vendor: 8,735 bytes, lines 1-149
1/*! @license DOMPurify 3.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.3/LICENSE */ 2const { 3 entries, 4 setPrototypeOf, 5 isFrozen, 6 getPrototypeOf, 7 getOwnPropertyDescriptor 8} = Object; 9let { 10 freeze, 11 seal, 12 create 13} = Object; 14let { 15 apply, 16 construct 17} = typeof Reflect !== "undefined" && Reflect; 18if (!freeze) { 19 freeze = function freeze2(x) { 20 return x; 21 }; 22} 23if (!seal) { 24 seal = function seal2(x) { 25 return x; 26 }; 27} 28if (!apply) { 29 apply = function apply2(func, thisArg) { 30 for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) { 31 args[_key - 2] = arguments[_key]; 32 } 33 return func.apply(thisArg, args); 34 }; 35} 36if (!construct) { 37 construct = function construct2(Func) { 38 for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) { 39 args[_key2 - 1] = arguments[_key2]; 40 } 41 return new Func(...args); 42 }; 43} 44const arrayForEach = unapply(Array.prototype.forEach); 45const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf); 46const arrayPop = unapply(Array.prototype.pop); 47const arrayPush = unapply(Array.prototype.push); 48const arraySplice = unapply(Array.prototype.splice); 49const stringToLowerCase = unapply(String.prototype.toLowerCase); 50const stringToString = unapply(String.prototype.toString); 51const stringMatch = unapply(String.prototype.match); 52const stringReplace = unapply(String.prototype.replace); 53const stringIndexOf = unapply(String.prototype.indexOf); 54const stringTrim = unapply(String.prototype.trim); 55const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty); 56const regExpTest = unapply(RegExp.prototype.test); 57const typeErrorCreate = unconstruct(TypeError); 58function unapply(func) { 59 return function(thisArg) { 60 if (thisArg instanceof RegExp) { 61 thisArg.lastIndex = 0; 62 } 63 for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) { 64 args[_key3 - 1] = arguments[_key3]; 65 } 66 return apply(func, thisArg, args); 67 }; 68} 69function unconstruct(Func) { 70 return function() { 71 for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) { 72 args[_key4] = arguments[_key4]; 73 } 74 return construct(Func, args); 75 }; 76} 77function addToSet(set, array) { 78 let transformCaseFunc = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : stringToLowerCase; 79 if (setPrototypeOf) { 80 setPrototypeOf(set, null); 81 } 82 let l = array.length; 83 while (l--) { 84 let element = array[l]; 85 if (typeof element === "string") { 86 const lcElement = transformCaseFunc(element); 87 if (lcElement !== element) { 88 if (!isFrozen(array)) { 89 array[l] = lcElement; 90 } 91 element = lcElement; 92 } 93 } 94 set[element] = true; 95 } 96 return set; 97} 98function cleanArray(array) { 99 for (let index = 0; index < array.length; index++) { 100 const isPropertyExist = objectHasOwnProperty(array, index); 101 if (!isPropertyExist) { 102 array[index] = null; 103 } 104 } 105 return array; 106} 107function clone(object) { 108 const newObject = create(null); 109 for (const [property, value] of entries(object)) { 110 const isPropertyExist = objectHasOwnProperty(object, property); 111 if (isPropertyExist) { 112 if (Array.isArray(value)) { 113 newObject[property] = cleanArray(value); 114 } else if (value && typeof value === "object" && value.constructor === Object) { 115 newObject[property] = clone(value); 116 } else { 117 newObject[property] = value; 118 } 119 } 120 } 121 return newObject; 122} 123function lookupGetter(object, prop) { 124 while (object !== null) { 125 const desc = getOwnPropertyDescriptor(object, prop); 126 if (desc) { 127 if (desc.get) { 128 return unapply(desc.get); 129 } 130 if (typeof desc.value === "function") { 131 return unapply(desc.value); 132 } 133 } 134 object = getPrototypeOf(object); 135 } 136 function fallbackValue() { 137 return null; 138 } 139 return fallbackValue; 140} 141const html$1 = freeze(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "search", "section", "select", "shadow", "slot", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]); 142const svg$1 = freeze(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "enterkeyhint", "exportparts", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "inputmode", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "part", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]); 143const svgFilters = freeze(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feDropShadow", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]); 144const svgDisallowed = freeze(["animate", "color-profile", "cursor", "discard", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]); 145const mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover", "mprescripts"]); 146const mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]); 147const text = freeze(["#text"]); 148const html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "exportparts", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inert", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "part", "pattern", "placeholder", "playsinline", "popover", "popovertarget", "popovertargetaction", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "slot", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "wrap", "xmlns", "slot"]); 149const svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "amplitude", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "dis
149play", "divisor", "dur", "edgemode", "elevation", "end", "exponent", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "intercept", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "mask-type", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "slope", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "tablevalues", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]); 150const mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnsalign", "columnlines", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lspace", "lquote", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]); 151const xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]); 152const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); 153const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm); 154const TMPLIT_EXPR = seal(/\$\{[\w\W]*/gm); 155const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); 156const ARIA_ATTR = seal(/^aria-[\-\w]+$/); 157const IS_ALLOWED_URI = seal( 158 /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i 159 // eslint-disable-line no-useless-escape 160); 161const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i); 162const ATTR_WHITESPACE = seal( 163 /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g 164 // eslint-disable-line no-control-regex 165); 166const DOCTYPE_NAME = seal(/^html$/i); 167const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i); 168var EXPRESSIONS = /* @__PURE__ */ Object.freeze({ 169 __proto__: null, 170 ARIA_ATTR, 171 ATTR_WHITESPACE, 172 CUSTOM_ELEMENT, 173 DATA_ATTR, 174 DOCTYPE_NAME, 175 ERB_EXPR, 176 IS_ALLOWED_URI, 177 IS_SCRIPT_OR_DATA, 178 MUSTACHE_EXPR, 179 TMPLIT_EXPR 180}); 181const NODE_TYPE = { 182 element: 1, 183 text: 3, 184 // Deprecated 185 progressingInstruction: 7, 186 comment: 8, 187 document: 9 188}; 189const getGlobal = function getGlobal2() { 190 return typeof window === "undefined" ? null : window; 191}; 192const _createTrustedTypesPolicy = function _createTrustedTypesPolicy2(trustedTypes, purifyHostElement) { 193 if (typeof trustedTypes !== "object" || typeof trustedTypes.createPolicy !== "function") { 194 return null; 195 } 196 let suffix = null; 197 const ATTR_NAME = "data-tt-policy-suffix"; 198 if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) { 199 suffix = purifyHostElement.getAttribute(ATTR_NAME); 200 } 201 const policyName = "dompurify" + (suffix ? "#" + suffix : ""); 202 try { 203 return trustedTypes.createPolicy(policyName, { 204 createHTML(html2) { 205 return html2; 206 }, 207 createScriptURL(scriptUrl) { 208 return scriptUrl; 209 } 210 }); 211 } catch (_) { 212 console.warn("TrustedTypes policy " + policyName + " could not be created."); 213 return null; 214 } 215}; 216const _createHooksMap = function _createHooksMap2() { 217 return { 218 afterSanitizeAttributes: [], 219 afterSanitizeElements: [], 220 afterSanitizeShadowDOM: [], 221 beforeSanitizeAttributes: [], 222 beforeSanitizeElements: [], 223 beforeSanitizeShadowDOM: [], 224 uponSanitizeAttribute: [], 225 uponSanitizeElement: [], 226 uponSanitizeShadowNode: [] 227 }; 228}; 229function createDOMPurify() { 230 let window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal(); 231 const DOMPurify = (root) => createDOMPurify(root); 232 DOMPurify.version = "3.3.3";
vendor: 2,977 bytes, lines 233-331
233 DOMPurify.removed = []; 234 if (!window2 || !window2.document || window2.document.nodeType !== NODE_TYPE.document || !window2.Element) { 235 DOMPurify.isSupported = false; 236 return DOMPurify; 237 } 238 let { 239 document 240 } = window2; 241 const originalDocument = document; 242 const currentScript = originalDocument.currentScript; 243 const { 244 DocumentFragment, 245 HTMLTemplateElement, 246 Node, 247 Element, 248 NodeFilter, 249 NamedNodeMap = window2.NamedNodeMap || window2.MozNamedAttrMap, 250 HTMLFormElement, 251 DOMParser, 252 trustedTypes 253 } = window2; 254 const ElementPrototype = Element.prototype; 255 const cloneNode = lookupGetter(ElementPrototype, "cloneNode"); 256 const remove = lookupGetter(ElementPrototype, "remove"); 257 const getNextSibling = lookupGetter(ElementPrototype, "nextSibling"); 258 const getChildNodes = lookupGetter(ElementPrototype, "childNodes"); 259 const getParentNode = lookupGetter(ElementPrototype, "parentNode"); 260 if (typeof HTMLTemplateElement === "function") { 261 const template = document.createElement("template"); 262 if (template.content && template.content.ownerDocument) { 263 document = template.content.ownerDocument; 264 } 265 } 266 let trustedTypesPolicy; 267 let emptyHTML = ""; 268 const { 269 implementation, 270 createNodeIterator, 271 createDocumentFragment, 272 getElementsByTagName 273 } = document; 274 const { 275 importNode 276 } = originalDocument; 277 let hooks = _createHooksMap(); 278 DOMPurify.isSupported = typeof entries === "function" && typeof getParentNode === "function" && implementation && implementation.createHTMLDocument !== void 0; 279 const { 280 MUSTACHE_EXPR: MUSTACHE_EXPR2, 281 ERB_EXPR: ERB_EXPR2, 282 TMPLIT_EXPR: TMPLIT_EXPR2, 283 DATA_ATTR: DATA_ATTR2, 284 ARIA_ATTR: ARIA_ATTR2, 285 IS_SCRIPT_OR_DATA: IS_SCRIPT_OR_DATA2, 286 ATTR_WHITESPACE: ATTR_WHITESPACE2, 287 CUSTOM_ELEMENT: CUSTOM_ELEMENT2 288 } = EXPRESSIONS; 289 let { 290 IS_ALLOWED_URI: IS_ALLOWED_URI$1 291 } = EXPRESSIONS; 292 let ALLOWED_TAGS = null; 293 const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]); 294 let ALLOWED_ATTR = null; 295 const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]); 296 let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, { 297 tagNameCheck: { 298 writable: true, 299 configurable: false, 300 enumerable: true, 301 value: null 302 }, 303 attributeNameCheck: { 304 writable: true, 305 configurable: false, 306 enumerable: true, 307 value: null 308 }, 309 allowCustomizedBuiltInElements: { 310 writable: true, 311 configurable: false, 312 enumerable: true, 313 value: false 314 } 315 })); 316 let FORBID_TAGS = null; 317 let FORBID_ATTR = null; 318 const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, { 319 tagCheck: { 320 writable: true, 321 configurable: false, 322 enumerable: true, 323 value: null 324 }, 325 attributeCheck: { 326 writable: true, 327 configurable: false, 328 enumerable: true, 329 value: null 330 } 331 }))
vendor: 1,480 bytes, lines 331-360
331; 332 let ALLOW_ARIA_ATTR = true; 333 let ALLOW_DATA_ATTR = true; 334 let ALLOW_UNKNOWN_PROTOCOLS = false; 335 let ALLOW_SELF_CLOSE_IN_ATTR = true; 336 let SAFE_FOR_TEMPLATES = false; 337 let SAFE_FOR_XML = true; 338 let WHOLE_DOCUMENT = false; 339 let SET_CONFIG = false; 340 let FORCE_BODY = false; 341 let RETURN_DOM = false; 342 let RETURN_DOM_FRAGMENT = false; 343 let RETURN_TRUSTED_TYPE = false; 344 let SANITIZE_DOM = true; 345 let SANITIZE_NAMED_PROPS = false; 346 const SANITIZE_NAMED_PROPS_PREFIX = "user-content-"; 347 let KEEP_CONTENT = true; 348 let IN_PLACE = false; 349 let USE_PROFILES = {}; 350 let FORBID_CONTENTS = null; 351 const DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]); 352 let DATA_URI_TAGS = null; 353 const DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]); 354 let URI_SAFE_ATTRIBUTES = null; 355 const DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]); 356 const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML"; 357 const SVG_NAMESPACE = "http://www.w3.org/2000/svg"; 358 const HTML_NAMESPACE = "http://www.w3.org/1999/xhtml"; 359 let NAMESPACE = HTML_NAMESPACE; 360 let IS_EMPTY_INPUT = false;
vendor: 4,727 bytes, lines 361-433
361 let ALLOWED_NAMESPACES = null; 362 const DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString); 363 let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]); 364 let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]); 365 const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]); 366 let PARSER_MEDIA_TYPE = null; 367 const SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"]; 368 const DEFAULT_PARSER_MEDIA_TYPE = "text/html"; 369 let transformCaseFunc = null; 370 let CONFIG = null; 371 const formElement = document.createElement("form"); 372 const isRegexOrFunction = function isRegexOrFunction2(testValue) { 373 return testValue instanceof RegExp || testValue instanceof Function; 374 }; 375 const _parseConfig = function _parseConfig2() { 376 let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {}; 377 if (CONFIG && CONFIG === cfg) { 378 return; 379 } 380 if (!cfg || typeof cfg !== "object") { 381 cfg = {}; 382 } 383 cfg = clone(cfg); 384 PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes 385 SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE; 386 transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase; 387 ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS; 388 ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR; 389 ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES; 390 URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES; 391 DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS; 392 FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS; 393 FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({}); 394 FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({}); 395 USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES : false; 396 ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; 397 ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; 398 ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; 399 ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; 400 SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; 401 SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false; 402 WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; 403 RETURN_DOM = cfg.RETURN_DOM || false; 404 RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; 405 RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; 406 FORCE_BODY = cfg.FORCE_BODY || false; 407 SANITIZE_DOM = cfg.SANITIZE_DOM !== false; 408 SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; 409 KEEP_CONTENT = cfg.KEEP_CONTENT !== false; 410 IN_PLACE = cfg.IN_PLACE || false; 411 IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI; 412 NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE; 413 MATHML_TEXT_INTEGRATION_POINTS = cfg.MATHML_TEXT_INTEGRATION_POINTS || MATHML_TEXT_INTEGRATION_POINTS; 414 HTML_INTEGRATION_POINTS = cfg.HTML_INTEGRATION_POINTS || HTML_INTEGRATION_POINTS; 415 CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; 416 if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) { 417 CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck; 418 } 419 if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) { 420 CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck; 421 } 422 if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === "boolean") { 423 CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements; 424 } 425 if (SAFE_FOR_TEMPLATES) { 426 ALLOW_DATA_ATTR = false; 427 } 428 if (RETURN_DOM_FRAGMENT) { 429 RETURN_DOM = true; 430 } 431 if (USE_PROFILES) { 432 ALLOWED_TAGS = addToSet({}, text); 433 ALLOWED_ATTR =
433create(null); 434 if (USE_PROFILES.html === true) { 435 addToSet(ALLOWED_TAGS, html$1); 436 addToSet(ALLOWED_ATTR, html); 437 } 438 if (USE_PROFILES.svg === true) { 439 addToSet(ALLOWED_TAGS, svg$1); 440 addToSet(ALLOWED_ATTR, svg); 441 addToSet(ALLOWED_ATTR, xml); 442 } 443 if (USE_PROFILES.svgFilters === true) { 444 addToSet(ALLOWED_TAGS, svgFilters); 445 addToSet(ALLOWED_ATTR, svg); 446 addToSet(ALLOWED_ATTR, xml); 447 } 448 if (USE_PROFILES.mathMl === true) { 449 addToSet(ALLOWED_TAGS, mathMl$1); 450 addToSet(ALLOWED_ATTR, mathMl); 451 addToSet(ALLOWED_ATTR, xml); 452 } 453 } 454 if (!objectHasOwnProperty(cfg, "ADD_TAGS")) { 455 EXTRA_ELEMENT_HANDLING.tagCheck = null; 456 } 457 if (!objectHasOwnProperty(cfg, "ADD_ATTR")) { 458 EXTRA_ELEMENT_HANDLING.attributeCheck = null;
vendor: 10,879 bytes, lines 458-738
458 459 } 460 if (cfg.ADD_TAGS) { 461 if (typeof cfg.ADD_TAGS === "function") { 462 EXTRA_ELEMENT_HANDLING.tagCheck = cfg.ADD_TAGS; 463 } else { 464 if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) { 465 ALLOWED_TAGS = clone(ALLOWED_TAGS); 466 } 467 addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc); 468 } 469 } 470 if (cfg.ADD_ATTR) { 471 if (typeof cfg.ADD_ATTR === "function") { 472 EXTRA_ELEMENT_HANDLING.attributeCheck = cfg.ADD_ATTR; 473 } else { 474 if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) { 475 ALLOWED_ATTR = clone(ALLOWED_ATTR); 476 } 477 addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc); 478 } 479 } 480 if (cfg.ADD_URI_SAFE_ATTR) { 481 addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc); 482 } 483 if (cfg.FORBID_CONTENTS) { 484 if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) { 485 FORBID_CONTENTS = clone(FORBID_CONTENTS); 486 } 487 addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc); 488 } 489 if (cfg.ADD_FORBID_CONTENTS) { 490 if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) { 491 FORBID_CONTENTS = clone(FORBID_CONTENTS); 492 } 493 addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc); 494 } 495 if (KEEP_CONTENT) { 496 ALLOWED_TAGS["#text"] = true; 497 } 498 if (WHOLE_DOCUMENT) { 499 addToSet(ALLOWED_TAGS, ["html", "head", "body"]); 500 } 501 if (ALLOWED_TAGS.table) { 502 addToSet(ALLOWED_TAGS, ["tbody"]); 503 delete FORBID_TAGS.tbody; 504 } 505 if (cfg.TRUSTED_TYPES_POLICY) { 506 if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== "function") { 507 throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.'); 508 } 509 if (typeof cfg.TRUSTED_TYPES_POLICY.createScriptURL !== "function") { 510 throw typeErrorCreate('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.'); 511 } 512 trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY; 513 emptyHTML = trustedTypesPolicy.createHTML(""); 514 } else { 515 if (trustedTypesPolicy === void 0) { 516 trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript); 517 } 518 if (trustedTypesPolicy !== null && typeof emptyHTML === "string") { 519 emptyHTML = trustedTypesPolicy.createHTML(""); 520 } 521 } 522 if (freeze) { 523 freeze(cfg); 524 } 525 CONFIG = cfg; 526 }; 527 const ALL_SVG_TAGS = addToSet({}, [...svg$1, ...svgFilters, ...svgDisallowed]); 528 const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]); 529 const _checkValidNamespace = function _checkValidNamespace2(element) { 530 let parent = getParentNode(element); 531 if (!parent || !parent.tagName) { 532 parent = { 533 namespaceURI: NAMESPACE, 534 tagName: "template" 535 }; 536 } 537 const tagName = stringToLowerCase(element.tagName); 538 const parentTagName = stringToLowerCase(parent.tagName); 539 if (!ALLOWED_NAMESPACES[element.namespaceURI]) { 540 return false; 541 } 542 if (element.namespaceURI === SVG_NAMESPACE) { 543 if (parent.namespaceURI === HTML_NAMESPACE) { 544 return tagName === "svg"; 545 } 546 if (parent.namespaceURI === MATHML_NAMESPACE) { 547 return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]); 548 } 549 return Boolean(ALL_SVG_TAGS[tagName]); 550 } 551 if (element.namespaceURI === MATHML_NAMESPACE) { 552 if (parent.namespaceURI === HTML_NAMESPACE) { 553 return tagName === "math"; 554 } 555 if (parent.namespaceURI === SVG_NAMESPACE) { 556 return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName]; 557 } 558 return Boolean(ALL_MATHML_TAGS[tagName]); 559 } 560 if (element.namespaceURI === HTML_NAMESPACE) { 561 if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) { 562 return false; 563 } 564 if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) { 565 return false; 566 } 567 return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]); 568 } 569 if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) { 570 return true; 571 } 572 return false; 573 }; 574 const _forceRemove = function _forceRemove2(node) { 575 arrayPush(DOMPurify.removed, { 576 element: node 577 }); 578 try { 579 getParentNode(node).removeChild(node); 580 } catch (_) { 581 remove(node); 582 } 583 }; 584 const _removeAttribute = function _removeAttribute2(name, element) { 585 try { 586 arrayPush(DOMPurify.removed, { 587 attribute: element.getAttributeNode(name), 588 from: element 589 }); 590 } catch (_) { 591 arrayPush(DOMPurify.removed, { 592 attribute: null, 593 from: element 594 }); 595 } 596 element.removeAttribute(name); 597 if (name === "is") { 598 if (RETURN_DOM || RETURN_DOM_FRAGMENT) { 599 try { 600 _forceRemove(element); 601 } catch (_) { 602 } 603 } else { 604 try { 605 element.setAttribute(name, ""); 606 } catch (_) { 607 } 608 } 609 } 610 }; 611 const _initDocument = function _initDocument2(dirty) { 612 let doc = null; 613 let leadingWhitespace = null; 614 if (FORCE_BODY) { 615 dirty = "<remove></remove>" + dirty; 616 } else { 617 const matches = stringMatch(dirty, /^[\r\n\t ]+/); 618 leadingWhitespace = matches && matches[0]; 619 } 620 if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) { 621 dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>"; 622 } 623 const dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty; 624 if (NAMESPACE === HTML_NAMESPACE) { 625 try { 626 doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE); 627 } catch (_) { 628 } 629 } 630 if (!doc || !doc.documentElement) { 631 doc = implementation.createDocument(NAMESPACE, "template", null); 632 try { 633 doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload; 634 } catch (_) { 635 } 636 } 637 const body = doc.body || doc.documentElement; 638 if (dirty && leadingWhitespace) { 639 body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null); 640 } 641 if (NAMESPACE === HTML_NAMESPACE) { 642 return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0]; 643 } 644 return WHOLE_DOCUMENT ? doc.documentElement : body; 645 }; 646 const _createNodeIterator = function _createNodeIterator2(root) { 647 return createNodeIterator.call( 648 root.ownerDocument || root, 649 root, 650 // eslint-disable-next-line no-bitwise 651 NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, 652 null 653 ); 654 }; 655 const _isClobbered = function _isClobbered2(element) { 656 return element instanceof HTMLFormElement && (typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || !(element.attributes instanceof NamedNodeMap) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function"); 657 }; 658 const _isNode = function _isNode2(value) { 659 return typeof Node === "function" && value instanceof Node; 660 }; 661 function _executeHooks(hooks2, currentNode, data) { 662 arrayForEach(hooks2, (hook) => { 663 hook.call(DOMPurify, currentNode, data, CONFIG); 664 }); 665 } 666 const _sanitizeElements = function _sanitizeElements2(currentNode) { 667 let content = null; 668 _executeHooks(hooks.beforeSanitizeElements, currentNode, null); 669 if (_isClobbered(currentNode)) { 670 _forceRemove(currentNode); 671 return true; 672 } 673 const tagName = transformCaseFunc(currentNode.nodeName); 674 _executeHooks(hooks.uponSanitizeElement, currentNode, { 675 tagName, 676 allowedTags: ALLOWED_TAGS 677 }); 678 if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) { 679 _forceRemove(currentNode); 680 return true; 681 } 682 if (currentNode.nodeType === NODE_TYPE.progressingInstruction) { 683 _forceRemove(currentNode); 684 return true; 685 } 686 if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) { 687 _forceRemove(currentNode); 688 return true; 689 } 690 if (!(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName])) { 691 if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) { 692 if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) { 693 return false; 694 } 695 if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) { 696 return false; 697 } 698 } 699 if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) { 700 const parentNode = getParentNode(currentNode) || currentNode.parentNode; 701 const childNodes = getChildNodes(currentNode) || currentNode.childNodes; 702 if (childNodes && parentNode) { 703 const childCount = childNodes.length; 704 for (let i = childCount - 1; i >= 0; --i) { 705 const childClone = cloneNode(childNodes[i], true); 706 childClone.__removalCount = (currentNode.__removalCount || 0) + 1; 707 parentNode.insertBefore(childClone, getNextSibling(currentNode)); 708 } 709 } 710 } 711 _forceRemove(currentNode); 712 return true; 713 } 714 if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) { 715 _forceRemove(currentNode); 716 return true; 717 } 718 if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) { 719 _forceRemove(currentNode); 720 return true; 721 } 722 if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { 723 content = currentNode.textContent; 724 arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => { 725 content = stringReplace(content, expr, " "); 726 }); 727 if (currentNode.textContent !== content) { 728 arrayPush(DOMPurify.removed, { 729 element: currentNode.cloneNode() 730 }); 731 currentNode.textContent = content; 732 } 733 } 734 _executeHooks(hooks.afterSanitizeElements, currentNode, null); 735 return false; 736 }; 737 const _isValidAttribute = function _isValidAttribute2(lcTag, lcName, value) { 738 if (
vendor: 3,912 bytes, lines 738-807
738FORBID_ATTR[lcName]) { 739 return false; 740 } 741 if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) { 742 return false; 743 } 744 if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR2, lcName)) ; 745 else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR2, lcName)) ; 746 else if (EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag)) ; 747 else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) { 748 if ( 749 // First condition does a very basic check if a) it's basically a valid custom element tagname AND 750 // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck 751 // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck 752 _isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || // Alternative, second condition checks if it's an `is`-attribute, AND 753 // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck 754 lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value)) 755 ) ; 756 else { 757 return false; 758 } 759 } else if (URI_SAFE_ATTRIBUTES[lcName]) ; 760 else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE2, ""))) ; 761 else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) ; 762 else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA2, stringReplace(value, ATTR_WHITESPACE2, ""))) ; 763 else if (value) { 764 return false; 765 } else ; 766 return true; 767 }; 768 const _isBasicCustomElement = function _isBasicCustomElement2(tagName) { 769 return tagName !== "annotation-xml" && stringMatch(tagName, CUSTOM_ELEMENT2); 770 }; 771 const _sanitizeAttributes = function _sanitizeAttributes2(currentNode) { 772 _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null); 773 const { 774 attributes 775 } = currentNode; 776 if (!attributes || _isClobbered(currentNode)) { 777 return; 778 } 779 const hookEvent = { 780 attrName: "", 781 attrValue: "", 782 keepAttr: true, 783 allowedAttributes: ALLOWED_ATTR, 784 forceKeepAttr: void 0 785 }; 786 let l = attributes.length; 787 while (l--) { 788 const attr = attributes[l]; 789 const { 790 name, 791 namespaceURI, 792 value: attrValue 793 } = attr; 794 const lcName = transformCaseFunc(name); 795 const initValue = attrValue; 796 let value = name === "value" ? initValue : stringTrim(initValue); 797 hookEvent.attrName = lcName; 798 hookEvent.attrValue = value; 799 hookEvent.keepAttr = true; 800 hookEvent.forceKeepAttr = void 0; 801 _executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent); 802 value = hookEvent.attrValue; 803 if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name")) { 804 _removeAttribute(name, currentNode); 805 value = SANITIZE_NAMED_PROPS_PREFIX + value; 806 } 807 if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes
vendor: 7,389 bytes, lines 807-1021
807)/i, value)) { 808 _removeAttribute(name, currentNode); 809 continue; 810 } 811 if (lcName === "attributename" && stringMatch(value, "href")) { 812 _removeAttribute(name, currentNode); 813 continue; 814 } 815 if (hookEvent.forceKeepAttr) { 816 continue; 817 } 818 if (!hookEvent.keepAttr) { 819 _removeAttribute(name, currentNode); 820 continue; 821 } 822 if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) { 823 _removeAttribute(name, currentNode); 824 continue; 825 } 826 if (SAFE_FOR_TEMPLATES) { 827 arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => { 828 value = stringReplace(value, expr, " "); 829 }); 830 } 831 const lcTag = transformCaseFunc(currentNode.nodeName); 832 if (!_isValidAttribute(lcTag, lcName, value)) { 833 _removeAttribute(name, currentNode); 834 continue; 835 } 836 if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") { 837 if (namespaceURI) ; 838 else { 839 switch (trustedTypes.getAttributeType(lcTag, lcName)) { 840 case "TrustedHTML": { 841 value = trustedTypesPolicy.createHTML(value); 842 break; 843 } 844 case "TrustedScriptURL": { 845 value = trustedTypesPolicy.createScriptURL(value); 846 break; 847 } 848 } 849 } 850 } 851 if (value !== initValue) { 852 try { 853 if (namespaceURI) { 854 currentNode.setAttributeNS(namespaceURI, name, value); 855 } else { 856 currentNode.setAttribute(name, value); 857 } 858 if (_isClobbered(currentNode)) { 859 _forceRemove(currentNode); 860 } else { 861 arrayPop(DOMPurify.removed); 862 } 863 } catch (_) { 864 _removeAttribute(name, currentNode); 865 } 866 } 867 } 868 _executeHooks(hooks.afterSanitizeAttributes, currentNode, null); 869 }; 870 const _sanitizeShadowDOM = function _sanitizeShadowDOM2(fragment) { 871 let shadowNode = null; 872 const shadowIterator = _createNodeIterator(fragment); 873 _executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null); 874 while (shadowNode = shadowIterator.nextNode()) { 875 _executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null); 876 _sanitizeElements(shadowNode); 877 _sanitizeAttributes(shadowNode); 878 if (shadowNode.content instanceof DocumentFragment) { 879 _sanitizeShadowDOM2(shadowNode.content); 880 } 881 } 882 _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null); 883 }; 884 DOMPurify.sanitize = function(dirty) { 885 let cfg = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {}; 886 let body = null; 887 let importedNode = null; 888 let currentNode = null; 889 let returnNode = null; 890 IS_EMPTY_INPUT = !dirty; 891 if (IS_EMPTY_INPUT) { 892 dirty = "<!-->"; 893 } 894 if (typeof dirty !== "string" && !_isNode(dirty)) { 895 if (typeof dirty.toString === "function") { 896 dirty = dirty.toString(); 897 if (typeof dirty !== "string") { 898 throw typeErrorCreate("dirty is not a string, aborting"); 899 } 900 } else { 901 throw typeErrorCreate("toString is not a function"); 902 } 903 } 904 if (!DOMPurify.isSupported) { 905 return dirty; 906 } 907 if (!SET_CONFIG) { 908 _parseConfig(cfg); 909 } 910 DOMPurify.removed = []; 911 if (typeof dirty === "string") { 912 IN_PLACE = false; 913 } 914 if (IN_PLACE) { 915 if (dirty.nodeName) { 916 const tagName = transformCaseFunc(dirty.nodeName); 917 if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) { 918 throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place"); 919 } 920 } 921 } else if (dirty instanceof Node) { 922 body = _initDocument("<!---->"); 923 importedNode = body.ownerDocument.importNode(dirty, true); 924 if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") { 925 body = importedNode; 926 } else if (importedNode.nodeName === "HTML") { 927 body = importedNode; 928 } else { 929 body.appendChild(importedNode); 930 } 931 } else { 932 if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes 933 dirty.indexOf("<") === -1) { 934 return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty; 935 } 936 body = _initDocument(dirty); 937 if (!body) { 938 return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : ""; 939 } 940 } 941 if (body && FORCE_BODY) { 942 _forceRemove(body.firstChild); 943 } 944 const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body); 945 while (currentNode = nodeIterator.nextNode()) { 946 _sanitizeElements(currentNode); 947 _sanitizeAttributes(currentNode); 948 if (currentNode.content instanceof DocumentFragment) { 949 _sanitizeShadowDOM(currentNode.content); 950 } 951 } 952 if (IN_PLACE) { 953 return dirty; 954 } 955 if (RETURN_DOM) { 956 if (RETURN_DOM_FRAGMENT) { 957 returnNode = createDocumentFragment.call(body.ownerDocument); 958 while (body.firstChild) { 959 returnNode.appendChild(body.firstChild); 960 } 961 } else { 962 returnNode = body; 963 } 964 if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) { 965 returnNode = importNode.call(originalDocument, returnNode, true); 966 } 967 return returnNode; 968 } 969 let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML; 970 if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) { 971 serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML; 972 } 973 if (SAFE_FOR_TEMPLATES) { 974 arrayForEach([MUSTACHE_EXPR2, ERB_EXPR2, TMPLIT_EXPR2], (expr) => { 975 serializedHTML = stringReplace(serializedHTML, expr, " "); 976 }); 977 } 978 return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML; 979 }; 980 DOMPurify.setConfig = function() { 981 let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {}; 982 _parseConfig(cfg); 983 SET_CONFIG = true; 984 }; 985 DOMPurify.clearConfig = function() { 986 CONFIG = null; 987 SET_CONFIG = false; 988 }; 989 DOMPurify.isValidAttribute = function(tag, attr, value) { 990 if (!CONFIG) { 991 _parseConfig({}); 992 } 993 const lcTag = transformCaseFunc(tag); 994 const lcName = transformCaseFunc(attr); 995 return _isValidAttribute(lcTag, lcName, value); 996 }; 997 DOMPurify.addHook = function(entryPoint, hookFunction) { 998 if (typeof hookFunction !== "function") { 999 return; 1000 } 1001 arrayPush(hooks[entryPoint], hookFunction); 1002 }; 1003 DOMPurify.removeHook = function(entryPoint, hookFunction) { 1004 if (hookFunction !== void 0) { 1005 const index = arrayLastIndexOf(hooks[entryPoint], hookFunction); 1006 return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0]; 1007 } 1008 return arrayPop(hooks[entryPoint]); 1009 }; 1010 DOMPurify.removeHooks = function(entryPoint) { 1011 hooks[entryPoint] = []; 1012 }; 1013 DOMPurify.removeAllHooks = function() { 1014 hooks = _createHooksMap(); 1015 }; 1016 return DOMPurify; 1017} 1018var purify = createDOMPurify(); 1019export { 1020 purify as default 1021};
1022//# sourceMappingURL=purify.es.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.