "string") {
|
|
@@ -629,81 +657,81 @@ function createDOMPurify() {
|
|
|
629
657
|
if (r) {
|
|
630
658
|
r(e);
|
|
631
659
|
}
|
|
632
|
-
|
|
660
|
+
ct = e;
|
|
633
661
|
};
|
|
634
662
|
/* Keep track of all possible SVG and MathML tags
|
|
635
663
|
* so that we can perform the namespace checks
|
|
636
664
|
* correctly. */ const dt = addToSet({}, [ ...v, ...A, ...E ]);
|
|
637
|
-
const
|
|
665
|
+
const mt = addToSet({}, [ ...R, ...O ]);
|
|
638
666
|
/**
|
|
639
667
|
* @param element a DOM element whose namespace is being checked
|
|
640
668
|
* @returns Return false if the element has a
|
|
641
669
|
* namespace that a spec-compliant parser would never
|
|
642
670
|
* return. Return true otherwise.
|
|
643
|
-
*/ const
|
|
671
|
+
*/ const gt = function _checkValidNamespace(e) {
|
|
644
672
|
let t = Z(e);
|
|
645
673
|
// In JSDOM, if we're inside shadow DOM, then parentNode
|
|
646
674
|
// can be null. We just simulate parent in this case.
|
|
647
675
|
if (!t || !t.tagName) {
|
|
648
676
|
t = {
|
|
649
|
-
namespaceURI:
|
|
677
|
+
namespaceURI: Qe,
|
|
650
678
|
tagName: "template"
|
|
651
679
|
};
|
|
652
680
|
}
|
|
653
681
|
const n = g(e.tagName);
|
|
654
682
|
const o = g(t.tagName);
|
|
655
|
-
if (!
|
|
683
|
+
if (!et[e.namespaceURI]) {
|
|
656
684
|
return false;
|
|
657
685
|
}
|
|
658
|
-
if (e.namespaceURI ===
|
|
686
|
+
if (e.namespaceURI === Ke) {
|
|
659
687
|
// The only way to switch from HTML namespace to SVG
|
|
660
688
|
// is via <svg>. If it happens via any other tag, then
|
|
661
689
|
// it should be killed.
|
|
662
|
-
if (t.namespaceURI ===
|
|
690
|
+
if (t.namespaceURI === Je) {
|
|
663
691
|
return n === "svg";
|
|
664
692
|
}
|
|
665
693
|
// The only way to switch from MathML to SVG is via`
|
|
666
694
|
// svg if parent is either <annotation-xml> or MathML
|
|
667
695
|
// text integration points.
|
|
668
|
-
if (t.namespaceURI ===
|
|
669
|
-
return n === "svg" && (o === "annotation-xml" ||
|
|
696
|
+
if (t.namespaceURI === Ve) {
|
|
697
|
+
return n === "svg" && (o === "annotation-xml" || nt[o]);
|
|
670
698
|
}
|
|
671
699
|
// We only allow elements that are defined in SVG
|
|
672
700
|
// spec. All others are disallowed in SVG namespace.
|
|
673
701
|
return Boolean(dt[n]);
|
|
674
702
|
}
|
|
675
|
-
if (e.namespaceURI ===
|
|
703
|
+
if (e.namespaceURI === Ve) {
|
|
676
704
|
// The only way to switch from HTML namespace to MathML
|
|
677
705
|
// is via <math>. If it happens via any other tag, then
|
|
678
706
|
// it should be killed.
|
|
679
|
-
if (t.namespaceURI ===
|
|
707
|
+
if (t.namespaceURI === Je) {
|
|
680
708
|
return n === "math";
|
|
681
709
|
}
|
|
682
710
|
// The only way to switch from SVG to MathML is via
|
|
683
711
|
// <math> and HTML integration points
|
|
684
|
-
if (t.namespaceURI ===
|
|
685
|
-
return n === "math" &&
|
|
712
|
+
if (t.namespaceURI === Ke) {
|
|
713
|
+
return n === "math" && ot[o];
|
|
686
714
|
}
|
|
687
715
|
// We only allow elements that are defined in MathML
|
|
688
716
|
// spec. All others are disallowed in MathML namespace.
|
|
689
|
-
return Boolean(
|
|
717
|
+
return Boolean(mt[n]);
|
|
690
718
|
}
|
|
691
|
-
if (e.namespaceURI ===
|
|
719
|
+
if (e.namespaceURI === Je) {
|
|
692
720
|
// The only way to switch from SVG to HTML is via
|
|
693
721
|
// HTML integration points, and from MathML to HTML
|
|
694
722
|
// is via MathML text integration points
|
|
695
|
-
if (t.namespaceURI ===
|
|
723
|
+
if (t.namespaceURI === Ke && !ot[o]) {
|
|
696
724
|
return false;
|
|
697
725
|
}
|
|
698
|
-
if (t.namespaceURI ===
|
|
726
|
+
if (t.namespaceURI === Ve && !nt[o]) {
|
|
699
727
|
return false;
|
|
700
728
|
}
|
|
701
729
|
// We disallow tags that are specific for MathML
|
|
702
730
|
// or SVG and should never appear in HTML namespace
|
|
703
|
-
return !
|
|
731
|
+
return !mt[n] && (it[n] || !dt[n]);
|
|
704
732
|
}
|
|
705
733
|
// For XHTML and XML documents that support custom namespaces
|
|
706
|
-
if (
|
|
734
|
+
if (rt === "application/xhtml+xml" && et[e.namespaceURI]) {
|
|
707
735
|
return true;
|
|
708
736
|
}
|
|
709
737
|
// The code should never reach this place (this means
|
|
@@ -716,8 +744,8 @@ function createDOMPurify() {
|
|
|
716
744
|
* _forceRemove
|
|
717
745
|
*
|
|
718
746
|
* @param node a DOM node
|
|
719
|
-
*/ const
|
|
720
|
-
|
|
747
|
+
*/ const ht = function _forceRemove(e) {
|
|
748
|
+
d(DOMPurify.removed, {
|
|
721
749
|
element: e
|
|
722
750
|
});
|
|
723
751
|
try {
|
|
@@ -732,14 +760,14 @@ function createDOMPurify() {
|
|
|
732
760
|
*
|
|
733
761
|
* @param name an Attribute name
|
|
734
762
|
* @param element a DOM node
|
|
735
|
-
*/ const
|
|
763
|
+
*/ const yt = function _removeAttribute(e, t) {
|
|
736
764
|
try {
|
|
737
|
-
|
|
765
|
+
d(DOMPurify.removed, {
|
|
738
766
|
attribute: t.getAttributeNode(e),
|
|
739
767
|
from: t
|
|
740
768
|
});
|
|
741
769
|
} catch (e) {
|
|
742
|
-
|
|
770
|
+
d(DOMPurify.removed, {
|
|
743
771
|
attribute: null,
|
|
744
772
|
from: t
|
|
745
773
|
});
|
|
@@ -747,9 +775,9 @@ function createDOMPurify() {
|
|
|
747
775
|
t.removeAttribute(e);
|
|
748
776
|
// We void attribute values for unremovable "is" attributes
|
|
749
777
|
if (e === "is") {
|
|
750
|
-
if (
|
|
778
|
+
if (Ie || Ne) {
|
|
751
779
|
try {
|
|
752
|
-
|
|
780
|
+
ht(t);
|
|
753
781
|
} catch (e) {}
|
|
754
782
|
} else {
|
|
755
783
|
try {
|
|
@@ -763,18 +791,18 @@ function createDOMPurify() {
|
|
|
763
791
|
*
|
|
764
792
|
* @param dirty - a string of dirty markup
|
|
765
793
|
* @return a DOM, filled with the dirty markup
|
|
766
|
-
*/ const
|
|
794
|
+
*/ const bt = function _initDocument(e) {
|
|
767
795
|
/* Create a HTML document */
|
|
768
796
|
let t = null;
|
|
769
797
|
let o = null;
|
|
770
|
-
if (
|
|
798
|
+
if (Le) {
|
|
771
799
|
e = "<remove></remove>" + e;
|
|
772
800
|
} else {
|
|
773
801
|
/* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
|
|
774
802
|
const t = y(e, /^[\r\n\t ]+/);
|
|
775
803
|
o = t && t[0];
|
|
776
804
|
}
|
|
777
|
-
if (
|
|
805
|
+
if (rt === "application/xhtml+xml" && Qe === Je) {
|
|
778
806
|
// Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
|
|
779
807
|
e = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + e + "</body></html>";
|
|
780
808
|
}
|
|
@@ -782,15 +810,15 @@ function createDOMPurify() {
|
|
|
782
810
|
/*
|
|
783
811
|
* Use the DOMParser API by default, fallback later if needs be
|
|
784
812
|
* DOMParser not work for svg when has multiple root element.
|
|
785
|
-
*/ if (
|
|
813
|
+
*/ if (Qe === Je) {
|
|
786
814
|
try {
|
|
787
|
-
t = (new H).parseFromString(i,
|
|
815
|
+
t = (new H).parseFromString(i, rt);
|
|
788
816
|
} catch (e) {}
|
|
789
817
|
}
|
|
790
818
|
/* Use createHTMLDocument in case DOMParser is not available */ if (!t || !t.documentElement) {
|
|
791
|
-
t = ne.createDocument(
|
|
819
|
+
t = ne.createDocument(Qe, "template", null);
|
|
792
820
|
try {
|
|
793
|
-
t.documentElement.innerHTML =
|
|
821
|
+
t.documentElement.innerHTML = Ze ? te : i;
|
|
794
822
|
} catch (e) {
|
|
795
823
|
// Syntax error if dirtyPayload is invalid xml
|
|
796
824
|
}
|
|
@@ -799,10 +827,10 @@ function createDOMPurify() {
|
|
|
799
827
|
if (e && o) {
|
|
800
828
|
r.insertBefore(n.createTextNode(o), r.childNodes[0] || null);
|
|
801
829
|
}
|
|
802
|
-
/* Work on whole document or just its body */ if (
|
|
803
|
-
return re.call(t,
|
|
830
|
+
/* Work on whole document or just its body */ if (Qe === Je) {
|
|
831
|
+
return re.call(t, Me ? "html" : "body")[0];
|
|
804
832
|
}
|
|
805
|
-
return
|
|
833
|
+
return Me ? t.documentElement : r;
|
|
806
834
|
};
|
|
807
835
|
/**
|
|
808
836
|
* Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
|
|
@@ -812,27 +840,27 @@ function createDOMPurify() {
|
|
|
812
840
|
*/ const Tt = function _createNodeIterator(e) {
|
|
813
841
|
return oe.call(e.ownerDocument || e, e,
|
|
814
842
|
// eslint-disable-next-line no-bitwise
|
|
815
|
-
|
|
843
|
+
F.SHOW_ELEMENT | F.SHOW_COMMENT | F.SHOW_TEXT | F.SHOW_PROCESSING_INSTRUCTION | F.SHOW_CDATA_SECTION, null);
|
|
816
844
|
};
|
|
817
845
|
/**
|
|
818
846
|
* _isClobbered
|
|
819
847
|
*
|
|
820
848
|
* @param element element to check for clobbering attacks
|
|
821
849
|
* @return true if clobbered, false if safe
|
|
822
|
-
*/ const
|
|
823
|
-
return e instanceof C && (typeof e.nodeName !== "string" || typeof e.textContent !== "string" || typeof e.removeChild !== "function" || !(e.attributes instanceof
|
|
850
|
+
*/ const wt = function _isClobbered(e) {
|
|
851
|
+
return e instanceof C && (typeof e.nodeName !== "string" || typeof e.textContent !== "string" || typeof e.removeChild !== "function" || !(e.attributes instanceof P) || typeof e.removeAttribute !== "function" || typeof e.setAttribute !== "function" || typeof e.namespaceURI !== "string" || typeof e.insertBefore !== "function" || typeof e.hasChildNodes !== "function");
|
|
824
852
|
};
|
|
825
853
|
/**
|
|
826
854
|
* Checks whether the given object is a DOM node.
|
|
827
855
|
*
|
|
828
856
|
* @param value object to check whether it's a DOM node
|
|
829
857
|
* @return true is object is a DOM node
|
|
830
|
-
*/ const
|
|
858
|
+
*/ const xt = function _isNode(e) {
|
|
831
859
|
return typeof c === "function" && e instanceof c;
|
|
832
860
|
};
|
|
833
861
|
function _executeHooks(e, t, n) {
|
|
834
862
|
f(e, (e => {
|
|
835
|
-
e.call(DOMPurify, t, n,
|
|
863
|
+
e.call(DOMPurify, t, n, ct);
|
|
836
864
|
}));
|
|
837
865
|
}
|
|
838
866
|
/**
|
|
@@ -843,41 +871,41 @@ function createDOMPurify() {
|
|
|
843
871
|
* @protect removeChild
|
|
844
872
|
* @param currentNode to check for permission to exist
|
|
845
873
|
* @return true if node was killed, false if left alive
|
|
846
|
-
*/ const
|
|
874
|
+
*/ const St = function _sanitizeElements(e) {
|
|
847
875
|
let t = null;
|
|
848
876
|
/* Execute a hook if present */ _executeHooks(le.beforeSanitizeElements, e, null);
|
|
849
|
-
/* Check if element is clobbered or can clobber */ if (
|
|
850
|
-
|
|
877
|
+
/* Check if element is clobbered or can clobber */ if (wt(e)) {
|
|
878
|
+
ht(e);
|
|
851
879
|
return true;
|
|
852
880
|
}
|
|
853
|
-
/* Now let's check the element's type and name */ const n =
|
|
881
|
+
/* Now let's check the element's type and name */ const n = st(e.nodeName);
|
|
854
882
|
/* Execute a hook if present */ _executeHooks(le.uponSanitizeElement, e, {
|
|
855
883
|
tagName: n,
|
|
856
884
|
allowedTags: ye
|
|
857
885
|
});
|
|
858
|
-
/* Detect mXSS attempts abusing namespace confusion */ if (De && e.hasChildNodes() && !
|
|
859
|
-
|
|
886
|
+
/* Detect mXSS attempts abusing namespace confusion */ if (De && e.hasChildNodes() && !xt(e.firstElementChild) && S(/<[/\w!]/g, e.innerHTML) && S(/<[/\w!]/g, e.textContent)) {
|
|
887
|
+
ht(e);
|
|
860
888
|
return true;
|
|
861
889
|
}
|
|
862
890
|
/* Remove any occurrence of processing instructions */ if (e.nodeType === Y.progressingInstruction) {
|
|
863
|
-
|
|
891
|
+
ht(e);
|
|
864
892
|
return true;
|
|
865
893
|
}
|
|
866
|
-
/* Remove any kind of possibly harmful comments */ if (De && e.nodeType === Y.comment &&
|
|
867
|
-
|
|
894
|
+
/* Remove any kind of possibly harmful comments */ if (De && e.nodeType === Y.comment && S(/<[/\w]/g, e.data)) {
|
|
895
|
+
ht(e);
|
|
868
896
|
return true;
|
|
869
897
|
}
|
|
870
|
-
/* Remove element if anything forbids its presence */ if (!ye[n] ||
|
|
898
|
+
/* Remove element if anything forbids its presence */ if (!(_e.tagCheck instanceof Function && _e.tagCheck(n)) && (!ye[n] || Se[n])) {
|
|
871
899
|
/* Check if we have a custom element to handle */
|
|
872
|
-
if (!
|
|
873
|
-
if (
|
|
900
|
+
if (!Se[n] && _t(n)) {
|
|
901
|
+
if (xe.tagNameCheck instanceof RegExp && S(xe.tagNameCheck, n)) {
|
|
874
902
|
return false;
|
|
875
903
|
}
|
|
876
|
-
if (
|
|
904
|
+
if (xe.tagNameCheck instanceof Function && xe.tagNameCheck(n)) {
|
|
877
905
|
return false;
|
|
878
906
|
}
|
|
879
907
|
}
|
|
880
|
-
/* Keep content except for bad-listed elements */ if (
|
|
908
|
+
/* Keep content except for bad-listed elements */ if (Ue && !Ge[n]) {
|
|
881
909
|
const t = Z(e) || e.parentNode;
|
|
882
910
|
const n = Q(e) || e.childNodes;
|
|
883
911
|
if (n && t) {
|
|
@@ -889,25 +917,25 @@ function createDOMPurify() {
|
|
|
889
917
|
}
|
|
890
918
|
}
|
|
891
919
|
}
|
|
892
|
-
|
|
920
|
+
ht(e);
|
|
893
921
|
return true;
|
|
894
922
|
}
|
|
895
|
-
/* Check whether element has a valid namespace */ if (e instanceof N && !
|
|
896
|
-
|
|
923
|
+
/* Check whether element has a valid namespace */ if (e instanceof N && !gt(e)) {
|
|
924
|
+
ht(e);
|
|
897
925
|
return true;
|
|
898
926
|
}
|
|
899
|
-
/* Make sure that older browsers don't get fallback-tag mXSS */ if ((n === "noscript" || n === "noembed" || n === "noframes") &&
|
|
900
|
-
|
|
927
|
+
/* Make sure that older browsers don't get fallback-tag mXSS */ if ((n === "noscript" || n === "noembed" || n === "noframes") && S(/<\/no(script|embed|frames)/i, e.innerHTML)) {
|
|
928
|
+
ht(e);
|
|
901
929
|
return true;
|
|
902
930
|
}
|
|
903
|
-
/* Sanitize element content to be template-safe */ if (
|
|
931
|
+
/* Sanitize element content to be template-safe */ if (Oe && e.nodeType === Y.text) {
|
|
904
932
|
/* Get the element's text content */
|
|
905
933
|
t = e.textContent;
|
|
906
934
|
f([ se, ce, fe ], (e => {
|
|
907
|
-
t =
|
|
935
|
+
t = b(t, e, " ");
|
|
908
936
|
}));
|
|
909
937
|
if (e.textContent !== t) {
|
|
910
|
-
|
|
938
|
+
d(DOMPurify.removed, {
|
|
911
939
|
element: e.cloneNode()
|
|
912
940
|
});
|
|
913
941
|
e.textContent = t;
|
|
@@ -925,26 +953,26 @@ function createDOMPurify() {
|
|
|
925
953
|
* @return Returns true if `value` is valid, otherwise false.
|
|
926
954
|
*/
|
|
927
955
|
// eslint-disable-next-line complexity
|
|
928
|
-
const
|
|
956
|
+
const kt = function _isValidAttribute(e, t, o) {
|
|
929
957
|
/* Make sure attribute cannot clobber */
|
|
930
|
-
if (Pe && (t === "id" || t === "name") && (o in n || o in
|
|
958
|
+
if (Pe && (t === "id" || t === "name") && (o in n || o in ft)) {
|
|
931
959
|
return false;
|
|
932
960
|
}
|
|
933
961
|
/* Allow valid data-* attributes: At least one character after "-"
|
|
934
962
|
(https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
|
|
935
963
|
XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
|
|
936
|
-
We don't need to check the value; it's always URI safe. */ if (
|
|
964
|
+
We don't need to check the value; it's always URI safe. */ if (Ae && !ke[t] && S(ue, t)) ; else if (ve && S(pe, t)) ; else if (_e.attributeCheck instanceof Function && _e.attributeCheck(t, e)) ; else if (!Te[t] || ke[t]) {
|
|
937
965
|
if (
|
|
938
966
|
// First condition does a very basic check if a) it's basically a valid custom element tagname AND
|
|
939
967
|
// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
940
968
|
// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
|
|
941
|
-
|
|
969
|
+
_t(e) && (xe.tagNameCheck instanceof RegExp && S(xe.tagNameCheck, e) || xe.tagNameCheck instanceof Function && xe.tagNameCheck(e)) && (xe.attributeNameCheck instanceof RegExp && S(xe.attributeNameCheck, t) || xe.attributeNameCheck instanceof Function && xe.attributeNameCheck(t, e)) ||
|
|
942
970
|
// Alternative, second condition checks if it's an `is`-attribute, AND
|
|
943
971
|
// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
|
|
944
|
-
t === "is" &&
|
|
972
|
+
t === "is" && xe.allowCustomizedBuiltInElements && (xe.tagNameCheck instanceof RegExp && S(xe.tagNameCheck, o) || xe.tagNameCheck instanceof Function && xe.tagNameCheck(o))) ; else {
|
|
945
973
|
return false;
|
|
946
974
|
}
|
|
947
|
-
/* Check value is safe. First, is attr inert? If so, is safe */ } else if (
|
|
975
|
+
/* Check value is safe. First, is attr inert? If so, is safe */ } else if (Xe[t]) ; else if (S(he, b(o, me, ""))) ; else if ((t === "src" || t === "xlink:href" || t === "href") && e !== "script" && T(o, "data:") === 0 && qe[e]) ; else if (Ee && !S(de, b(o, me, ""))) ; else if (o) {
|
|
948
976
|
return false;
|
|
949
977
|
} else ;
|
|
950
978
|
return true;
|
|
@@ -956,7 +984,7 @@ function createDOMPurify() {
|
|
|
956
984
|
*
|
|
957
985
|
* @param tagName name of the tag of the node to sanitize
|
|
958
986
|
* @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
|
|
959
|
-
*/ const
|
|
987
|
+
*/ const _t = function _isBasicCustomElement(e) {
|
|
960
988
|
return e !== "annotation-xml" && y(e, ge);
|
|
961
989
|
};
|
|
962
990
|
/**
|
|
@@ -968,27 +996,27 @@ function createDOMPurify() {
|
|
|
968
996
|
* @protect setAttribute
|
|
969
997
|
*
|
|
970
998
|
* @param currentNode to sanitize
|
|
971
|
-
*/ const
|
|
999
|
+
*/ const vt = function _sanitizeAttributes(e) {
|
|
972
1000
|
/* Execute a hook if present */
|
|
973
1001
|
_executeHooks(le.beforeSanitizeAttributes, e, null);
|
|
974
1002
|
const {attributes: t} = e;
|
|
975
|
-
/* Check if we have attributes; if not we might have a text node */ if (!t ||
|
|
1003
|
+
/* Check if we have attributes; if not we might have a text node */ if (!t || wt(e)) {
|
|
976
1004
|
return;
|
|
977
1005
|
}
|
|
978
1006
|
const n = {
|
|
979
1007
|
attrName: "",
|
|
980
1008
|
attrValue: "",
|
|
981
1009
|
keepAttr: true,
|
|
982
|
-
allowedAttributes:
|
|
1010
|
+
allowedAttributes: Te,
|
|
983
1011
|
forceKeepAttr: undefined
|
|
984
1012
|
};
|
|
985
1013
|
let o = t.length;
|
|
986
1014
|
/* Go backwards over all attributes; safely remove bad ones */ while (o--) {
|
|
987
1015
|
const i = t[o];
|
|
988
1016
|
const {name: r, namespaceURI: a, value: l} = i;
|
|
989
|
-
const s =
|
|
1017
|
+
const s = st(r);
|
|
990
1018
|
const c = l;
|
|
991
|
-
let u = r === "value" ? c :
|
|
1019
|
+
let u = r === "value" ? c : w(c);
|
|
992
1020
|
/* Execute a hook if present */ n.attrName = s;
|
|
993
1021
|
n.attrValue = u;
|
|
994
1022
|
n.keepAttr = true;
|
|
@@ -998,40 +1026,44 @@ function createDOMPurify() {
|
|
|
998
1026
|
u = n.attrValue;
|
|
999
1027
|
/* Full DOM Clobbering protection via namespace isolation,
|
|
1000
1028
|
* Prefix id and name attributes with `user-content-`
|
|
1001
|
-
*/ if (
|
|
1029
|
+
*/ if (Ce && (s === "id" || s === "name")) {
|
|
1002
1030
|
// Remove the attribute with this value
|
|
1003
|
-
|
|
1031
|
+
yt(r, e);
|
|
1004
1032
|
// Prefix the value and later re-create the attribute with the sanitized value
|
|
1005
|
-
u =
|
|
1033
|
+
u = He + u;
|
|
1034
|
+
}
|
|
1035
|
+
/* Work around a security issue with comments inside attributes */ if (De && S(/((--!?|])>)|<\/(style|title|textarea)/i, u)) {
|
|
1036
|
+
yt(r, e);
|
|
1037
|
+
continue;
|
|
1006
1038
|
}
|
|
1007
|
-
/*
|
|
1008
|
-
|
|
1039
|
+
/* Make sure we cannot easily use animated hrefs, even if animations are allowed */ if (s === "attributename" && y(u, "href")) {
|
|
1040
|
+
yt(r, e);
|
|
1009
1041
|
continue;
|
|
1010
1042
|
}
|
|
1011
1043
|
/* Did the hooks approve of the attribute? */ if (n.forceKeepAttr) {
|
|
1012
1044
|
continue;
|
|
1013
1045
|
}
|
|
1014
1046
|
/* Did the hooks approve of the attribute? */ if (!n.keepAttr) {
|
|
1015
|
-
|
|
1047
|
+
yt(r, e);
|
|
1016
1048
|
continue;
|
|
1017
1049
|
}
|
|
1018
|
-
/* Work around a security issue in jQuery 3.0 */ if (!
|
|
1019
|
-
|
|
1050
|
+
/* Work around a security issue in jQuery 3.0 */ if (!Re && S(/\/>/i, u)) {
|
|
1051
|
+
yt(r, e);
|
|
1020
1052
|
continue;
|
|
1021
1053
|
}
|
|
1022
|
-
/* Sanitize attribute content to be template-safe */ if (
|
|
1054
|
+
/* Sanitize attribute content to be template-safe */ if (Oe) {
|
|
1023
1055
|
f([ se, ce, fe ], (e => {
|
|
1024
|
-
u =
|
|
1056
|
+
u = b(u, e, " ");
|
|
1025
1057
|
}));
|
|
1026
1058
|
}
|
|
1027
|
-
/* Is `value` valid for this attribute? */ const
|
|
1028
|
-
if (!
|
|
1029
|
-
|
|
1059
|
+
/* Is `value` valid for this attribute? */ const d = st(e.nodeName);
|
|
1060
|
+
if (!kt(d, s, u)) {
|
|
1061
|
+
yt(r, e);
|
|
1030
1062
|
continue;
|
|
1031
1063
|
}
|
|
1032
|
-
/* Handle attributes that require Trusted Types */ if (ee && typeof
|
|
1064
|
+
/* Handle attributes that require Trusted Types */ if (ee && typeof j === "object" && typeof j.getAttributeType === "function") {
|
|
1033
1065
|
if (a) ; else {
|
|
1034
|
-
switch (
|
|
1066
|
+
switch (j.getAttributeType(d, s)) {
|
|
1035
1067
|
case "TrustedHTML":
|
|
1036
1068
|
{
|
|
1037
1069
|
u = ee.createHTML(u);
|
|
@@ -1054,13 +1086,13 @@ function createDOMPurify() {
|
|
|
1054
1086
|
/* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
|
|
1055
1087
|
e.setAttribute(r, u);
|
|
1056
1088
|
}
|
|
1057
|
-
if (
|
|
1058
|
-
|
|
1089
|
+
if (wt(e)) {
|
|
1090
|
+
ht(e);
|
|
1059
1091
|
} else {
|
|
1060
|
-
|
|
1092
|
+
p(DOMPurify.removed);
|
|
1061
1093
|
}
|
|
1062
1094
|
} catch (t) {
|
|
1063
|
-
|
|
1095
|
+
yt(r, e);
|
|
1064
1096
|
}
|
|
1065
1097
|
}
|
|
1066
1098
|
}
|
|
@@ -1070,15 +1102,15 @@ function createDOMPurify() {
|
|
|
1070
1102
|
* _sanitizeShadowDOM
|
|
1071
1103
|
*
|
|
1072
1104
|
* @param fragment to iterate over recursively
|
|
1073
|
-
*/ const
|
|
1105
|
+
*/ const At = function _sanitizeShadowDOM(e) {
|
|
1074
1106
|
let t = null;
|
|
1075
1107
|
const n = Tt(e);
|
|
1076
1108
|
/* Execute a hook if present */ _executeHooks(le.beforeSanitizeShadowDOM, e, null);
|
|
1077
1109
|
while (t = n.nextNode()) {
|
|
1078
1110
|
/* Execute a hook if present */
|
|
1079
1111
|
_executeHooks(le.uponSanitizeShadowNode, t, null);
|
|
1080
|
-
/* Sanitize tags and elements */
|
|
1081
|
-
/* Check attributes next */
|
|
1112
|
+
/* Sanitize tags and elements */ St(t);
|
|
1113
|
+
/* Check attributes next */ vt(t);
|
|
1082
1114
|
/* Deep shadow DOM detected */ if (t.content instanceof a) {
|
|
1083
1115
|
_sanitizeShadowDOM(t.content);
|
|
1084
1116
|
}
|
|
@@ -1094,11 +1126,11 @@ function createDOMPurify() {
|
|
|
1094
1126
|
let l = null;
|
|
1095
1127
|
/* Make sure we have a string to sanitize.
|
|
1096
1128
|
DO NOT return early, as this will return the wrong type if
|
|
1097
|
-
the user has requested a DOM object rather than a string */
|
|
1098
|
-
if (
|
|
1129
|
+
the user has requested a DOM object rather than a string */ Ze = !e;
|
|
1130
|
+
if (Ze) {
|
|
1099
1131
|
e = "\x3c!--\x3e";
|
|
1100
1132
|
}
|
|
1101
|
-
/* Stringify, in case dirty is an object */ if (typeof e !== "string" && !
|
|
1133
|
+
/* Stringify, in case dirty is an object */ if (typeof e !== "string" && !xt(e)) {
|
|
1102
1134
|
if (typeof e.toString === "function") {
|
|
1103
1135
|
e = e.toString();
|
|
1104
1136
|
if (typeof e !== "string") {
|
|
@@ -1111,25 +1143,25 @@ function createDOMPurify() {
|
|
|
1111
1143
|
/* Return dirty HTML if DOMPurify cannot run */ if (!DOMPurify.isSupported) {
|
|
1112
1144
|
return e;
|
|
1113
1145
|
}
|
|
1114
|
-
/* Assign config vars */ if (!
|
|
1115
|
-
|
|
1146
|
+
/* Assign config vars */ if (!ze) {
|
|
1147
|
+
pt(t);
|
|
1116
1148
|
}
|
|
1117
1149
|
/* Clean up removed elements */ DOMPurify.removed = [];
|
|
1118
1150
|
/* Check if dirty is correctly typed for IN_PLACE */ if (typeof e === "string") {
|
|
1119
|
-
|
|
1151
|
+
je = false;
|
|
1120
1152
|
}
|
|
1121
|
-
if (
|
|
1153
|
+
if (je) {
|
|
1122
1154
|
/* Do some early pre-sanitization to avoid unsafe root nodes */
|
|
1123
1155
|
if (e.nodeName) {
|
|
1124
|
-
const t =
|
|
1125
|
-
if (!ye[t] ||
|
|
1156
|
+
const t = st(e.nodeName);
|
|
1157
|
+
if (!ye[t] || Se[t]) {
|
|
1126
1158
|
throw k("root node is forbidden and cannot be sanitized in-place");
|
|
1127
1159
|
}
|
|
1128
1160
|
}
|
|
1129
1161
|
} else if (e instanceof c) {
|
|
1130
1162
|
/* If dirty is a DOM element, append to an empty document to avoid
|
|
1131
1163
|
elements being stripped by the parser */
|
|
1132
|
-
n =
|
|
1164
|
+
n = bt("\x3c!----\x3e");
|
|
1133
1165
|
i = n.ownerDocument.importNode(e, true);
|
|
1134
1166
|
if (i.nodeType === Y.element && i.nodeName === "BODY") {
|
|
1135
1167
|
/* Node is already a body, use as is */
|
|
@@ -1142,33 +1174,33 @@ function createDOMPurify() {
|
|
|
1142
1174
|
}
|
|
1143
1175
|
} else {
|
|
1144
1176
|
/* Exit directly if we have nothing to do */
|
|
1145
|
-
if (!
|
|
1177
|
+
if (!Ie && !Oe && !Me &&
|
|
1146
1178
|
// eslint-disable-next-line unicorn/prefer-includes
|
|
1147
1179
|
e.indexOf("<") === -1) {
|
|
1148
|
-
return ee &&
|
|
1180
|
+
return ee && Fe ? ee.createHTML(e) : e;
|
|
1149
1181
|
}
|
|
1150
|
-
/* Initialize the document to work on */ n =
|
|
1182
|
+
/* Initialize the document to work on */ n = bt(e);
|
|
1151
1183
|
/* Check we have a DOM node from the data */ if (!n) {
|
|
1152
|
-
return
|
|
1184
|
+
return Ie ? null : Fe ? te : "";
|
|
1153
1185
|
}
|
|
1154
1186
|
}
|
|
1155
|
-
/* Remove first element node (ours) if FORCE_BODY is set */ if (n &&
|
|
1156
|
-
|
|
1187
|
+
/* Remove first element node (ours) if FORCE_BODY is set */ if (n && Le) {
|
|
1188
|
+
ht(n.firstChild);
|
|
1157
1189
|
}
|
|
1158
|
-
/* Get node iterator */ const s = Tt(
|
|
1190
|
+
/* Get node iterator */ const s = Tt(je ? e : n);
|
|
1159
1191
|
/* Now start iterating over the created document */ while (r = s.nextNode()) {
|
|
1160
1192
|
/* Sanitize tags and elements */
|
|
1161
|
-
|
|
1162
|
-
/* Check attributes next */
|
|
1193
|
+
St(r);
|
|
1194
|
+
/* Check attributes next */ vt(r);
|
|
1163
1195
|
/* Shadow DOM detected, sanitize it */ if (r.content instanceof a) {
|
|
1164
|
-
|
|
1196
|
+
At(r.content);
|
|
1165
1197
|
}
|
|
1166
1198
|
}
|
|
1167
|
-
/* If we sanitized `dirty` in-place, return it. */ if (
|
|
1199
|
+
/* If we sanitized `dirty` in-place, return it. */ if (je) {
|
|
1168
1200
|
return e;
|
|
1169
1201
|
}
|
|
1170
|
-
/* Return sanitized string or DOM */ if (
|
|
1171
|
-
if (
|
|
1202
|
+
/* Return sanitized string or DOM */ if (Ie) {
|
|
1203
|
+
if (Ne) {
|
|
1172
1204
|
l = ie.call(n.ownerDocument);
|
|
1173
1205
|
while (n.firstChild) {
|
|
1174
1206
|
// eslint-disable-next-line unicorn/prefer-dom-node-append
|
|
@@ -1177,7 +1209,7 @@ function createDOMPurify() {
|
|
|
1177
1209
|
} else {
|
|
1178
1210
|
l = n;
|
|
1179
1211
|
}
|
|
1180
|
-
if (
|
|
1212
|
+
if (Te.shadowroot || Te.shadowrootmode) {
|
|
1181
1213
|
/*
|
|
1182
1214
|
AdoptNode() is not used because internal state is not reset
|
|
1183
1215
|
(e.g. the past names map of a HTMLFormElement), this is safe
|
|
@@ -1189,47 +1221,47 @@ function createDOMPurify() {
|
|
|
1189
1221
|
}
|
|
1190
1222
|
return l;
|
|
1191
1223
|
}
|
|
1192
|
-
let u =
|
|
1193
|
-
/* Serialize doctype if allowed */ if (
|
|
1224
|
+
let u = Me ? n.outerHTML : n.innerHTML;
|
|
1225
|
+
/* Serialize doctype if allowed */ if (Me && ye["!doctype"] && n.ownerDocument && n.ownerDocument.doctype && n.ownerDocument.doctype.name && S(G, n.ownerDocument.doctype.name)) {
|
|
1194
1226
|
u = "<!DOCTYPE " + n.ownerDocument.doctype.name + ">\n" + u;
|
|
1195
1227
|
}
|
|
1196
|
-
/* Sanitize final string template-safe */ if (
|
|
1228
|
+
/* Sanitize final string template-safe */ if (Oe) {
|
|
1197
1229
|
f([ se, ce, fe ], (e => {
|
|
1198
|
-
u =
|
|
1230
|
+
u = b(u, e, " ");
|
|
1199
1231
|
}));
|
|
1200
1232
|
}
|
|
1201
|
-
return ee &&
|
|
1233
|
+
return ee && Fe ? ee.createHTML(u) : u;
|
|
1202
1234
|
};
|
|
1203
1235
|
DOMPurify.setConfig = function() {
|
|
1204
1236
|
let e = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
|
|
1205
|
-
|
|
1206
|
-
|
|
1237
|
+
pt(e);
|
|
1238
|
+
ze = true;
|
|
1207
1239
|
};
|
|
1208
1240
|
DOMPurify.clearConfig = function() {
|
|
1209
|
-
|
|
1210
|
-
|
|
1241
|
+
ct = null;
|
|
1242
|
+
ze = false;
|
|
1211
1243
|
};
|
|
1212
1244
|
DOMPurify.isValidAttribute = function(e, t, n) {
|
|
1213
1245
|
/* Initialize shared config vars if necessary. */
|
|
1214
|
-
if (!
|
|
1215
|
-
|
|
1246
|
+
if (!ct) {
|
|
1247
|
+
pt({});
|
|
1216
1248
|
}
|
|
1217
|
-
const o =
|
|
1218
|
-
const i =
|
|
1219
|
-
return
|
|
1249
|
+
const o = st(e);
|
|
1250
|
+
const i = st(t);
|
|
1251
|
+
return kt(o, i, n);
|
|
1220
1252
|
};
|
|
1221
1253
|
DOMPurify.addHook = function(e, t) {
|
|
1222
1254
|
if (typeof t !== "function") {
|
|
1223
1255
|
return;
|
|
1224
1256
|
}
|
|
1225
|
-
|
|
1257
|
+
d(le[e], t);
|
|
1226
1258
|
};
|
|
1227
1259
|
DOMPurify.removeHook = function(e, t) {
|
|
1228
1260
|
if (t !== undefined) {
|
|
1229
1261
|
const n = u(le[e], t);
|
|
1230
1262
|
return n === -1 ? undefined : m(le[e], n, 1)[0];
|
|
1231
1263
|
}
|
|
1232
|
-
return
|
|
1264
|
+
return p(le[e]);
|
|
1233
1265
|
};
|
|
1234
1266
|
DOMPurify.removeHooks = function(e) {
|
|
1235
1267
|
le[e] = [];
|
|
@@ -1252,5 +1284,5 @@ function sanitizeHTMLString(e) {
|
|
|
1252
1284
|
}
|
|
1253
1285
|
|
|
1254
1286
|
export { sanitizeHTMLString as s };
|
|
1255
|
-
//# sourceMappingURL=sanitize-html-string-
|
|
1256
|
-
//# sourceMappingURL=sanitize-html-string-
|
|
1287
|
+
//# sourceMappingURL=sanitize-html-string-DOVERJq5.js.map
|
|
1288
|
+
//# sourceMappingURL=sanitize-html-string-DOVERJq5.js.map
|