purify.es-FFYFKQBW.js 46 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012
  1. import {
  2. __esm
  3. } from "./chunk-2LSFTFF7.js";
  4. // node_modules/.pnpm/dompurify@2.5.8/node_modules/dompurify/dist/purify.es.js
  5. function _typeof(obj) {
  6. "@babel/helpers - typeof";
  7. return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(obj2) {
  8. return typeof obj2;
  9. } : function(obj2) {
  10. return obj2 && "function" == typeof Symbol && obj2.constructor === Symbol && obj2 !== Symbol.prototype ? "symbol" : typeof obj2;
  11. }, _typeof(obj);
  12. }
  13. function _setPrototypeOf(o, p) {
  14. _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf2(o2, p2) {
  15. o2.__proto__ = p2;
  16. return o2;
  17. };
  18. return _setPrototypeOf(o, p);
  19. }
  20. function _isNativeReflectConstruct() {
  21. if (typeof Reflect === "undefined" || !Reflect.construct)
  22. return false;
  23. if (Reflect.construct.sham)
  24. return false;
  25. if (typeof Proxy === "function")
  26. return true;
  27. try {
  28. Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {
  29. }));
  30. return true;
  31. } catch (e) {
  32. return false;
  33. }
  34. }
  35. function _construct(Parent, args, Class) {
  36. if (_isNativeReflectConstruct()) {
  37. _construct = Reflect.construct;
  38. } else {
  39. _construct = function _construct2(Parent2, args2, Class2) {
  40. var a = [null];
  41. a.push.apply(a, args2);
  42. var Constructor = Function.bind.apply(Parent2, a);
  43. var instance = new Constructor();
  44. if (Class2)
  45. _setPrototypeOf(instance, Class2.prototype);
  46. return instance;
  47. };
  48. }
  49. return _construct.apply(null, arguments);
  50. }
  51. function _toConsumableArray(arr) {
  52. return _arrayWithoutHoles(arr) || _iterableToArray(arr) || _unsupportedIterableToArray(arr) || _nonIterableSpread();
  53. }
  54. function _arrayWithoutHoles(arr) {
  55. if (Array.isArray(arr))
  56. return _arrayLikeToArray(arr);
  57. }
  58. function _iterableToArray(iter) {
  59. if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null)
  60. return Array.from(iter);
  61. }
  62. function _unsupportedIterableToArray(o, minLen) {
  63. if (!o)
  64. return;
  65. if (typeof o === "string")
  66. return _arrayLikeToArray(o, minLen);
  67. var n = Object.prototype.toString.call(o).slice(8, -1);
  68. if (n === "Object" && o.constructor)
  69. n = o.constructor.name;
  70. if (n === "Map" || n === "Set")
  71. return Array.from(o);
  72. if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))
  73. return _arrayLikeToArray(o, minLen);
  74. }
  75. function _arrayLikeToArray(arr, len) {
  76. if (len == null || len > arr.length)
  77. len = arr.length;
  78. for (var i = 0, arr2 = new Array(len); i < len; i++)
  79. arr2[i] = arr[i];
  80. return arr2;
  81. }
  82. function _nonIterableSpread() {
  83. throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
  84. }
  85. function unapply(func) {
  86. return function(thisArg) {
  87. for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
  88. args[_key - 1] = arguments[_key];
  89. }
  90. return apply(func, thisArg, args);
  91. };
  92. }
  93. function unconstruct(func) {
  94. return function() {
  95. for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
  96. args[_key2] = arguments[_key2];
  97. }
  98. return construct(func, args);
  99. };
  100. }
  101. function addToSet(set, array, transformCaseFunc) {
  102. var _transformCaseFunc;
  103. transformCaseFunc = (_transformCaseFunc = transformCaseFunc) !== null && _transformCaseFunc !== void 0 ? _transformCaseFunc : stringToLowerCase;
  104. if (setPrototypeOf) {
  105. setPrototypeOf(set, null);
  106. }
  107. var l = array.length;
  108. while (l--) {
  109. var element = array[l];
  110. if (typeof element === "string") {
  111. var lcElement = transformCaseFunc(element);
  112. if (lcElement !== element) {
  113. if (!isFrozen(array)) {
  114. array[l] = lcElement;
  115. }
  116. element = lcElement;
  117. }
  118. }
  119. set[element] = true;
  120. }
  121. return set;
  122. }
  123. function clone(object) {
  124. var newObject = create(null);
  125. var property;
  126. for (property in object) {
  127. if (apply(hasOwnProperty, object, [property]) === true) {
  128. newObject[property] = object[property];
  129. }
  130. }
  131. return newObject;
  132. }
  133. function lookupGetter(object, prop) {
  134. while (object !== null) {
  135. var desc = getOwnPropertyDescriptor(object, prop);
  136. if (desc) {
  137. if (desc.get) {
  138. return unapply(desc.get);
  139. }
  140. if (typeof desc.value === "function") {
  141. return unapply(desc.value);
  142. }
  143. }
  144. object = getPrototypeOf(object);
  145. }
  146. function fallbackValue(element) {
  147. console.warn("fallback value for", element);
  148. return null;
  149. }
  150. return fallbackValue;
  151. }
  152. function createDOMPurify() {
  153. var window2 = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
  154. var DOMPurify = function DOMPurify2(root) {
  155. return createDOMPurify(root);
  156. };
  157. DOMPurify.version = "2.5.8";
  158. DOMPurify.removed = [];
  159. if (!window2 || !window2.document || window2.document.nodeType !== 9) {
  160. DOMPurify.isSupported = false;
  161. return DOMPurify;
  162. }
  163. var originalDocument = window2.document;
  164. var document = window2.document;
  165. var DocumentFragment = window2.DocumentFragment, HTMLTemplateElement = window2.HTMLTemplateElement, Node = window2.Node, Element = window2.Element, NodeFilter = window2.NodeFilter, _window$NamedNodeMap = window2.NamedNodeMap, NamedNodeMap = _window$NamedNodeMap === void 0 ? window2.NamedNodeMap || window2.MozNamedAttrMap : _window$NamedNodeMap, HTMLFormElement = window2.HTMLFormElement, DOMParser = window2.DOMParser, trustedTypes = window2.trustedTypes;
  166. var ElementPrototype = Element.prototype;
  167. var cloneNode = lookupGetter(ElementPrototype, "cloneNode");
  168. var getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
  169. var getChildNodes = lookupGetter(ElementPrototype, "childNodes");
  170. var getParentNode = lookupGetter(ElementPrototype, "parentNode");
  171. if (typeof HTMLTemplateElement === "function") {
  172. var template = document.createElement("template");
  173. if (template.content && template.content.ownerDocument) {
  174. document = template.content.ownerDocument;
  175. }
  176. }
  177. var trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, originalDocument);
  178. var emptyHTML = trustedTypesPolicy ? trustedTypesPolicy.createHTML("") : "";
  179. var _document = document, implementation = _document.implementation, createNodeIterator = _document.createNodeIterator, createDocumentFragment = _document.createDocumentFragment, getElementsByTagName = _document.getElementsByTagName;
  180. var importNode = originalDocument.importNode;
  181. var documentMode = {};
  182. try {
  183. documentMode = clone(document).documentMode ? document.documentMode : {};
  184. } catch (_) {
  185. }
  186. var hooks = {};
  187. DOMPurify.isSupported = typeof getParentNode === "function" && implementation && implementation.createHTMLDocument !== void 0 && documentMode !== 9;
  188. var MUSTACHE_EXPR$1 = MUSTACHE_EXPR, ERB_EXPR$1 = ERB_EXPR, TMPLIT_EXPR$1 = TMPLIT_EXPR, DATA_ATTR$1 = DATA_ATTR, ARIA_ATTR$1 = ARIA_ATTR, IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA, ATTR_WHITESPACE$1 = ATTR_WHITESPACE, CUSTOM_ELEMENT$1 = CUSTOM_ELEMENT;
  189. var IS_ALLOWED_URI$1 = IS_ALLOWED_URI;
  190. var ALLOWED_TAGS = null;
  191. var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray(html$1), _toConsumableArray(svg$1), _toConsumableArray(svgFilters), _toConsumableArray(mathMl$1), _toConsumableArray(text)));
  192. var ALLOWED_ATTR = null;
  193. var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(_toConsumableArray(html), _toConsumableArray(svg), _toConsumableArray(mathMl), _toConsumableArray(xml)));
  194. var CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
  195. tagNameCheck: {
  196. writable: true,
  197. configurable: false,
  198. enumerable: true,
  199. value: null
  200. },
  201. attributeNameCheck: {
  202. writable: true,
  203. configurable: false,
  204. enumerable: true,
  205. value: null
  206. },
  207. allowCustomizedBuiltInElements: {
  208. writable: true,
  209. configurable: false,
  210. enumerable: true,
  211. value: false
  212. }
  213. }));
  214. var FORBID_TAGS = null;
  215. var FORBID_ATTR = null;
  216. var ALLOW_ARIA_ATTR = true;
  217. var ALLOW_DATA_ATTR = true;
  218. var ALLOW_UNKNOWN_PROTOCOLS = false;
  219. var ALLOW_SELF_CLOSE_IN_ATTR = true;
  220. var SAFE_FOR_TEMPLATES = false;
  221. var SAFE_FOR_XML = true;
  222. var WHOLE_DOCUMENT = false;
  223. var SET_CONFIG = false;
  224. var FORCE_BODY = false;
  225. var RETURN_DOM = false;
  226. var RETURN_DOM_FRAGMENT = false;
  227. var RETURN_TRUSTED_TYPE = false;
  228. var SANITIZE_DOM = true;
  229. var SANITIZE_NAMED_PROPS = false;
  230. var SANITIZE_NAMED_PROPS_PREFIX = "user-content-";
  231. var KEEP_CONTENT = true;
  232. var IN_PLACE = false;
  233. var USE_PROFILES = {};
  234. var FORBID_CONTENTS = null;
  235. var DEFAULT_FORBID_CONTENTS = addToSet({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
  236. var DATA_URI_TAGS = null;
  237. var DEFAULT_DATA_URI_TAGS = addToSet({}, ["audio", "video", "img", "source", "image", "track"]);
  238. var URI_SAFE_ATTRIBUTES = null;
  239. var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]);
  240. var MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML";
  241. var SVG_NAMESPACE = "http://www.w3.org/2000/svg";
  242. var HTML_NAMESPACE = "http://www.w3.org/1999/xhtml";
  243. var NAMESPACE = HTML_NAMESPACE;
  244. var IS_EMPTY_INPUT = false;
  245. var ALLOWED_NAMESPACES = null;
  246. var DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
  247. var PARSER_MEDIA_TYPE;
  248. var SUPPORTED_PARSER_MEDIA_TYPES = ["application/xhtml+xml", "text/html"];
  249. var DEFAULT_PARSER_MEDIA_TYPE = "text/html";
  250. var transformCaseFunc;
  251. var CONFIG = null;
  252. var formElement = document.createElement("form");
  253. var isRegexOrFunction = function isRegexOrFunction2(testValue) {
  254. return testValue instanceof RegExp || testValue instanceof Function;
  255. };
  256. var _parseConfig = function _parseConfig2(cfg) {
  257. if (CONFIG && CONFIG === cfg) {
  258. return;
  259. }
  260. if (!cfg || _typeof(cfg) !== "object") {
  261. cfg = {};
  262. }
  263. cfg = clone(cfg);
  264. PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
  265. SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE;
  266. transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
  267. ALLOWED_TAGS = "ALLOWED_TAGS" in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
  268. ALLOWED_ATTR = "ALLOWED_ATTR" in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
  269. ALLOWED_NAMESPACES = "ALLOWED_NAMESPACES" in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
  270. URI_SAFE_ATTRIBUTES = "ADD_URI_SAFE_ATTR" in cfg ? addToSet(
  271. clone(DEFAULT_URI_SAFE_ATTRIBUTES),
  272. // eslint-disable-line indent
  273. cfg.ADD_URI_SAFE_ATTR,
  274. // eslint-disable-line indent
  275. transformCaseFunc
  276. // eslint-disable-line indent
  277. ) : DEFAULT_URI_SAFE_ATTRIBUTES;
  278. DATA_URI_TAGS = "ADD_DATA_URI_TAGS" in cfg ? addToSet(
  279. clone(DEFAULT_DATA_URI_TAGS),
  280. // eslint-disable-line indent
  281. cfg.ADD_DATA_URI_TAGS,
  282. // eslint-disable-line indent
  283. transformCaseFunc
  284. // eslint-disable-line indent
  285. ) : DEFAULT_DATA_URI_TAGS;
  286. FORBID_CONTENTS = "FORBID_CONTENTS" in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
  287. FORBID_TAGS = "FORBID_TAGS" in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
  288. FORBID_ATTR = "FORBID_ATTR" in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
  289. USE_PROFILES = "USE_PROFILES" in cfg ? cfg.USE_PROFILES : false;
  290. ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
  291. ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
  292. ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false;
  293. ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false;
  294. SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false;
  295. SAFE_FOR_XML = cfg.SAFE_FOR_XML !== false;
  296. WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false;
  297. RETURN_DOM = cfg.RETURN_DOM || false;
  298. RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false;
  299. RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false;
  300. FORCE_BODY = cfg.FORCE_BODY || false;
  301. SANITIZE_DOM = cfg.SANITIZE_DOM !== false;
  302. SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false;
  303. KEEP_CONTENT = cfg.KEEP_CONTENT !== false;
  304. IN_PLACE = cfg.IN_PLACE || false;
  305. IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$1;
  306. NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
  307. CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
  308. if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
  309. CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
  310. }
  311. if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
  312. CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
  313. }
  314. if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === "boolean") {
  315. CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
  316. }
  317. if (SAFE_FOR_TEMPLATES) {
  318. ALLOW_DATA_ATTR = false;
  319. }
  320. if (RETURN_DOM_FRAGMENT) {
  321. RETURN_DOM = true;
  322. }
  323. if (USE_PROFILES) {
  324. ALLOWED_TAGS = addToSet({}, _toConsumableArray(text));
  325. ALLOWED_ATTR = [];
  326. if (USE_PROFILES.html === true) {
  327. addToSet(ALLOWED_TAGS, html$1);
  328. addToSet(ALLOWED_ATTR, html);
  329. }
  330. if (USE_PROFILES.svg === true) {
  331. addToSet(ALLOWED_TAGS, svg$1);
  332. addToSet(ALLOWED_ATTR, svg);
  333. addToSet(ALLOWED_ATTR, xml);
  334. }
  335. if (USE_PROFILES.svgFilters === true) {
  336. addToSet(ALLOWED_TAGS, svgFilters);
  337. addToSet(ALLOWED_ATTR, svg);
  338. addToSet(ALLOWED_ATTR, xml);
  339. }
  340. if (USE_PROFILES.mathMl === true) {
  341. addToSet(ALLOWED_TAGS, mathMl$1);
  342. addToSet(ALLOWED_ATTR, mathMl);
  343. addToSet(ALLOWED_ATTR, xml);
  344. }
  345. }
  346. if (cfg.ADD_TAGS) {
  347. if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
  348. ALLOWED_TAGS = clone(ALLOWED_TAGS);
  349. }
  350. addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
  351. }
  352. if (cfg.ADD_ATTR) {
  353. if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
  354. ALLOWED_ATTR = clone(ALLOWED_ATTR);
  355. }
  356. addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
  357. }
  358. if (cfg.ADD_URI_SAFE_ATTR) {
  359. addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
  360. }
  361. if (cfg.FORBID_CONTENTS) {
  362. if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
  363. FORBID_CONTENTS = clone(FORBID_CONTENTS);
  364. }
  365. addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
  366. }
  367. if (KEEP_CONTENT) {
  368. ALLOWED_TAGS["#text"] = true;
  369. }
  370. if (WHOLE_DOCUMENT) {
  371. addToSet(ALLOWED_TAGS, ["html", "head", "body"]);
  372. }
  373. if (ALLOWED_TAGS.table) {
  374. addToSet(ALLOWED_TAGS, ["tbody"]);
  375. delete FORBID_TAGS.tbody;
  376. }
  377. if (freeze) {
  378. freeze(cfg);
  379. }
  380. CONFIG = cfg;
  381. };
  382. var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ["mi", "mo", "mn", "ms", "mtext"]);
  383. var HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
  384. var COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ["title", "style", "font", "a", "script"]);
  385. var ALL_SVG_TAGS = addToSet({}, svg$1);
  386. addToSet(ALL_SVG_TAGS, svgFilters);
  387. addToSet(ALL_SVG_TAGS, svgDisallowed);
  388. var ALL_MATHML_TAGS = addToSet({}, mathMl$1);
  389. addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
  390. var _checkValidNamespace = function _checkValidNamespace2(element) {
  391. var parent = getParentNode(element);
  392. if (!parent || !parent.tagName) {
  393. parent = {
  394. namespaceURI: NAMESPACE,
  395. tagName: "template"
  396. };
  397. }
  398. var tagName = stringToLowerCase(element.tagName);
  399. var parentTagName = stringToLowerCase(parent.tagName);
  400. if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
  401. return false;
  402. }
  403. if (element.namespaceURI === SVG_NAMESPACE) {
  404. if (parent.namespaceURI === HTML_NAMESPACE) {
  405. return tagName === "svg";
  406. }
  407. if (parent.namespaceURI === MATHML_NAMESPACE) {
  408. return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
  409. }
  410. return Boolean(ALL_SVG_TAGS[tagName]);
  411. }
  412. if (element.namespaceURI === MATHML_NAMESPACE) {
  413. if (parent.namespaceURI === HTML_NAMESPACE) {
  414. return tagName === "math";
  415. }
  416. if (parent.namespaceURI === SVG_NAMESPACE) {
  417. return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
  418. }
  419. return Boolean(ALL_MATHML_TAGS[tagName]);
  420. }
  421. if (element.namespaceURI === HTML_NAMESPACE) {
  422. if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
  423. return false;
  424. }
  425. if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
  426. return false;
  427. }
  428. return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
  429. }
  430. if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) {
  431. return true;
  432. }
  433. return false;
  434. };
  435. var _forceRemove = function _forceRemove2(node) {
  436. arrayPush(DOMPurify.removed, {
  437. element: node
  438. });
  439. try {
  440. node.parentNode.removeChild(node);
  441. } catch (_) {
  442. try {
  443. node.outerHTML = emptyHTML;
  444. } catch (_2) {
  445. node.remove();
  446. }
  447. }
  448. };
  449. var _removeAttribute = function _removeAttribute2(name, node) {
  450. try {
  451. arrayPush(DOMPurify.removed, {
  452. attribute: node.getAttributeNode(name),
  453. from: node
  454. });
  455. } catch (_) {
  456. arrayPush(DOMPurify.removed, {
  457. attribute: null,
  458. from: node
  459. });
  460. }
  461. node.removeAttribute(name);
  462. if (name === "is" && !ALLOWED_ATTR[name]) {
  463. if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
  464. try {
  465. _forceRemove(node);
  466. } catch (_) {
  467. }
  468. } else {
  469. try {
  470. node.setAttribute(name, "");
  471. } catch (_) {
  472. }
  473. }
  474. }
  475. };
  476. var _initDocument = function _initDocument2(dirty) {
  477. var doc;
  478. var leadingWhitespace;
  479. if (FORCE_BODY) {
  480. dirty = "<remove></remove>" + dirty;
  481. } else {
  482. var matches = stringMatch(dirty, /^[\r\n\t ]+/);
  483. leadingWhitespace = matches && matches[0];
  484. }
  485. if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && NAMESPACE === HTML_NAMESPACE) {
  486. dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + "</body></html>";
  487. }
  488. var dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
  489. if (NAMESPACE === HTML_NAMESPACE) {
  490. try {
  491. doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
  492. } catch (_) {
  493. }
  494. }
  495. if (!doc || !doc.documentElement) {
  496. doc = implementation.createDocument(NAMESPACE, "template", null);
  497. try {
  498. doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
  499. } catch (_) {
  500. }
  501. }
  502. var body = doc.body || doc.documentElement;
  503. if (dirty && leadingWhitespace) {
  504. body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
  505. }
  506. if (NAMESPACE === HTML_NAMESPACE) {
  507. return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? "html" : "body")[0];
  508. }
  509. return WHOLE_DOCUMENT ? doc.documentElement : body;
  510. };
  511. var _createIterator = function _createIterator2(root) {
  512. return createNodeIterator.call(
  513. root.ownerDocument || root,
  514. root,
  515. // eslint-disable-next-line no-bitwise
  516. NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION,
  517. null,
  518. false
  519. );
  520. };
  521. var _isClobbered = function _isClobbered2(elm) {
  522. return elm instanceof HTMLFormElement && (typeof elm.nodeName !== "string" || typeof elm.textContent !== "string" || typeof elm.removeChild !== "function" || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== "function" || typeof elm.setAttribute !== "function" || typeof elm.namespaceURI !== "string" || typeof elm.insertBefore !== "function" || typeof elm.hasChildNodes !== "function");
  523. };
  524. var _isNode = function _isNode2(object) {
  525. return _typeof(Node) === "object" ? object instanceof Node : object && _typeof(object) === "object" && typeof object.nodeType === "number" && typeof object.nodeName === "string";
  526. };
  527. var _executeHook = function _executeHook2(entryPoint, currentNode, data) {
  528. if (!hooks[entryPoint]) {
  529. return;
  530. }
  531. arrayForEach(hooks[entryPoint], function(hook) {
  532. hook.call(DOMPurify, currentNode, data, CONFIG);
  533. });
  534. };
  535. var _sanitizeElements = function _sanitizeElements2(currentNode) {
  536. var content;
  537. _executeHook("beforeSanitizeElements", currentNode, null);
  538. if (_isClobbered(currentNode)) {
  539. _forceRemove(currentNode);
  540. return true;
  541. }
  542. if (regExpTest(/[\u0080-\uFFFF]/, currentNode.nodeName)) {
  543. _forceRemove(currentNode);
  544. return true;
  545. }
  546. var tagName = transformCaseFunc(currentNode.nodeName);
  547. _executeHook("uponSanitizeElement", currentNode, {
  548. tagName,
  549. allowedTags: ALLOWED_TAGS
  550. });
  551. if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
  552. _forceRemove(currentNode);
  553. return true;
  554. }
  555. if (tagName === "select" && regExpTest(/<template/i, currentNode.innerHTML)) {
  556. _forceRemove(currentNode);
  557. return true;
  558. }
  559. if (currentNode.nodeType === 7) {
  560. _forceRemove(currentNode);
  561. return true;
  562. }
  563. if (SAFE_FOR_XML && currentNode.nodeType === 8 && regExpTest(/<[/\w]/g, currentNode.data)) {
  564. _forceRemove(currentNode);
  565. return true;
  566. }
  567. if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
  568. if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
  569. if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName))
  570. return false;
  571. if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName))
  572. return false;
  573. }
  574. if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
  575. var parentNode = getParentNode(currentNode) || currentNode.parentNode;
  576. var childNodes = getChildNodes(currentNode) || currentNode.childNodes;
  577. if (childNodes && parentNode) {
  578. var childCount = childNodes.length;
  579. for (var i = childCount - 1; i >= 0; --i) {
  580. var childClone = cloneNode(childNodes[i], true);
  581. childClone.__removalCount = (currentNode.__removalCount || 0) + 1;
  582. parentNode.insertBefore(childClone, getNextSibling(currentNode));
  583. }
  584. }
  585. }
  586. _forceRemove(currentNode);
  587. return true;
  588. }
  589. if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
  590. _forceRemove(currentNode);
  591. return true;
  592. }
  593. if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
  594. _forceRemove(currentNode);
  595. return true;
  596. }
  597. if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
  598. content = currentNode.textContent;
  599. content = stringReplace(content, MUSTACHE_EXPR$1, " ");
  600. content = stringReplace(content, ERB_EXPR$1, " ");
  601. content = stringReplace(content, TMPLIT_EXPR$1, " ");
  602. if (currentNode.textContent !== content) {
  603. arrayPush(DOMPurify.removed, {
  604. element: currentNode.cloneNode()
  605. });
  606. currentNode.textContent = content;
  607. }
  608. }
  609. _executeHook("afterSanitizeElements", currentNode, null);
  610. return false;
  611. };
  612. var _isValidAttribute = function _isValidAttribute2(lcTag, lcName, value) {
  613. if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) {
  614. return false;
  615. }
  616. if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName))
  617. ;
  618. else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName))
  619. ;
  620. else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
  621. if (
  622. // First condition does a very basic check if a) it's basically a valid custom element tagname AND
  623. // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
  624. // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
  625. _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
  626. // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
  627. lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))
  628. )
  629. ;
  630. else {
  631. return false;
  632. }
  633. } else if (URI_SAFE_ATTRIBUTES[lcName])
  634. ;
  635. else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, "")))
  636. ;
  637. else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag])
  638. ;
  639. else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, "")))
  640. ;
  641. else if (value) {
  642. return false;
  643. } else
  644. ;
  645. return true;
  646. };
  647. var _basicCustomElementTest = function _basicCustomElementTest2(tagName) {
  648. return tagName !== "annotation-xml" && stringMatch(tagName, CUSTOM_ELEMENT$1);
  649. };
  650. var _sanitizeAttributes = function _sanitizeAttributes2(currentNode) {
  651. var attr;
  652. var value;
  653. var lcName;
  654. var l;
  655. _executeHook("beforeSanitizeAttributes", currentNode, null);
  656. var attributes = currentNode.attributes;
  657. if (!attributes || _isClobbered(currentNode)) {
  658. return;
  659. }
  660. var hookEvent = {
  661. attrName: "",
  662. attrValue: "",
  663. keepAttr: true,
  664. allowedAttributes: ALLOWED_ATTR
  665. };
  666. l = attributes.length;
  667. while (l--) {
  668. attr = attributes[l];
  669. var _attr = attr, name = _attr.name, namespaceURI = _attr.namespaceURI;
  670. value = name === "value" ? attr.value : stringTrim(attr.value);
  671. lcName = transformCaseFunc(name);
  672. hookEvent.attrName = lcName;
  673. hookEvent.attrValue = value;
  674. hookEvent.keepAttr = true;
  675. hookEvent.forceKeepAttr = void 0;
  676. _executeHook("uponSanitizeAttribute", currentNode, hookEvent);
  677. value = hookEvent.attrValue;
  678. if (hookEvent.forceKeepAttr) {
  679. continue;
  680. }
  681. _removeAttribute(name, currentNode);
  682. if (!hookEvent.keepAttr) {
  683. continue;
  684. }
  685. if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
  686. _removeAttribute(name, currentNode);
  687. continue;
  688. }
  689. if (SAFE_FOR_TEMPLATES) {
  690. value = stringReplace(value, MUSTACHE_EXPR$1, " ");
  691. value = stringReplace(value, ERB_EXPR$1, " ");
  692. value = stringReplace(value, TMPLIT_EXPR$1, " ");
  693. }
  694. var lcTag = transformCaseFunc(currentNode.nodeName);
  695. if (!_isValidAttribute(lcTag, lcName, value)) {
  696. continue;
  697. }
  698. if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name")) {
  699. _removeAttribute(name, currentNode);
  700. value = SANITIZE_NAMED_PROPS_PREFIX + value;
  701. }
  702. if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|title)/i, value)) {
  703. _removeAttribute(name, currentNode);
  704. continue;
  705. }
  706. if (trustedTypesPolicy && _typeof(trustedTypes) === "object" && typeof trustedTypes.getAttributeType === "function") {
  707. if (namespaceURI)
  708. ;
  709. else {
  710. switch (trustedTypes.getAttributeType(lcTag, lcName)) {
  711. case "TrustedHTML": {
  712. value = trustedTypesPolicy.createHTML(value);
  713. break;
  714. }
  715. case "TrustedScriptURL": {
  716. value = trustedTypesPolicy.createScriptURL(value);
  717. break;
  718. }
  719. }
  720. }
  721. }
  722. try {
  723. if (namespaceURI) {
  724. currentNode.setAttributeNS(namespaceURI, name, value);
  725. } else {
  726. currentNode.setAttribute(name, value);
  727. }
  728. if (_isClobbered(currentNode)) {
  729. _forceRemove(currentNode);
  730. } else {
  731. arrayPop(DOMPurify.removed);
  732. }
  733. } catch (_) {
  734. }
  735. }
  736. _executeHook("afterSanitizeAttributes", currentNode, null);
  737. };
  738. var _sanitizeShadowDOM = function _sanitizeShadowDOM2(fragment) {
  739. var shadowNode;
  740. var shadowIterator = _createIterator(fragment);
  741. _executeHook("beforeSanitizeShadowDOM", fragment, null);
  742. while (shadowNode = shadowIterator.nextNode()) {
  743. _executeHook("uponSanitizeShadowNode", shadowNode, null);
  744. _sanitizeElements(shadowNode);
  745. _sanitizeAttributes(shadowNode);
  746. if (shadowNode.content instanceof DocumentFragment) {
  747. _sanitizeShadowDOM2(shadowNode.content);
  748. }
  749. }
  750. _executeHook("afterSanitizeShadowDOM", fragment, null);
  751. };
  752. DOMPurify.sanitize = function(dirty) {
  753. var cfg = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {};
  754. var body;
  755. var importedNode;
  756. var currentNode;
  757. var oldNode;
  758. var returnNode;
  759. IS_EMPTY_INPUT = !dirty;
  760. if (IS_EMPTY_INPUT) {
  761. dirty = "<!-->";
  762. }
  763. if (typeof dirty !== "string" && !_isNode(dirty)) {
  764. if (typeof dirty.toString === "function") {
  765. dirty = dirty.toString();
  766. if (typeof dirty !== "string") {
  767. throw typeErrorCreate("dirty is not a string, aborting");
  768. }
  769. } else {
  770. throw typeErrorCreate("toString is not a function");
  771. }
  772. }
  773. if (!DOMPurify.isSupported) {
  774. if (_typeof(window2.toStaticHTML) === "object" || typeof window2.toStaticHTML === "function") {
  775. if (typeof dirty === "string") {
  776. return window2.toStaticHTML(dirty);
  777. }
  778. if (_isNode(dirty)) {
  779. return window2.toStaticHTML(dirty.outerHTML);
  780. }
  781. }
  782. return dirty;
  783. }
  784. if (!SET_CONFIG) {
  785. _parseConfig(cfg);
  786. }
  787. DOMPurify.removed = [];
  788. if (typeof dirty === "string") {
  789. IN_PLACE = false;
  790. }
  791. if (IN_PLACE) {
  792. if (dirty.nodeName) {
  793. var tagName = transformCaseFunc(dirty.nodeName);
  794. if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
  795. throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
  796. }
  797. }
  798. } else if (dirty instanceof Node) {
  799. body = _initDocument("<!---->");
  800. importedNode = body.ownerDocument.importNode(dirty, true);
  801. if (importedNode.nodeType === 1 && importedNode.nodeName === "BODY") {
  802. body = importedNode;
  803. } else if (importedNode.nodeName === "HTML") {
  804. body = importedNode;
  805. } else {
  806. body.appendChild(importedNode);
  807. }
  808. } else {
  809. if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
  810. dirty.indexOf("<") === -1) {
  811. return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
  812. }
  813. body = _initDocument(dirty);
  814. if (!body) {
  815. return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
  816. }
  817. }
  818. if (body && FORCE_BODY) {
  819. _forceRemove(body.firstChild);
  820. }
  821. var nodeIterator = _createIterator(IN_PLACE ? dirty : body);
  822. while (currentNode = nodeIterator.nextNode()) {
  823. if (currentNode.nodeType === 3 && currentNode === oldNode) {
  824. continue;
  825. }
  826. _sanitizeElements(currentNode);
  827. _sanitizeAttributes(currentNode);
  828. if (currentNode.content instanceof DocumentFragment) {
  829. _sanitizeShadowDOM(currentNode.content);
  830. }
  831. oldNode = currentNode;
  832. }
  833. oldNode = null;
  834. if (IN_PLACE) {
  835. return dirty;
  836. }
  837. if (RETURN_DOM) {
  838. if (RETURN_DOM_FRAGMENT) {
  839. returnNode = createDocumentFragment.call(body.ownerDocument);
  840. while (body.firstChild) {
  841. returnNode.appendChild(body.firstChild);
  842. }
  843. } else {
  844. returnNode = body;
  845. }
  846. if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmod) {
  847. returnNode = importNode.call(originalDocument, returnNode, true);
  848. }
  849. return returnNode;
  850. }
  851. var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
  852. if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
  853. serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
  854. }
  855. if (SAFE_FOR_TEMPLATES) {
  856. serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR$1, " ");
  857. serializedHTML = stringReplace(serializedHTML, ERB_EXPR$1, " ");
  858. serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR$1, " ");
  859. }
  860. return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
  861. };
  862. DOMPurify.setConfig = function(cfg) {
  863. _parseConfig(cfg);
  864. SET_CONFIG = true;
  865. };
  866. DOMPurify.clearConfig = function() {
  867. CONFIG = null;
  868. SET_CONFIG = false;
  869. };
  870. DOMPurify.isValidAttribute = function(tag, attr, value) {
  871. if (!CONFIG) {
  872. _parseConfig({});
  873. }
  874. var lcTag = transformCaseFunc(tag);
  875. var lcName = transformCaseFunc(attr);
  876. return _isValidAttribute(lcTag, lcName, value);
  877. };
  878. DOMPurify.addHook = function(entryPoint, hookFunction) {
  879. if (typeof hookFunction !== "function") {
  880. return;
  881. }
  882. hooks[entryPoint] = hooks[entryPoint] || [];
  883. arrayPush(hooks[entryPoint], hookFunction);
  884. };
  885. DOMPurify.removeHook = function(entryPoint) {
  886. if (hooks[entryPoint]) {
  887. return arrayPop(hooks[entryPoint]);
  888. }
  889. };
  890. DOMPurify.removeHooks = function(entryPoint) {
  891. if (hooks[entryPoint]) {
  892. hooks[entryPoint] = [];
  893. }
  894. };
  895. DOMPurify.removeAllHooks = function() {
  896. hooks = {};
  897. };
  898. return DOMPurify;
  899. }
  900. var hasOwnProperty, setPrototypeOf, isFrozen, getPrototypeOf, getOwnPropertyDescriptor, freeze, seal, create, _ref, apply, construct, arrayForEach, arrayPop, arrayPush, stringToLowerCase, stringToString, stringMatch, stringReplace, stringIndexOf, stringTrim, regExpTest, typeErrorCreate, html$1, svg$1, svgFilters, svgDisallowed, mathMl$1, mathMlDisallowed, text, html, svg, mathMl, xml, MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR, DATA_ATTR, ARIA_ATTR, IS_ALLOWED_URI, IS_SCRIPT_OR_DATA, ATTR_WHITESPACE, DOCTYPE_NAME, CUSTOM_ELEMENT, getGlobal, _createTrustedTypesPolicy, purify;
  901. var init_purify_es = __esm({
  902. "node_modules/.pnpm/dompurify@2.5.8/node_modules/dompurify/dist/purify.es.js"() {
  903. hasOwnProperty = Object.hasOwnProperty;
  904. setPrototypeOf = Object.setPrototypeOf;
  905. isFrozen = Object.isFrozen;
  906. getPrototypeOf = Object.getPrototypeOf;
  907. getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
  908. freeze = Object.freeze;
  909. seal = Object.seal;
  910. create = Object.create;
  911. _ref = typeof Reflect !== "undefined" && Reflect;
  912. apply = _ref.apply;
  913. construct = _ref.construct;
  914. if (!apply) {
  915. apply = function apply2(fun, thisValue, args) {
  916. return fun.apply(thisValue, args);
  917. };
  918. }
  919. if (!freeze) {
  920. freeze = function freeze2(x) {
  921. return x;
  922. };
  923. }
  924. if (!seal) {
  925. seal = function seal2(x) {
  926. return x;
  927. };
  928. }
  929. if (!construct) {
  930. construct = function construct2(Func, args) {
  931. return _construct(Func, _toConsumableArray(args));
  932. };
  933. }
  934. arrayForEach = unapply(Array.prototype.forEach);
  935. arrayPop = unapply(Array.prototype.pop);
  936. arrayPush = unapply(Array.prototype.push);
  937. stringToLowerCase = unapply(String.prototype.toLowerCase);
  938. stringToString = unapply(String.prototype.toString);
  939. stringMatch = unapply(String.prototype.match);
  940. stringReplace = unapply(String.prototype.replace);
  941. stringIndexOf = unapply(String.prototype.indexOf);
  942. stringTrim = unapply(String.prototype.trim);
  943. regExpTest = unapply(RegExp.prototype.test);
  944. typeErrorCreate = unconstruct(TypeError);
  945. html$1 = freeze(["a", "abbr", "acronym", "address", "area", "article", "aside", "audio", "b", "bdi", "bdo", "big", "blink", "blockquote", "body", "br", "button", "canvas", "caption", "center", "cite", "code", "col", "colgroup", "content", "data", "datalist", "dd", "decorator", "del", "details", "dfn", "dialog", "dir", "div", "dl", "dt", "element", "em", "fieldset", "figcaption", "figure", "font", "footer", "form", "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "main", "map", "mark", "marquee", "menu", "menuitem", "meter", "nav", "nobr", "ol", "optgroup", "option", "output", "p", "picture", "pre", "progress", "q", "rp", "rt", "ruby", "s", "samp", "section", "select", "shadow", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "tr", "track", "tt", "u", "ul", "var", "video", "wbr"]);
  946. svg$1 = freeze(["svg", "a", "altglyph", "altglyphdef", "altglyphitem", "animatecolor", "animatemotion", "animatetransform", "circle", "clippath", "defs", "desc", "ellipse", "filter", "font", "g", "glyph", "glyphref", "hkern", "image", "line", "lineargradient", "marker", "mask", "metadata", "mpath", "path", "pattern", "polygon", "polyline", "radialgradient", "rect", "stop", "style", "switch", "symbol", "text", "textpath", "title", "tref", "tspan", "view", "vkern"]);
  947. svgFilters = freeze(["feBlend", "feColorMatrix", "feComponentTransfer", "feComposite", "feConvolveMatrix", "feDiffuseLighting", "feDisplacementMap", "feDistantLight", "feFlood", "feFuncA", "feFuncB", "feFuncG", "feFuncR", "feGaussianBlur", "feImage", "feMerge", "feMergeNode", "feMorphology", "feOffset", "fePointLight", "feSpecularLighting", "feSpotLight", "feTile", "feTurbulence"]);
  948. svgDisallowed = freeze(["animate", "color-profile", "cursor", "discard", "fedropshadow", "font-face", "font-face-format", "font-face-name", "font-face-src", "font-face-uri", "foreignobject", "hatch", "hatchpath", "mesh", "meshgradient", "meshpatch", "meshrow", "missing-glyph", "script", "set", "solidcolor", "unknown", "use"]);
  949. mathMl$1 = freeze(["math", "menclose", "merror", "mfenced", "mfrac", "mglyph", "mi", "mlabeledtr", "mmultiscripts", "mn", "mo", "mover", "mpadded", "mphantom", "mroot", "mrow", "ms", "mspace", "msqrt", "mstyle", "msub", "msup", "msubsup", "mtable", "mtd", "mtext", "mtr", "munder", "munderover"]);
  950. mathMlDisallowed = freeze(["maction", "maligngroup", "malignmark", "mlongdiv", "mscarries", "mscarry", "msgroup", "mstack", "msline", "msrow", "semantics", "annotation", "annotation-xml", "mprescripts", "none"]);
  951. text = freeze(["#text"]);
  952. html = freeze(["accept", "action", "align", "alt", "autocapitalize", "autocomplete", "autopictureinpicture", "autoplay", "background", "bgcolor", "border", "capture", "cellpadding", "cellspacing", "checked", "cite", "class", "clear", "color", "cols", "colspan", "controls", "controlslist", "coords", "crossorigin", "datetime", "decoding", "default", "dir", "disabled", "disablepictureinpicture", "disableremoteplayback", "download", "draggable", "enctype", "enterkeyhint", "face", "for", "headers", "height", "hidden", "high", "href", "hreflang", "id", "inputmode", "integrity", "ismap", "kind", "label", "lang", "list", "loading", "loop", "low", "max", "maxlength", "media", "method", "min", "minlength", "multiple", "muted", "name", "nonce", "noshade", "novalidate", "nowrap", "open", "optimum", "pattern", "placeholder", "playsinline", "poster", "preload", "pubdate", "radiogroup", "readonly", "rel", "required", "rev", "reversed", "role", "rows", "rowspan", "spellcheck", "scope", "selected", "shape", "size", "sizes", "span", "srclang", "start", "src", "srcset", "step", "style", "summary", "tabindex", "title", "translate", "type", "usemap", "valign", "value", "width", "xmlns", "slot"]);
  953. svg = freeze(["accent-height", "accumulate", "additive", "alignment-baseline", "ascent", "attributename", "attributetype", "azimuth", "basefrequency", "baseline-shift", "begin", "bias", "by", "class", "clip", "clippathunits", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-profile", "color-rendering", "cx", "cy", "d", "dx", "dy", "diffuseconstant", "direction", "display", "divisor", "dur", "edgemode", "elevation", "end", "fill", "fill-opacity", "fill-rule", "filter", "filterunits", "flood-color", "flood-opacity", "font-family", "font-size", "font-size-adjust", "font-stretch", "font-style", "font-variant", "font-weight", "fx", "fy", "g1", "g2", "glyph-name", "glyphref", "gradientunits", "gradienttransform", "height", "href", "id", "image-rendering", "in", "in2", "k", "k1", "k2", "k3", "k4", "kerning", "keypoints", "keysplines", "keytimes", "lang", "lengthadjust", "letter-spacing", "kernelmatrix", "kernelunitlength", "lighting-color", "local", "marker-end", "marker-mid", "marker-start", "markerheight", "markerunits", "markerwidth", "maskcontentunits", "maskunits", "max", "mask", "media", "method", "mode", "min", "name", "numoctaves", "offset", "operator", "opacity", "order", "orient", "orientation", "origin", "overflow", "paint-order", "path", "pathlength", "patterncontentunits", "patterntransform", "patternunits", "points", "preservealpha", "preserveaspectratio", "primitiveunits", "r", "rx", "ry", "radius", "refx", "refy", "repeatcount", "repeatdur", "restart", "result", "rotate", "scale", "seed", "shape-rendering", "specularconstant", "specularexponent", "spreadmethod", "startoffset", "stddeviation", "stitchtiles", "stop-color", "stop-opacity", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke", "stroke-width", "style", "surfacescale", "systemlanguage", "tabindex", "targetx", "targety", "transform", "transform-origin", "text-anchor", "text-decoration", "text-rendering", "textlength", "type", "u1", "u2", "unicode", "values", "viewbox", "visibility", "version", "vert-adv-y", "vert-origin-x", "vert-origin-y", "width", "word-spacing", "wrap", "writing-mode", "xchannelselector", "ychannelselector", "x", "x1", "x2", "xmlns", "y", "y1", "y2", "z", "zoomandpan"]);
  954. mathMl = freeze(["accent", "accentunder", "align", "bevelled", "close", "columnsalign", "columnlines", "columnspan", "denomalign", "depth", "dir", "display", "displaystyle", "encoding", "fence", "frame", "height", "href", "id", "largeop", "length", "linethickness", "lspace", "lquote", "mathbackground", "mathcolor", "mathsize", "mathvariant", "maxsize", "minsize", "movablelimits", "notation", "numalign", "open", "rowalign", "rowlines", "rowspacing", "rowspan", "rspace", "rquote", "scriptlevel", "scriptminsize", "scriptsizemultiplier", "selection", "separator", "separators", "stretchy", "subscriptshift", "supscriptshift", "symmetric", "voffset", "width", "xmlns"]);
  955. xml = freeze(["xlink:href", "xml:id", "xlink:title", "xml:space", "xmlns:xlink"]);
  956. MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm);
  957. ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
  958. TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
  959. DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/);
  960. ARIA_ATTR = seal(/^aria-[\-\w]+$/);
  961. IS_ALLOWED_URI = seal(
  962. /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
  963. // eslint-disable-line no-useless-escape
  964. );
  965. IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
  966. ATTR_WHITESPACE = seal(
  967. /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g
  968. // eslint-disable-line no-control-regex
  969. );
  970. DOCTYPE_NAME = seal(/^html$/i);
  971. CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
  972. getGlobal = function getGlobal2() {
  973. return typeof window === "undefined" ? null : window;
  974. };
  975. _createTrustedTypesPolicy = function _createTrustedTypesPolicy2(trustedTypes, document) {
  976. if (_typeof(trustedTypes) !== "object" || typeof trustedTypes.createPolicy !== "function") {
  977. return null;
  978. }
  979. var suffix = null;
  980. var ATTR_NAME = "data-tt-policy-suffix";
  981. if (document.currentScript && document.currentScript.hasAttribute(ATTR_NAME)) {
  982. suffix = document.currentScript.getAttribute(ATTR_NAME);
  983. }
  984. var policyName = "dompurify" + (suffix ? "#" + suffix : "");
  985. try {
  986. return trustedTypes.createPolicy(policyName, {
  987. createHTML: function createHTML(html2) {
  988. return html2;
  989. },
  990. createScriptURL: function createScriptURL(scriptUrl) {
  991. return scriptUrl;
  992. }
  993. });
  994. } catch (_) {
  995. console.warn("TrustedTypes policy " + policyName + " could not be created.");
  996. return null;
  997. }
  998. };
  999. purify = createDOMPurify();
  1000. }
  1001. });
  1002. init_purify_es();
  1003. export {
  1004. purify as default
  1005. };
  1006. /*! Bundled license information:
  1007. dompurify/dist/purify.es.js:
  1008. (*! @license DOMPurify 2.5.8 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.5.8/LICENSE *)
  1009. */
  1010. //# sourceMappingURL=purify.es-FFYFKQBW.js.map