1/** 2 * For jQuery versions less than 3.4.0, this replaces the jQuery.extend 3 * function with the one from jQuery 3.4.0, slightly modified (documented 4 * below) to be compatible with older jQuery versions and browsers. 5 * 6 * This provides the Object.prototype pollution vulnerability fix to Drupal 7 * installations running older jQuery versions, including the versions shipped 8 * with Drupal core and https://www.drupal.org/project/jquery_update. 9 * 10 * @see https://github.com/jquery/jquery/pull/4333 11 */ 12 13(function (jQuery) { 14 15// Do not override jQuery.extend() if the jQuery version is already >=3.4.0. 16var versionParts = jQuery.fn.jquery.split('.'); 17var majorVersion = parseInt(versionParts[0]); 18var minorVersion = parseInt(versionParts[1]); 19var patchVersion = parseInt(versionParts[2]); 20var isPreReleaseVersion = (patchVersion.toString() !== versionParts[2]); 21if ( 22 (majorVersion > 3) || 23 (majorVersion === 3 && minorVersion > 4) || 24 (majorVersion === 3 && minorVersion === 4 && patchVersion > 0) || 25 (majorVersion === 3 && minorVersion === 4 && patchVersion === 0 && !isPreReleaseVersion) 26) { 27 return; 28} 29 30/** 31 * This is almost verbatim copied from jQuery 3.4.0. 32 * 33 * Only two minor changes have been made: 34 * - The call to isFunction() is changed to jQuery.isFunction(). 35 * - The two calls to Array.isArray() is changed to jQuery.isArray(). 36 * 37 * The above two changes ensure compatibility with all older jQuery versions 38 * (1.4.4 - 3.3.1) and older browser versions (e.g., IE8). 39 */ 40jQuery.extend = jQuery.fn.extend = function() { 41 var options, name, src, copy, copyIsArray, clone, 42 target = arguments[ 0 ] || {}, 43 i = 1, 44 length = arguments.length, 45 deep = false; 46 47 // Handle a deep copy situation 48 if ( typeof target === "boolean" ) { 49 deep = target; 50 51 // Skip the boolean and the target 52 target = arguments[ i ] || {}; 53 i++; 54 } 55 56 // Handle case when target is a string or something (possible in deep copy) 57 if ( typeof target !== "object" && !jQuery.isFunction( target ) ) { 58 target = {}; 59 } 60 61 // Extend jQuery itself if only one argument is passed 62 if ( i === length ) { 63 target = this; 64 i--; 65 } 66 67 for ( ; i < length; i++ ) { 68 69 // Only deal with non-null/undefined values 70 if ( ( options = arguments[ i ] ) != null ) { 71 72 // Extend the base object 73 for ( name in options ) { 74 copy = options[ name ]; 75 76 // Prevent Object.prototype pollution 77 // Prevent never-ending loop 78 if ( name === "__proto__" || target === copy ) { 79 continue; 80 } 81 82 // Recurse if we're merging plain objects or arrays 83 if ( deep && copy && ( jQuery.isPlainObject( copy ) || 84 ( copyIsArray = jQuery.isArray( copy ) ) ) ) { 85 src = target[ name ]; 86 87 // Ensure proper type for the source value 88 if ( copyIsArray && !jQuery.isArray( src ) ) { 89 clone = []; 90 } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) { 91 clone = {}; 92 } else { 93 clone = src; 94 } 95 copyIsArray = false; 96 97 // Never move original objects, clone them 98 target[ name ] = jQuery.extend( deep, clone, copy ); 99 100 // Don't bring in undefined values 101 } else if ( copy !== undefined ) { 102 target[ name ] = copy; 103 } 104 } 105 } 106 } 107 108 // Return the modified object 109 return target; 110}; 111 112})(jQuery); 113;/*})'"*/;/*})'"*/ 114/** 115 * For jQuery versions less than 3.5.0, this replaces the jQuery.htmlPrefilter() 116 * function with one that fixes these security vulnerabilities while also 117 * retaining the pre-3.5.0 behavior where it's safe to do so. 118 * - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 119 * - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 120 * 121 * Additionally, for jQuery versions that do not have a jQuery.htmlPrefilter() 122 * function (1.x prior to 1.12 and 2.x prior to 2.2), this adds it, and 123 * extends the functions that need to call it to do so. 124 * 125 * Drupal core's jQuery version is 1.4.4, but jQuery Update can provide a 126 * different version, so this covers all versions between 1.4.4 and 3.4.1. 127 * The GitHub links in the code comments below link to jQuery 1.5 code, be
127cause 128 * 1.4.4 isn't on GitHub, but the referenced code didn't change from 1.4.4 to 129 * 1.5. 130 */ 131 132(function (jQuery) { 133 134 // Parts of this backport differ by jQuery version. 135 var versionParts = jQuery.fn.jquery.split('.'); 136 var majorVersion = parseInt(versionParts[0]); 137 var minorVersion = parseInt(versionParts[1]); 138 139 // No backport is needed if we're already on jQuery 3.5 or higher. 140 if ( (majorVersion > 3) || (majorVersion === 3 && minorVersion >= 5) ) { 141 return; 142 } 143 144 // Prior to jQuery 3.5, jQuery converted XHTML-style self-closing tags to 145 // their XML equivalent: e.g., "<div />" to "<div></div>". This is 146 // problematic for several reasons, including that it's vulnerable to XSS 147 // attacks. However, since this was jQuery's behavior for many years, many 148 // Drupal modules and jQuery plugins may be relying on it. Therefore, we 149 // preserve that behavior, but for a limited set of tags only, that we believe 150 // to not be vulnerable. This is the set of HTML tags that satisfy all of the 151 // following conditions: 152 // - In DOMPurify's list of HTML tags. If an HTML tag isn't safe enough to 153 // appear in that list, then we don't want to mess with it here either. 154 // @see https://github.com/cure53/DOMPurify/blob/2.0.11/dist/purify.js#L128 155 // - A normal element (not a void, template, text, or foreign element). 156 // @see https://html.spec.whatwg.org/multipage/syntax.html#elements-2 157 // - An element that is still defined by the current HTML specification 158 // (not a deprecated element), because we do not want to rely on how 159 // browsers parse deprecated elements. 160 // @see https://developer.mozilla.org/en-US/docs/Web/HTML/Element 161 // - Not 'html', 'head', or 'body', because this pseudo-XHTML expansion is 162 // designed for fragments, not entire documents. 163 // - Not 'colgroup', because due to an idiosyncrasy of jQuery's original 164 // regular expression, it didn't match on colgroup, and we don't want to 165 // introduce a behavior change for that. 166 var selfClosingTagsToReplace = [ 167 'a', 'abbr', 'address', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 168 'blockquote', 'button', 'canvas', 'caption', 'cite', 'code', 'data', 169 'datalist', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 170 'fieldset', 'figcaption', 'figure', 'footer', 'form', 'h1', 'h2', 'h3', 171 'h4', 'h5', 'h6', 'header', 'hgroup', 'i', 'ins', 'kbd', 'label', 'legend', 172 'li', 'main', 'map', 'mark', 'menu', 'meter', 'nav', 'ol', 'optgroup', 173 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 174 'ruby', 's', 'samp', 'section', 'select', 'small', 'source', 'span', 175 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 176 'thead', 'time', 'tr', 'u', 'ul', 'var', 'video' 177 ]; 178 179 // Define regular expressions for <TAG/> and <TAG ATTRIBUTES/>. Doing this as 180 // two expressions makes it easier to target <a/> without also targeting 181 // every tag that starts with "a". 182 var xhtmlRegExpGroup = '(' + selfClosingTagsToReplace.join('|') + ')'; 183 var whitespace = '[\\x20\\t\\r\\n\\f]'; 184 var rxhtmlTagWithoutSpaceOrAttributes = new RegExp('<' + xhtmlRegExpGroup + '\\/>', 'gi'); 185 var rxhtmlTagWithSpaceAndMaybeAttributes = new RegExp('<' + xhtmlRegExpGroup + '(' + whitespace + '[^>]*)\\/>', 'gi'); 186 187 // jQuery 3.5 also fixed a vulnerability for when </select> appears within 188 // an <option> or <optgroup>, but it did that in local code that we can't 189 // backport directly. Instead, we filter such cases out. To do so, we need to 190 // determine when jQuery would otherwise invoke the vulnerable code, which it 191 // uses this regular expression to determine. The regular expression changed 192 // for version 3.0.0 and changed again for 3.4.0. 193 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L4958 194 // @see https://github.com/jquery/jquery/blob/3.0.0/dist/jquery.js#L4584 195 // @see https://github.com/jquery/jquery/blob/3.4.0/dist/jquery.js#L4712 196 var rtagName; 197 if (majorVersion < 3) { 198 rtagName = /<([\w:]+)/; 199 } 200 else if (minorVersion < 4) { 201 rtagName = /<([a-z][^\/\0>\x20\t\r\n\f]+)/i; 202 } 203 else { 204 rtagName = /<([a-z][^\/\0>\x20\t\r\n\f]*)/i; 205 } 206 207 // The regular expression that jQuery uses to determine which self-closing 208 // tags to expand to open and close tags. This is vulnerable, because it 209 // matches all tag names except the few excluded ones. We only use this 210 // expression for determining vulnerability. The expression changed for 211 // version 3, but we only need to check for vulnerability in versions 1 and 2, 212 // so we use the expression from those versions. 213 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L4957 214 var rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/gi; 215 216 jQuery.extend({ 217 htmlPrefilter: function (html) { 218 // This is how jQuery determines the first tag in the HTML. 219 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L5521 220 var tag = ( rtagName.exec( html ) || [ "", "" ] )[ 1 ].toLowerCase(); 221
222 // It is not valid HTML for <option> or <optgroup> to have <select> as 223 // either a descendant or sibling, and attempts to inject one can cause 224 // XSS on jQuery versions before 3.5. Since this is invalid HTML and a 225 // possible XSS attack, reject the entire string. 226 // @see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 227 if ((tag === 'option' || tag === 'optgroup') && html.match(/<\/?select/i)) { 228 html = ''; 229 } 230 231 // Retain jQuery's prior to 3.5 conversion of pseudo-XHTML, but for only 232 // the tags in the `selfClosingTagsToReplace` list defined above. 233 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L5518 234 // @see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 235 html = html.replace(rxhtmlTagWithoutSpaceOrAttributes, "<$1></$1>"); 236 html = html.replace(rxhtmlTagWithSpaceAndMaybeAttributes, "<$1$2></$1>"); 237 238 // Prior to jQuery 1.12 and 2.2, this function gets called (via code later 239 // in this file) in addition to, rather than instead of, the unsafe 240 // expansion of self-closing tags (including ones not in the list above). 241 // We can't prevent that unsafe expansion from running, so instead we 242 // check to make sure that it doesn't affect the DOM returned by the 243 // browser's parsing logic. If it does affect it, then it's vulnerable to 244 // XSS, so we reject the entire string. 245 if ( (majorVersion === 1 && minorVersion < 12) || (majorVersion === 2 && minorVersion < 2) ) { 246 var htmlRisky = html.replace(rxhtmlTag, "<$1></$2>"); 247 if (htmlRisky !== html) { 248 // Even though htmlRisky and html are different strings, they might 249 // represent the same HTML structure once parsed, in which case, 250 // htmlRisky is actually safe. We can ask the browser to parse both 251 // to find out, but the browser can't parse table fragments (e.g., a 252 // root-level "<td>"), so we need to wrap them. We just need this 253 // technique to work on all supported browsers; we don't need to 254 // copy from the specific jQuery version we're using. 255 // @see https://github.com/jquery/jquery/blob/3.5.1/dist/jquery.js#L4939 256 var wrapMap = { 257 thead: [ 1, "<table>", "</table>" ], 258 col: [ 2, "<table><colgroup>", "</colgroup></table>" ], 259 tr: [ 2, "<table><tbody>", "</tbody></table>" ], 260 td: [ 3, "<table><tbody><tr>", "</tr></tbody></table>" ], 261 }; 262 wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead; 263 wrapMap.th = wrapMap.td; 264 265 // Function to wrap HTML into something that a browser can parse. 266 // @see https://github.com/jquery/jquery/blob/3.5.1/dist/jquery.js#L5032 267 var getWrappedHtml = function (html) { 268 var wrap = wrapMap[tag]; 269 if (wrap) { 270 html = wrap[1] + html + wrap[2]; 271 } 272 return html; 273 }; 274 275 // Function to return canonical HTML after parsing it. This parses 276 // only; it doesn't execute scripts. 277 // @see https://github.com/jquery/jquery-migrate/blob/3.3.0/src/jquery/manipulation.js#L5 278 var getParsedHtml = function (html) { 279 var doc = window.document.implementation.createHTMLDocument( "" ); 280 doc.body.innerHTML = html; 281 return doc.body ? doc.body.innerHTML : ''; 282 }; 283 284 // If the browser couldn't parse either one successfully, or if 285 // htmlRisky parses differently than html, then html is vulnerable, 286 // so reject it. 287 var htmlParsed = getParsedHtml(getWrappedHtml(html)); 288 var htmlRiskyParsed = getParsedHtml(getWrappedHtml(htmlRisky)); 289 if (htmlRiskyParsed === '' || htmlParsed === '' || (htmlRiskyParsed !== htmlParsed)) { 290 html = ''; 291 } 292 } 293 } 294 295 return html; 296 } 297 }); 298 299 // Prior to jQuery 1.12 and 2.2, jQuery.clean(), jQuery.buildFragment(), and 300 // jQuery.fn.html() did not call jQuery.htmlPrefilter(), so we add that. 301 if ( (majorVersion === 1 && minorVersion < 12) || (majorVersion === 2 && minorVersion < 2) ) { 302 // Filter the HTML coming into jQuery.fn.html(). 303 var fnOriginalHtml = jQuery.fn.html; 304 jQuery.fn.extend({ 305 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L5147 306 html: function (value) { 307 if (typeof value === "string") { 308 value = jQuery.htmlPrefilter(value); 309 } 310 // .html() can be called as a setter (with an argument) or as a getter 311 // (without an argument), so invoke fnOriginalHtml() the same way that 312 // we were invoked. 313 return fnOriginalHtml.apply(this, arguments.length ? [value] : []); 314 } 315 }); 316 317 // The regular expression that jQuery uses to determine if a string is HTML. 318 // Used by both clean() and buildFragment(). 319 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L4960
320 var rhtml = /<|&#?\w+;/; 321 322 // Filter HTML coming into: 323 // - jQuery.clean() for versions prior to 1.9. 324 // - jQuery.buildFragment() for 1.9 and above. 325 // 326 // The looping constructs in the two functions might be essentially 327 // identical, but they're each expressed here in the way that most closely 328 // matches their original expression in jQuery, so that we filter all of 329 // the items and only the items that jQuery will treat as HTML strings. 330 if (majorVersion === 1 && minorVersion < 9) { 331 var originalClean = jQuery.clean; 332 jQuery.extend({ 333 // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L5493 334 'clean': function (elems, context, fragment, scripts) { 335 for ( var i = 0, elem; (elem = elems[i]) != null; i++ ) { 336 if ( typeof elem === "string" && rhtml.test( elem ) ) { 337 elems[i] = elem = jQuery.htmlPrefilter(elem); 338 } 339 } 340 return originalClean.call(this, elems, context, fragment, scripts); 341 } 342 }); 343 } 344 else { 345 var originalBuildFragment = jQuery.buildFragment; 346 jQuery.extend({ 347 // @see https://github.com/jquery/jquery/blob/1.9.0/jquery.js#L6419 348 'buildFragment': function (elems, context, scripts, selection) { 349 var l = elems.length; 350 for ( var i = 0; i < l; i++ ) { 351 var elem = elems[i]; 352 if (elem || elem === 0) { 353 if ( jQuery.type( elem ) !== "object" && rhtml.test( elem ) ) { 354 elems[i] = elem = jQuery.htmlPrefilter(elem); 355 } 356 } 357 } 358 return originalBuildFragment.call(this, elems, context, scripts, selection); 359 } 360 }); 361 } 362 } 363 364})(jQuery); 365;/*})'"*/;/*})'"*/ 366/*global jQuery */ 367/*jshint browser:true */ 368/*! 369* FitVids 1.1 370* 371* Copyright 2013, Chris Coyier - http://css-tricks.com + Dave Rupert - http://daverupert.com 372* Credit to Thierry Koblentz - http://www.alistapart.com/articles/creating-intrinsic-ratios-for-video/ 373* Released under the WTFPL license - http://sam.zoy.org/wtfpl/ 374* 375*/ 376 377;(function( $ ){ 378 379 'use strict'; 380 381 $.fn.fitVids = function( options ) { 382 var settings = { 383 customSelector: null, 384 ignore: null 385 }; 386 387 if(!document.getElementById('fit-vids-style')) { 388 // appendStyles: https://github.com/toddmotto/fluidvids/blob/master/dist/fluidvids.js 389 var head = document.head || document.getElementsByTagName('head')[0]; 390 var css = '.fluid-width-video-wrapper{width:100%;position:relative;padding:0;}.fluid-width-video-wrapper iframe,.fluid-width-video-wrapper object,.fluid-width-video-wrapper embed {position:absolute;top:0;left:0;width:100%;height:100%;}'; 391 var div = document.createElement("div"); 392 div.innerHTML = '<p>x</p><style id="fit-vids-style">' + css + '</style>'; 393 head.appendChild(div.childNodes[1]); 394 } 395 396 if ( options ) { 397 $.extend( settings, options ); 398 } 399 400 return this.each(function(){ 401 var selectors = [ 402 'iframe[src*="player.vimeo.com"]', 403 'iframe[src*="youtube.com"]', 404 'iframe[src*="youtube-nocookie.com"]', 405 'iframe[src*="kickstarter.com"][src*="video.html"]', 406 'object', 407 'embed' 408 ]; 409 410 if (settings.customSelector) { 411 selectors.push(settings.customSelector); 412 } 413 414 var ignoreList = '.fitvidsignore'; 415 416 if(settings.ignore) { 417 ignoreList = ignoreList + ', ' + settings.ignore; 418 } 419 420 var $allVideos = $(this).find(selectors.join(',')); 421 $allVideos = $allVideos.not('object object'); // SwfObj conflict patch 422 $allVideos = $allVideos.not(ignoreList); // Disable FitVids on this video. 423 424 $allVideos.each(function(){ 425 var $this = $(this); 426 if($this.parents(ignoreList).length > 0) { 427 return; // Disable FitVids on this video. 428 } 429 if (this.tagName.toLowerCase() === 'embed' && $this.parent('object').length || $this.parent('.fluid-width-video-wrapper').length) { return; } 430 if ((!$this.css('height') && !$this.css('width')) && (isNaN($this.attr('height')) || isNaN($this.attr('width')))) 431 { 432 $this.attr('height', 9); 433 $this.attr('width', 16); 434 } 435 var height = ( this.tagName.toLowerCase() === 'object' || ($this.attr('height') && !isNaN(parseInt($this.attr('height'), 10))) ) ? parseInt($this.attr('height'), 10) : $this.height(), 436 width = !isNaN(parseInt($this.attr('width'), 10)) ? parseInt($this.attr('width'), 10) : $this.width(), 437 aspectRatio = height / width; 438 if(!$this.attr('id')){ 439 var videoID = 'fitvid' + Math.floor(Math.random()*999999); 440 $this.attr('id', videoID); 441 } 442 $this.wrap('<div class="fluid-width-video-wrapper"></div>').parent('.fluid-width-video-wrapper').css('padding-top', (aspectRatio * 100)+'%'); 443 $this.removeAttr('height').removeAttr('width'); 444 }); 445 }); 446 }; 447// Works with either jQuery or Zepto 448})( window.jQuery || window.Zepto ); 449;/*})'"*/;/*})'"*/ 450/** 451 * Workaround for deprecated $.browser which was removed in jQuery 1.9 452 * @see https://api.jquery.com/jquery.browser/ 453 */ 454(function ($) { 455 if ($.browser===undefined) { 456 $.browser={}; 457 $.browser.msie=false; 458 $.browser.version=0; 459 if (navigator.userAgent.match(/MSIE ([0-9]+)\./)) { 460 $.browser.msie=true; 461 $.browser.version=RegExp.$1; 462 } 463 } 464})(jQuery); 465;/*})'"*/;/*})'"*/
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.