Initial ForgeLM import
This commit is contained in:
Evandro Fonseca Junior committed
commit
a392b9dc60
4296 files changed
+1212675
No files matched your search
+450
@@ -0,0 +1,450 @@
|
||||
/*! @license DOMPurify 3.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.3/LICENSE */
|
||||
|
||||
import { TrustedTypePolicy, TrustedHTML, TrustedTypesWindow } from 'trusted-types/lib/index.js';
|
||||
|
||||
/**
|
||||
* Configuration to control DOMPurify behavior.
|
||||
*/
|
||||
interface Config {
|
||||
/**
|
||||
* Extend the existing array of allowed attributes.
|
||||
* Can be an array of attribute names, or a function that receives
|
||||
* the attribute name and tag name to determine if the attribute is allowed.
|
||||
*/
|
||||
ADD_ATTR?: string[] | ((attributeName: string, tagName: string) => boolean) | undefined;
|
||||
/**
|
||||
* Extend the existing array of elements that can use Data URIs.
|
||||
*/
|
||||
ADD_DATA_URI_TAGS?: string[] | undefined;
|
||||
/**
|
||||
* Extend the existing array of allowed tags.
|
||||
* Can be an array of tag names, or a function that receives
|
||||
* the tag name to determine if the tag is allowed.
|
||||
*/
|
||||
ADD_TAGS?: string[] | ((tagName: string) => boolean) | undefined;
|
||||
/**
|
||||
* Extend the existing array of elements that are safe for URI-like values (be careful, XSS risk).
|
||||
*/
|
||||
ADD_URI_SAFE_ATTR?: string[] | undefined;
|
||||
/**
|
||||
* Allow ARIA attributes, leave other safe HTML as is (default is true).
|
||||
*/
|
||||
ALLOW_ARIA_ATTR?: boolean | undefined;
|
||||
/**
|
||||
* Allow HTML5 data attributes, leave other safe HTML as is (default is true).
|
||||
*/
|
||||
ALLOW_DATA_ATTR?: boolean | undefined;
|
||||
/**
|
||||
* Allow external protocol handlers in URL attributes (default is false, be careful, XSS risk).
|
||||
* By default only `http`, `https`, `ftp`, `ftps`, `tel`, `mailto`, `callto`, `sms`, `cid` and `xmpp` are allowed.
|
||||
*/
|
||||
ALLOW_UNKNOWN_PROTOCOLS?: boolean | undefined;
|
||||
/**
|
||||
* Decide if self-closing tags in attributes are allowed.
|
||||
* Usually removed due to a mXSS issue in jQuery 3.0.
|
||||
*/
|
||||
ALLOW_SELF_CLOSE_IN_ATTR?: boolean | undefined;
|
||||
/**
|
||||
* Allow only specific attributes.
|
||||
*/
|
||||
ALLOWED_ATTR?: string[] | undefined;
|
||||
/**
|
||||
* Allow only specific elements.
|
||||
*/
|
||||
ALLOWED_TAGS?: string[] | undefined;
|
||||
/**
|
||||
* Allow only specific namespaces. Defaults to:
|
||||
* - `http://www.w3.org/1999/xhtml`
|
||||
* - `http://www.w3.org/2000/svg`
|
||||
* - `http://www.w3.org/1998/Math/MathML`
|
||||
*/
|
||||
ALLOWED_NAMESPACES?: string[] | undefined;
|
||||
/**
|
||||
* Allow specific protocols handlers in URL attributes via regex (be careful, XSS risk).
|
||||
* Default RegExp:
|
||||
* ```
|
||||
* /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
|
||||
* ```
|
||||
*/
|
||||
ALLOWED_URI_REGEXP?: RegExp | undefined;
|
||||
/**
|
||||
* Define how custom elements are handled.
|
||||
*/
|
||||
CUSTOM_ELEMENT_HANDLING?: {
|
||||
/**
|
||||
* Regular expression or function to match to allowed elements.
|
||||
* Default is null (disallow any custom elements).
|
||||
*/
|
||||
tagNameCheck?: RegExp | ((tagName: string) => boolean) | null | undefined;
|
||||
/**
|
||||
* Regular expression or function to match to allowed attributes.
|
||||
* Default is null (disallow any attributes not on the allow list).
|
||||
*/
|
||||
attributeNameCheck?: RegExp | ((attributeName: string, tagName?: string) => boolean) | null | undefined;
|
||||
/**
|
||||
* Allow custom elements derived from built-ins if they pass `tagNameCheck`. Default is false.
|
||||
*/
|
||||
allowCustomizedBuiltInElements?: boolean | undefined;
|
||||
};
|
||||
/**
|
||||
* Add attributes to block-list.
|
||||
*/
|
||||
FORBID_ATTR?: string[] | undefined;
|
||||
/**
|
||||
* Add child elements to be removed when their parent is removed.
|
||||
*/
|
||||
FORBID_CONTENTS?: string[] | undefined;
|
||||
/**
|
||||
* Extend the existing or default array of forbidden content elements.
|
||||
*/
|
||||
ADD_FORBID_CONTENTS?: string[] | undefined;
|
||||
/**
|
||||
* Add elements to block-list.
|
||||
*/
|
||||
FORBID_TAGS?: string[] | undefined;
|
||||
/**
|
||||
* Glue elements like style, script or others to `document.body` and prevent unintuitive browser behavior in several edge-cases (default is false).
|
||||
*/
|
||||
FORCE_BODY?: boolean | undefined;
|
||||
/**
|
||||
* Map of non-standard HTML element names to support. Map to true to enable support. For example:
|
||||
*
|
||||
* ```
|
||||
* HTML_INTEGRATION_POINTS: { foreignobject: true }
|
||||
* ```
|
||||
*/
|
||||
HTML_INTEGRATION_POINTS?: Record<string, boolean> | undefined;
|
||||
/**
|
||||
* Sanitize a node "in place", which is much faster depending on how you use DOMPurify.
|
||||
*/
|
||||
IN_PLACE?: boolean | undefined;
|
||||
/**
|
||||
* Keep an element's content when the element is removed (default is true).
|
||||
*/
|
||||
KEEP_CONTENT?: boolean | undefined;
|
||||
/**
|
||||
* Map of MathML element names to support. Map to true to enable support. For example:
|
||||
*
|
||||
* ```
|
||||
* MATHML_TEXT_INTEGRATION_POINTS: { mtext: true }
|
||||
* ```
|
||||
*/
|
||||
MATHML_TEXT_INTEGRATION_POINTS?: Record<string, boolean> | undefined;
|
||||
/**
|
||||
* Change the default namespace from HTML to something different.
|
||||
*/
|
||||
NAMESPACE?: string | undefined;
|
||||
/**
|
||||
* Change the parser type so sanitized data is treated as XML and not as HTML, which is the default.
|
||||
*/
|
||||
PARSER_MEDIA_TYPE?: DOMParserSupportedType | undefined;
|
||||
/**
|
||||
* Return a DOM `DocumentFragment` instead of an HTML string (default is false).
|
||||
*/
|
||||
RETURN_DOM_FRAGMENT?: boolean | undefined;
|
||||
/**
|
||||
* Return a DOM `HTMLBodyElement` instead of an HTML string (default is false).
|
||||
*/
|
||||
RETURN_DOM?: boolean | undefined;
|
||||
/**
|
||||
* Return a TrustedHTML object instead of a string if possible.
|
||||
*/
|
||||
RETURN_TRUSTED_TYPE?: boolean | undefined;
|
||||
/**
|
||||
* Strip `{{ ... }}`, `${ ... }` and `<% ... %>` to make output safe for template systems.
|
||||
* Be careful please, this mode is not recommended for production usage.
|
||||
* Allowing template parsing in user-controlled HTML is not advised at all.
|
||||
* Only use this mode if there is really no alternative.
|
||||
*/
|
||||
SAFE_FOR_TEMPLATES?: boolean | undefined;
|
||||
/**
|
||||
* Change how e.g. comments containing risky HTML characters are treated.
|
||||
* Be very careful, this setting should only be set to `false` if you really only handle
|
||||
* HTML and nothing else, no SVG, MathML or the like.
|
||||
* Otherwise, changing from `true` to `false` will lead to XSS in this or some other way.
|
||||
*/
|
||||
SAFE_FOR_XML?: boolean | undefined;
|
||||
/**
|
||||
* Use DOM Clobbering protection on output (default is true, handle with care, minor XSS risks here).
|
||||
*/
|
||||
SANITIZE_DOM?: boolean | undefined;
|
||||
/**
|
||||
* Enforce strict DOM Clobbering protection via namespace isolation (default is false).
|
||||
* When enabled, isolates the namespace of named properties (i.e., `id` and `name` attributes)
|
||||
* from JS variables by prefixing them with the string `user-content-`
|
||||
*/
|
||||
SANITIZE_NAMED_PROPS?: boolean | undefined;
|
||||
/**
|
||||
* Supplied policy must define `createHTML` and `createScriptURL`.
|
||||
*/
|
||||
TRUSTED_TYPES_POLICY?: TrustedTypePolicy | undefined;
|
||||
/**
|
||||
* Controls categories of allowed elements.
|
||||
*
|
||||
* Note that the `USE_PROFILES` setting will override the `ALLOWED_TAGS` setting
|
||||
* so don't use them together.
|
||||
*/
|
||||
USE_PROFILES?: false | UseProfilesConfig | undefined;
|
||||
/**
|
||||
* Return entire document including <html> tags (default is false).
|
||||
*/
|
||||
WHOLE_DOCUMENT?: boolean | undefined;
|
||||
}
|
||||
/**
|
||||
* Defines categories of allowed elements.
|
||||
*/
|
||||
interface UseProfilesConfig {
|
||||
/**
|
||||
* Allow all safe MathML elements.
|
||||
*/
|
||||
mathMl?: boolean | undefined;
|
||||
/**
|
||||
* Allow all safe SVG elements.
|
||||
*/
|
||||
svg?: boolean | undefined;
|
||||
/**
|
||||
* Allow all save SVG Filters.
|
||||
*/
|
||||
svgFilters?: boolean | undefined;
|
||||
/**
|
||||
* Allow all safe HTML elements.
|
||||
*/
|
||||
html?: boolean | undefined;
|
||||
}
|
||||
|
||||
declare const _default: DOMPurify;
|
||||
|
||||
interface DOMPurify {
|
||||
/**
|
||||
* Creates a DOMPurify instance using the given window-like object. Defaults to `window`.
|
||||
*/
|
||||
(root?: WindowLike): DOMPurify;
|
||||
/**
|
||||
* Version label, exposed for easier checks
|
||||
* if DOMPurify is up to date or not
|
||||
*/
|
||||
version: string;
|
||||
/**
|
||||
* Array of elements that DOMPurify removed during sanitation.
|
||||
* Empty if nothing was removed.
|
||||
*/
|
||||
removed: Array<RemovedElement | RemovedAttribute>;
|
||||
/**
|
||||
* Expose whether this browser supports running the full DOMPurify.
|
||||
*/
|
||||
isSupported: boolean;
|
||||
/**
|
||||
* Set the configuration once.
|
||||
*
|
||||
* @param cfg configuration object
|
||||
*/
|
||||
setConfig(cfg?: Config): void;
|
||||
/**
|
||||
* Removes the configuration.
|
||||
*/
|
||||
clearConfig(): void;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized TrustedHTML.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg: Config & {
|
||||
RETURN_TRUSTED_TYPE: true;
|
||||
}): TrustedHTML;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized DOM node.
|
||||
*/
|
||||
sanitize(dirty: Node, cfg: Config & {
|
||||
IN_PLACE: true;
|
||||
}): Node;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized DOM node.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg: Config & {
|
||||
RETURN_DOM: true;
|
||||
}): Node;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized document fragment.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg: Config & {
|
||||
RETURN_DOM_FRAGMENT: true;
|
||||
}): DocumentFragment;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized string.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg?: Config): string;
|
||||
/**
|
||||
* Checks if an attribute value is valid.
|
||||
* Uses last set config, if any. Otherwise, uses config defaults.
|
||||
*
|
||||
* @param tag Tag name of containing element.
|
||||
* @param attr Attribute name.
|
||||
* @param value Attribute value.
|
||||
* @returns Returns true if `value` is valid. Otherwise, returns false.
|
||||
*/
|
||||
isValidAttribute(tag: string, attr: string, value: string): boolean;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: BasicHookName, hookFunction: NodeHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: ElementHookName, hookFunction: ElementHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: DocumentFragmentHookName, hookFunction: DocumentFragmentHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: 'uponSanitizeElement', hookFunction: UponSanitizeElementHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: 'uponSanitizeAttribute', hookFunction: UponSanitizeAttributeHook): void;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: BasicHookName, hookFunction?: NodeHook): NodeHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: ElementHookName, hookFunction?: ElementHook): ElementHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: DocumentFragmentHookName, hookFunction?: DocumentFragmentHook): DocumentFragmentHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: 'uponSanitizeElement', hookFunction?: UponSanitizeElementHook): UponSanitizeElementHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: 'uponSanitizeAttribute', hookFunction?: UponSanitizeAttributeHook): UponSanitizeAttributeHook | undefined;
|
||||
/**
|
||||
* Removes all DOMPurify hooks at a given entryPoint
|
||||
*
|
||||
* @param entryPoint entry point for the hooks to remove
|
||||
*/
|
||||
removeHooks(entryPoint: HookName): void;
|
||||
/**
|
||||
* Removes all DOMPurify hooks.
|
||||
*/
|
||||
removeAllHooks(): void;
|
||||
}
|
||||
/**
|
||||
* An element removed by DOMPurify.
|
||||
*/
|
||||
interface RemovedElement {
|
||||
/**
|
||||
* The element that was removed.
|
||||
*/
|
||||
element: Node;
|
||||
}
|
||||
/**
|
||||
* An element removed by DOMPurify.
|
||||
*/
|
||||
interface RemovedAttribute {
|
||||
/**
|
||||
* The attribute that was removed.
|
||||
*/
|
||||
attribute: Attr | null;
|
||||
/**
|
||||
* The element that the attribute was removed.
|
||||
*/
|
||||
from: Node;
|
||||
}
|
||||
type BasicHookName = 'beforeSanitizeElements' | 'afterSanitizeElements' | 'uponSanitizeShadowNode';
|
||||
type ElementHookName = 'beforeSanitizeAttributes' | 'afterSanitizeAttributes';
|
||||
type DocumentFragmentHookName = 'beforeSanitizeShadowDOM' | 'afterSanitizeShadowDOM';
|
||||
type UponSanitizeElementHookName = 'uponSanitizeElement';
|
||||
type UponSanitizeAttributeHookName = 'uponSanitizeAttribute';
|
||||
type HookName = BasicHookName | ElementHookName | DocumentFragmentHookName | UponSanitizeElementHookName | UponSanitizeAttributeHookName;
|
||||
type NodeHook = (this: DOMPurify, currentNode: Node, hookEvent: null, config: Config) => void;
|
||||
type ElementHook = (this: DOMPurify, currentNode: Element, hookEvent: null, config: Config) => void;
|
||||
type DocumentFragmentHook = (this: DOMPurify, currentNode: DocumentFragment, hookEvent: null, config: Config) => void;
|
||||
type UponSanitizeElementHook = (this: DOMPurify, currentNode: Node, hookEvent: UponSanitizeElementHookEvent, config: Config) => void;
|
||||
type UponSanitizeAttributeHook = (this: DOMPurify, currentNode: Element, hookEvent: UponSanitizeAttributeHookEvent, config: Config) => void;
|
||||
interface UponSanitizeElementHookEvent {
|
||||
tagName: string;
|
||||
allowedTags: Record<string, boolean>;
|
||||
}
|
||||
interface UponSanitizeAttributeHookEvent {
|
||||
attrName: string;
|
||||
attrValue: string;
|
||||
keepAttr: boolean;
|
||||
allowedAttributes: Record<string, boolean>;
|
||||
forceKeepAttr: boolean | undefined;
|
||||
}
|
||||
/**
|
||||
* A `Window`-like object containing the properties and types that DOMPurify requires.
|
||||
*/
|
||||
type WindowLike = Pick<typeof globalThis, 'DocumentFragment' | 'HTMLTemplateElement' | 'Node' | 'Element' | 'NodeFilter' | 'NamedNodeMap' | 'HTMLFormElement' | 'DOMParser'> & {
|
||||
document?: Document;
|
||||
MozNamedAttrMap?: typeof window.NamedNodeMap;
|
||||
} & Pick<TrustedTypesWindow, 'trustedTypes'>;
|
||||
|
||||
export { type Config, type DOMPurify, type DocumentFragmentHook, type ElementHook, type HookName, type NodeHook, type RemovedAttribute, type RemovedElement, type UponSanitizeAttributeHook, type UponSanitizeAttributeHookEvent, type UponSanitizeElementHook, type UponSanitizeElementHookEvent, type WindowLike };
|
||||
|
||||
// @ts-ignore
|
||||
export = _default;
|
||||
+1399
File diff suppressed because it is too large.
Load diff
+1
@@ -0,0 +1 @@
|
||||
{"version":3,"file":"purify.cjs.js","sources":["../src/utils.ts","../src/tags.ts","../src/attrs.ts","../src/regexp.ts","../src/purify.ts"],"sourcesContent":["const {\n entries,\n setPrototypeOf,\n isFrozen,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n} = Object;\n\nlet { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports\nlet { apply, construct } = typeof Reflect !== 'undefined' && Reflect;\n\nif (!freeze) {\n freeze = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!seal) {\n seal = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!apply) {\n apply = function <T>(\n func: (thisArg: any, ...args: any[]) => T,\n thisArg: any,\n ...args: any[]\n ): T {\n return func.apply(thisArg, args);\n };\n}\n\nif (!construct) {\n construct = function <T>(Func: new (...args: any[]) => T, ...args: any[]): T {\n return new Func(...args);\n };\n}\n\nconst arrayForEach = unapply(Array.prototype.forEach);\nconst arrayIndexOf = unapply(Array.prototype.indexOf);\nconst arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);\nconst arrayPop = unapply(Array.prototype.pop);\nconst arrayPush = unapply(Array.prototype.push);\nconst arraySlice = unapply(Array.prototype.slice);\nconst arraySplice = unapply(Array.prototype.splice);\n\nconst stringToLowerCase = unapply(String.prototype.toLowerCase);\nconst stringToString = unapply(String.prototype.toString);\nconst stringMatch = unapply(String.prototype.match);\nconst stringReplace = unapply(String.prototype.replace);\nconst stringIndexOf = unapply(String.prototype.indexOf);\nconst stringTrim = unapply(String.prototype.trim);\n\nconst objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);\n\nconst regExpTest = unapply(RegExp.prototype.test);\n\nconst typeErrorCreate = unconstruct(TypeError);\n\n/**\n * Creates a new function that calls the given function with a specified thisArg and arguments.\n *\n * @param func - The function to be wrapped and called.\n * @returns A new function that calls the given function with a specified thisArg and arguments.\n */\nfunction unapply<T>(\n func: (thisArg: any, ...args: any[]) => T\n): (thisArg: any, ...args: any[]) => T {\n return (thisArg: any, ...args: any[]): T => {\n if (thisArg instanceof RegExp) {\n thisArg.lastIndex = 0;\n }\n\n return apply(func, thisArg, args);\n };\n}\n\n/**\n * Creates a new function that constructs an instance of the given constructor function with the provided arguments.\n *\n * @param func - The constructor function to be wrapped and called.\n * @returns A new function that constructs an instance of the given constructor function with the provided arguments.\n */\nfunction unconstruct<T>(\n Func: new (...args: any[]) => T\n): (...args: any[]) => T {\n return (...args: any[]): T => construct(Func, args);\n}\n\n/**\n * Add properties to a lookup table\n *\n * @param set - The set to which elements will be added.\n * @param array - The array containing elements to be added to the set.\n * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.\n * @returns The modified set with added elements.\n */\nfunction addToSet(\n set: Record<string, any>,\n array: readonly any[],\n transformCaseFunc: ReturnType<typeof unapply<string>> = stringToLowerCase\n): Record<string, any> {\n if (setPrototypeOf) {\n // Make 'in' and truthy checks like Boolean(set.constructor)\n // independent of any properties defined on Object.prototype.\n // Prevent prototype setters from intercepting set as a this value.\n setPrototypeOf(set, null);\n }\n\n let l = array.length;\n while (l--) {\n let element = array[l];\n if (typeof element === 'string') {\n const lcElement = transformCaseFunc(element);\n if (lcElement !== element) {\n // Config presets (e.g. tags.js, attrs.js) are immutable.\n if (!isFrozen(array)) {\n (array as any[])[l] = lcElement;\n }\n\n element = lcElement;\n }\n }\n\n set[element] = true;\n }\n\n return set;\n}\n\n/**\n * Clean up an array to harden against CSPP\n *\n * @param array - The array to be cleaned.\n * @returns The cleaned version of the array\n */\nfunction cleanArray<T>(array: T[]): Array<T | null> {\n for (let index = 0; index < array.length; index++) {\n const isPropertyExist = objectHasOwnProperty(array, index);\n\n if (!isPropertyExist) {\n array[index] = null;\n }\n }\n\n return array;\n}\n\n/**\n * Shallow clone an object\n *\n * @param object - The object to be cloned.\n * @returns A new object that copies the original.\n */\nfunction clone<T extends Record<string, any>>(object: T): T {\n const newObject = create(null);\n\n for (const [property, value] of entries(object)) {\n const isPropertyExist = objectHasOwnProperty(object, property);\n\n if (isPropertyExist) {\n if (Array.isArray(value)) {\n newObject[property] = cleanArray(valueLine truncated
|
||||
+447
@@ -0,0 +1,447 @@
|
||||
/*! @license DOMPurify 3.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.3/LICENSE */
|
||||
|
||||
import { TrustedTypePolicy, TrustedHTML, TrustedTypesWindow } from 'trusted-types/lib/index.js';
|
||||
|
||||
/**
|
||||
* Configuration to control DOMPurify behavior.
|
||||
*/
|
||||
interface Config {
|
||||
/**
|
||||
* Extend the existing array of allowed attributes.
|
||||
* Can be an array of attribute names, or a function that receives
|
||||
* the attribute name and tag name to determine if the attribute is allowed.
|
||||
*/
|
||||
ADD_ATTR?: string[] | ((attributeName: string, tagName: string) => boolean) | undefined;
|
||||
/**
|
||||
* Extend the existing array of elements that can use Data URIs.
|
||||
*/
|
||||
ADD_DATA_URI_TAGS?: string[] | undefined;
|
||||
/**
|
||||
* Extend the existing array of allowed tags.
|
||||
* Can be an array of tag names, or a function that receives
|
||||
* the tag name to determine if the tag is allowed.
|
||||
*/
|
||||
ADD_TAGS?: string[] | ((tagName: string) => boolean) | undefined;
|
||||
/**
|
||||
* Extend the existing array of elements that are safe for URI-like values (be careful, XSS risk).
|
||||
*/
|
||||
ADD_URI_SAFE_ATTR?: string[] | undefined;
|
||||
/**
|
||||
* Allow ARIA attributes, leave other safe HTML as is (default is true).
|
||||
*/
|
||||
ALLOW_ARIA_ATTR?: boolean | undefined;
|
||||
/**
|
||||
* Allow HTML5 data attributes, leave other safe HTML as is (default is true).
|
||||
*/
|
||||
ALLOW_DATA_ATTR?: boolean | undefined;
|
||||
/**
|
||||
* Allow external protocol handlers in URL attributes (default is false, be careful, XSS risk).
|
||||
* By default only `http`, `https`, `ftp`, `ftps`, `tel`, `mailto`, `callto`, `sms`, `cid` and `xmpp` are allowed.
|
||||
*/
|
||||
ALLOW_UNKNOWN_PROTOCOLS?: boolean | undefined;
|
||||
/**
|
||||
* Decide if self-closing tags in attributes are allowed.
|
||||
* Usually removed due to a mXSS issue in jQuery 3.0.
|
||||
*/
|
||||
ALLOW_SELF_CLOSE_IN_ATTR?: boolean | undefined;
|
||||
/**
|
||||
* Allow only specific attributes.
|
||||
*/
|
||||
ALLOWED_ATTR?: string[] | undefined;
|
||||
/**
|
||||
* Allow only specific elements.
|
||||
*/
|
||||
ALLOWED_TAGS?: string[] | undefined;
|
||||
/**
|
||||
* Allow only specific namespaces. Defaults to:
|
||||
* - `http://www.w3.org/1999/xhtml`
|
||||
* - `http://www.w3.org/2000/svg`
|
||||
* - `http://www.w3.org/1998/Math/MathML`
|
||||
*/
|
||||
ALLOWED_NAMESPACES?: string[] | undefined;
|
||||
/**
|
||||
* Allow specific protocols handlers in URL attributes via regex (be careful, XSS risk).
|
||||
* Default RegExp:
|
||||
* ```
|
||||
* /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
|
||||
* ```
|
||||
*/
|
||||
ALLOWED_URI_REGEXP?: RegExp | undefined;
|
||||
/**
|
||||
* Define how custom elements are handled.
|
||||
*/
|
||||
CUSTOM_ELEMENT_HANDLING?: {
|
||||
/**
|
||||
* Regular expression or function to match to allowed elements.
|
||||
* Default is null (disallow any custom elements).
|
||||
*/
|
||||
tagNameCheck?: RegExp | ((tagName: string) => boolean) | null | undefined;
|
||||
/**
|
||||
* Regular expression or function to match to allowed attributes.
|
||||
* Default is null (disallow any attributes not on the allow list).
|
||||
*/
|
||||
attributeNameCheck?: RegExp | ((attributeName: string, tagName?: string) => boolean) | null | undefined;
|
||||
/**
|
||||
* Allow custom elements derived from built-ins if they pass `tagNameCheck`. Default is false.
|
||||
*/
|
||||
allowCustomizedBuiltInElements?: boolean | undefined;
|
||||
};
|
||||
/**
|
||||
* Add attributes to block-list.
|
||||
*/
|
||||
FORBID_ATTR?: string[] | undefined;
|
||||
/**
|
||||
* Add child elements to be removed when their parent is removed.
|
||||
*/
|
||||
FORBID_CONTENTS?: string[] | undefined;
|
||||
/**
|
||||
* Extend the existing or default array of forbidden content elements.
|
||||
*/
|
||||
ADD_FORBID_CONTENTS?: string[] | undefined;
|
||||
/**
|
||||
* Add elements to block-list.
|
||||
*/
|
||||
FORBID_TAGS?: string[] | undefined;
|
||||
/**
|
||||
* Glue elements like style, script or others to `document.body` and prevent unintuitive browser behavior in several edge-cases (default is false).
|
||||
*/
|
||||
FORCE_BODY?: boolean | undefined;
|
||||
/**
|
||||
* Map of non-standard HTML element names to support. Map to true to enable support. For example:
|
||||
*
|
||||
* ```
|
||||
* HTML_INTEGRATION_POINTS: { foreignobject: true }
|
||||
* ```
|
||||
*/
|
||||
HTML_INTEGRATION_POINTS?: Record<string, boolean> | undefined;
|
||||
/**
|
||||
* Sanitize a node "in place", which is much faster depending on how you use DOMPurify.
|
||||
*/
|
||||
IN_PLACE?: boolean | undefined;
|
||||
/**
|
||||
* Keep an element's content when the element is removed (default is true).
|
||||
*/
|
||||
KEEP_CONTENT?: boolean | undefined;
|
||||
/**
|
||||
* Map of MathML element names to support. Map to true to enable support. For example:
|
||||
*
|
||||
* ```
|
||||
* MATHML_TEXT_INTEGRATION_POINTS: { mtext: true }
|
||||
* ```
|
||||
*/
|
||||
MATHML_TEXT_INTEGRATION_POINTS?: Record<string, boolean> | undefined;
|
||||
/**
|
||||
* Change the default namespace from HTML to something different.
|
||||
*/
|
||||
NAMESPACE?: string | undefined;
|
||||
/**
|
||||
* Change the parser type so sanitized data is treated as XML and not as HTML, which is the default.
|
||||
*/
|
||||
PARSER_MEDIA_TYPE?: DOMParserSupportedType | undefined;
|
||||
/**
|
||||
* Return a DOM `DocumentFragment` instead of an HTML string (default is false).
|
||||
*/
|
||||
RETURN_DOM_FRAGMENT?: boolean | undefined;
|
||||
/**
|
||||
* Return a DOM `HTMLBodyElement` instead of an HTML string (default is false).
|
||||
*/
|
||||
RETURN_DOM?: boolean | undefined;
|
||||
/**
|
||||
* Return a TrustedHTML object instead of a string if possible.
|
||||
*/
|
||||
RETURN_TRUSTED_TYPE?: boolean | undefined;
|
||||
/**
|
||||
* Strip `{{ ... }}`, `${ ... }` and `<% ... %>` to make output safe for template systems.
|
||||
* Be careful please, this mode is not recommended for production usage.
|
||||
* Allowing template parsing in user-controlled HTML is not advised at all.
|
||||
* Only use this mode if there is really no alternative.
|
||||
*/
|
||||
SAFE_FOR_TEMPLATES?: boolean | undefined;
|
||||
/**
|
||||
* Change how e.g. comments containing risky HTML characters are treated.
|
||||
* Be very careful, this setting should only be set to `false` if you really only handle
|
||||
* HTML and nothing else, no SVG, MathML or the like.
|
||||
* Otherwise, changing from `true` to `false` will lead to XSS in this or some other way.
|
||||
*/
|
||||
SAFE_FOR_XML?: boolean | undefined;
|
||||
/**
|
||||
* Use DOM Clobbering protection on output (default is true, handle with care, minor XSS risks here).
|
||||
*/
|
||||
SANITIZE_DOM?: boolean | undefined;
|
||||
/**
|
||||
* Enforce strict DOM Clobbering protection via namespace isolation (default is false).
|
||||
* When enabled, isolates the namespace of named properties (i.e., `id` and `name` attributes)
|
||||
* from JS variables by prefixing them with the string `user-content-`
|
||||
*/
|
||||
SANITIZE_NAMED_PROPS?: boolean | undefined;
|
||||
/**
|
||||
* Supplied policy must define `createHTML` and `createScriptURL`.
|
||||
*/
|
||||
TRUSTED_TYPES_POLICY?: TrustedTypePolicy | undefined;
|
||||
/**
|
||||
* Controls categories of allowed elements.
|
||||
*
|
||||
* Note that the `USE_PROFILES` setting will override the `ALLOWED_TAGS` setting
|
||||
* so don't use them together.
|
||||
*/
|
||||
USE_PROFILES?: false | UseProfilesConfig | undefined;
|
||||
/**
|
||||
* Return entire document including <html> tags (default is false).
|
||||
*/
|
||||
WHOLE_DOCUMENT?: boolean | undefined;
|
||||
}
|
||||
/**
|
||||
* Defines categories of allowed elements.
|
||||
*/
|
||||
interface UseProfilesConfig {
|
||||
/**
|
||||
* Allow all safe MathML elements.
|
||||
*/
|
||||
mathMl?: boolean | undefined;
|
||||
/**
|
||||
* Allow all safe SVG elements.
|
||||
*/
|
||||
svg?: boolean | undefined;
|
||||
/**
|
||||
* Allow all save SVG Filters.
|
||||
*/
|
||||
svgFilters?: boolean | undefined;
|
||||
/**
|
||||
* Allow all safe HTML elements.
|
||||
*/
|
||||
html?: boolean | undefined;
|
||||
}
|
||||
|
||||
declare const _default: DOMPurify;
|
||||
|
||||
interface DOMPurify {
|
||||
/**
|
||||
* Creates a DOMPurify instance using the given window-like object. Defaults to `window`.
|
||||
*/
|
||||
(root?: WindowLike): DOMPurify;
|
||||
/**
|
||||
* Version label, exposed for easier checks
|
||||
* if DOMPurify is up to date or not
|
||||
*/
|
||||
version: string;
|
||||
/**
|
||||
* Array of elements that DOMPurify removed during sanitation.
|
||||
* Empty if nothing was removed.
|
||||
*/
|
||||
removed: Array<RemovedElement | RemovedAttribute>;
|
||||
/**
|
||||
* Expose whether this browser supports running the full DOMPurify.
|
||||
*/
|
||||
isSupported: boolean;
|
||||
/**
|
||||
* Set the configuration once.
|
||||
*
|
||||
* @param cfg configuration object
|
||||
*/
|
||||
setConfig(cfg?: Config): void;
|
||||
/**
|
||||
* Removes the configuration.
|
||||
*/
|
||||
clearConfig(): void;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized TrustedHTML.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg: Config & {
|
||||
RETURN_TRUSTED_TYPE: true;
|
||||
}): TrustedHTML;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized DOM node.
|
||||
*/
|
||||
sanitize(dirty: Node, cfg: Config & {
|
||||
IN_PLACE: true;
|
||||
}): Node;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized DOM node.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg: Config & {
|
||||
RETURN_DOM: true;
|
||||
}): Node;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized document fragment.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg: Config & {
|
||||
RETURN_DOM_FRAGMENT: true;
|
||||
}): DocumentFragment;
|
||||
/**
|
||||
* Provides core sanitation functionality.
|
||||
*
|
||||
* @param dirty string or DOM node
|
||||
* @param cfg object
|
||||
* @returns Sanitized string.
|
||||
*/
|
||||
sanitize(dirty: string | Node, cfg?: Config): string;
|
||||
/**
|
||||
* Checks if an attribute value is valid.
|
||||
* Uses last set config, if any. Otherwise, uses config defaults.
|
||||
*
|
||||
* @param tag Tag name of containing element.
|
||||
* @param attr Attribute name.
|
||||
* @param value Attribute value.
|
||||
* @returns Returns true if `value` is valid. Otherwise, returns false.
|
||||
*/
|
||||
isValidAttribute(tag: string, attr: string, value: string): boolean;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: BasicHookName, hookFunction: NodeHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: ElementHookName, hookFunction: ElementHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: DocumentFragmentHookName, hookFunction: DocumentFragmentHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: 'uponSanitizeElement', hookFunction: UponSanitizeElementHook): void;
|
||||
/**
|
||||
* Adds a DOMPurify hook.
|
||||
*
|
||||
* @param entryPoint entry point for the hook to add
|
||||
* @param hookFunction function to execute
|
||||
*/
|
||||
addHook(entryPoint: 'uponSanitizeAttribute', hookFunction: UponSanitizeAttributeHook): void;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: BasicHookName, hookFunction?: NodeHook): NodeHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: ElementHookName, hookFunction?: ElementHook): ElementHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: DocumentFragmentHookName, hookFunction?: DocumentFragmentHook): DocumentFragmentHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: 'uponSanitizeElement', hookFunction?: UponSanitizeElementHook): UponSanitizeElementHook | undefined;
|
||||
/**
|
||||
* Remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if hook not specified)
|
||||
*
|
||||
* @param entryPoint entry point for the hook to remove
|
||||
* @param hookFunction optional specific hook to remove
|
||||
* @returns removed hook
|
||||
*/
|
||||
removeHook(entryPoint: 'uponSanitizeAttribute', hookFunction?: UponSanitizeAttributeHook): UponSanitizeAttributeHook | undefined;
|
||||
/**
|
||||
* Removes all DOMPurify hooks at a given entryPoint
|
||||
*
|
||||
* @param entryPoint entry point for the hooks to remove
|
||||
*/
|
||||
removeHooks(entryPoint: HookName): void;
|
||||
/**
|
||||
* Removes all DOMPurify hooks.
|
||||
*/
|
||||
removeAllHooks(): void;
|
||||
}
|
||||
/**
|
||||
* An element removed by DOMPurify.
|
||||
*/
|
||||
interface RemovedElement {
|
||||
/**
|
||||
* The element that was removed.
|
||||
*/
|
||||
element: Node;
|
||||
}
|
||||
/**
|
||||
* An element removed by DOMPurify.
|
||||
*/
|
||||
interface RemovedAttribute {
|
||||
/**
|
||||
* The attribute that was removed.
|
||||
*/
|
||||
attribute: Attr | null;
|
||||
/**
|
||||
* The element that the attribute was removed.
|
||||
*/
|
||||
from: Node;
|
||||
}
|
||||
type BasicHookName = 'beforeSanitizeElements' | 'afterSanitizeElements' | 'uponSanitizeShadowNode';
|
||||
type ElementHookName = 'beforeSanitizeAttributes' | 'afterSanitizeAttributes';
|
||||
type DocumentFragmentHookName = 'beforeSanitizeShadowDOM' | 'afterSanitizeShadowDOM';
|
||||
type UponSanitizeElementHookName = 'uponSanitizeElement';
|
||||
type UponSanitizeAttributeHookName = 'uponSanitizeAttribute';
|
||||
type HookName = BasicHookName | ElementHookName | DocumentFragmentHookName | UponSanitizeElementHookName | UponSanitizeAttributeHookName;
|
||||
type NodeHook = (this: DOMPurify, currentNode: Node, hookEvent: null, config: Config) => void;
|
||||
type ElementHook = (this: DOMPurify, currentNode: Element, hookEvent: null, config: Config) => void;
|
||||
type DocumentFragmentHook = (this: DOMPurify, currentNode: DocumentFragment, hookEvent: null, config: Config) => void;
|
||||
type UponSanitizeElementHook = (this: DOMPurify, currentNode: Node, hookEvent: UponSanitizeElementHookEvent, config: Config) => void;
|
||||
type UponSanitizeAttributeHook = (this: DOMPurify, currentNode: Element, hookEvent: UponSanitizeAttributeHookEvent, config: Config) => void;
|
||||
interface UponSanitizeElementHookEvent {
|
||||
tagName: string;
|
||||
allowedTags: Record<string, boolean>;
|
||||
}
|
||||
interface UponSanitizeAttributeHookEvent {
|
||||
attrName: string;
|
||||
attrValue: string;
|
||||
keepAttr: boolean;
|
||||
allowedAttributes: Record<string, boolean>;
|
||||
forceKeepAttr: boolean | undefined;
|
||||
}
|
||||
/**
|
||||
* A `Window`-like object containing the properties and types that DOMPurify requires.
|
||||
*/
|
||||
type WindowLike = Pick<typeof globalThis, 'DocumentFragment' | 'HTMLTemplateElement' | 'Node' | 'Element' | 'NodeFilter' | 'NamedNodeMap' | 'HTMLFormElement' | 'DOMParser'> & {
|
||||
document?: Document;
|
||||
MozNamedAttrMap?: typeof window.NamedNodeMap;
|
||||
} & Pick<TrustedTypesWindow, 'trustedTypes'>;
|
||||
|
||||
export { type Config, type DOMPurify, type DocumentFragmentHook, type ElementHook, type HookName, type NodeHook, type RemovedAttribute, type RemovedElement, type UponSanitizeAttributeHook, type UponSanitizeAttributeHookEvent, type UponSanitizeElementHook, type UponSanitizeElementHookEvent, type WindowLike, _default as default };
|
||||
+1397
File diff suppressed because it is too large.
Load diff
+1
@@ -0,0 +1 @@
|
||||
{"version":3,"file":"purify.es.mjs","sources":["../src/utils.ts","../src/tags.ts","../src/attrs.ts","../src/regexp.ts","../src/purify.ts"],"sourcesContent":["const {\n entries,\n setPrototypeOf,\n isFrozen,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n} = Object;\n\nlet { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports\nlet { apply, construct } = typeof Reflect !== 'undefined' && Reflect;\n\nif (!freeze) {\n freeze = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!seal) {\n seal = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!apply) {\n apply = function <T>(\n func: (thisArg: any, ...args: any[]) => T,\n thisArg: any,\n ...args: any[]\n ): T {\n return func.apply(thisArg, args);\n };\n}\n\nif (!construct) {\n construct = function <T>(Func: new (...args: any[]) => T, ...args: any[]): T {\n return new Func(...args);\n };\n}\n\nconst arrayForEach = unapply(Array.prototype.forEach);\nconst arrayIndexOf = unapply(Array.prototype.indexOf);\nconst arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);\nconst arrayPop = unapply(Array.prototype.pop);\nconst arrayPush = unapply(Array.prototype.push);\nconst arraySlice = unapply(Array.prototype.slice);\nconst arraySplice = unapply(Array.prototype.splice);\n\nconst stringToLowerCase = unapply(String.prototype.toLowerCase);\nconst stringToString = unapply(String.prototype.toString);\nconst stringMatch = unapply(String.prototype.match);\nconst stringReplace = unapply(String.prototype.replace);\nconst stringIndexOf = unapply(String.prototype.indexOf);\nconst stringTrim = unapply(String.prototype.trim);\n\nconst objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);\n\nconst regExpTest = unapply(RegExp.prototype.test);\n\nconst typeErrorCreate = unconstruct(TypeError);\n\n/**\n * Creates a new function that calls the given function with a specified thisArg and arguments.\n *\n * @param func - The function to be wrapped and called.\n * @returns A new function that calls the given function with a specified thisArg and arguments.\n */\nfunction unapply<T>(\n func: (thisArg: any, ...args: any[]) => T\n): (thisArg: any, ...args: any[]) => T {\n return (thisArg: any, ...args: any[]): T => {\n if (thisArg instanceof RegExp) {\n thisArg.lastIndex = 0;\n }\n\n return apply(func, thisArg, args);\n };\n}\n\n/**\n * Creates a new function that constructs an instance of the given constructor function with the provided arguments.\n *\n * @param func - The constructor function to be wrapped and called.\n * @returns A new function that constructs an instance of the given constructor function with the provided arguments.\n */\nfunction unconstruct<T>(\n Func: new (...args: any[]) => T\n): (...args: any[]) => T {\n return (...args: any[]): T => construct(Func, args);\n}\n\n/**\n * Add properties to a lookup table\n *\n * @param set - The set to which elements will be added.\n * @param array - The array containing elements to be added to the set.\n * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.\n * @returns The modified set with added elements.\n */\nfunction addToSet(\n set: Record<string, any>,\n array: readonly any[],\n transformCaseFunc: ReturnType<typeof unapply<string>> = stringToLowerCase\n): Record<string, any> {\n if (setPrototypeOf) {\n // Make 'in' and truthy checks like Boolean(set.constructor)\n // independent of any properties defined on Object.prototype.\n // Prevent prototype setters from intercepting set as a this value.\n setPrototypeOf(set, null);\n }\n\n let l = array.length;\n while (l--) {\n let element = array[l];\n if (typeof element === 'string') {\n const lcElement = transformCaseFunc(element);\n if (lcElement !== element) {\n // Config presets (e.g. tags.js, attrs.js) are immutable.\n if (!isFrozen(array)) {\n (array as any[])[l] = lcElement;\n }\n\n element = lcElement;\n }\n }\n\n set[element] = true;\n }\n\n return set;\n}\n\n/**\n * Clean up an array to harden against CSPP\n *\n * @param array - The array to be cleaned.\n * @returns The cleaned version of the array\n */\nfunction cleanArray<T>(array: T[]): Array<T | null> {\n for (let index = 0; index < array.length; index++) {\n const isPropertyExist = objectHasOwnProperty(array, index);\n\n if (!isPropertyExist) {\n array[index] = null;\n }\n }\n\n return array;\n}\n\n/**\n * Shallow clone an object\n *\n * @param object - The object to be cloned.\n * @returns A new object that copies the original.\n */\nfunction clone<T extends Record<string, any>>(object: T): T {\n const newObject = create(null);\n\n for (const [property, value] of entries(object)) {\n const isPropertyExist = objectHasOwnProperty(object, property);\n\n if (isPropertyExist) {\n if (Array.isArray(value)) {\n newObject[property] = cleanArray(valueLine truncated
|
||||
+1405
File diff suppressed because it is too large.
Load diff
+1
@@ -0,0 +1 @@
|
||||
{"version":3,"file":"purify.js","sources":["../src/utils.ts","../src/tags.ts","../src/attrs.ts","../src/regexp.ts","../src/purify.ts"],"sourcesContent":["const {\n entries,\n setPrototypeOf,\n isFrozen,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n} = Object;\n\nlet { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports\nlet { apply, construct } = typeof Reflect !== 'undefined' && Reflect;\n\nif (!freeze) {\n freeze = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!seal) {\n seal = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!apply) {\n apply = function <T>(\n func: (thisArg: any, ...args: any[]) => T,\n thisArg: any,\n ...args: any[]\n ): T {\n return func.apply(thisArg, args);\n };\n}\n\nif (!construct) {\n construct = function <T>(Func: new (...args: any[]) => T, ...args: any[]): T {\n return new Func(...args);\n };\n}\n\nconst arrayForEach = unapply(Array.prototype.forEach);\nconst arrayIndexOf = unapply(Array.prototype.indexOf);\nconst arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);\nconst arrayPop = unapply(Array.prototype.pop);\nconst arrayPush = unapply(Array.prototype.push);\nconst arraySlice = unapply(Array.prototype.slice);\nconst arraySplice = unapply(Array.prototype.splice);\n\nconst stringToLowerCase = unapply(String.prototype.toLowerCase);\nconst stringToString = unapply(String.prototype.toString);\nconst stringMatch = unapply(String.prototype.match);\nconst stringReplace = unapply(String.prototype.replace);\nconst stringIndexOf = unapply(String.prototype.indexOf);\nconst stringTrim = unapply(String.prototype.trim);\n\nconst objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);\n\nconst regExpTest = unapply(RegExp.prototype.test);\n\nconst typeErrorCreate = unconstruct(TypeError);\n\n/**\n * Creates a new function that calls the given function with a specified thisArg and arguments.\n *\n * @param func - The function to be wrapped and called.\n * @returns A new function that calls the given function with a specified thisArg and arguments.\n */\nfunction unapply<T>(\n func: (thisArg: any, ...args: any[]) => T\n): (thisArg: any, ...args: any[]) => T {\n return (thisArg: any, ...args: any[]): T => {\n if (thisArg instanceof RegExp) {\n thisArg.lastIndex = 0;\n }\n\n return apply(func, thisArg, args);\n };\n}\n\n/**\n * Creates a new function that constructs an instance of the given constructor function with the provided arguments.\n *\n * @param func - The constructor function to be wrapped and called.\n * @returns A new function that constructs an instance of the given constructor function with the provided arguments.\n */\nfunction unconstruct<T>(\n Func: new (...args: any[]) => T\n): (...args: any[]) => T {\n return (...args: any[]): T => construct(Func, args);\n}\n\n/**\n * Add properties to a lookup table\n *\n * @param set - The set to which elements will be added.\n * @param array - The array containing elements to be added to the set.\n * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.\n * @returns The modified set with added elements.\n */\nfunction addToSet(\n set: Record<string, any>,\n array: readonly any[],\n transformCaseFunc: ReturnType<typeof unapply<string>> = stringToLowerCase\n): Record<string, any> {\n if (setPrototypeOf) {\n // Make 'in' and truthy checks like Boolean(set.constructor)\n // independent of any properties defined on Object.prototype.\n // Prevent prototype setters from intercepting set as a this value.\n setPrototypeOf(set, null);\n }\n\n let l = array.length;\n while (l--) {\n let element = array[l];\n if (typeof element === 'string') {\n const lcElement = transformCaseFunc(element);\n if (lcElement !== element) {\n // Config presets (e.g. tags.js, attrs.js) are immutable.\n if (!isFrozen(array)) {\n (array as any[])[l] = lcElement;\n }\n\n element = lcElement;\n }\n }\n\n set[element] = true;\n }\n\n return set;\n}\n\n/**\n * Clean up an array to harden against CSPP\n *\n * @param array - The array to be cleaned.\n * @returns The cleaned version of the array\n */\nfunction cleanArray<T>(array: T[]): Array<T | null> {\n for (let index = 0; index < array.length; index++) {\n const isPropertyExist = objectHasOwnProperty(array, index);\n\n if (!isPropertyExist) {\n array[index] = null;\n }\n }\n\n return array;\n}\n\n/**\n * Shallow clone an object\n *\n * @param object - The object to be cloned.\n * @returns A new object that copies the original.\n */\nfunction clone<T extends Record<string, any>>(object: T): T {\n const newObject = create(null);\n\n for (const [property, value] of entries(object)) {\n const isPropertyExist = objectHasOwnProperty(object, property);\n\n if (isPropertyExist) {\n if (Array.isArray(value)) {\n newObject[property] = cleanArray(value);\nLine truncated
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
/*! @license DOMPurify 3.3.3 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.3/LICENSE */
|
||||
!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).DOMPurify=t()}(this,(function(){"use strict";const{entries:e,setPrototypeOf:t,isFrozen:n,getPrototypeOf:o,getOwnPropertyDescriptor:r}=Object;let{freeze:i,seal:a,create:l}=Object,{apply:c,construct:s}="undefined"!=typeof Reflect&&Reflect;i||(i=function(e){return e}),a||(a=function(e){return e}),c||(c=function(e,t){for(var n=arguments.length,o=new Array(n>2?n-2:0),r=2;r<n;r++)o[r-2]=arguments[r];return e.apply(t,o)}),s||(s=function(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),o=1;o<t;o++)n[o-1]=arguments[o];return new e(...n)});const u=D(Array.prototype.forEach),m=D(Array.prototype.lastIndexOf),p=D(Array.prototype.pop),f=D(Array.prototype.push),d=D(Array.prototype.splice),h=D(String.prototype.toLowerCase),g=D(String.prototype.toString),T=D(String.prototype.match),y=D(String.prototype.replace),E=D(String.prototype.indexOf),A=D(String.prototype.trim),_=D(Object.prototype.hasOwnProperty),b=D(RegExp.prototype.test),S=(N=TypeError,function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return s(N,t)});var N;function D(e){return function(t){t instanceof RegExp&&(t.lastIndex=0);for(var n=arguments.length,o=new Array(n>1?n-1:0),r=1;r<n;r++)o[r-1]=arguments[r];return c(e,t,o)}}function R(e,o){let r=arguments.length>2&&void 0!==arguments[2]?arguments[2]:h;t&&t(e,null);let i=o.length;for(;i--;){let t=o[i];if("string"==typeof t){const e=r(t);e!==t&&(n(o)||(o[i]=e),t=e)}e[t]=!0}return e}function w(e){for(let t=0;t<e.length;t++){_(e,t)||(e[t]=null)}return e}function C(t){const n=l(null);for(const[o,r]of e(t)){_(t,o)&&(Array.isArray(r)?n[o]=w(r):r&&"object"==typeof r&&r.constructor===Object?n[o]=C(r):n[o]=r)}return n}function O(e,t){for(;null!==e;){const n=r(e,t);if(n){if(n.get)return D(n.get);if("function"==typeof n.value)return D(n.value)}e=o(e)}return function(){return null}}const v=i(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","search","section","select","shadow","slot","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),k=i(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","enterkeyhint","exportparts","filter","font","g","glyph","glyphref","hkern","image","inputmode","line","lineargradient","marker","mask","metadata","mpath","part","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),x=i(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feDropShadow","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),L=i(["animate","color-profile","cursor","discard","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),I=i(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover","mprescripts"]),M=i(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),U=i(["#text"]),z=i(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","controls","controlslist","coords","crossorigin","datetime","decoding","default","dir","disabled","disablepictureinpicture","disableremoteplayback","download","draggable","enctype","enterkeyhint","exportparts","face","for","headers","height","hidden","high","href","hreflang","id","inert","inputmodLine truncated
|
||||
//# sourceMappingURL=purify.min.js.map
|
||||
+1
@@ -0,0 +1 @@
|
||||
{"version":3,"file":"purify.min.js","sources":["../src/utils.ts","../src/tags.ts","../src/attrs.ts","../src/regexp.ts","../src/purify.ts"],"sourcesContent":["const {\n entries,\n setPrototypeOf,\n isFrozen,\n getPrototypeOf,\n getOwnPropertyDescriptor,\n} = Object;\n\nlet { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports\nlet { apply, construct } = typeof Reflect !== 'undefined' && Reflect;\n\nif (!freeze) {\n freeze = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!seal) {\n seal = function <T>(x: T): T {\n return x;\n };\n}\n\nif (!apply) {\n apply = function <T>(\n func: (thisArg: any, ...args: any[]) => T,\n thisArg: any,\n ...args: any[]\n ): T {\n return func.apply(thisArg, args);\n };\n}\n\nif (!construct) {\n construct = function <T>(Func: new (...args: any[]) => T, ...args: any[]): T {\n return new Func(...args);\n };\n}\n\nconst arrayForEach = unapply(Array.prototype.forEach);\nconst arrayIndexOf = unapply(Array.prototype.indexOf);\nconst arrayLastIndexOf = unapply(Array.prototype.lastIndexOf);\nconst arrayPop = unapply(Array.prototype.pop);\nconst arrayPush = unapply(Array.prototype.push);\nconst arraySlice = unapply(Array.prototype.slice);\nconst arraySplice = unapply(Array.prototype.splice);\n\nconst stringToLowerCase = unapply(String.prototype.toLowerCase);\nconst stringToString = unapply(String.prototype.toString);\nconst stringMatch = unapply(String.prototype.match);\nconst stringReplace = unapply(String.prototype.replace);\nconst stringIndexOf = unapply(String.prototype.indexOf);\nconst stringTrim = unapply(String.prototype.trim);\n\nconst objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty);\n\nconst regExpTest = unapply(RegExp.prototype.test);\n\nconst typeErrorCreate = unconstruct(TypeError);\n\n/**\n * Creates a new function that calls the given function with a specified thisArg and arguments.\n *\n * @param func - The function to be wrapped and called.\n * @returns A new function that calls the given function with a specified thisArg and arguments.\n */\nfunction unapply<T>(\n func: (thisArg: any, ...args: any[]) => T\n): (thisArg: any, ...args: any[]) => T {\n return (thisArg: any, ...args: any[]): T => {\n if (thisArg instanceof RegExp) {\n thisArg.lastIndex = 0;\n }\n\n return apply(func, thisArg, args);\n };\n}\n\n/**\n * Creates a new function that constructs an instance of the given constructor function with the provided arguments.\n *\n * @param func - The constructor function to be wrapped and called.\n * @returns A new function that constructs an instance of the given constructor function with the provided arguments.\n */\nfunction unconstruct<T>(\n Func: new (...args: any[]) => T\n): (...args: any[]) => T {\n return (...args: any[]): T => construct(Func, args);\n}\n\n/**\n * Add properties to a lookup table\n *\n * @param set - The set to which elements will be added.\n * @param array - The array containing elements to be added to the set.\n * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set.\n * @returns The modified set with added elements.\n */\nfunction addToSet(\n set: Record<string, any>,\n array: readonly any[],\n transformCaseFunc: ReturnType<typeof unapply<string>> = stringToLowerCase\n): Record<string, any> {\n if (setPrototypeOf) {\n // Make 'in' and truthy checks like Boolean(set.constructor)\n // independent of any properties defined on Object.prototype.\n // Prevent prototype setters from intercepting set as a this value.\n setPrototypeOf(set, null);\n }\n\n let l = array.length;\n while (l--) {\n let element = array[l];\n if (typeof element === 'string') {\n const lcElement = transformCaseFunc(element);\n if (lcElement !== element) {\n // Config presets (e.g. tags.js, attrs.js) are immutable.\n if (!isFrozen(array)) {\n (array as any[])[l] = lcElement;\n }\n\n element = lcElement;\n }\n }\n\n set[element] = true;\n }\n\n return set;\n}\n\n/**\n * Clean up an array to harden against CSPP\n *\n * @param array - The array to be cleaned.\n * @returns The cleaned version of the array\n */\nfunction cleanArray<T>(array: T[]): Array<T | null> {\n for (let index = 0; index < array.length; index++) {\n const isPropertyExist = objectHasOwnProperty(array, index);\n\n if (!isPropertyExist) {\n array[index] = null;\n }\n }\n\n return array;\n}\n\n/**\n * Shallow clone an object\n *\n * @param object - The object to be cloned.\n * @returns A new object that copies the original.\n */\nfunction clone<T extends Record<string, any>>(object: T): T {\n const newObject = create(null);\n\n for (const [property, value] of entries(object)) {\n const isPropertyExist = objectHasOwnProperty(object, property);\n\n if (isPropertyExist) {\n if (Array.isArray(value)) {\n newObject[property] = cleanArray(valueLine truncated
|
||||
Reference in new issue
Block a user