https://smractionplan.ca/libraries/wet-boew/js/wet-boew.min.js?tmb444

1/*!
2 * Web Experience Toolkit (WET) / Boîte à outils de l'expérience Web (BOEW)
3 * wet-boew.github.io/wet-boew/License-en.html / wet-boew.github.io/wet-boew/Licence-fr.html
4 * v4.0.88.1 - 2025-06-04
5 *
6 */
7
8/*! Modernizr (Custom Build) | MIT & BSD */
9/*! @license DOMPurify 3.2.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.6/LICENSE */
10
11(function (global, factory) {
12  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
13  typeof define === 'function' && define.amd ? define(factory) :
14  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, global.DOMPurify = factory());
15})(this, (function () { 'use strict';
16
17  const {
18    entries,
19    setPrototypeOf,
20    isFrozen,
21    getPrototypeOf,
22    getOwnPropertyDescriptor
23  } = Object;
24  let {
25    freeze,
26    seal,
27    create
28  } = Object; // eslint-disable-line import/no-mutable-exports
29  let {
30    apply,
31    construct
32  } = typeof Reflect !== 'undefined' && Reflect;
33  if (!freeze) {
34    freeze = function freeze(x) {
35      return x;
36    };
37  }
38  if (!seal) {
39    seal = function seal(x) {
40      return x;
41    };
42  }
43  if (!apply) {
44    apply = function apply(fun, thisValue, args) {
45      return fun.apply(thisValue, args);
46    };
47  }
48  if (!construct) {
49    construct = function construct(Func, args) {
50      return new Func(...args);
51    };
52  }
53  const arrayForEach = unapply(Array.prototype.forEach);
54  const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);
55  const arrayPop = unapply(Array.prototype.pop);
56  const arrayPush = unapply(Array.prototype.push);
57  const arraySplice = unapply(Array.prototype.splice);
58  const stringToLowerCase = unapply(String.prototype.toLowerCase);
59  const stringToString = unapply(String.prototype.toString);
60  const stringMatch = unapply(String.prototype.match);
61  const stringReplace = unapply(String.prototype.replace);
62  const stringIndexOf = unapply(String.prototype.indexOf);
63  const stringTrim = unapply(String.prototype.trim);
64  const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);
65  const regExpTest = unapply(RegExp.prototype.test);
66  const typeErrorCreate = unconstruct(TypeError);
67  /**
68   * Creates a new function that calls the given function with a specified thisArg and arguments.
69   *
70   * @param func - The function to be wrapped and called.
71   * @returns A new function that calls the given function with a specified thisArg and arguments.
72   */
73  function unapply(func) {
74    return function (thisArg) {
75      if (thisArg instanceof RegExp) {
76        thisArg.lastIndex = 0;
77      }
78      for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
79        args[_key - 1] = arguments[_key];
80      }
81      return apply(func, thisArg, args);
82    };
83  }
84  /**
85   * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
86   *
87   * @param func - The constructor function to be wrapped and called.
88   * @returns A new function that constructs an instance of the given constructor function with the provided arguments.
89   */
90  function unconstruct(func) {
91    return function () {
92      for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
93        args[_key2] = arguments[_key2];
94      }
95      return construct(func, args);
96    };
97  }
98  /**
99   * Add properties to a lookup table
100   *
101   * @param set - The set to which elements will be added.
102   * @param array - The array containing elements to be added to the set.
103   * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.
104   * @returns The modified set with added elements.
105   */
106  function addToSet(set, array) {
107    let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase;
108    if (setPrototypeOf) {
109      // Make 'in' and truthy checks like Boolean(set.constructor)
110      // independent of any properties defined on Object.prototype.
111      // Prevent prototype setters from intercepting set as a this value.
112      setPrototypeOf(set, null);
113    }
114    let l = array.length;
115    while (l--) {
116      let element = array[l];
117      if (typeof element === 'string') {
118        const lcElement = transformCaseFunc(element);
119        if (lcElement !== element) {
120          // Config presets (e.g. tags.js, attrs.js) are immutable.
121          if (!isFrozen(array)) {
122            array[l] = lcElement;
123          }
124          element = lcElement;
125        }
126      }
127      set[element] = true;
128    }
129    return set;
130  }
131  /**
132   * Clean up an array to harden against CSPP
133   *
134   * @param array - The array to be cleaned.
135   * @returns The cleaned version of the array
136   */
137  function cleanArray(array) {
138    for (let index = 0; index < array.length; index++) {
139      const isPropertyExist = objectHasOwnProperty(array, index);
140      if (!isPropertyExist) {
141        array[index] = null;
142      }
143    }
144    return array;
145  }
146  /**
147   * Shallow clone an object
148   *
149   * @param object - The object to be cloned.
150   * @returns A new object that copies the original.
151   */
152  function clone(object) {
153    const newObject = create(null);

154    for (const [property, value] of entries(object)) {
155      const isPropertyExist = objectHasOwnProperty(object, property);
156      if (isPropertyExist) {
157        if (Array.isArray(value)) {
158          newObject[property] = cleanArray(value);
159        } else if (value && typeof value === 'object' && value.constructor === Object) {
160          newObject[property] = clone(value);
161        } else {
162          newObject[property] = value;
163        }
164      }
165    }
166    return newObject;
167  }
168  /**
169   * This method automatically checks if the prop is function or getter and behaves accordingly.
170   *
171   * @param object - The object to look up the getter function in its prototype chain.
172   * @param prop - The property name for which to find the getter function.
173   * @returns The getter function found in the prototype chain or a fallback function.
174   */
175  function lookupGetter(object, prop) {
176    while (object !== null) {
177      const desc = getOwnPropertyDescriptor(object, prop);
178      if (desc) {
179        if (desc.get) {
180          return unapply(desc.get);
181        }
182        if (typeof desc.value === 'function') {
183          return unapply(desc.value);
184        }
185      }
186      object = getPrototypeOf(object);
187    }
188    function fallbackValue() {
189      return null;
190    }
191    return fallbackValue;
192  }
193
194  const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']);
195  const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
196  const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']);
197  // List of SVG elements that are disallowed by default.
198  // We still need to know them so that we can do namespace
199  // checks properly in case one wants to add them to
200  // allow-list.
201  const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
202  const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']);
203  // Similarly to SVG, we want to know all MathML elements,
204  // even those that we disallow by default.
205  const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'n

219  const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
220  );
221  const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
222  const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
223  );
224  const DOCTYPE_NAME = seal(/^html$/i);
225  const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
226
227  var EXPRESSIONS = /*#__PURE__*/Object.freeze({
228    __proto__: null,
229    ARIA_ATTR: ARIA_ATTR,
230    ATTR_WHITESPACE: ATTR_WHITESPACE,
231    CUSTOM_ELEMENT: CUSTOM_ELEMENT,
232    DATA_ATTR: DATA_ATTR,
233    DOCTYPE_NAME: DOCTYPE_NAME,
234    ERB_EXPR: ERB_EXPR,
235    IS_ALLOWED_URI: IS_ALLOWED_URI,
236    IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA,
237    MUSTACHE_EXPR: MUSTACHE_EXPR,
238    TMPLIT_EXPR: TMPLIT_EXPR
239  });
240
241  /* eslint-disable @typescript-eslint/indent */
242  // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
243  const NODE_TYPE = {
244    element: 1,
245    attribute: 2,
246    text: 3,
247    cdataSection: 4,
248    entityReference: 5,
249    // Deprecated
250    entityNode: 6,
251    // Deprecated
252    progressingInstruction: 7,
253    comment: 8,
254    document: 9,
255    documentType: 10,
256    documentFragment: 11,
257    notation: 12 // Deprecated
258  };
259  const getGlobal = function getGlobal() {
260    return typeof window === 'undefined' ? null : window;
261  };
262  /**
263   * Creates a no-op policy for internal use only.
264   * Don't export this function outside this module!
265   * @param trustedTypes The policy factory.
266   * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix).
267   * @return The policy created (or null, if Trusted Types
268   * are not supported or creating the policy failed).
269   */
270  const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
271    if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
272      return null;
273    }
274    // Allow the callers to control the unique policy name
275    // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
276    // Policy creation with duplicate names throws in Trusted Types.
277    let suffix = null;
278    const ATTR_NAME = 'data-tt-policy-suffix';
279    if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) {
280      suffix = purifyHostElement.getAttribute(ATTR_NAME);
281    }
282    const policyName = 'dompurify' + (suffix ? '#' + suffix : '');
283    try {
284      return trustedTypes.createPolicy(policyName, {
285        createHTML(html) {
286          return html;
287        },
288        createScriptURL(scriptUrl) {
289          return scriptUrl;
290        }
291      });
292    } catch (_) {
293      // Policy creation failed (most likely another DOMPurify script has
294      // already run). Skip creating the policy, as this will only cause errors
295      // if TT are enforced.
296      console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
297      return null;
298    }
299  };
300  const _createHooksMap = function _createHooksMap() {
301    return {
302      afterSanitizeAttributes: [],
303      afterSanitizeElements: [],
304      afterSanitizeShadowDOM: [],
305      beforeSanitizeAttributes: [],
306      beforeSanitizeElements: [],
307      beforeSanitizeShadowDOM: [],
308      uponSanitizeAttribute: [],
309      uponSanitizeElement: [],
310      uponSanitizeShadowNode: []
311    };
312  };
313  function createDOMPurify() {
314    let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
315    const DOMPurify = root => createDOMPurify(root);
316    DOMPurify.version = '3.2.6';
317    DOMPurify.removed = [];
318    if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
319      // Not running in a browser, provide a factory function
320      // so that you can pass your own Window
321      DOMPurify.isSupported = false;
322      return DOMPurify;
323    }
324    let {
325      document
326    } = window;
327    const originalDocument = document;
328    const currentScript = originalDocument.currentScript;
329    const {
330      DocumentFragment,
331      HTMLTemplateElement,
332      Node,
333      Element,
334      NodeFilter,
335      NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap,
336      HTMLFormElement,
337      DOMParser,
338      trustedTypes
339    } = window;
340    const ElementPrototype = Element.prototype;
341    const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
342    const remove = lookupGetter(ElementPrototype, 'remove');
343    const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
344    const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
345    const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
346    // As per issue #47, the web-components registry is inherited by a
347    // new document created via createHTMLDocument. As per the spec
348    // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
349    // a new empty registry is used when creating a template contents owner
350    // document, so we use that as our parent document to ensure nothing
351    // is inherited.
352    if (typeof HTMLTemplateElement === 'function') {
353      const template = document.createElement('template');
354      if (template.content && template.content.ownerDocument) {
355        document = template.content.ownerDocument;
356      }
357    }
358    let trustedTypesPolicy;
359    let emptyHTML = '';
360    const {
361      implementation,
362      createNodeIterator,
363      createDocumentFragment,
364      getElementsByTagName
365    } = document;
366    const {
367      importNode
368    } = originalDocument;
369    let hooks = _createHooksMap();
370    /**
371     * Expose whether this browser supports running the full DOMPurify.
372     */
373    DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined;
374    const {
375      MUSTACHE_EXPR,
376      ERB_EXPR,
377      TMPLIT_EXPR,
378      DATA_ATTR,
379      ARIA_ATTR,
380      IS_SCRIPT_OR_DATA,
381      ATTR_WHITESPACE,
382      CUSTOM_ELEMENT
383    } = EXPRESSIONS;
384    let {
385      IS_ALLOWED_URI: IS_ALLOWED_URI$1
386    } = EXPRESSIONS;
387    /**
388     * We consider the elements and attributes below to be safe. Ideally
389     * don't add any new ones but feel free to remove unwanted ones.
390     */
391    /* allowed element names */
392    let ALLOWED_TAGS = null;
393    const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]);
394    /* Allowed attribute names */
395    let ALLOWED_ATTR = null;
396    const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]);
397    /*
398     * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements.
399     * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
400     * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
401     * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
402     */
403    let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, {
404      tagNameCheck: {
405        writable: true,
406        configurable: false,
407        enumerable: true,
408        value: null
409      },
410      attributeNameCheck: {
411        writable: true,
412        configurable: false,
413        enumerable: true,
414        value: null
415      },
416      allowCustomizedBuiltInElements: {
417        writable: true,
418        configurable: false,
419        enumerable: true,
420        value: false
421      }
422    }));
423    /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
424    let FORBID_TAGS = null;
425    /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
426    let FORBID_ATTR = null

426;
427    /* Decide if ARIA attributes are okay */
428    let ALLOW_ARIA_ATTR = true;
429    /* Decide if custom data attributes are okay */
430    let ALLOW_DATA_ATTR = true;
431    /* Decide if unknown protocols are okay */
432    let ALLOW_UNKNOWN_PROTOCOLS = false;
433    /* Decide if self-closing tags in attributes are allowed.
434     * Usually removed due to a mXSS issue in jQuery 3.0 */
435    let ALLOW_SELF_CLOSE_IN_ATTR = true;
436    /* Output should be safe for common template engines.
437     * This means, DOMPurify removes data attributes, mustaches and ERB
438     */
439    let SAFE_FOR_TEMPLATES = false;
440    /* Output should be safe even for XML used within HTML and alike.
441     * This means, DOMPurify removes comments when containing risky content.
442     */
443    let SAFE_FOR_XML = true;
444    /* Decide if document with <html>... should be returned */
445    let WHOLE_DOCUMENT = false;
446    /* Track whether config is already set on this instance of DOMPurify. */
447    let SET_CONFIG = false;
448    /* Decide if all elements (e.g. style, script) must be children of
449     * document.body. By default, browsers might move them to document.head */
450    let FORCE_BODY = false;
451    /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
452     * string (or a TrustedHTML object if Trusted Types are supported).
453     * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
454     */
455    let RETURN_DOM = false;
456    /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
457     * string  (or a TrustedHTML object if Trusted Types are supported) */
458    let RETURN_DOM_FRAGMENT = false;
459    /* Try to return a Trusted Type object instead of a string, return a string in
460     * case Trusted Types are not supported  */
461    let RETURN_TRUSTED_TYPE = false;
462    /* Output should be free from DOM clobbering attacks?
463     * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
464     */
465    let SANITIZE_DOM = true;
466    /* Achieve full DOM Clobbering protection by isolating the namespace of named
467     * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
468     *
469     * HTML/DOM spec rules that enable DOM Clobbering:
470     *   - Named Access on Window (§7.3.3)
471     *   - DOM Tree Accessors (§3.1.5)
472     *   - Form Element Parent-Child Relations (§4.10.3)
473     *   - Iframe srcdoc / Nested WindowProxies (§4.8.5)
474     *   - HTMLCollection (§4.2.10.2)
475     *
476     * Namespace isolation is implemented by prefixing `id` and `name` attributes
477     * with a constant string, i.e., `user-content-`
478     */
479    let SANITIZE_NAMED_PROPS = false;
480    const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
481    /* Keep element content when removing element? */
482    let KEEP_CONTENT = true;
483    /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
484     * of importing it into a new Document and returning a sanitized copy */
485    let IN_PLACE = false;
486    /* Allow usage of profiles like html, svg and mathMl */
487    let USE_PROFILES = {};
488    /* Tags to ignore content of when KEEP_CONTENT is true */
489    let FORBID_CONTENTS = null;
490    const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
491    /* Tags that are safe for data: URIs */
492    let DATA_URI_TAGS = null;
493    const DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
494    /* Attributes safe for values like "javascript:" */
495    let URI_SAFE_ATTRIBUTES = null;
496    const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
497    const MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
498    const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
499    const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
500    /* Document namespace */
501    let NAMESPACE = HTML_NAMESPACE;
502    let IS_EMPTY_INPUT = false;
503    /* Allowed XHTML+XML namespaces */
504    let ALLOWED_NAMESPACES = null;
505    const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
506    let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
507    let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
508    // Certain elements are allowed in both SVG and HTML
509    // namespace. We need to specify them explicitly
510    // so that they don't get erroneously deleted from
511    // HTML namespace.
512    const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
513    /* Parsing of strict XHTML documents */
514    let PARSER_MEDIA_TYPE = null;
515    const SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
516    const DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
517    let transformCaseFunc = null;
518    /* Keep a reference to config to pass to hooks */
519    let CONFIG = null;
520    /* Ideally, do not touch anything below this line */
521    /* ______________________________________________ */
522    const formElement = document.createElement('form');
523    const isRegexOrFunction = function isRegexOrFunction(testValue) {
524      return testValue instanceof RegExp || testValue instanceof Function;
525    };
526    /**
527     * _parseConfig
528     *
529     * @param cfg optional config literal
530     */
531    // eslint-disable-next-line complexity
532    const _parseConfig = function _parseConfig() {
533      let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
534      if (CONFIG && CONFIG === cfg) {
535        return;
536      }
537      /* Shield configuration object from tampering */
538      if (!cfg || typeof cfg !== 'object') {
539        cfg = {};
540      }
541      /* Shield configuration object from prototype pollution */
542      cfg = clone(cfg);
543      PARSER_MEDIA_TYPE =
544      // eslint-disable-next-line unicorn/prefer-includes
545      SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
546      // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
547      transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
548      /* Set configuration parameters */
549      ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS') ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
550      ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR') ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
551      ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
552      URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
553      DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
554      FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS') ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
555      FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS') ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
556      FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR') ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
557      USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES') ? cfg.USE_PROFILES : false;
558      ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
559      ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
560      ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
561      ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
562      SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
563      SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; // Default true
564      WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
565      RETURN_DOM = cfg.RETURN_DOM || false; // Default false
566      RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
567      RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
568      FORCE_BODY = cfg.FORCE_BODY || false; // Default false
569      SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
570      SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
571      KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
572      IN_PLACE = cfg.IN_PLACE || false; // Default false
573      IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
574      NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
575      MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS;
576      HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS;
577      CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || 

577{};
578      if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
579        CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
580      }
581      if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
582        CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
583      }
584      if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
585        CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
586      }
587      if (SAFE_FOR_TEMPLATES) {
588        ALLOW_DATA_ATTR = false;
589      }
590      if (RETURN_DOM_FRAGMENT) {
591        RETURN_DOM = true;
592      }
593      /* Parse profile info */
594      if (USE_PROFILES) {
595        ALLOWED_TAGS = addToSet({}, text);
596        ALLOWED_ATTR = [];
597        if (USE_PROFILES.html === true) {
598          addToSet(ALLOWED_TAGS, html$1);
599          addToSet(ALLOWED_ATTR, html);
600        }
601        if (USE_PROFILES.svg === true) {
602          addToSet(ALLOWED_TAGS, svg$1);
603          addToSet(ALLOWED_ATTR, svg);
604          addToSet(ALLOWED_ATTR, xml);
605        }
606        if (USE_PROFILES.svgFilters === true) {
607          addToSet(ALLOWED_TAGS, svgFilters);
608          addToSet(ALLOWED_ATTR, svg);
609          addToSet(ALLOWED_ATTR, xml);
610        }
611        if (USE_PROFILES.mathMl === true) {
612          addToSet(ALLOWED_TAGS, mathMl$1);
613          addToSet(ALLOWED_ATTR, mathMl);
614          addToSet(ALLOWED_ATTR, xml);
615        }
616      }

617      /* Merge configuration parameters */
618      if (cfg.ADD_TAGS) {
619        if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
620          ALLOWED_TAGS = clone(ALLOWED_TAGS);
621        }
622        addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
623      }
624      if (cfg.ADD_ATTR) {
625        if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
626          ALLOWED_ATTR = clone(ALLOWED_ATTR);
627        }
628        addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
629      }
630      if (cfg.ADD_URI_SAFE_ATTR) {
631        addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
632      }
633      if (cfg.FORBID_CONTENTS) {
634        if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
635          FORBID_CONTENTS = clone(FORBID_CONTENTS);
636        }
637        addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
638      }
639      /* Add #text in case KEEP_CONTENT is set to true */
640      if (KEEP_CONTENT) {
641        ALLOWED_TAGS['#text'] = true;
642      }
643      /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
644      if (WHOLE_DOCUMENT) {
645        addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
646      }
647      /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
648      if (ALLOWED_TAGS.table) {
649        addToSet(ALLOWED_TAGS, ['tbody']);
650        delete FORBID_TAGS.tbody;
651      }
652      if (cfg.TRUSTED_TYPES_POLICY) {
653        if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
654          throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
655        }
656        if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== 'function') {
657          throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');
658        }
659        // Overwrite existing TrustedTypes policy.
660        trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
661        // Sign local variables required by `sanitize`.
662        emptyHTML = trustedTypesPolicy.createHTML('');
663      } else {
664        // Uninitialized policy, attempt to initialize the internal dompurify policy.
665        if (trustedTypesPolicy === undefined) {
666          trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
667        }
668        // If creating the internal policy succeeded sign internal variables.
669        if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {
670          emptyHTML = trustedTypesPolicy.createHTML('');
671        }
672      }
673      // Prevent further manipulation of configuration.
674      // Not available in IE8, Safari 5, etc.
675      if (freeze) {
676        freeze(cfg);
677      }
678      CONFIG = cfg;
679    };
680    /* Keep track of all possible SVG and MathML tags
681     * so that we can perform the namespace checks
682     * correctly. */
683    const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]);
684    const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
685    /**
686     * @param element a DOM element whose namespace is being checked
687     * @returns Return false if the element has a
688     *  namespace that a spec-compliant parser would never
689     *  return. Return true otherwise.
690     */
691    const _checkValidNamespace = function _checkValidNamespace(element) {
692      let parent = getParentNode(element);
693      // In JSDOM, if we're inside shadow DOM, then parentNode
694      // can be null. We just simulate parent in this case.
695      if (!parent || !parent.tagName) {
696        parent = {
697          namespaceURI: NAMESPACE,
698          tagName: 'template'
699        };
700      }
701      const tagName = stringToLowerCase(element.tagName);
702      const parentTagName = stringToLowerCase(parent.tagName);
703      if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
704        return false;
705      }
706      if (element.namespaceURI === SVG_NAMESPACE) {
707        // The only way to switch from HTML namespace to SVG
708        // is via <svg>. If it happens via any other tag, then
709        // it should be killed.
710        if (parent.namespaceURI === HTML_NAMESPACE) {
711          return tagName === 'svg';
712        }
713        // The only way to switch from MathML to SVG is via`
714        // svg if parent is either <annotation-xml> or MathML
715        // text integration points.
716        if (parent.namespaceURI === MATHML_NAMESPACE) {
717          return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
718        }
719        // We only allow elements that are defined in SVG
720        // spec. All others are disallowed in SVG namespace.
721        return Boolean(ALL_SVG_TAGS[tagName]);
722      }
723      if (element.namespaceURI === MATHML_NAMESPACE) {
724        // The only way to switch from HTML namespace to MathML
725        // is via <math>. If it happens via any other tag, then
726        // it should be killed.
727        if (parent.namespaceURI === HTML_NAMESPACE) {
728          return tagName === 'math';
729        }
730        // The only way to switch from SVG to MathML is via
731        // <math> and HTML integration points
732        if (parent.namespaceURI === SVG_NAMESPACE) {
733          return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
734        }
735        // We only allow elements that are defined in MathML
736        // spec. All others are disallowed in MathML namespace.
737        return Boolean(ALL_MATHML_TAGS[tagName]);
738      }
739      if (element.namespaceURI === HTML_NAMESPACE) {
740        // The only way to switch from SVG to HTML is via
741        // HTML integration points, and from MathML to HTML
742        // is via MathML text integration points
743        if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
744          return false;

773        // eslint-disable-next-line unicorn/prefer-dom-node-remove
774        getParentNode(node).removeChild(node);
775      } catch (_) {
776        remove(node);
777      }
778    };
779    /**
780     * _removeAttribute
781     *
782     * @param name an Attribute name
783     * @param element a DOM node
784     */
785    const _removeAttribute = function _removeAttribute(name, element) {
786      try {
787        arrayPush(DOMPurify.removed, {
788          attribute: element.getAttributeNode(name),
789          from: element
790        });
791      } catch (_) {
792        arrayPush(DOMPurify.removed, {
793          attribute: null,
794          from: element
795        });
796      }
797      element.removeAttribute(name);
798      // We void attribute values for unremovable "is" attributes
799      if (name === 'is') {
800        if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
801          try {
802            _forceRemove(element);
803          } catch (_) {}
804        } else {
805          try {
806            element.setAttribute(name, '');
807          } catch (_) {}
808        }
809      }
810    };
811    /**
812     * _initDocument
813     *
814     * @param dirty - a string of dirty markup
815     * @return a DOM, filled with the dirty markup
816     */
817    const _initDocument = function _initDocument(dirty) {
818      /* Create a HTML document */
819      let doc = null;
820      let leadingWhitespace = null;
821      if (FORCE_BODY) {
822        dirty = '<remove></remove>' + dirty;
823      } else {
824        /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
825        const matches = stringMatch(dirty, /^[\r\n\t ]+/);
826        leadingWhitespace = matches && matches[0];
827      }
828      if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
829        // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
830        dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
831      }
832      const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
833      /*
834       * Use the DOMParser API by default, fallback later if needs be
835       * DOMParser not work for svg when has multiple root element.
836       */
837      if (NAMESPACE === HTML_NAMESPACE) {
838        try {
839          doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
840        } catch (_) {}
841      }
842      /* Use createHTMLDocument in case DOMParser is not available */
843      if (!doc || !doc.documentElement) {
844        doc = implementation.createDocument(NAMESPACE, 'template', null);
845        try {
846          doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
847        } catch (_) {
848          // Syntax error if dirtyPayload is invalid xml
849        }
850      }
851      const body = doc.body || doc.documentElement;
852      if (dirty && leadingWhitespace) {
853        body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
854      }
855      /* Work on whole document or just its body */
856      if (NAMESPACE === HTML_NAMESPACE) {
857        return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
858      }
859      return WHOLE_DOCUMENT ? doc.documentElement : body;
860    };
861    /**
862     * Creates a NodeIterator object that you can use to traverse filtered lists of nodes or elements in a document.
863     *
864     * @param root The root element or node to start traversing on.
865     * @return The created NodeIterator
866     */
867    const _createNodeIterator = function _createNodeIterator(root) {
868      return createNodeIterator.call(root.ownerDocument || root, root,
869      // eslint-disable-next-line no-bitwise
870      NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
871    };
872    /**
873     * _isClobbered
874     *
875     * @param element element to check for clobbering attacks
876     * @return true if clobbered, false if safe
877     */
878    const _isClobbered = function _isClobbered(element) {
879      return element instanceof HTMLFormElement && (typeof element.nodeName !== 'string' || typeof element.textContent !== 'string' || typeof element.removeChild !== 'function' || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function');
880    };
881    /**
882     * Checks whether the given object is a DOM node.
883     *
884     * @param value object to check whether it's a DOM node
885     * @return true is object is a DOM node
886     */
887    const _isNode = function _isNode(value) {
888      return typeof Node === 'function' && value instanceof Node;
889    };
890    function _executeHooks(hooks, currentNode, data) {
891      arrayForEach(hooks, hook => {
892        hook.call(DOMPurify, currentNode, data, CONFIG);
893      });
894    }
895    /**
896     * _sanitizeElements
897     *
898     * @protect nodeName
899     * @protect textContent
900     * @protect removeChild
901     * @param currentNode to check for permission to exist
902     * @return true if node was killed, false if left alive
903     */
904    const _sanitizeElements = function _sanitizeElements(currentNode) {
905      let content = null;
906      /* Execute a hook if present */
907      _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
908      /* Check if element is clobbered or can clobber */
909      if (_isClobbered(currentNode)) {
910        _forceRemove(currentNode);
911        return true;
912      }
913      /* Now let's check the element's type and name */
914      const tagName = transformCaseFunc(currentNode.nodeName);
915      /* Execute a hook if present */
916      _executeHooks(hooks.uponSanitizeElement, currentNode, {
917        tagName,
918        allowedTags: ALLOWED_TAGS
919      });
920      /* Detect mXSS attempts abusing namespace confusion */
921      if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
922        _forceRemove(currentNode);
923        return true;
924      }
925      /* Remove any occurrence of processing instructions */
926      if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
927        _forceRemove(currentNode);
928        return true;
929      }
930      /* Remove any kind of possibly harmful comments */
931      if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
932        _forceRemove(currentNode);
933        return true;
934      }
935      /* Remove element if anything forbids its presence */
936      if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
937        /* Check if we have a custom element to handle */
938        if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
939          if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) {
940            return false;

941          }
942          if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) {
943            return false;
944          }
945        }
946        /* Keep content except for bad-listed elements */
947        if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
948          const parentNode = getParentNode(currentNode) || currentNode.parentNode;
949          const childNodes = getChildNodes(currentNode) || currentNode.childNodes;
950          if (childNodes && parentNode) {
951            const childCount = childNodes.length;
952            for (let i = childCount - 1; i >= 0; --i) {
953              const childClone = cloneNode(childNodes[i], true);
954              childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
955              parentNode.insertBefore(childClone, getNextSibling(currentNode));
956            }
957          }
958        }
959        _forceRemove(currentNode);
960        return true;
961      }
962      /* Check whether element has a valid namespace */
963      if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
964        _forceRemove(currentNode);
965        return true;
966      }
967      /* Make sure that older browsers don't get fallback-tag mXSS */
968      if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
969        _forceRemove(currentNode);
970        return true;
971      }
972      /* Sanitize element content to be template-safe */
973      if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
974        /* Get the element's text content */
975        content = currentNode.textContent;
976        arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
977          content = stringReplace(content, expr, ' ');
978        });
979        if (currentNode.textContent !== content) {
980          arrayPush(DOMPurify.removed, {
981            element: currentNode.cloneNode()
982          });
983          currentNode.textContent = content;
984        }
985      }
986      /* Execute a hook if present */
987      _executeHooks(hooks.afterSanitizeElements, currentNode, null);
988      return false;
989    };
990    /**
991     * _isValidAttribute
992     *
993     * @param lcTag Lowercase tag name of containing element.
994     * @param lcName Lowercase attribute name.
995     * @param value Attribute value.
996     * @return Returns true if `value` is valid, otherwise false.
997     */
998    // eslint-disable-next-line complexity
999    const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
1000      /* Make sure attribute cannot clobber */
1001      if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
1002        return false;
1003      }
1004      /* Allow valid data-* attributes: At least one character after "-"
1005          (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
1006          XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
1007          We don't need to check the value; it's always URI safe. */
1008      if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
1009        if (
1010        // First condition does a very basic check if a) it's basically a valid custom element tagname AND
1011        // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1012        // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
1013        _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) ||
1014        // Alternative, second condition checks if it's an `is`-attribute, AND
1015        // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1016        lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
1017          return false;

1018        }
1019        /* Check value is safe. First, is attr inert? If so, is safe */
1020      } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA, stringReplace(value, ATTR_WHITESPACE, ''))) ; else if (value) {
1021        return false;
1022      } else ;
1023      return true;
1024    };
1025    /**
1026     * _isBasicCustomElement
1027     * checks if at least one dash is included in tagName, and it's not the first char
1028     * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
1029     *
1030     * @param tagName name of the tag of the node to sanitize
1031     * @returns Returns true if the tag name meets the basic criteria for a custom element, otherwise false.
1032     */
1033    const _isBasicCustomElement = function _isBasicCustomElement(tagName) {
1034      return tagName !== 'annotation-xml' && stringMatch(tagName, CUSTOM_ELEMENT);
1035    };
1036    /**
1037     * _sanitizeAttributes
1038     *
1039     * @protect attributes
1040     * @protect nodeName
1041     * @protect removeAttribute
1042     * @protect setAttribute
1043     *
1044     * @param currentNode to sanitize
1045     */
1046    const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
1047      /* Execute a hook if present */
1048      _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
1049      const {
1050        attributes
1051      } = currentNode;
1052      /* Check if we have attributes; if not we might have a text node */
1053      if (!attributes || _isClobbered(currentNode)) {
1054        return;
1055      }
1056      const hookEvent = {
1057        attrName: '',
1058        attrValue: '',
1059        keepAttr: true,
1060        allowedAttributes: ALLOWED_ATTR,
1061        forceKeepAttr: undefined
1062      };
1063      let l = attributes.length;
1064      /* Go backwards over all attributes; safely remove bad ones */
1065      while (l--) {
1066        const attr = attributes[l];
1067        const {
1068          name,
1069          namespaceURI,
1070          value: attrValue
1071        } = attr;
1072        const lcName = transformCaseFunc(name);
1073        const initValue = attrValue;
1074        let value = name === 'value' ? initValue : stringTrim(initValue);
1075        /* Execute a hook if present */
1076        hookEvent.attrName = lcName;
1077        hookEvent.attrValue = value;
1078        hookEvent.keepAttr = true;
1079        hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
1080        _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
1081        value = hookEvent.attrValue;
1082        /* Full DOM Clobbering protection via namespace isolation,
1083         * Prefix id and name attributes with `user-content-`
1084         */
1085        if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
1086          // Remove the attribute with this value
1087          _removeAttribute(name, currentNode);
1088          // Prefix the value and later re-create the attribute with the sanitized value
1089          value = SANITIZE_NAMED_PROPS_PREFIX + value;
1090        }
1091        /* Work around a security issue with comments inside attributes */
1092        if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
1093          _removeAttribute(name, currentNode);
1094          continue;
1095        }
1096        /* Did the hooks approve of the attribute? */
1097        if (hookEvent.forceKeepAttr) {
1098          continue;
1099        }
1100        /* Did the hooks approve of the attribute? */
1101        if (!hookEvent.keepAttr) {
1102          _removeAttribute(name, currentNode);
1103          continue;
1104        }
1105        /* Work around a security issue in jQuery 3.0 */
1106        if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
1107          _removeAttribute(name, currentNode);
1108          continue;
1109        }
1110        /* Sanitize attribute content to be template-safe */
1111        if (SAFE_FOR_TEMPLATES) {
1112          arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
1113            value = stringReplace(value, expr, ' ');
1114          });
1115        }
1116        /* Is `value` valid for this attribute? */
1117        const lcTag = transformCaseFunc(currentNode.nodeName);
1118        if (!_isValidAttribute(lcTag, lcName, value)) {
1119          _removeAttribute(name, currentNode);
1120          continue;
1121        }
1122        /* Handle attributes that require Trusted Types */
1123        if (trustedTypesPolicy && typeof trustedTypes === 'object' && typeof trustedTypes.getAttributeType === 'function') {
1124          if (namespaceURI) ; else {
1125            switch (trustedTypes.getAttributeType(lcTag, lcName)) {
1126              case 'TrustedHTML':
1127                {
1128                  value = trustedTypesPolicy.createHTML(value);
1129                  break;
1130                }
1131              case 'TrustedScriptURL':
1132                {
1133                  value = trustedTypesPolicy.createScriptURL(value);
1134                  break;
1135                }
1136            }
1137          }
1138        }
1139        /* Handle invalid data-* attribute set by try-catching it */
1140        if (value !== initValue) {
1141          try {
1142            if (namespaceURI) {
1143              currentNode.setAttributeNS(namespaceURI, name, value);
1144            } else {
1145              /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1146              currentNode.setAttribute(name, value);
1147            }
1148            if (_isClobbered(currentNode)) {
1149              _forceRemove(currentNode);
1150            } else {
1151              arrayPop(DOMPurify.removed);
1152            }
1153          } catch (_) {
1154            _removeAttribute(name, currentNode);
1155          }
1156        }
1157      }
1158      /* Execute a hook if present */
1159      _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
1160    };
1161    /**
1162     * _sanitizeShadowDOM
1163     *
1164     * @param fragment to iterate over recursively
1165     */
1166    const _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
1167      let shadowNode = null;
1168      const shadowIterator = _createNodeIterator(fragment);
1169      /* Execute a hook if present */
1170      _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
1171      while (shadowNode = shadowIterator.nextNode()) {
1172        /* Execute a hook if present */
1173        _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
1174        /* Sanitize tags and elements */
1175        _sanitizeElements(shadowNode);
1176        /* Check attributes next */
1177        _sanitizeAttributes(shadowNode);
1178        /* Deep shadow DOM detected */
1179        if (shadowNode.content instanceof DocumentFragment) {
1180          _sanitizeShadowDOM(shadowNode.content);
1181        }
1182      }
1183      /* Execute a hook if present */
1184      _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
1185    };
1186    // eslint-disable-next-line complexity
1187    DOMPurify.sanitize = function (dirty) {
1188      let cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
1189      let body = null;
1190      let importedNode = null;
1191      let currentNode = null;
1192      let returnNode = null;
1193      /* Make sure we have a string to sanitize.
1194        DO NOT return early, as this will return the wrong type if
1195        the user has requested a DOM object rather than a string */
1196      IS_EMPTY_INPUT = !dirty;
1197      if (IS_EMPTY_INPUT) {
1198        dirty = '<!-->';
1199      }
1200      /* Stringify, in case dirty is an object */
1201      if (typeof dirty !== 'string' && !_isNode(dirty)) {
1202        if (typeof dirty.toString === 'function') {
1203          dirty = dirty.toString();
1204          if (typeof dirty !== 'string') {
1205            throw typeErrorCreate('dirty is not a string, aborting');
1206          }
1207        } else {
1208          throw typeErrorCreate('toString is not a function');
1209        }
1210      }
1211      /* Return dirty HTML if DOMPurify cannot run */
1212      if (!DOMPurify.isSupported) {
1213        return dirty;
1214      }
1215      /* Assign config vars */
1216      if (!SET_CONFIG) {
1217        _parseConfig(cfg);
1218      }
1219      /* Clean up removed elements */
1220      DOMPurify.removed = [];
1221      /* Check if dirty is correctly typed for IN_PLACE */
1222      if (typeof dirty === 'string') {
1223        IN_PLACE = false;
1224      }
1225      if (IN_PLACE) {
1226        /* Do some early pre-sanitization to avoid unsafe root nodes */
1227        if (dirty.nodeName) {
1228          const tagName = transformCaseFunc(dirty.nodeName);
1229          if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1230            throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
1231          }
1232        }
1233      } else if (dirty instanceof Node) {
1234        /* If dirty is a DOM element, append to an empty document to avoid
1235           elements being stripped by the parser */
1236        body = _initDocument('<!---->');
1237        importedNode = body.ownerDocument.importNode(dirty, true);
1238        if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === 'BODY') {
1239          /* Node is already a body, use as is */
1240          body = importedNode;
1241        } else if (importedNode.nodeName === 'HTML') {
1242          body = importedNode;
1243        } else {
1244          // eslint-disable-next-line unicorn/prefer-dom-node-append
1245          body.appendChild(importedNode);
1246        }
1247      } else {
1248        /* Exit directly if we have nothing to do */
1249        if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
1250        // eslint-disable-next-line unicorn/prefer-includes
1251        dirty.indexOf('<') === -1) {
1252          return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
1253        }
1254        /* Initialize the document to work on */
1255        body = _initDocument(dirty);
1256        /* Check we have a DOM node from the data */
1257        if (!body) {
1258          return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
1259        }
1260      }
1261      /* Remove first element node (ours) if FORCE_BODY is set */
1262      if (body && FORCE_BODY) {
1263        _forceRemove(body.firstChild);
1264      }
1265      /* Get node iterator */
1266      const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
1267      /* Now start iterating over the created document */
1268      while (currentNode = nodeIterator.nextNode()) {
1269        /* Sanitize tags and elements */
1270        _sanitizeElements(currentNode);
1271        /* Check attributes next */
1272        _sanitizeAttributes(currentNode);
1273        /* Shadow DOM detected, sanitize it */
1274        if (currentNode.content instanceof DocumentFragment) {
1275          _sanitizeShadowDOM(currentNode.content);
1276        }
1277      }
1278      /* If we sanitized `dirty` in-place, return it. */
1279      if (IN_PLACE) {
1280        return dirty;
1281      }
1282      /* Return sanitized string or DOM */
1283      if (RETURN_DOM) {
1284        if (RETURN_DOM_FRAGMENT) {
1285          returnNode = createDocumentFragment.call(body.ownerDocument);
1286          while (body.firstChild) {
1287            // eslint-disable-next-line unicorn/prefer-dom-node-append
1288            returnNode.appendChild(body.firstChild);
1289          }
1290        } else {
1291          returnNode = body;
1292        }
1293        if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
1294          /*
1295            AdoptNode() is not used because internal state is not reset
1296            (e.g. the past names map of a HTMLFormElement), this is safe
1297            in theory but we would rather not risk another attack vector.
1298            The state that is cloned by importNode() is explicitly defined
1299            by the specs.
1300          */
1301          returnNode = importNode.call(originalDocument, returnNode, true);
1302        }
1303        return returnNode;
1304      }
1305      let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1306      /* Serialize doctype if allowed */
1307      if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1308        serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
1309      }
1310      /* Sanitize final string template-safe */
1311      if (SAFE_FOR_TEMPLATES) {
1312        arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {
1313          serializedHTML = stringReplace(serializedHTML, expr, ' ');
1314        });
1315      }
1316      return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1317    };
1318    DOMPurify.setConfig = function () {
1319      let cfg = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
1320      _parseConfig(cfg);
1321      SET_CONFIG = true;
1322    };
1323    DOMPurify.clearConfig = function () {
1324      CONFIG = null;
1325      SET_CONFIG = false;
1326    };
1327    DOMPurify.isValidAttribute = function (tag, attr, value) {
1328      /* Initialize shared config vars if necessary. */
1329      if (!CONFIG) {
1330        _parseConfig({});
1331      }
1332      const lcTag = transformCaseFunc(tag);
1333      const lcName = transformCaseFunc(attr);
1334      return _isValidAttribute(lcTag, lcName, value);
1335    };
1336    DOMPurify.addHook = function (entryPoint, hookFunction) {
1337      if (typeof hookFunction !== 'function') {
1338        return;
1339      }
1340      arrayPush(hooks[entryPoint], hookFunction);
1341    };
1342    DOMPurify.removeHook = function (entryPoint, hookFunction) {
1343      if (hookFunction !== undefined) {
1344        const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
1345        return index === -1 ? undefined : arraySplice(hooks[entryPoint], index, 1)[0];
1346      }
1347      return arrayPop(hooks[entryPoint]);
1348    };
1349    DOMPurify.removeHooks = function (entryPoint) {
1350      hooks[entryPoint] = [];
1351    };
1352    DOMPurify.removeAllHooks = function () {
1353      hooks = _createHooksMap();
1354    };
1355    return DOMPurify;
1356  }
1357  var purify = createDOMPurify();
1358
1359  return purify;
1360
1361}));
1362//# sourceMappingURL=purify.js.map
1363
1364/**
1365 * jQuery fixes
1366 *
1367 * Note: The following analysis and/or changes was required also to be applied in our code base:
1368 *	- Ensure there is no JSONP ajax call
1369 *	- Ensure to not use self closing tag when a closing tag is usually needed.
1370 *		ex: `<div />` need to change for `<div></div>`
1371 *		This is applicable to all tags except the one in this list: area|br|col|embed|hr|img|input|link|meta|param
1372 *	- Review how `<tr>`, `<td>`, `<script>` and `<link>` are inserted with `$()`.
1373 *		Their insertion need to be completed differently like the by using the javascript DOM interface.
1374 *	- All content that related to jQuery DOM manipulation are sanitized with DOMPurify
1375 *	- You can't use jQuery for parsing XML document, you can use DOMParser() as an alternative
1376 *	- Ensure AJAX and fetch are sanitized before they response are used
1377 */
1378/*
1379
1380// Test case for the jQuery fixes bellow
1381
1382Test: jQuery()
1383
1384	- Run in your browser console
1385	> $( "<p>abc<iframe//src=jAva&Tab;script:alert(3)>def</p>" ).appendTo( "#wb-cont" );
1386	result: No iframe inserted around the heading level 1
1387
1388Test:
1389jQuery.html()
1390jQuery.append()
1391jQuery.prepend()
1392jQuery.before()
1393jQuery.after()
1394
1395	- Use the data-ajax demo page: /demos/data-ajax/data-ajax-en.html

1647var r="2.8.3",i={},s=!0,o=t.documentElement,u="modernizr",a=t.createElement(u),f=a.style,l=t.createElement("input"),c=":)",h={}.toString,p=" -webkit- -moz- -o- -ms- ".split(" "),d="Webkit Moz O ms",v=d.split(" "),m=d.toLowerCase().split(" "),g={svg:"http://www.w3.org/2000/svg"},y={},b={},w={},E=[],S=E.slice,x,T=function(e,n,r,i){var s,a,f,l,c=t.createElement("div"),h=t.body,p=h||t.createElement("body");if(parseInt(r,10))while(r--)f=t.createElement("div"),f.id=i?i[r]:u+(r+1),c.appendChild(f);return s=["&#173;",'<style id="s',u,'">',e,"</style>"].join(""),c.id=u,(h?c:p).innerHTML+=s,p.appendChild(c),h||(p.style.background="",p.style.overflow="hidden",l=o.style.overflow,o.style.overflow="hidden",o.appendChild(p)),a=n(c,e),h?c.parentNode.removeChild(c):(p.parentNode.removeChild(p),o.style.overflow=l),!!a},N=function(t){var n=e.matchMedia||e.msMatchMedia;if(n)return n(t)&&n(t).matches||!1;var r;return T("@media "+t+" { #"+u+" { position: absolute; } }",function(t){r=(e.getComputedStyle?getComputedStyle(t,null):t.currentStyle)["position"]=="absolute"}),r},C={}.hasOwnProperty,k;!O(C,"undefined")&&!O(C.call,"undefined")?k=function(e,t){return C.call(e,t)}:k=function(e,t){return t in e&&O(e.constructor.prototype[t],"undefined")},Function.prototype.bind||(Function.prototype.bind=function(t){var n=this;if(typeof n!="function")throw new TypeError;var r=S.call(arguments,1),i=function(){if(this instanceof i){var e=function(){};e.prototype=n.prototype;var s=new e,o=n.apply(s,r.concat(S.call(arguments)));return Object(o)===o?o:s}return n.apply(t,r.concat(S.call(arguments)))};return i}),y.backgroundsize=function(){return P("backgroundSize")},y.borderimage=function(){return P("borderImage")},y.csstransitions=function(){return P("transition")},y.fontface=function(){var e;return T('@font-face {font-family:"font";src:url("https://")}',function(n,r){var i=t.getElementById("smodernizr"),s=i.sheet||i.styleSheet,o=s?s.cssRules&&s.cssRules[0]?s.cssRules[0].cssText:s.cssText||"":"";e=/src/i.test(o)&&o.indexOf(r.split(" ")[0])===0}),e},y.svg=function(){return!!t.createElementNS&&!!t.createElementNS(g.svg,"svg").createSVGRect};for(var B in y)k(y,B)&&(x=B.toLowerCase(),i[x]=y[B](),E.push((i[x]?"":"no-")+x));return i.input||H(),i.addTest=function(e,t){if(typeof e=="object")for(var r in e)k(e,r)&&i.addTest(r,e[r]);else{e=e.toLowerCase();if(i[e]!==n)return i;t=typeof t=="function"?t():t,typeof s!="undefined"&&s&&(o.className+=" "+(t?"":"no-")+e),i[e]=t}return i},L(""),a=l=null,i._version=r,i._prefixes=p,i._domPrefixes=m,i._cssomPrefixes=v,i.mq=N,i.testProp=function(e){return _([e])},i.testAllProps=P,i.testStyles=T,o.className=o.className.replace(/(^|\s)no-js(\s|$)/,"$1$2")+(s?" js "+E.join(" "):""),i}(this,this.document),function(e,t,n){function r(e){return"[object Function]"==d.call(e)}function i(e){return"string"==typeof e}function s(){}function o(e){return!e||"loaded"==e||"complete"==e||"uninitialized"==e}function u(){var e=v.shift();m=1,e?e.t?h(function(){("c"==e.t?k.injectCss:k.injectJs)(e.s,0,e.a,e.x,e.e,1)},0):(e(),u()):m=0}function a(e,n,r,i,s,a,f){function l(t){if(!d&&o(c.readyState)&&(w.r=d=1,!m&&u(),c.onload=c.onreadystatechange=null,t)){"img"!=e&&h(function(){b.removeChild(c)},50);for(var r in T[n])T[n].hasOwnProperty(r)&&T[n][r].onload()}}var f=f||k.errorTimeout,c=t.createElement(e),d=0,g=0,w={t:r,s:n,e:s,a:a,x:f};1===T[n]&&(g=1,T[n]=[]),"object"==e?c.data=n:(c.src=n,c.type=e),c.width=c.height="0",c.onerror=c.onload=c.onreadystatechange=function(){l.call(this,g)},v.splice(i,0,w),"img"!=e&&(g||2===T[n]?(b.insertBefore(c,y?null:p),h(l,f)):T[n].push(c))}function f(e,t,n,r,s){return m=0,t=t||"j",i(e)?a("c"==t?E:w,e,t,this.i++,n,r,s):(v.splice(this.i++,0,e),1==v.length&&u()),this}function l(){var e=k;return e.loader={load:f,i:0},e}var c=t.documentElement,h=e.setTimeout,p=t.getElementsByTagName("script")[0],d={}.toString,v=[],m=0,g="MozAppearance"in c.style,y=g&&!!t.createRange().compareNode,b=y?c:p.parentNode,c=e.opera&&"[object Opera]"==d.call(e.opera),c=!!t.attachEvent&&!c,w=g?"object":c?"script":"img",E=c?"script":w,S=Array.isArray||function(e){return"[object Array]"==d.call(e)},x=[],T={},N={timeout:function(e,t){return t.length&&(e.timeout=t[0]),e}},C,k;k=function(e){function t(e){var e=e.split("!"),t=x.length,n=e.pop(),r=e.length,n={url:n,origUrl:n,prefixes:e},i,s,o;for(s=0;s<r;s++)o=e[s].split("="),(i=N[o.shift()])&&(n=i(n,o));for(s=0;s<t;s++)n=x[s](n);return n}function o(e,i,s,o,u){var a=t(e),f=a.autoCallback;a.url.split(".").pop().split("?").shift(),a.bypass||(i&&(i=r(i)?i:i[e]||i[o]||i[e.split("/").pop().split("?")[0]]),a.instead?a.instead(e,i,s,o,u):(T[a.url]?a.noexec=!0:T[a.url]=1,s.load(a.url,a.forceCSS||!a.forceJS&&"css"==a.url.split(".").pop().split("?").shift()?"c":n,a.noexec,a.attrs,a.timeout),(r(i)||r(f))&&s.load(function(){l(),i&&i(a.origUrl,u,o),f&&f(a.origUrl,u,o),T[a.url]=2})))}function u(e,t){function n(e,n){if(e){if(i(e))n||(f=function(){var e=[].slice.call(arguments);l.apply(this,e),c()}),o(e,f,t,0,u);else if(Object(e)===e)for(p in h=function(){var t=0,n;for(n in e)e.hasOwnProperty(n)&&t++;return t}(),e)e.hasOwnProperty(p)&&(!n&&!--h&&(r(f)?f=function(){var e=[].slice.call(arguments);l.apply(this,e),c()}:f[p]=function(e){return function(){var t=[].slice.call(arguments);e&&e.apply(this,t),c()}}(l[p])),o(e[p],f,t,p,u))}else!n&&c()}var u=!!e.test,a=e.load||e.both,f=e.callback||s,l=f,c=e.complete||s,h,p;n(u?e.yep:e.nope,!!a),a&&n(a)}var a,f,c=this.yepnope.loader;if(i(e))o(e,0,c,0);else if(S(e))for(a=0;a<e.length;a++)f=e[a],i(f)?o(f,0,c,0):S(f)?k(f):Object(f)===f&&u(f,c);else Object(e)===e&&u(e,c)}