url-sanitizer 4.1.0 → 4.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/dist/url-sanitizer-wo-dompurify.min.js +1 -1
- package/dist/url-sanitizer-wo-dompurify.min.js.map +4 -4
- package/dist/url-sanitizer.min.js +4 -4
- package/dist/url-sanitizer.min.js.map +4 -4
- package/package.json +16 -14
- package/src/lib/file/text-chars.json +1 -1
- package/src/lib/iana/uri-schemes.json +1 -1
- package/src/mjs/regexp.js +14 -3
- package/src/mjs/sanitizer.js +26 -13
- package/src/mjs/uri-util.js +132 -69
- package/types/mjs/regexp.d.ts +2 -0
- package/types/mjs/uri-util.d.ts +2 -2
- package/src/mjs/file-reader.js +0 -348
- package/types/mjs/file-reader.d.ts +0 -30
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
function
|
|
2
|
-
In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Gn(n,t){return Fn(n)||zn(n,t)||$n(n,t)||Hn()}function $n(n,t){if(n){if(typeof n=="string")return Vt(n,t);var r={}.toString.call(n).slice(8,-1);return r==="Object"&&n.constructor&&(r=n.constructor.name),r==="Map"||r==="Set"?Array.from(n):r==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r)?Vt(n,t):void 0}}var ln=Object.entries,qt=Object.setPrototypeOf,Bn=Object.isFrozen,jn=Object.getPrototypeOf,Wn=Object.getOwnPropertyDescriptor,P=Object.freeze,H=Object.seal,Ae=Object.create,cn=typeof Reflect<"u"&&Reflect,Tt=cn.apply,Et=cn.construct;P||(P=function(t){return t});H||(H=function(t){return t});Tt||(Tt=function(t,r){for(var s=arguments.length,i=new Array(s>2?s-2:0),l=2;l<s;l++)i[l-2]=arguments[l];return t.apply(r,i)});Et||(Et=function(t){for(var r=arguments.length,s=new Array(r>1?r-1:0),i=1;i<r;i++)s[i-1]=arguments[i];return new t(...s)});var Ee=O(Array.prototype.forEach),Yn=O(Array.prototype.lastIndexOf),Zt=O(Array.prototype.pop),ye=O(Array.prototype.push),Xn=O(Array.prototype.splice),U=Array.isArray,Me=O(String.prototype.toLowerCase),mt=O(String.prototype.toString),Kt=O(String.prototype.match),_e=O(String.prototype.replace),Qt=O(String.prototype.indexOf),Vn=O(String.prototype.trim),qn=O(Number.prototype.toString),Zn=O(Boolean.prototype.toString),Jt=typeof BigInt>"u"?null:O(BigInt.prototype.toString),en=typeof Symbol>"u"?null:O(Symbol.prototype.toString),y=O(Object.prototype.hasOwnProperty),De=O(Object.prototype.toString),N=O(RegExp.prototype.test),Ce=Kn(TypeError);function O(n){return function(t){t instanceof RegExp&&(t.lastIndex=0);for(var r=arguments.length,s=new Array(r>1?r-1:0),i=1;i<r;i++)s[i-1]=arguments[i];return Tt(n,t,s)}}function Kn(n){return function(){for(var t=arguments.length,r=new Array(t),s=0;s<t;s++)r[s]=arguments[s];return Et(n,r)}}function f(n,t){let r=arguments.length>2&&arguments[2]!==void 0?arguments[2]:Me;if(qt&&qt(n,null),!U(t))return n;let s=t.length;for(;s--;){let i=t[s];if(typeof i=="string"){let l=r(i);l!==i&&(Bn(t)||(t[s]=l),i=l)}n[i]=!0}return n}function Qn(n){for(let t=0;t<n.length;t++)y(n,t)||(n[t]=null);return n}function C(n){let t=Ae(null);for(let s of ln(n)){var r=Gn(s,2);let i=r[0],l=r[1];y(n,i)&&(U(l)?t[i]=Qn(l):l&&typeof l=="object"&&l.constructor===Object?t[i]=C(l):t[i]=l)}return t}function Jn(n){switch(typeof n){case"string":return n;case"number":return qn(n);case"boolean":return Zn(n);case"bigint":return Jt?Jt(n):"0";case"symbol":return en?en(n):"Symbol()";case"undefined":return De(n);case"function":case"object":{if(n===null)return De(n);let t=n,r=Q(t,"toString");if(typeof r=="function"){let s=r(t);return typeof s=="string"?s:De(s)}return De(n)}default:return De(n)}}function Q(n,t){for(;n!==null;){let s=Wn(n,t);if(s){if(s.get)return O(s.get);if(typeof s.value=="function")return O(s.value)}n=jn(n)}function r(){return null}return r}function er(n){try{return N(n,""),!0}catch{return!1}}var tn=P(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","search","section","select","shadow","slot","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),ut=P(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","enterkeyhint","exportparts","filter","font","g","glyph","glyphref","hkern","image","inputmode","line","lineargradient","marker","mask","metadata","mpath","part","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),dt=P(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feDropShadow","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),tr=P(["animate","color-profile","cursor","discard","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),ht=P(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover","mprescripts"]),nr=P(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),nn=P(["#text"]),rn=P(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","command","commandfor","controls","controlslist","coords","crossorigin","datetime","decoding","default","dir","disabled","disablepictureinpicture","disableremoteplayback","download","draggable","enctype","enterkeyhint","exportparts","face","for","headers","height","hidden","high","href","hreflang","id","inert","inputmode","integrity","ismap","kind","label","lang","list","loading","loop","low","max","maxlength","media","method","min","minlength","multiple","muted","name","nonce","noshade","novalidate","nowrap","open","optimum","part","pattern","placeholder","playsinline","popover","popovertarget","popovertargetaction","poster","preload","pubdate","radiogroup","readonly","rel","required","rev","reversed","role","rows","rowspan","spellcheck","scope","selected","shape","size","sizes","slot","span","srclang","start","src","srcset","step","style","summary","tabindex","title","translate","type","usemap","valign","value","width","wrap","xmlns"]),gt=P(["accent-height","accumulate","additive","alignment-baseline","amplitude","ascent","attributename","attributetype","azimuth","basefrequency","baseline-shift","begin","bias","by","class","clip","clippathunits","clip-path","clip-rule","color","color-interpolation","color-interpolation-filters","color-profile","color-rendering","cx","cy","d","dx","dy","diffuseconstant","direction","display","divisor","dur","edgemode","elevation","end","exponent","fill","fill-opacity","fill-rule","filter","filterunits","flood-color","flood-opacity","font-family","font-size","font-size-adjust","font-stretch","font-style","font-variant","font-weight","fx","fy","g1","g2","glyph-name","glyphref","gradientunits","gradienttransform","height","href","id","image-rendering","in","in2","intercept","k","k1","k2","k3","k4","kerning","keypoints","keysplines","keytimes","lang","lengthadjust","letter-spacing","kernelmatrix","kernelunitlength","lighting-color","local","marker-end","marker-mid","marker-start","markerheight","markerunits","markerwidth","maskcontentunits","maskunits","max","mask","mask-type","media","method","mode","min","name","numoctaves","offset","operator","opacity","order","orient","orientation","origin","overflow","paint-order","path","pathlength","patterncontentunits","patterntransform","patternunits","points","preservealpha","preserveaspectratio","primitiveunits","r","rx","ry","radius","refx","refy","repeatcount","repeatdur","restart","result","rotate","scale","seed","shape-rendering","slope","specularconstant","specularexponent","spreadmethod","startoffset","stddeviation","stitchtiles","stop-color","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-linecap","stroke-linejoin","stroke-miterlimit","stroke-opacity","stroke","stroke-width","style","surfacescale","systemlanguage","tabindex","tablevalues","targetx","targety","transform","transform-origin","text-anchor","text-decoration","text-rendering","textlength","type","u1","u2","unicode","values","viewbox","visibility","version","vert-adv-y","vert-origin-x","vert-origin-y","width","word-spacing","wrap","writing-mode","xchannelselector","ychannelselector","x","x1","x2","xmlns","y","y1","y2","z","zoomandpan"]),on=P(["accent","accentunder","align","bevelled","close","columnalign","columnlines","columnspacing","columnspan","denomalign","depth","dir","display","displaystyle","encoding","fence","frame","height","href","id","largeop","length","linethickness","lquote","lspace","mathbackground","mathcolor","mathsize","mathvariant","maxsize","minsize","movablelimits","notation","numalign","open","rowalign","rowlines","rowspacing","rowspan","rspace","rquote","scriptlevel","scriptminsize","scriptsizemultiplier","selection","separator","separators","stretchy","subscriptshift","supscriptshift","symmetric","voffset","width","xmlns"]),We=P(["xlink:href","xml:id","xlink:title","xml:space","xmlns:xlink"]),rr=H(/{{[\w\W]*|^[\w\W]*}}/g),or=H(/<%[\w\W]*|^[\w\W]*%>/g),sr=H(/\${[\w\W]*/g),ir=H(/^data-[\-\w.\u00B7-\uFFFF]+$/),ar=H(/^aria-[\-\w]+$/),sn=H(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),lr=H(/^(?:\w+script|data):/i),cr=H(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),pr=H(/^html$/i),fr=H(/^[a-z][.\w]*(-[.\w]+)+$/i),K={element:1,attribute:2,text:3,cdataSection:4,entityReference:5,entityNode:6,progressingInstruction:7,comment:8,document:9,documentType:10,documentFragment:11,notation:12},mr=function(){return typeof window>"u"?null:window},ur=function(t,r){if(typeof t!="object"||typeof t.createPolicy!="function")return null;let s=null,i="data-tt-policy-suffix";r&&r.hasAttribute(i)&&(s=r.getAttribute(i));let l="dompurify"+(s?"#"+s:"");try{return t.createPolicy(l,{createHTML(p){return p},createScriptURL(p){return p}})}catch{return console.warn("TrustedTypes policy "+l+" could not be created."),null}},an=function(){return{afterSanitizeAttributes:[],afterSanitizeElements:[],afterSanitizeShadowDOM:[],beforeSanitizeAttributes:[],beforeSanitizeElements:[],beforeSanitizeShadowDOM:[],uponSanitizeAttribute:[],uponSanitizeElement:[],uponSanitizeShadowNode:[]}};function pn(){let n=arguments.length>0&&arguments[0]!==void 0?arguments[0]:mr(),t=c=>pn(c);if(t.version="3.4.7",t.removed=[],!n||!n.document||n.document.nodeType!==K.document||!n.Element)return t.isSupported=!1,t;let r=n.document,s=r,i=s.currentScript;n.DocumentFragment;let l=n.HTMLTemplateElement,p=n.Node,d=n.Element,u=n.NodeFilter,v=n.NamedNodeMap;v===void 0&&(n.NamedNodeMap||n.MozNamedAttrMap),n.HTMLFormElement;let _=n.DOMParser,k=n.trustedTypes,L=d.prototype,G=Q(L,"cloneNode"),fe=Q(L,"remove"),g=Q(L,"nextSibling"),F=Q(L,"childNodes"),Y=Q(L,"parentNode"),ie=Q(L,"shadowRoot"),Ue=Q(L,"attributes"),D=p&&p.prototype?Q(p.prototype,"nodeType"):null,$=p&&p.prototype?Q(p.prototype,"nodeName"):null;if(typeof l=="function"){let c=r.createElement("template");c.content&&c.content.ownerDocument&&(r=c.content.ownerDocument)}let A,J="",b=r,B=b.implementation,te=b.createNodeIterator,Se=b.createDocumentFragment,me=b.getElementsByTagName,Pe=s.importNode,T=an();t.isSupported=typeof ln=="function"&&typeof Y=="function"&&B&&B.createHTMLDocument!==void 0;let X=rr,ae=or,we=sr,Ke=ir,Ln=ar,In=lr,wt=cr,Nn=fr,xt=sn,R=null,Qe=f({},[...tn,...ut,...dt,...ht,...nn]),x=null,Je=f({},[...rn,...gt,...on,...We]),S=Object.seal(Ae(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),xe=null,ke=null,ne=Object.seal(Ae(null,{tagCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeCheck:{writable:!0,configurable:!1,enumerable:!0,value:null}})),Ot=!0,et=!0,Lt=!1,It=!0,re=!1,Oe=!0,le=!1,tt=!1,nt=!1,ue=!1,Fe=!1,ze=!1,Nt=!0,Dt=!1,Ct="user-content-",rt=!0,Le=!1,de={},V=null,ot=f({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","style","svg","template","thead","title","video","xmp"]),Mt=null,vt=f({},["audio","video","img","source","image","track"]),st=null,Ut=f({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),He="http://www.w3.org/1998/Math/MathML",Ge="http://www.w3.org/2000/svg",q="http://www.w3.org/1999/xhtml",he=q,it=!1,at=null,Dn=f({},[He,Ge,q],mt),lt=f({},["mi","mo","mn","ms","mtext"]),ct=f({},["annotation-xml"]),Cn=f({},["title","style","font","a","script"]),Ie=null,Mn=["application/xhtml+xml","text/html"],vn="text/html",w=null,ge=null,Un=r.createElement("form"),Pt=function(e){return e instanceof RegExp||e instanceof Function},pt=function(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};if(ge&&ge===e)return;(!e||typeof e!="object")&&(e={}),e=C(e),Ie=Mn.indexOf(e.PARSER_MEDIA_TYPE)===-1?vn:e.PARSER_MEDIA_TYPE,w=Ie==="application/xhtml+xml"?mt:Me,R=y(e,"ALLOWED_TAGS")&&U(e.ALLOWED_TAGS)?f({},e.ALLOWED_TAGS,w):Qe,x=y(e,"ALLOWED_ATTR")&&U(e.ALLOWED_ATTR)?f({},e.ALLOWED_ATTR,w):Je,at=y(e,"ALLOWED_NAMESPACES")&&U(e.ALLOWED_NAMESPACES)?f({},e.ALLOWED_NAMESPACES,mt):Dn,st=y(e,"ADD_URI_SAFE_ATTR")&&U(e.ADD_URI_SAFE_ATTR)?f(C(Ut),e.ADD_URI_SAFE_ATTR,w):Ut,Mt=y(e,"ADD_DATA_URI_TAGS")&&U(e.ADD_DATA_URI_TAGS)?f(C(vt),e.ADD_DATA_URI_TAGS,w):vt,V=y(e,"FORBID_CONTENTS")&&U(e.FORBID_CONTENTS)?f({},e.FORBID_CONTENTS,w):ot,xe=y(e,"FORBID_TAGS")&&U(e.FORBID_TAGS)?f({},e.FORBID_TAGS,w):C({}),ke=y(e,"FORBID_ATTR")&&U(e.FORBID_ATTR)?f({},e.FORBID_ATTR,w):C({}),de=y(e,"USE_PROFILES")?e.USE_PROFILES&&typeof e.USE_PROFILES=="object"?C(e.USE_PROFILES):e.USE_PROFILES:!1,Ot=e.ALLOW_ARIA_ATTR!==!1,et=e.ALLOW_DATA_ATTR!==!1,Lt=e.ALLOW_UNKNOWN_PROTOCOLS||!1,It=e.ALLOW_SELF_CLOSE_IN_ATTR!==!1,re=e.SAFE_FOR_TEMPLATES||!1,Oe=e.SAFE_FOR_XML!==!1,le=e.WHOLE_DOCUMENT||!1,ue=e.RETURN_DOM||!1,Fe=e.RETURN_DOM_FRAGMENT||!1,ze=e.RETURN_TRUSTED_TYPE||!1,nt=e.FORCE_BODY||!1,Nt=e.SANITIZE_DOM!==!1,Dt=e.SANITIZE_NAMED_PROPS||!1,rt=e.KEEP_CONTENT!==!1,Le=e.IN_PLACE||!1,xt=er(e.ALLOWED_URI_REGEXP)?e.ALLOWED_URI_REGEXP:sn,he=typeof e.NAMESPACE=="string"?e.NAMESPACE:q,lt=y(e,"MATHML_TEXT_INTEGRATION_POINTS")&&e.MATHML_TEXT_INTEGRATION_POINTS&&typeof e.MATHML_TEXT_INTEGRATION_POINTS=="object"?C(e.MATHML_TEXT_INTEGRATION_POINTS):f({},["mi","mo","mn","ms","mtext"]),ct=y(e,"HTML_INTEGRATION_POINTS")&&e.HTML_INTEGRATION_POINTS&&typeof e.HTML_INTEGRATION_POINTS=="object"?C(e.HTML_INTEGRATION_POINTS):f({},["annotation-xml"]);let o=y(e,"CUSTOM_ELEMENT_HANDLING")&&e.CUSTOM_ELEMENT_HANDLING&&typeof e.CUSTOM_ELEMENT_HANDLING=="object"?C(e.CUSTOM_ELEMENT_HANDLING):Ae(null);if(S=Ae(null),y(o,"tagNameCheck")&&Pt(o.tagNameCheck)&&(S.tagNameCheck=o.tagNameCheck),y(o,"attributeNameCheck")&&Pt(o.attributeNameCheck)&&(S.attributeNameCheck=o.attributeNameCheck),y(o,"allowCustomizedBuiltInElements")&&typeof o.allowCustomizedBuiltInElements=="boolean"&&(S.allowCustomizedBuiltInElements=o.allowCustomizedBuiltInElements),re&&(et=!1),Fe&&(ue=!0),de&&(R=f({},nn),x=Ae(null),de.html===!0&&(f(R,tn),f(x,rn)),de.svg===!0&&(f(R,ut),f(x,gt),f(x,We)),de.svgFilters===!0&&(f(R,dt),f(x,gt),f(x,We)),de.mathMl===!0&&(f(R,ht),f(x,on),f(x,We))),ne.tagCheck=null,ne.attributeCheck=null,y(e,"ADD_TAGS")&&(typeof e.ADD_TAGS=="function"?ne.tagCheck=e.ADD_TAGS:U(e.ADD_TAGS)&&(R===Qe&&(R=C(R)),f(R,e.ADD_TAGS,w))),y(e,"ADD_ATTR")&&(typeof e.ADD_ATTR=="function"?ne.attributeCheck=e.ADD_ATTR:U(e.ADD_ATTR)&&(x===Je&&(x=C(x)),f(x,e.ADD_ATTR,w))),y(e,"ADD_URI_SAFE_ATTR")&&U(e.ADD_URI_SAFE_ATTR)&&f(st,e.ADD_URI_SAFE_ATTR,w),y(e,"FORBID_CONTENTS")&&U(e.FORBID_CONTENTS)&&(V===ot&&(V=C(V)),f(V,e.FORBID_CONTENTS,w)),y(e,"ADD_FORBID_CONTENTS")&&U(e.ADD_FORBID_CONTENTS)&&(V===ot&&(V=C(V)),f(V,e.ADD_FORBID_CONTENTS,w)),rt&&(R["#text"]=!0),le&&f(R,["html","head","body"]),R.table&&(f(R,["tbody"]),delete xe.tbody),e.TRUSTED_TYPES_POLICY){if(typeof e.TRUSTED_TYPES_POLICY.createHTML!="function")throw Ce('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');if(typeof e.TRUSTED_TYPES_POLICY.createScriptURL!="function")throw Ce('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');A=e.TRUSTED_TYPES_POLICY,J=A.createHTML("")}else A===void 0&&(A=ur(k,i)),A!==null&&typeof J=="string"&&(J=A.createHTML(""));(T.uponSanitizeElement.length>0||T.uponSanitizeAttribute.length>0)&&R===Qe&&(R=C(R)),T.uponSanitizeAttribute.length>0&&x===Je&&(x=C(x)),P&&P(e),ge=e},kt=f({},[...ut,...dt,...tr]),Ft=f({},[...ht,...nr]),Pn=function(e){let o=Y(e);(!o||!o.tagName)&&(o={namespaceURI:he,tagName:"template"});let a=Me(e.tagName),h=Me(o.tagName);return at[e.namespaceURI]?e.namespaceURI===Ge?o.namespaceURI===q?a==="svg":o.namespaceURI===He?a==="svg"&&(h==="annotation-xml"||lt[h]):!!kt[a]:e.namespaceURI===He?o.namespaceURI===q?a==="math":o.namespaceURI===Ge?a==="math"&&ct[h]:!!Ft[a]:e.namespaceURI===q?o.namespaceURI===Ge&&!ct[h]||o.namespaceURI===He&&!lt[h]?!1:!Ft[a]&&(Cn[a]||!kt[a]):!!(Ie==="application/xhtml+xml"&&at[e.namespaceURI]):!1},j=function(e){ye(t.removed,{element:e});try{Y(e).removeChild(e)}catch{fe(e)}},ce=function(e,o){try{ye(t.removed,{attribute:o.getAttributeNode(e),from:o})}catch{ye(t.removed,{attribute:null,from:o})}if(o.removeAttribute(e),e==="is")if(ue||Fe)try{j(o)}catch{}else try{o.setAttribute(e,"")}catch{}},zt=function(e){let o=null,a=null;if(nt)e="<remove></remove>"+e;else{let E=Kt(e,/^[\r\n\t ]+/);a=E&&E[0]}Ie==="application/xhtml+xml"&&he===q&&(e='<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>'+e+"</body></html>");let h=A?A.createHTML(e):e;if(he===q)try{o=new _().parseFromString(h,Ie)}catch{}if(!o||!o.documentElement){o=B.createDocument(he,"template",null);try{o.documentElement.innerHTML=it?J:h}catch{}}let m=o.body||o.documentElement;return e&&a&&m.insertBefore(r.createTextNode(a),m.childNodes[0]||null),he===q?me.call(o,le?"html":"body")[0]:le?o.documentElement:m},Ht=function(e){return te.call(e.ownerDocument||e,e,u.SHOW_ELEMENT|u.SHOW_COMMENT|u.SHOW_TEXT|u.SHOW_PROCESSING_INSTRUCTION|u.SHOW_CDATA_SECTION,null)},Gt=function(e){e.normalize();let o=te.call(e.ownerDocument||e,e,u.SHOW_TEXT|u.SHOW_COMMENT|u.SHOW_CDATA_SECTION|u.SHOW_PROCESSING_INSTRUCTION,null),a=o.nextNode();for(;a;){let h=a.data;Ee([X,ae,we],m=>{h=_e(h,m," ")}),a.data=h,a=o.nextNode()}},$e=function(e){let o=$?$(e):null;return typeof o!="string"||w(o)!=="form"?!1:typeof e.nodeName!="string"||typeof e.textContent!="string"||typeof e.removeChild!="function"||e.attributes!==Ue(e)||typeof e.removeAttribute!="function"||typeof e.setAttribute!="function"||typeof e.namespaceURI!="string"||typeof e.insertBefore!="function"||typeof e.hasChildNodes!="function"||e.nodeType!==D(e)||e.childNodes!==F(e)},Ne=function(e){if(!D||typeof e!="object"||e===null)return!1;try{return D(e)===K.documentFragment}catch{return!1}},Be=function(e){if(!D||typeof e!="object"||e===null)return!1;try{return typeof D(e)=="number"}catch{return!1}};function ee(c,e,o){Ee(c,a=>{a.call(t,e,o,ge)})}let $t=function(e){let o=null;if(ee(T.beforeSanitizeElements,e,null),$e(e))return j(e),!0;let a=w(e.nodeName);if(ee(T.uponSanitizeElement,e,{tagName:a,allowedTags:R}),Oe&&e.hasChildNodes()&&!Be(e.firstElementChild)&&N(/<[/\w!]/g,e.innerHTML)&&N(/<[/\w!]/g,e.textContent)||Oe&&e.namespaceURI===q&&a==="style"&&Be(e.firstElementChild)||e.nodeType===K.progressingInstruction||Oe&&e.nodeType===K.comment&&N(/<[/\w]/g,e.data))return j(e),!0;if(xe[a]||!(ne.tagCheck instanceof Function&&ne.tagCheck(a))&&!R[a]){if(!xe[a]&&jt(a)&&(S.tagNameCheck instanceof RegExp&&N(S.tagNameCheck,a)||S.tagNameCheck instanceof Function&&S.tagNameCheck(a)))return!1;if(rt&&!V[a]){let m=Y(e),E=F(e);if(E&&m){let z=E.length;for(let Z=z-1;Z>=0;--Z){let W=G(E[Z],!0);m.insertBefore(W,g(e))}}}return j(e),!0}return(D?D(e):e.nodeType)===K.element&&!Pn(e)||(a==="noscript"||a==="noembed"||a==="noframes")&&N(/<\/no(script|embed|frames)/i,e.innerHTML)?(j(e),!0):(re&&e.nodeType===K.text&&(o=e.textContent,Ee([X,ae,we],m=>{o=_e(o,m," ")}),e.textContent!==o&&(ye(t.removed,{element:e.cloneNode()}),e.textContent=o)),ee(T.afterSanitizeElements,e,null),!1)},Bt=function(e,o,a){if(ke[o]||Nt&&(o==="id"||o==="name")&&(a in r||a in Un))return!1;let h=x[o]||ne.attributeCheck instanceof Function&&ne.attributeCheck(o,e);if(!(et&&!ke[o]&&N(Ke,o))){if(!(Ot&&N(Ln,o))){if(!h||ke[o]){if(!(jt(e)&&(S.tagNameCheck instanceof RegExp&&N(S.tagNameCheck,e)||S.tagNameCheck instanceof Function&&S.tagNameCheck(e))&&(S.attributeNameCheck instanceof RegExp&&N(S.attributeNameCheck,o)||S.attributeNameCheck instanceof Function&&S.attributeNameCheck(o,e))||o==="is"&&S.allowCustomizedBuiltInElements&&(S.tagNameCheck instanceof RegExp&&N(S.tagNameCheck,a)||S.tagNameCheck instanceof Function&&S.tagNameCheck(a))))return!1}else if(!st[o]){if(!N(xt,_e(a,wt,""))){if(!((o==="src"||o==="xlink:href"||o==="href")&&e!=="script"&&Qt(a,"data:")===0&&Mt[e])){if(!(Lt&&!N(In,_e(a,wt,"")))){if(a)return!1}}}}}}return!0},kn=f({},["annotation-xml","color-profile","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","missing-glyph"]),jt=function(e){return!kn[Me(e)]&&N(Nn,e)},Wt=function(e){ee(T.beforeSanitizeAttributes,e,null);let o=e.attributes;if(!o||$e(e))return;let a={attrName:"",attrValue:"",keepAttr:!0,allowedAttributes:x,forceKeepAttr:void 0},h=o.length;for(;h--;){let m=o[h],E=m.name,z=m.namespaceURI,Z=m.value,W=w(E),ft=Z,I=E==="value"?ft:Vn(ft);if(a.attrName=W,a.attrValue=I,a.keepAttr=!0,a.forceKeepAttr=void 0,ee(T.uponSanitizeAttribute,e,a),I=a.attrValue,Dt&&(W==="id"||W==="name")&&Qt(I,Ct)!==0&&(ce(E,e),I=Ct+I),Oe&&N(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i,I)){ce(E,e);continue}if(W==="attributename"&&Kt(I,"href")){ce(E,e);continue}if(a.forceKeepAttr)continue;if(!a.keepAttr){ce(E,e);continue}if(!It&&N(/\/>/i,I)){ce(E,e);continue}re&&Ee([X,ae,we],Xt=>{I=_e(I,Xt," ")});let Yt=w(e.nodeName);if(!Bt(Yt,W,I)){ce(E,e);continue}if(A&&typeof k=="object"&&typeof k.getAttributeType=="function"&&!z)switch(k.getAttributeType(Yt,W)){case"TrustedHTML":{I=A.createHTML(I);break}case"TrustedScriptURL":{I=A.createScriptURL(I);break}}if(I!==ft)try{z?e.setAttributeNS(z,E,I):e.setAttribute(E,I),$e(e)?j(e):Zt(t.removed)}catch{ce(E,e)}}ee(T.afterSanitizeAttributes,e,null)},je=function(e){let o=null,a=Ht(e);for(ee(T.beforeSanitizeShadowDOM,e,null);o=a.nextNode();)if(ee(T.uponSanitizeShadowNode,o,null),$t(o),Wt(o),Ne(o.content)&&je(o.content),(D?D(o):o.nodeType)===K.element){let m=ie?ie(o):o.shadowRoot;Ne(m)&&(Te(m),je(m))}ee(T.afterSanitizeShadowDOM,e,null)},Te=function(e){let o=D?D(e):e.nodeType;if(o===K.element){let m=ie?ie(e):e.shadowRoot;Ne(m)&&(Te(m),je(m))}let a=F?F(e):e.childNodes;if(!a)return;let h=[];Ee(a,m=>{ye(h,m)});for(let m of h)Te(m);if(o===K.element){let m=$?$(e):null;if(typeof m=="string"&&w(m)==="template"){let E=e.content;Ne(E)&&Te(E)}}};return t.sanitize=function(c){let e=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},o=null,a=null,h=null,m=null;if(it=!c,it&&(c="<!-->"),typeof c!="string"&&!Be(c)&&(c=Jn(c),typeof c!="string"))throw Ce("dirty is not a string, aborting");if(!t.isSupported)return c;if(tt||pt(e),t.removed=[],typeof c=="string"&&(Le=!1),Le){let Z=$?$(c):c.nodeName;if(typeof Z=="string"){let W=w(Z);if(!R[W]||xe[W])throw Ce("root node is forbidden and cannot be sanitized in-place")}if($e(c))throw Ce("root node is clobbered and cannot be sanitized in-place");Te(c)}else if(Be(c))o=zt("<!---->"),a=o.ownerDocument.importNode(c,!0),a.nodeType===K.element&&a.nodeName==="BODY"||a.nodeName==="HTML"?o=a:o.appendChild(a),Te(a);else{if(!ue&&!re&&!le&&c.indexOf("<")===-1)return A&&ze?A.createHTML(c):c;if(o=zt(c),!o)return ue?null:ze?J:""}o&&nt&&j(o.firstChild);let E=Ht(Le?c:o);for(;h=E.nextNode();)$t(h),Wt(h),Ne(h.content)&&je(h.content);if(Le)return re&&Gt(c),c;if(ue){if(re&&Gt(o),Fe)for(m=Se.call(o.ownerDocument);o.firstChild;)m.appendChild(o.firstChild);else m=o;return(x.shadowroot||x.shadowrootmode)&&(m=Pe.call(s,m,!0)),m}let z=le?o.outerHTML:o.innerHTML;return le&&R["!doctype"]&&o.ownerDocument&&o.ownerDocument.doctype&&o.ownerDocument.doctype.name&&N(pr,o.ownerDocument.doctype.name)&&(z="<!DOCTYPE "+o.ownerDocument.doctype.name+`>
|
|
3
|
-
`+z),re&&Ee([X,ae,we],Z=>{z=_e(z,Z," ")}),A&&ze?A.createHTML(z):z},t.setConfig=function(){let c=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};pt(c),tt=!0},t.clearConfig=function(){ge=null,tt=!1},t.isValidAttribute=function(c,e,o){ge||pt({});let a=w(c),h=w(e);return Bt(a,h,o)},t.addHook=function(c,e){typeof e=="function"&&ye(T[c],e)},t.removeHook=function(c,e){if(e!==void 0){let o=Yn(T[c],e);return o===-1?void 0:Xn(T[c],o,1)[0]}return Zt(T[c])},t.removeHooks=function(c){T[c]=[]},t.removeAllHooks=function(){T=an()},t}var fn=pn();var Ye=fn(globalThis.window);var pe=n=>Object.prototype.toString.call(n).slice(8,-1),M=n=>typeof n=="string"||n instanceof String;var mn=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"];var{FileReader:un}=globalThis;var dn=/(?:#|%23)$/,hn=/^(?:application\/(?:[\w.-]+\+)?xml|image\/svg\+xml|text\/(?:html|xml))(?:\s*;\s*|$)/i;var gn=/(?<!(?:#|%23).*)(?:\?|%3F)$/,yt=/^[a-z][\da-z+.-]*$/,Tn=/^(?:web\+[a-z]+|ext\+[a-z][\da-z.-]*)$/,ve=/^(?:java|vb)script$/i,_t=/^(?:(?:java|vb)script|blob)$/i,Xe=/["'<>]|%(?:22|27|3C|3E)|&(?:apos|lt|gt|quot|#0*(?:34|39|60|62)|#x0*(?:22|27|3C|3E));/i,En=/^%[\dA-F]{2}$/i,yn=/^(?:\/{2,}|\\|[a-z][a-z\d+\-.]*:[^/])/i;var _n=[8,9,10,11,12,13,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];var At=new Set(_n),Ve=new Map([[128,8364],[130,8218],[131,402],[132,8222],[133,8230],[134,8224],[135,8225],[136,710],[137,8240],[138,352],[139,8249],[140,338],[142,381],[145,8216],[146,8217],[147,8220],[148,8221],[149,8226],[150,8211],[151,8212],[152,732],[153,8482],[154,353],[155,8250],[156,339],[158,382],[159,376]]),Er=()=>{let n=new Map;for(let t=0;t<256;t++)!At.has(t)&&!Ve.has(t)&&n.set(t,`\\x${t.toString(16).padStart(2,"0").toUpperCase()}`);return n},bt=Er();var[Re,_r,Ar,br,Rr,Sr]=["&","#","<",">",'"',"'"].map(n=>`%${n.charCodeAt(0).toString(16).toUpperCase()}`),wr=new RegExp(`[${[...bt.values()].join("")}]`),xr=/&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/gi,qe=class{#e=new Set(mn);get(){return[...this.#e]}has(t){return this.#e.has(t)}verify(t,r=this.#e){if(!M(t))return!1;try{let{protocol:s}=new URL(t),i=s.replace(/:$/,""),l=i.split("+");return l.some(d=>ve.test(d))?!1:Tn.test(i)||l.every(d=>r.has(d))}catch{return!1}}};var An=n=>{let t=n;if(M(t))switch(En.test(t)&&(t=t.toUpperCase()),t){case Re:return`${Re}amp;`;case Ar:return`${Re}lt;`;case br:return`${Re}gt;`;case Rr:return`${Re}quot;`;case Sr:return`${Re}${_r}39;`;default:}return t},bn=n=>{if(!M(n))throw new TypeError(`Expected String but got ${pe(n)}.`);let t=n.replace(/\s/g,""),r;try{r=atob(t)}catch{throw new Error(`Invalid base64 data: ${n}`)}let s=Uint8Array.from(r,i=>i.charCodeAt(0));try{let l=new TextDecoder("utf-8",{fatal:!0}).decode(s);return wr.test(l)?t:l}catch{return t}},Or=(n,t)=>{let r=/x/i.test(t[0])?parseInt(t.substring(1),16):parseInt(t,10);if(Number.isInteger(r)){if(At.has(r))return String.fromCharCode(r);if(Ve.has(r)){let s=Ve.get(r);return String.fromCodePoint(s)}else if(bt.has(r))return""}return n},Rn=(n,t=0)=>{if(!M(n))throw new TypeError(`Expected String but got ${pe(n)}.`);if(!Number.isInteger(t))throw new TypeError(`Expected Number but got ${pe(t)}.`);let r=decodeURIComponent(n);for(;/&#/.test(r);){if(t>16)throw new Error("Character references nested too deeply.");let s=r;if(r=r.replace(xr,Or),r===s)break;t++}return r},Sn=(n,t=16777216)=>new Promise((r,s)=>{if(Number.isInteger(n?.size)){if(Number.isInteger(t)&&n.size>t){let l=`Blob size (${n.size} bytes) exceeds max (${t} bytes).`;return s(new DOMException(l,"NotReadableError"))}}else return r(null);let i=new un;i.addEventListener("error",()=>s(i.error)),i.addEventListener("abort",()=>r(i.result)),i.addEventListener("load",()=>r(i.result)),i.readAsDataURL(n)}),wn=n=>M(n)?n.replace(dn,"").replace(gn,""):n;var Lr=Object.freeze(["href","origin","protocol","username","password","host","hostname","port","pathname","search","hash"]),Ir=Object.freeze({RETURN_DOM:!1,RETURN_DOM_FRAGMENT:!1,RETURN_TRUSTED_TYPE:!1}),oe=(n,t,r)=>{n&&console.warn(`[URLSanitizer Debug] ${t}`,r?r.message:"")},St=class n extends qe{#e;static#t=null;static#n=null;static#s(t,r){if(!r.attrValue||!/^\s*data:/i.test(r.attrValue))return;let s=n.#t,i=n.#n;if(!s||!i)return;let l;try{l=new URL(r.attrValue)}catch{return}if(l.protocol==="data:"){let p=r.attrValue;if(i.recurse||(i.recurse=new Set),i.recurse.has(p)){let d=`Circular Data URL detected and skipped: ${p}`;oe(i.debug,d),r.attrValue="";return}i.nest++,i.recurse.add(p);try{let d=s.#o(p,{allow:["data"],deny:[],only:[],allowRelative:!1},i);r.attrValue=d||""}finally{i.nest--,i.recurse.delete(p)}}}static{Ye.setConfig(Ir),Ye.addHook("uponSanitizeAttribute",n.#s)}constructor(){super(),this.#e=new Set(super.get())}#r(t,r,s,i,l){if(_t.test(t))return!1;if(t.split("+").some(u=>ve.test(u))||!yt.test(t)){let u=`Failed to add scheme '${t}' in '${r}' list.`;return oe(l.debug,u),!1}return i.set(t,!0),s.add(t),!0}#i(t,r){let s=t;try{s=decodeURIComponent(t)}catch{}let i=n.#t,l=n.#n;n.#t=this,n.#n=r;let p;try{p=r.domPurify.sanitize(s)}finally{n.#t=i,n.#n=l}p=wn(p);try{return encodeURI(p)}catch{return p}}#o(t,r,s){if(s.nest>16)throw new Error("Data URLs nested too deeply.");let{allow:i,deny:l,only:p,allowRelative:d}=r,u=this.#e,v=!1,_=new Map(s.schemeMap);if(p.length){u=new Set;for(let g of p)M(g)&&(g=g.trim(),this.#r(g,"only",u,_,s)&&!v&&(v=!0))}else{if(i.length){u=new Set(this.#e);for(let g of i)M(g)&&this.#r(g.trim(),"allow",u,_,s)}if(l.length)for(let g of l)M(g)&&(g=g.trim(),g&&_.set(g,!1))}let k,L=super.verify(t,u),G=!1,fe="";if(!L&&d&&!yn.test(t))try{let g=new URL(t,"http://dummy.local");g.protocol==="http:"&&g.hostname==="dummy.local"&&(L=!0,G=!0,fe=`${g.pathname}${g.search}${g.hash}`)}catch(g){oe(s.debug,"Failed to parse relative URL.",g)}if(L){let g,F,Y,ie,Ue,D="",$=[],A=!1;if(G)A=!0;else if({hash:g,href:F,pathname:Y,protocol:ie,search:Ue}=new URL(t),D=ie.replace(/:$/,""),$=D.split("+"),v)A=$.every(b=>_.get(b));else for(let[b,B]of _.entries())if(A=B||D!==b&&$.every(te=>te!==b),!A)break;if(A){let J=G?!1:$.includes("data"),b=G?fe:F;if(J){let[B,...te]=Y.split(","),Se=`${te.join(",")}${Ue}${g}`,me=B.split(";"),Pe=me[me.length-1]==="base64",T=Se;if(Pe)try{T=bn(Se)}catch(X){oe(s.debug,"Failed to parse base64 data.",X),b=""}try{let X=Rn(T).trim(),{protocol:ae}=new URL(X,"http://dummy.local");ae.replace(/:$/,"").split("+").some(Ke=>_t.test(Ke))&&(b="")}catch(X){oe(s.debug,"Failed to parse inner data URL protocol.",X)}(!B||hn.test(B))&&(T=this.#i(T,s)),b&&T?(Pe&&T!==Se&&me.pop(),b=`${D}:${me.join(";")},${T}`):b=""}if(!J&&Xe.test(b)){let B=Xe.exec(b),{index:te}=B;b=b.substring(0,te).replace(/[?&]$/,"")}b&&(k=b)}}return k||null}sanitize(t,r){if(!t||!M(t))return null;let s=Number.isInteger(r?.maxLength)&&r.maxLength?r.maxLength:0;if(s&&t.length>s){let d=`URL length ${t.length} exceeds maxLength ${s}.`;throw new RangeError(d)}if(!(r&&(Array.isArray(r.deny)&&r.deny.length>0||Array.isArray(r.only)&&r.only.length>0||r.allowRelative))&&(t.startsWith("https://")||t.startsWith("http://"))&&!Xe.test(t)&&!t.includes("data:"))try{let{href:d}=new URL(t);return d.replace(/%26/g,An)}catch{return null}let l={allow:Array.isArray(r?.allow)?r.allow:[],deny:Array.isArray(r?.deny)?r.deny:[],only:Array.isArray(r?.only)?r.only:[],allowRelative:!!r?.allowRelative},p={debug:!!r?.debug,domPurify:Ye,nest:0,recurse:null,schemeMap:new Map([["blob",!1],["data",!1],["file",!1],["javascript",!1],["vbscript",!1]])};return this.#o(t,l,p)}inspect(t,r){if(!M(t))throw new TypeError(`Expected String but got ${pe(t)}.`);let s=new Map([["input",t]]),i,l=null,p=Number.isInteger(r?.maxLength)&&r.maxLength?r.maxLength:0;if(p&&t.length>p)l=`URL length ${t.length} exceeds maxLength ${p}.`;else if(this.verify(t)){let{protocol:d}=new URL(t);if(d==="blob:")i=t;else try{i=this.sanitize(t,r??{allow:["data","file"]}),i||(l="Sanitization failed (blocked by allowed schemes or rules).")}catch(u){l=u.message}}else l="Invalid URI syntax or scheme is not registered.";if(i){let d=new URL(i),{pathname:u,protocol:v}=d,k=v.replace(/:$/,"").split("+").includes("data");if(s.set("valid",!0),k){let L=new Map,[G,...fe]=u.split(","),g=`${fe.join(",")}${d.search}${d.hash}`,F=G.split(";"),Y=F[F.length-1]==="base64";Y&&F.pop(),L.set("mime",F.join(";")),L.set("base64",Y),L.set("data",g),s.set("data",Object.fromEntries(L))}else s.set("data",null);for(let L of Lr){let G=d[L];M(G)&&s.set(L,G)}}else s.set("valid",!1),l&&s.set("reason",l);return Object.fromEntries(s)}get(){return[...this.#e]}has(t){return this.#e.has(t)}add(t){if(!M(t))throw new TypeError(`Expected String but got ${pe(t)}.`);if(t.split("+").some(i=>ve.test(i))||!yt.test(t))throw new Error(`Invalid scheme: ${t}`);return this.#e.add(t),[...this.#e]}remove(t){return this.#e.delete(t)}reset(){this.#e=new Set(super.get())}verify(t,r=this.#e){return super.verify(t,r)}};var se=new St,Nr=async(n,t={allow:[],deny:[],only:[],allowRelative:!1,debug:!1,revokeObjectURL:!1,maxBlobSize:16777216})=>{let r=!!t?.debug,s=Number.isInteger(t?.maxBlobSize)&&t.maxBlobSize>0?t.maxBlobSize:16777216,i;if(n&&M(n)){let l;try{let{protocol:p}=new URL(n);l=p.replace(/:$/,"")}catch(p){oe(r,`Invalid URL input format: ${n}`,p)}if(l==="blob"){let{allow:p,deny:d,only:u}=t;if(Array.isArray(p)&&p.includes("blob")&&!(Array.isArray(d)&&d.includes("blob"))||Array.isArray(u)&&u.includes("blob")){let v;try{v=await fetch(n).then(_=>_.blob()).then(_=>Sn(_,s))}catch(_){let k=`Failed to fetch and convert blob URL: ${n}`;oe(r,k,_)}if(v){let _={...t};Array.isArray(t.only)?_.only=t.only.includes("data")?t.only:[...t.only,"data"]:Array.isArray(t.allow)&&(_.allow=t.allow.includes("data")?t.allow:[...t.allow,"data"],Array.isArray(t.deny)&&(_.deny=t.deny.filter(k=>k!=="data"))),i=se.sanitize(v,_)}}t?.revokeObjectURL&&URL.revokeObjectURL(n)}else(l||t.allowRelative)&&(i=se.sanitize(n,t))}return i||null},Dr=(n,t={allow:[],deny:[],only:[],allowRelative:!1,debug:!1,revokeObjectURL:!1})=>{let r=!!t?.debug,s;if(n&&M(n)){let i;try{let{protocol:l}=new URL(n);i=l.replace(/:$/,"")}catch(l){let p=`Invalid URL input format: ${n}`;oe(r,p,l)}if(i==="blob")return t?.revokeObjectURL&&URL.revokeObjectURL(n),null;(i||t.allowRelative)&&(s=se.sanitize(n,t))}return s||null},xn=async n=>se.inspect(n),Cr=n=>xn(n),On=n=>se.inspect(n),Mr=n=>On(n),vr=async n=>se.verify(n),Ur=n=>se.verify(n),Pr=se;export{Pr as default,xn as inspectURL,On as inspectURLSync,vr as isURI,Ur as isURISync,Cr as parseURL,Mr as parseURLSync,Nr as sanitizeURL,Dr as sanitizeURLSync};
|
|
1
|
+
function rn(n,t){(t==null||t>n.length)&&(t=n.length);for(var o=0,s=Array(t);o<t;o++)s[o]=n[o];return s}function fr(n){if(Array.isArray(n))return n}function ur(n,t){var o=n==null?null:typeof Symbol<"u"&&n[Symbol.iterator]||n["@@iterator"];if(o!=null){var s,i,l,u,g=[],h=!0,k=!1;try{if(l=(o=o.call(n)).next,t!==0)for(;!(h=(s=l.call(o)).done)&&(g.push(s.value),g.length!==t);h=!0);}catch(R){k=!0,i=R}finally{try{if(!h&&o.return!=null&&(u=o.return(),Object(u)!==u))return}finally{if(k)throw i}}return g}}function pr(){throw new TypeError(`Invalid attempt to destructure non-iterable instance.
|
|
2
|
+
In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function mr(n,t){return fr(n)||ur(n,t)||dr(n,t)||pr()}function dr(n,t){if(n){if(typeof n=="string")return rn(n,t);var o={}.toString.call(n).slice(8,-1);return o==="Object"&&n.constructor&&(o=n.constructor.name),o==="Map"||o==="Set"?Array.from(n):o==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(o)?rn(n,t):void 0}}var En=Object.entries,on=Object.setPrototypeOf,hr=Object.isFrozen,gr=Object.getPrototypeOf,Tr=Object.getOwnPropertyDescriptor,M=Object.freeze,v=Object.seal,we=Object.create,yn=typeof Reflect<"u"&&Reflect,Rt=yn.apply,St=yn.construct;M||(M=function(t){return t});v||(v=function(t){return t});Rt||(Rt=function(t,o){for(var s=arguments.length,i=new Array(s>2?s-2:0),l=2;l<s;l++)i[l-2]=arguments[l];return t.apply(o,i)});St||(St=function(t){for(var o=arguments.length,s=new Array(o>1?o-1:0),i=1;i<o;i++)s[i-1]=arguments[i];return new t(...s)});var De=O(Array.prototype.forEach),Er=O(Array.prototype.lastIndexOf),sn=O(Array.prototype.pop),Se=O(Array.prototype.push),yr=O(Array.prototype.splice),ce=Array.isArray,Ue=O(String.prototype.toLowerCase),Et=O(String.prototype.toString),an=O(String.prototype.match),Me=O(String.prototype.replace),cn=O(String.prototype.indexOf),_r=O(String.prototype.trim),br=O(Number.prototype.toString),Ar=O(Boolean.prototype.toString),ln=typeof BigInt>"u"?null:O(BigInt.prototype.toString),fn=typeof Symbol>"u"?null:O(Symbol.prototype.toString),C=O(Object.prototype.hasOwnProperty),ve=O(Object.prototype.toString),D=O(RegExp.prototype.test),de=Rr(TypeError);function O(n){return function(t){t instanceof RegExp&&(t.lastIndex=0);for(var o=arguments.length,s=new Array(o>1?o-1:0),i=1;i<o;i++)s[i-1]=arguments[i];return Rt(n,t,s)}}function Rr(n){return function(){for(var t=arguments.length,o=new Array(t),s=0;s<t;s++)o[s]=arguments[s];return St(n,o)}}function m(n,t){let o=arguments.length>2&&arguments[2]!==void 0?arguments[2]:Ue;if(on&&on(n,null),!ce(t))return n;let s=t.length;for(;s--;){let i=t[s];if(typeof i=="string"){let l=o(i);l!==i&&(hr(t)||(t[s]=l),i=l)}n[i]=!0}return n}function Sr(n){for(let t=0;t<n.length;t++)C(n,t)||(n[t]=null);return n}function F(n){let t=we(null);for(let s of En(n)){var o=mr(s,2);let i=o[0],l=o[1];C(n,i)&&(ce(l)?t[i]=Sr(l):l&&typeof l=="object"&&l.constructor===Object?t[i]=F(l):t[i]=l)}return t}function wr(n){switch(typeof n){case"string":return n;case"number":return br(n);case"boolean":return Ar(n);case"bigint":return ln?ln(n):"0";case"symbol":return fn?fn(n):"Symbol()";case"undefined":return ve(n);case"function":case"object":{if(n===null)return ve(n);let t=n,o=J(t,"toString");if(typeof o=="function"){let s=o(t);return typeof s=="string"?s:ve(s)}return ve(n)}default:return ve(n)}}function J(n,t){for(;n!==null;){let s=Tr(n,t);if(s){if(s.get)return O(s.get);if(typeof s.value=="function")return O(s.value)}n=gr(n)}function o(){return null}return o}function xr(n){try{return D(n,""),!0}catch{return!1}}var un=M(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","search","section","select","shadow","slot","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),yt=M(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","enterkeyhint","exportparts","filter","font","g","glyph","glyphref","hkern","image","inputmode","line","lineargradient","marker","mask","metadata","mpath","part","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),_t=M(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feDropShadow","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),Or=M(["animate","color-profile","cursor","discard","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),bt=M(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover","mprescripts"]),Lr=M(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),pn=M(["#text"]),mn=M(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","command","commandfor","controls","controlslist","coords","crossorigin","datetime","decoding","default","dir","disabled","disablepictureinpicture","disableremoteplayback","download","draggable","enctype","enterkeyhint","exportparts","face","for","headers","height","hidden","high","href","hreflang","id","inert","inputmode","integrity","ismap","kind","label","lang","list","loading","loop","low","max","maxlength","media","method","min","minlength","multiple","muted","name","nonce","noshade","novalidate","nowrap","open","optimum","part","pattern","placeholder","playsinline","popover","popovertarget","popovertargetaction","poster","preload","pubdate","radiogroup","readonly","rel","required","rev","reversed","role","rows","rowspan","spellcheck","scope","selected","shape","size","sizes","slot","span","srclang","start","src","srcset","step","style","summary","tabindex","title","translate","type","usemap","valign","value","width","wrap","xmlns"]),At=M(["accent-height","accumulate","additive","alignment-baseline","amplitude","ascent","attributename","attributetype","azimuth","basefrequency","baseline-shift","begin","bias","by","class","clip","clippathunits","clip-path","clip-rule","color","color-interpolation","color-interpolation-filters","color-profile","color-rendering","cx","cy","d","dx","dy","diffuseconstant","direction","display","divisor","dur","edgemode","elevation","end","exponent","fill","fill-opacity","fill-rule","filter","filterunits","flood-color","flood-opacity","font-family","font-size","font-size-adjust","font-stretch","font-style","font-variant","font-weight","fx","fy","g1","g2","glyph-name","glyphref","gradientunits","gradienttransform","height","href","id","image-rendering","in","in2","intercept","k","k1","k2","k3","k4","kerning","keypoints","keysplines","keytimes","lang","lengthadjust","letter-spacing","kernelmatrix","kernelunitlength","lighting-color","local","marker-end","marker-mid","marker-start","markerheight","markerunits","markerwidth","maskcontentunits","maskunits","max","mask","mask-type","media","method","mode","min","name","numoctaves","offset","operator","opacity","order","orient","orientation","origin","overflow","paint-order","path","pathlength","patterncontentunits","patterntransform","patternunits","points","preservealpha","preserveaspectratio","primitiveunits","r","rx","ry","radius","refx","refy","repeatcount","repeatdur","restart","result","rotate","scale","seed","shape-rendering","slope","specularconstant","specularexponent","spreadmethod","startoffset","stddeviation","stitchtiles","stop-color","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-linecap","stroke-linejoin","stroke-miterlimit","stroke-opacity","stroke","stroke-width","style","surfacescale","systemlanguage","tabindex","tablevalues","targetx","targety","transform","transform-origin","text-anchor","text-decoration","text-rendering","textlength","type","u1","u2","unicode","values","viewbox","visibility","version","vert-adv-y","vert-origin-x","vert-origin-y","width","word-spacing","wrap","writing-mode","xchannelselector","ychannelselector","x","x1","x2","xmlns","y","y1","y2","z","zoomandpan"]),dn=M(["accent","accentunder","align","bevelled","close","columnalign","columnlines","columnspacing","columnspan","denomalign","depth","dir","display","displaystyle","encoding","fence","frame","height","href","id","largeop","length","linethickness","lquote","lspace","mathbackground","mathcolor","mathsize","mathvariant","maxsize","minsize","movablelimits","notation","numalign","open","rowalign","rowlines","rowspacing","rowspan","rspace","rquote","scriptlevel","scriptminsize","scriptsizemultiplier","selection","separator","separators","stretchy","subscriptshift","supscriptshift","symmetric","voffset","width","xmlns"]),Ye=M(["xlink:href","xml:id","xlink:title","xml:space","xmlns:xlink"]),Nr=v(/{{[\w\W]*|^[\w\W]*}}/g),Ir=v(/<%[\w\W]*|^[\w\W]*%>/g),Cr=v(/\${[\w\W]*/g),Dr=v(/^data-[\-\w.\u00B7-\uFFFF]+$/),Mr=v(/^aria-[\-\w]+$/),hn=v(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),vr=v(/^(?:\w+script|data):/i),Ur=v(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),Pr=v(/^html$/i),kr=v(/^[a-z][.\w]*(-[.\w]+)+$/i),gn=v(/<[/\w!]/g),zr=v(/<[/\w]/g),Fr=v(/<\/no(script|embed|frames)/i),Hr=v(/\/>/i),Q={element:1,attribute:2,text:3,cdataSection:4,entityReference:5,entityNode:6,processingInstruction:7,comment:8,document:9,documentType:10,documentFragment:11,notation:12},Gr=function(){return typeof window>"u"?null:window},$r=function(t,o){if(typeof t!="object"||typeof t.createPolicy!="function")return null;let s=null,i="data-tt-policy-suffix";o&&o.hasAttribute(i)&&(s=o.getAttribute(i));let l="dompurify"+(s?"#"+s:"");try{return t.createPolicy(l,{createHTML(u){return u},createScriptURL(u){return u}})}catch{return console.warn("TrustedTypes policy "+l+" could not be created."),null}},Tn=function(){return{afterSanitizeAttributes:[],afterSanitizeElements:[],afterSanitizeShadowDOM:[],beforeSanitizeAttributes:[],beforeSanitizeElements:[],beforeSanitizeShadowDOM:[],uponSanitizeAttribute:[],uponSanitizeElement:[],uponSanitizeShadowNode:[]}},ae=function(t,o,s,i){return C(t,o)&&ce(t[o])?m(i.base?F(i.base):{},t[o],i.transform):s};function _n(){let n=arguments.length>0&&arguments[0]!==void 0?arguments[0]:Gr(),t=c=>_n(c);if(t.version="3.4.11",t.removed=[],!n||!n.document||n.document.nodeType!==Q.document||!n.Element)return t.isSupported=!1,t;let o=n.document,s=o,i=s.currentScript;n.DocumentFragment;let l=n.HTMLTemplateElement,u=n.Node,g=n.Element,h=n.NodeFilter,k=n.NamedNodeMap;k===void 0&&(n.NamedNodeMap||n.MozNamedAttrMap),n.HTMLFormElement;let R=n.DOMParser,H=n.trustedTypes,L=g.prototype,W=J(L,"cloneNode"),ue=J(L,"remove"),T=J(L,"nextSibling"),U=J(L,"childNodes"),Y=J(L,"parentNode"),Oe=J(L,"shadowRoot"),ge=J(L,"attributes"),N=u&&u.prototype?J(u.prototype,"nodeType"):null,G=u&&u.prototype?J(u.prototype,"nodeName"):null;if(typeof l=="function"){let c=o.createElement("template");c.content&&c.content.ownerDocument&&(o=c.content.ownerDocument)}let w,X="",E,B=!1,$=0,Te=function(){if($>0)throw de('A configured TRUSTED_TYPES_POLICY callback (createHTML or createScriptURL) must not call DOMPurify.sanitize, as that causes infinite recursion. Do not pass a policy whose callbacks wrap DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted Types" section of the README.')},V=function(e){Te(),$++;try{return w.createHTML(e)}finally{$--}},ke=function(e){Te(),$++;try{return w.createScriptURL(e)}finally{$--}},ee=function(){return B||(E=$r(H,i),B=!0),E},te=o,Ee=te.implementation,ze=te.createNodeIterator,It=te.createDocumentFragment,et=te.getElementsByTagName,Hn=s.importNode,S=Tn();t.isSupported=typeof En=="function"&&typeof Y=="function"&&Ee&&Ee.createHTMLDocument!==void 0;let Gn=Nr,$n=Ir,Bn=Cr,jn=Dr,Wn=Mr,Yn=vr,Ct=Ur,Xn=kr,Dt=hn,y=null,Mt=m({},[...un,...yt,..._t,...bt,...pn]),_=null,vt=m({},[...mn,...At,...dn,...Ye]),b=Object.seal(we(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),Le=null,Ut=null,oe=Object.seal(we(null,{tagCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeCheck:{writable:!0,configurable:!1,enumerable:!0,value:null}})),Pt=!0,tt=!0,kt=!1,zt=!0,se=!1,Ne=!0,pe=!1,nt=!1,rt=null,ot=null,st=!1,ye=!1,Fe=!1,He=!1,Ft=!0,Ht=!1,Gt="user-content-",it=!0,at=!1,_e={},K=null,ct=m({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","selectedcontent","style","svg","template","thead","title","video","xmp"]),$t=null,Bt=m({},["audio","video","img","source","image","track"]),lt=null,jt=m({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),Ge="http://www.w3.org/1998/Math/MathML",$e="http://www.w3.org/2000/svg",Z="http://www.w3.org/1999/xhtml",be=Z,ft=!1,ut=null,Vn=m({},[Ge,$e,Z],Et),Wt=M(["mi","mo","mn","ms","mtext"]),pt=m({},Wt),Yt=M(["annotation-xml"]),mt=m({},Yt),qn=m({},["title","style","font","a","script"]),Ie=null,Kn=["application/xhtml+xml","text/html"],Zn="text/html",A=null,Ae=null,Qn=o.createElement("form"),Xt=function(e){return e instanceof RegExp||e instanceof Function},dt=function(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};if(Ae&&Ae===e)return;(!e||typeof e!="object")&&(e={}),e=F(e),Ie=Kn.indexOf(e.PARSER_MEDIA_TYPE)===-1?Zn:e.PARSER_MEDIA_TYPE,A=Ie==="application/xhtml+xml"?Et:Ue,y=ae(e,"ALLOWED_TAGS",Mt,{transform:A}),_=ae(e,"ALLOWED_ATTR",vt,{transform:A}),ut=ae(e,"ALLOWED_NAMESPACES",Vn,{transform:Et}),lt=ae(e,"ADD_URI_SAFE_ATTR",jt,{transform:A,base:jt}),$t=ae(e,"ADD_DATA_URI_TAGS",Bt,{transform:A,base:Bt}),K=ae(e,"FORBID_CONTENTS",ct,{transform:A}),Le=ae(e,"FORBID_TAGS",F({}),{transform:A}),Ut=ae(e,"FORBID_ATTR",F({}),{transform:A}),_e=C(e,"USE_PROFILES")?e.USE_PROFILES&&typeof e.USE_PROFILES=="object"?F(e.USE_PROFILES):e.USE_PROFILES:!1,Pt=e.ALLOW_ARIA_ATTR!==!1,tt=e.ALLOW_DATA_ATTR!==!1,kt=e.ALLOW_UNKNOWN_PROTOCOLS||!1,zt=e.ALLOW_SELF_CLOSE_IN_ATTR!==!1,se=e.SAFE_FOR_TEMPLATES||!1,Ne=e.SAFE_FOR_XML!==!1,pe=e.WHOLE_DOCUMENT||!1,ye=e.RETURN_DOM||!1,Fe=e.RETURN_DOM_FRAGMENT||!1,He=e.RETURN_TRUSTED_TYPE||!1,st=e.FORCE_BODY||!1,Ft=e.SANITIZE_DOM!==!1,Ht=e.SANITIZE_NAMED_PROPS||!1,it=e.KEEP_CONTENT!==!1,at=e.IN_PLACE||!1,Dt=xr(e.ALLOWED_URI_REGEXP)?e.ALLOWED_URI_REGEXP:hn,be=typeof e.NAMESPACE=="string"?e.NAMESPACE:Z,pt=C(e,"MATHML_TEXT_INTEGRATION_POINTS")&&e.MATHML_TEXT_INTEGRATION_POINTS&&typeof e.MATHML_TEXT_INTEGRATION_POINTS=="object"?F(e.MATHML_TEXT_INTEGRATION_POINTS):m({},Wt),mt=C(e,"HTML_INTEGRATION_POINTS")&&e.HTML_INTEGRATION_POINTS&&typeof e.HTML_INTEGRATION_POINTS=="object"?F(e.HTML_INTEGRATION_POINTS):m({},Yt);let r=C(e,"CUSTOM_ELEMENT_HANDLING")&&e.CUSTOM_ELEMENT_HANDLING&&typeof e.CUSTOM_ELEMENT_HANDLING=="object"?F(e.CUSTOM_ELEMENT_HANDLING):we(null);if(b=we(null),C(r,"tagNameCheck")&&Xt(r.tagNameCheck)&&(b.tagNameCheck=r.tagNameCheck),C(r,"attributeNameCheck")&&Xt(r.attributeNameCheck)&&(b.attributeNameCheck=r.attributeNameCheck),C(r,"allowCustomizedBuiltInElements")&&typeof r.allowCustomizedBuiltInElements=="boolean"&&(b.allowCustomizedBuiltInElements=r.allowCustomizedBuiltInElements),v(b),se&&(tt=!1),Fe&&(ye=!0),_e&&(y=m({},pn),_=we(null),_e.html===!0&&(m(y,un),m(_,mn)),_e.svg===!0&&(m(y,yt),m(_,At),m(_,Ye)),_e.svgFilters===!0&&(m(y,_t),m(_,At),m(_,Ye)),_e.mathMl===!0&&(m(y,bt),m(_,dn),m(_,Ye))),oe.tagCheck=null,oe.attributeCheck=null,C(e,"ADD_TAGS")&&(typeof e.ADD_TAGS=="function"?oe.tagCheck=e.ADD_TAGS:ce(e.ADD_TAGS)&&(y===Mt&&(y=F(y)),m(y,e.ADD_TAGS,A))),C(e,"ADD_ATTR")&&(typeof e.ADD_ATTR=="function"?oe.attributeCheck=e.ADD_ATTR:ce(e.ADD_ATTR)&&(_===vt&&(_=F(_)),m(_,e.ADD_ATTR,A))),C(e,"ADD_URI_SAFE_ATTR")&&ce(e.ADD_URI_SAFE_ATTR)&&m(lt,e.ADD_URI_SAFE_ATTR,A),C(e,"FORBID_CONTENTS")&&ce(e.FORBID_CONTENTS)&&(K===ct&&(K=F(K)),m(K,e.FORBID_CONTENTS,A)),C(e,"ADD_FORBID_CONTENTS")&&ce(e.ADD_FORBID_CONTENTS)&&(K===ct&&(K=F(K)),m(K,e.ADD_FORBID_CONTENTS,A)),it&&(y["#text"]=!0),pe&&m(y,["html","head","body"]),y.table&&(m(y,["tbody"]),delete Le.tbody),e.TRUSTED_TYPES_POLICY){if(typeof e.TRUSTED_TYPES_POLICY.createHTML!="function")throw de('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');if(typeof e.TRUSTED_TYPES_POLICY.createScriptURL!="function")throw de('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');let a=w;w=e.TRUSTED_TYPES_POLICY;try{X=V("")}catch(f){throw w=a,f}}else e.TRUSTED_TYPES_POLICY===null?(w=void 0,X=""):(w===void 0&&(w=ee()),w&&typeof X=="string"&&(X=V("")));M&&M(e),Ae=e},Vt=m({},[...yt,..._t,...Or]),qt=m({},[...bt,...Lr]),Jn=function(e,r,a){return r.namespaceURI===Z?e==="svg":r.namespaceURI===Ge?e==="svg"&&(a==="annotation-xml"||pt[a]):!!Vt[e]},er=function(e,r,a){return r.namespaceURI===Z?e==="math":r.namespaceURI===$e?e==="math"&&mt[a]:!!qt[e]},tr=function(e,r,a){return r.namespaceURI===$e&&!mt[a]||r.namespaceURI===Ge&&!pt[a]?!1:!qt[e]&&(qn[e]||!Vt[e])},nr=function(e){let r=Y(e);(!r||!r.tagName)&&(r={namespaceURI:be,tagName:"template"});let a=Ue(e.tagName),f=Ue(r.tagName);return ut[e.namespaceURI]?e.namespaceURI===$e?Jn(a,r,f):e.namespaceURI===Ge?er(a,r,f):e.namespaceURI===Z?tr(a,r,f):!!(Ie==="application/xhtml+xml"&&ut[e.namespaceURI]):!1},ie=function(e){Se(t.removed,{element:e});try{Y(e).removeChild(e)}catch{if(ue(e),!Y(e))throw de("a node selected for removal could not be detached from its tree and cannot be safely returned; refusing to sanitize in place")}},Kt=function(e){let r=U(e);if(r){let f=[];De(r,p=>{Se(f,p)}),De(f,p=>{try{ue(p)}catch{}})}let a=ge(e);if(a)for(let f=a.length-1;f>=0;--f){let p=a[f],d=p&&p.name;if(typeof d=="string")try{e.removeAttribute(d)}catch{}}},me=function(e,r){try{Se(t.removed,{attribute:r.getAttributeNode(e),from:r})}catch{Se(t.removed,{attribute:null,from:r})}if(r.removeAttribute(e),e==="is")if(ye||Fe)try{ie(r)}catch{}else try{r.setAttribute(e,"")}catch{}},rr=function(e){let r=ge(e);if(r)for(let a=r.length-1;a>=0;--a){let f=r[a],p=f&&f.name;if(!(typeof p!="string"||_[A(p)]))try{e.removeAttribute(p)}catch{}}},or=function(e){let r=[e];for(;r.length>0;){let a=r.pop();(N?N(a):a.nodeType)===Q.element&&rr(a);let p=U(a);if(p)for(let d=p.length-1;d>=0;--d)r.push(p[d])}},Zt=function(e){let r=null,a=null;if(st)e="<remove></remove>"+e;else{let d=an(e,/^[\r\n\t ]+/);a=d&&d[0]}Ie==="application/xhtml+xml"&&be===Z&&(e='<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>'+e+"</body></html>");let f=w?V(e):e;if(be===Z)try{r=new R().parseFromString(f,Ie)}catch{}if(!r||!r.documentElement){r=Ee.createDocument(be,"template",null);try{r.documentElement.innerHTML=ft?X:f}catch{}}let p=r.body||r.documentElement;return e&&a&&p.insertBefore(o.createTextNode(a),p.childNodes[0]||null),be===Z?et.call(r,pe?"html":"body")[0]:pe?r.documentElement:p},Qt=function(e){return ze.call(e.ownerDocument||e,e,h.SHOW_ELEMENT|h.SHOW_COMMENT|h.SHOW_TEXT|h.SHOW_PROCESSING_INSTRUCTION|h.SHOW_CDATA_SECTION,null)},Be=function(e){return e=Me(e,Gn," "),e=Me(e,$n," "),e=Me(e,Bn," "),e},ht=function(e){var r;e.normalize();let a=ze.call(e.ownerDocument||e,e,h.SHOW_TEXT|h.SHOW_COMMENT|h.SHOW_CDATA_SECTION|h.SHOW_PROCESSING_INSTRUCTION,null),f=a.nextNode();for(;f;)f.data=Be(f.data),f=a.nextNode();let p=(r=e.querySelectorAll)===null||r===void 0?void 0:r.call(e,"template");p&&De(p,d=>{Re(d.content)&&ht(d.content)})},je=function(e){let r=G?G(e):null;return typeof r!="string"||A(r)!=="form"?!1:typeof e.nodeName!="string"||typeof e.textContent!="string"||typeof e.removeChild!="function"||e.attributes!==ge(e)||typeof e.removeAttribute!="function"||typeof e.setAttribute!="function"||typeof e.namespaceURI!="string"||typeof e.insertBefore!="function"||typeof e.hasChildNodes!="function"||e.nodeType!==N(e)||e.childNodes!==U(e)},Re=function(e){if(!N||typeof e!="object"||e===null)return!1;try{return N(e)===Q.documentFragment}catch{return!1}},Ce=function(e){if(!N||typeof e!="object"||e===null)return!1;try{return typeof N(e)=="number"}catch{return!1}};function ne(c,e,r){c.length!==0&&De(c,a=>{a.call(t,e,r,Ae)})}let sr=function(e,r){return!!(Ne&&e.hasChildNodes()&&!Ce(e.firstElementChild)&&D(gn,e.textContent)&&D(gn,e.innerHTML)||Ne&&e.namespaceURI===Z&&r==="style"&&Ce(e.firstElementChild)||e.nodeType===Q.processingInstruction||Ne&&e.nodeType===Q.comment&&D(zr,e.data))},ir=function(e,r){if(!Le[r]&&tn(r)&&(b.tagNameCheck instanceof RegExp&&D(b.tagNameCheck,r)||b.tagNameCheck instanceof Function&&b.tagNameCheck(r)))return!1;if(it&&!K[r]){let a=Y(e),f=U(e);if(f&&a){let p=f.length;for(let d=p-1;d>=0;--d){let I=at?f[d]:W(f[d],!0);a.insertBefore(I,T(e))}}}return ie(e),!0},Jt=function(e){if(ne(S.beforeSanitizeElements,e,null),je(e))return ie(e),!0;let r=A(G?G(e):e.nodeName);if(ne(S.uponSanitizeElement,e,{tagName:r,allowedTags:y}),sr(e,r))return ie(e),!0;if(Le[r]||!(oe.tagCheck instanceof Function&&oe.tagCheck(r))&&!y[r])return ir(e,r);if((N?N(e):e.nodeType)===Q.element&&!nr(e)||(r==="noscript"||r==="noembed"||r==="noframes")&&D(Fr,e.innerHTML))return ie(e),!0;if(se&&e.nodeType===Q.text){let f=Be(e.textContent);e.textContent!==f&&(Se(t.removed,{element:e.cloneNode()}),e.textContent=f)}return ne(S.afterSanitizeElements,e,null),!1},en=function(e,r,a){if(Ut[r]||Ft&&(r==="id"||r==="name")&&(a in o||a in Qn))return!1;let f=_[r]||oe.attributeCheck instanceof Function&&oe.attributeCheck(r,e);if(!(tt&&D(jn,r))){if(!(Pt&&D(Wn,r))){if(f){if(!lt[r]){if(!D(Dt,Me(a,Ct,""))){if(!((r==="src"||r==="xlink:href"||r==="href")&&e!=="script"&&cn(a,"data:")===0&&$t[e])){if(!(kt&&!D(Yn,Me(a,Ct,"")))){if(a)return!1}}}}}else if(!(tn(e)&&(b.tagNameCheck instanceof RegExp&&D(b.tagNameCheck,e)||b.tagNameCheck instanceof Function&&b.tagNameCheck(e))&&(b.attributeNameCheck instanceof RegExp&&D(b.attributeNameCheck,r)||b.attributeNameCheck instanceof Function&&b.attributeNameCheck(r,e))||r==="is"&&b.allowCustomizedBuiltInElements&&(b.tagNameCheck instanceof RegExp&&D(b.tagNameCheck,a)||b.tagNameCheck instanceof Function&&b.tagNameCheck(a))))return!1}}return!0},ar=m({},["annotation-xml","color-profile","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","missing-glyph"]),tn=function(e){return!ar[Ue(e)]&&D(Xn,e)},cr=function(e,r,a,f){if(w&&typeof H=="object"&&typeof H.getAttributeType=="function"&&!a)switch(H.getAttributeType(e,r)){case"TrustedHTML":return V(f);case"TrustedScriptURL":return ke(f)}return f},lr=function(e,r,a,f){try{a?e.setAttributeNS(a,r,f):e.setAttribute(r,f),je(e)?ie(e):sn(t.removed)}catch{me(r,e)}},nn=function(e){ne(S.beforeSanitizeAttributes,e,null);let r=e.attributes;if(!r||je(e))return;let a={attrName:"",attrValue:"",keepAttr:!0,allowedAttributes:_,forceKeepAttr:void 0},f=r.length,p=A(e.nodeName);for(;f--;){let d=r[f],I=d.name,x=d.namespaceURI,j=d.value,q=A(I),Tt=j,z=I==="value"?Tt:_r(Tt);if(a.attrName=q,a.attrValue=z,a.keepAttr=!0,a.forceKeepAttr=void 0,ne(S.uponSanitizeAttribute,e,a),z=a.attrValue,Ht&&(q==="id"||q==="name")&&cn(z,Gt)!==0&&(me(I,e),z=Gt+z),Ne&&D(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i,z)){me(I,e);continue}if(q==="attributename"&&an(z,"href")){me(I,e);continue}if(!a.forceKeepAttr){if(!a.keepAttr){me(I,e);continue}if(!zt&&D(Hr,z)){me(I,e);continue}if(se&&(z=Be(z)),!en(p,q,z)){me(I,e);continue}z=cr(p,q,x,z),z!==Tt&&lr(e,I,x,z)}}ne(S.afterSanitizeAttributes,e,null)},We=function(e){let r=null,a=Qt(e);for(ne(S.beforeSanitizeShadowDOM,e,null);r=a.nextNode();)if(ne(S.uponSanitizeShadowNode,r,null),Jt(r),nn(r),Re(r.content)&&We(r.content),(N?N(r):r.nodeType)===Q.element){let p=Oe(r);Re(p)&&(gt(p),We(p))}ne(S.afterSanitizeShadowDOM,e,null)},gt=function(e){let r=[{node:e,shadow:null}];for(;r.length>0;){let a=r.pop();if(a.shadow){We(a.shadow);continue}let f=a.node,d=(N?N(f):f.nodeType)===Q.element,I=U(f);if(I)for(let x=I.length-1;x>=0;--x)r.push({node:I[x],shadow:null});if(d){let x=G?G(f):null;if(typeof x=="string"&&A(x)==="template"){let j=f.content;Re(j)&&r.push({node:j,shadow:null})}}if(d){let x=Oe(f);Re(x)&&r.push({node:null,shadow:x},{node:x,shadow:null})}}};return t.sanitize=function(c){let e=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},r=null,a=null,f=null,p=null;if(ft=!c,ft&&(c="<!-->"),typeof c!="string"&&!Ce(c)&&(c=wr(c),typeof c!="string"))throw de("dirty is not a string, aborting");if(!t.isSupported)return c;nt?(y=rt,_=ot):dt(e),(S.uponSanitizeElement.length>0||S.uponSanitizeAttribute.length>0)&&(y=F(y)),S.uponSanitizeAttribute.length>0&&(_=F(_)),t.removed=[];let d=at&&typeof c!="string"&&Ce(c);if(d){let j=G?G(c):c.nodeName;if(typeof j=="string"){let q=A(j);if(!y[q]||Le[q])throw de("root node is forbidden and cannot be sanitized in-place")}if(je(c))throw de("root node is clobbered and cannot be sanitized in-place");try{gt(c)}catch(q){throw Kt(c),q}}else if(Ce(c))r=Zt("<!---->"),a=r.ownerDocument.importNode(c,!0),a.nodeType===Q.element&&a.nodeName==="BODY"||a.nodeName==="HTML"?r=a:r.appendChild(a),gt(a);else{if(!ye&&!se&&!pe&&c.indexOf("<")===-1)return w&&He?V(c):c;if(r=Zt(c),!r)return ye?null:He?X:""}r&&st&&ie(r.firstChild);let I=Qt(d?c:r);try{for(;f=I.nextNode();)Jt(f),nn(f),Re(f.content)&&We(f.content)}catch(j){throw d&&Kt(c),j}if(d)return De(t.removed,j=>{j.element&&or(j.element)}),se&&ht(c),c;if(ye){if(se&&ht(r),Fe)for(p=It.call(r.ownerDocument);r.firstChild;)p.appendChild(r.firstChild);else p=r;return(_.shadowroot||_.shadowrootmode)&&(p=Hn.call(s,p,!0)),p}let x=pe?r.outerHTML:r.innerHTML;return pe&&y["!doctype"]&&r.ownerDocument&&r.ownerDocument.doctype&&r.ownerDocument.doctype.name&&D(Pr,r.ownerDocument.doctype.name)&&(x="<!DOCTYPE "+r.ownerDocument.doctype.name+`>
|
|
3
|
+
`+x),se&&(x=Be(x)),w&&He?V(x):x},t.setConfig=function(){let c=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};dt(c),nt=!0,rt=y,ot=_},t.clearConfig=function(){Ae=null,nt=!1,rt=null,ot=null,w=E,X=""},t.isValidAttribute=function(c,e,r){Ae||dt({});let a=A(c),f=A(e);return en(a,f,r)},t.addHook=function(c,e){typeof e=="function"&&C(S,c)&&Se(S[c],e)},t.removeHook=function(c,e){if(C(S,c)){if(e!==void 0){let r=Er(S[c],e);return r===-1?void 0:yr(S[c],r,1)[0]}return sn(S[c])}},t.removeHooks=function(c){C(S,c)&&(S[c]=[])},t.removeAllHooks=function(){S=Tn()},t}var bn=_n();var Xe=bn(globalThis.window);var he=n=>Object.prototype.toString.call(n).slice(8,-1),P=n=>typeof n=="string"||n instanceof String;var An=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"];var Rn=/(?:#|%23)$/,Sn=/^(?:application\/(?:[\w.-]+\+)?xml|image\/svg\+xml|text\/(?:html|xml))(?:\s*;\s*|$)/i;var wn=/&#(x0*[\dA-F]{1,2}|0*\d{1,3});?/gi,xn=/^((?:[^#%]|%(?!23))*)(?:\?|%3F)$/i,wt=/^[a-z][\da-z+.-]*$/,On=/^(?:web\+[a-z]+|ext\+[a-z][\da-z.-]*)$/,Pe=/^(?:java|vb)script$/i,xt=/^(?:(?:java|vb)script|blob)$/i,Ve=/["'<>]|%(?:22|27|3C|3E)|&(?:apos|lt|gt|quot|#0*(?:34|39|60|62)|#x0*(?:22|27|3C|3E));/i,Ln=/^%[\dA-F]{2}$/i,Ot=/&(?=[#a-z0-9])(?![a-z0-9]+=)/i,Nn=/^(?:\/{2,}|\\|[a-z][a-z\d+\-.]*:[^/])/i;var In=[9,10,13,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];var Lt=new Set(In),qe=new Map([[128,8364],[130,8218],[131,402],[132,8222],[133,8230],[134,8224],[135,8225],[136,710],[137,8240],[138,352],[139,8249],[140,338],[142,381],[145,8216],[146,8217],[147,8220],[148,8221],[149,8226],[150,8211],[151,8212],[152,732],[153,8482],[154,353],[155,8250],[156,339],[158,382],[159,376]]),Xr=()=>{let n=new Map;for(let t=0;t<256;t++)!Lt.has(t)&&!qe.has(t)&&n.set(t,`\\x${t.toString(16).padStart(2,"0").toUpperCase()}`);return n},Ke=Xr();var[xe,qr,Kr,Zr,Qr,Jr]=["&","#","<",">",'"',"'"].map(n=>`%${n.charCodeAt(0).toString(16).toUpperCase()}`),eo={[xe]:`${xe}amp;`,[Kr]:`${xe}lt;`,[Zr]:`${xe}gt;`,[Qr]:`${xe}quot;`,[Jr]:`${xe}${qr}39;`},Uo=Array.from({length:256},(n,t)=>`%${t.toString(16).padStart(2,"0").toUpperCase()}`),Dn=globalThis.process?.versions?.node!==void 0,to=new RegExp(`[${[...Ke.values()].join("")}]`),no=new RegExp(`[${[...Ke.values()].join("")}]`,"g"),Po=new TextEncoder,ro=new TextDecoder("utf-8",{fatal:!0}),Qe=class{#e=new Set(An);get(){return[...this.#e]}has(t){return this.#e.has(t)}verify(t,o=this.#e){if(!P(t))return!1;try{let{protocol:s}=new URL(t.normalize("NFKC")),i=s.replace(/:$/,""),l=i.split("+");return l.some(g=>Pe.test(g))?!1:On.test(i)||l.every(g=>o.has(g))}catch{return!1}}};var Mn=n=>{if(!P(n))return n;let t=Ln.test(n)?n.toUpperCase():n;return eo[t]??n},vn=n=>{if(!P(n))throw new TypeError(`Expected String but got ${he(n)}.`);let t=n.replace(/\s/g,""),o;try{o=atob(t)}catch{throw new Error(`Invalid base64 data: ${n}`)}let s;if(Dn&&globalThis.Buffer)s=globalThis.Buffer.from(o,"latin1");else{let i=o.length;s=new Uint8Array(i);for(let l=0;l<i;l++)s[l]=o.charCodeAt(l)}try{let i=ro.decode(s);return to.test(i)?t:i}catch{return t}},oo=(n,t)=>{let o=/x/i.test(t[0])?parseInt(t.substring(1),16):parseInt(t,10);if(Number.isInteger(o)){if(Lt.has(o))return String.fromCharCode(o);if(qe.has(o)){let s=qe.get(o);return String.fromCodePoint(s)}else if(Ke.has(o))return""}return n},Un=n=>P(n)?n.replace(Rn,"").replace(xn,"$1"):n,Pn=(n,t=0)=>{if(!P(n))throw new TypeError(`Expected String but got ${he(n)}.`);if(!Number.isInteger(t))throw new TypeError(`Expected Number but got ${he(t)}.`);let o;try{o=decodeURIComponent(n)}catch{o=n.replace(/(?:%[\dA-F]{2})+/gi,i=>{try{return decodeURIComponent(i)}catch{return i}})}o=o.replace(no,"");let s=0;for(;s+t<=16;s++){let i=o;if(o=o.replace(/&/gi,"&").replace(wn,oo),o===i)break}if(s+t>16&&/&#/.test(o))throw new Error("Character references nested too deeply.");return o},so=async n=>{let t=n.type?`${n.type};base64`:"base64",o=await n.arrayBuffer(),s=globalThis.Buffer.from(o).toString("base64");return`data:${t},${s}`},io=n=>new Promise((t,o)=>{let s=new globalThis.FileReader;s.addEventListener("error",()=>o(s.error)),s.addEventListener("abort",()=>t(null)),s.addEventListener("load",()=>t(s.result)),s.readAsDataURL(n)}),ao=async n=>{let t=n.type?`${n.type};base64`:"base64",o=await n.arrayBuffer(),s=new Uint8Array(o),i=[];for(let l=0;l<s.length;l+=8192)i.push(String.fromCharCode(...s.subarray(l,l+8192)));return`data:${t},${btoa(i.join(""))}`},kn=async(n,t=16777216)=>{if(Number.isInteger(n?.size)){if(Number.isInteger(t)&&n.size>t){let o=`Blob size (${n.size} bytes) exceeds max (${t} bytes).`;throw new DOMException(o,"NotReadableError")}}else return null;return Dn&&globalThis.Buffer?so(n):globalThis.FileReader?io(n):ao(n)};var co=Object.freeze(["href","origin","protocol","username","password","host","hostname","port","pathname","search","hash"]),lo=Object.freeze({RETURN_DOM:!1,RETURN_DOM_FRAGMENT:!1,RETURN_TRUSTED_TYPE:!1}),le=(n,t,o)=>{n&&console.warn(`[URLSanitizer Debug] ${t}`,o?o.message:"")},Nt=class n extends Qe{#e;static#t=null;static#n=null;static#s(t,o){if(!o.attrValue||!/^\s*data:/i.test(o.attrValue))return;let s=n.#t,i=n.#n;if(!s||!i)return;let l;try{l=new URL(o.attrValue)}catch{return}if(l.protocol==="data:"){let u=o.attrValue;if(i.recurse||(i.recurse=new Set),i.recurse.has(u)){let g=`Circular Data URL detected and skipped: ${u}`;le(i.debug,g),o.attrValue="";return}i.nest++,i.recurse.add(u);try{let g=s.#o(u,{allow:["data"],deny:[],only:[],allowRelative:!1},i);o.attrValue=g||""}finally{i.nest--,i.recurse.delete(u)}}}static{Xe.setConfig(lo),Xe.addHook("uponSanitizeAttribute",n.#s)}constructor(){super(),this.#e=new Set(super.get())}#r(t,o,s,i,l){if(xt.test(t))return!1;if(t.split("+").some(h=>Pe.test(h))||!wt.test(t)){let h=`Failed to add scheme '${t}' in '${o}' list.`;return le(l.debug,h),!1}return i.set(t,!0),s.add(t),!0}#i(t,o){let s=t;try{s=decodeURIComponent(t)}catch{}let i=n.#t,l=n.#n;n.#t=this,n.#n=o;let u;try{u=o.domPurify.sanitize(s)}finally{n.#t=i,n.#n=l}u=Un(u);try{return encodeURI(u)}catch{return u}}#o(t,o,s){if(s.nest>16)throw new Error("Data URLs nested too deeply.");let{allow:i,deny:l,only:u,allowRelative:g}=o,h=this.#e,k=!1,R=new Map(s.schemeMap);if(u.length){h=new Set;for(let T of u)P(T)&&(T=T.trim(),this.#r(T,"only",h,R,s)&&!k&&(k=!0))}else{if(i.length){h=new Set(this.#e);for(let T of i)P(T)&&this.#r(T.trim(),"allow",h,R,s)}if(l.length)for(let T of l)P(T)&&(T=T.trim(),T&&R.set(T,!1))}let H,L=super.verify(t,h),W=!1,ue="";if(!L&&g&&!Nn.test(t))try{let T=new URL(t,"http://dummy.local"),U=new URL(t.normalize("NFKC"),"http://dummy.local");T.protocol==="http:"&&T.hostname==="dummy.local"&&U.protocol==="http:"&&(L=!0,W=!0,ue=`${T.pathname}${T.search}${T.hash}`)}catch(T){le(s.debug,"Failed to parse relative URL.",T)}if(L){let T,U,Y,Oe,ge,N="",G=[],w=!1;if(W)w=!0;else if({hash:T,href:U,pathname:Y,protocol:Oe,search:ge}=new URL(t),N=Oe.replace(/:$/,"").normalize("NFKC"),G=N.split("+"),k)w=G.every(E=>R.get(E));else for(let[E,B]of R.entries())if(w=B||N!==E&&G.every($=>$!==E),!w)break;if(w){let X=W?!1:G.includes("data"),E=W?ue:U;if(X){let[B,...$]=Y.split(","),Te=`${$.join(",")}${ge}${T}`,V=B.split(";"),ke=V[V.length-1]==="base64",ee=Te;if(ke)try{ee=vn(Te)}catch(te){le(s.debug,"Failed to parse base64 data.",te),E=""}try{let Ee=Pn(ee).trim().normalize("NFKC"),{protocol:ze}=new URL(Ee,"http://dummy.local");ze.replace(/:$/,"").split("+").some(et=>xt.test(et))&&(E="")}catch(te){le(s.debug,"Failed to parse inner data URL protocol.",te),E=""}(!B||Sn.test(B))&&(ee=this.#i(ee,s)),E&&ee?(ke&&ee!==Te&&V.pop(),E=`${N}:${V.join(";")},${ee}`):E=""}if(!X){if(Ve.test(E)){let B=Ve.exec(E),{index:$}=B;E=E.substring(0,$).replace(/[?&]$/,"")}if(Ot.test(E)){let B=Ot.exec(E),{index:$}=B;E=E.substring(0,$).replace(/[?&]$/,"")}}E&&(H=E)}}return H||null}sanitize(t,o){if(!t||!P(t))return null;let s=Number.isInteger(o?.maxLength)&&o.maxLength?o.maxLength:0;if(s&&t.length>s){let g=`URL length ${t.length} exceeds maxLength ${s}.`;throw new RangeError(g)}if(!(o&&(Array.isArray(o.deny)&&o.deny.length>0||Array.isArray(o.only)&&o.only.length>0||o.allowRelative))&&(t.startsWith("https://")||t.startsWith("http://"))&&!Ve.test(t)&&!t.includes("data:"))try{let{href:g}=new URL(t);return g.replace(/%26/g,Mn)}catch{return null}let l={allow:Array.isArray(o?.allow)?o.allow:[],deny:Array.isArray(o?.deny)?o.deny:[],only:Array.isArray(o?.only)?o.only:[],allowRelative:!!o?.allowRelative},u={debug:!!o?.debug,domPurify:Xe,nest:0,recurse:null,schemeMap:new Map([["blob",!1],["data",!1],["file",!1],["javascript",!1],["vbscript",!1]])};return this.#o(t,l,u)}inspect(t,o){if(!P(t))throw new TypeError(`Expected String but got ${he(t)}.`);let s=new Map([["input",t]]),i,l=null,u=Number.isInteger(o?.maxLength)&&o.maxLength?o.maxLength:0;if(u&&t.length>u)l=`URL length ${t.length} exceeds maxLength ${u}.`;else if(this.verify(t)){let{protocol:g}=new URL(t);if(g==="blob:")i=t;else try{i=this.sanitize(t,o??{allow:["data"]}),i||(l="Sanitization failed (blocked by allowed schemes or rules).")}catch(h){l=h.message}}else l="Invalid URI syntax or scheme is not registered.";if(i){let g=new URL(i),{pathname:h,protocol:k}=g,H=k.replace(/:$/,"").split("+").includes("data");if(s.set("valid",!0),H){let L=new Map,[W,...ue]=h.split(","),T=`${ue.join(",")}${g.search}${g.hash}`,U=W.split(";"),Y=U[U.length-1]==="base64";Y&&U.pop(),L.set("mime",U.join(";")),L.set("base64",Y),L.set("data",T),s.set("data",Object.fromEntries(L))}else s.set("data",null);for(let L of co){let W=g[L];P(W)&&s.set(L,W)}}else s.set("valid",!1),l&&s.set("reason",l);return Object.fromEntries(s)}get(){return[...this.#e]}has(t){return this.#e.has(t)}add(t){if(!P(t))throw new TypeError(`Expected String but got ${he(t)}.`);if(t.split("+").some(i=>Pe.test(i))||!wt.test(t))throw new Error(`Invalid scheme: ${t}`);return this.#e.add(t),[...this.#e]}remove(t){return this.#e.delete(t)}reset(){this.#e=new Set(super.get())}verify(t,o=this.#e){return super.verify(t,o)}};var fe=new Nt,fo=async(n,t={allow:[],deny:[],only:[],allowRelative:!1,debug:!1,revokeObjectURL:!1,maxBlobSize:16777216})=>{let o=!!t?.debug,s=Number.isInteger(t?.maxBlobSize)&&t.maxBlobSize>0?t.maxBlobSize:16777216,i;if(n&&P(n)){let l;try{let{protocol:u}=new URL(n);l=u.replace(/:$/,"")}catch(u){le(o,`Invalid URL input format: ${n}`,u)}if(l==="blob"){let{allow:u,deny:g,only:h}=t;if(Array.isArray(u)&&u.includes("blob")&&!(Array.isArray(g)&&g.includes("blob"))||Array.isArray(h)&&h.includes("blob")){let k;try{k=await fetch(n).then(R=>R.blob()).then(R=>kn(R,s))}catch(R){let H=`Failed to fetch and convert blob URL: ${n}`;le(o,H,R)}if(k){let R={...t};Array.isArray(t.only)?R.only=t.only.includes("data")?t.only:[...t.only,"data"]:Array.isArray(t.allow)&&(R.allow=t.allow.includes("data")?t.allow:[...t.allow,"data"],Array.isArray(t.deny)&&(R.deny=t.deny.filter(H=>H!=="data"))),i=fe.sanitize(k,R)}}t?.revokeObjectURL&&URL.revokeObjectURL(n)}else(l||t.allowRelative)&&(i=fe.sanitize(n,t))}return i||null},uo=(n,t={allow:[],deny:[],only:[],allowRelative:!1,debug:!1,revokeObjectURL:!1})=>{let o=!!t?.debug,s;if(n&&P(n)){let i;try{let{protocol:l}=new URL(n);i=l.replace(/:$/,"")}catch(l){let u=`Invalid URL input format: ${n}`;le(o,u,l)}if(i==="blob")return t?.revokeObjectURL&&URL.revokeObjectURL(n),null;(i||t.allowRelative)&&(s=fe.sanitize(n,t))}return s||null},zn=async n=>fe.inspect(n),po=n=>zn(n),Fn=n=>fe.inspect(n),mo=n=>Fn(n),ho=async n=>fe.verify(n),go=n=>fe.verify(n),To=fe;export{To as default,zn as inspectURL,Fn as inspectURLSync,ho as isURI,go as isURISync,po as parseURL,mo as parseURLSync,fo as sanitizeURL,uo as sanitizeURLSync};
|
|
4
4
|
/*!
|
|
5
5
|
* URL Sanitizer
|
|
6
6
|
*
|
|
@@ -11,6 +11,6 @@ In order to be iterable, non-array objects must have a [Symbol.iterator]() metho
|
|
|
11
11
|
/*! Bundled license information:
|
|
12
12
|
|
|
13
13
|
dompurify/dist/purify.es.mjs:
|
|
14
|
-
(*! @license DOMPurify 3.4.
|
|
14
|
+
(*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE *)
|
|
15
15
|
*/
|
|
16
16
|
//# sourceMappingURL=url-sanitizer.min.js.map
|