https://crcc-ccetp.gc.ca/libraries/wet-boew/js/wet-boew.js?tksz1r

1/*!
2 * Web Experience Toolkit (WET) / Boîte à outils de l'expérience Web (BOEW)
3 * wet-boew.github.io/wet-boew/License-en.html / wet-boew.github.io/wet-boew/Licence-fr.html
4 * v4.0.75 - 2024-03-05
5 *
6 *//*! Modernizr (Custom Build) | MIT & BSD */
7/*! @license DOMPurify 2.4.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.4.4/LICENSE */
8
9(function (global, factory) {
10  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
11  typeof define === 'function' && define.amd ? define(factory) :
12  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, global.DOMPurify = factory());
13})(this, (function () { 'use strict';
14
15  function _typeof(obj) {
16    "@babel/helpers - typeof";
17
18    return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (obj) {
19      return typeof obj;
20    } : function (obj) {
21      return obj && "function" == typeof Symbol && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj;
22    }, _typeof(obj);
23  }
24
25  function _setPrototypeOf(o, p) {
26    _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf(o, p) {
27      o.__proto__ = p;
28      return o;
29    };
30
31    return _setPrototypeOf(o, p);
32  }
33
34  function _isNativeReflectConstruct() {
35    if (typeof Reflect === "undefined" || !Reflect.construct) return false;
36    if (Reflect.construct.sham) return false;
37    if (typeof Proxy === "function") return true;
38
39    try {
40      Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {}));
41      return true;
42    } catch (e) {
43      return false;
44    }
45  }
46
47  function _construct(Parent, args, Class) {
48    if (_isNativeReflectConstruct()) {
49      _construct = Reflect.construct;
50    } else {
51      _construct = function _construct(Parent, args, Class) {
52        var a = [null];
53        a.push.apply(a, args);
54        var Constructor = Function.bind.apply(Parent, a);
55        var instance = new Constructor();
56        if (Class) _setPrototypeOf(instance, Class.prototype);
57        return instance;
58      };
59    }
60
61    return _construct.apply(null, arguments);
62  }
63
64  function _toConsumableArray(arr) {
65    return _arrayWithoutHoles(arr) || _iterableToArray(arr) || _unsupportedIterableToArray(arr) || _nonIterableSpread();
66  }
67
68  function _arrayWithoutHoles(arr) {
69    if (Array.isArray(arr)) return _arrayLikeToArray(arr);
70  }
71
72  function _iterableToArray(iter) {
73    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
74  }
75
76  function _unsupportedIterableToArray(o, minLen) {
77    if (!o) return;
78    if (typeof o === "string") return _arrayLikeToArray(o, minLen);
79    var n = Object.prototype.toString.call(o).slice(8, -1);
80    if (n === "Object" && o.constructor) n = o.constructor.name;
81    if (n === "Map" || n === "Set") return Array.from(o);
82    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen);
83  }
84
85  function _arrayLikeToArray(arr, len) {
86    if (len == null || len > arr.length) len = arr.length;
87
88    for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i];
89
90    return arr2;
91  }
92
93  function _nonIterableSpread() {
94    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
95  }
96
97  var hasOwnProperty = Object.hasOwnProperty,
98      setPrototypeOf = Object.setPrototypeOf,
99      isFrozen = Object.isFrozen,
100      getPrototypeOf = Object.getPrototypeOf,
101      getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
102  var freeze = Object.freeze,
103      seal = Object.seal,
104      create = Object.create; // eslint-disable-line import/no-mutable-exports
105
106  var _ref = typeof Reflect !== 'undefined' && Reflect,
107      apply = _ref.apply,
108      construct = _ref.construct;
109
110  if (!apply) {
111    apply = function apply(fun, thisValue, args) {
112      return fun.apply(thisValue, args);
113    };
114  }
115
116  if (!freeze) {
117    freeze = function freeze(x) {
118      return x;
119    };
120  }
121
122  if (!seal) {
123    seal = function seal(x) {
124      return x;
125    };
126  }
127
128  if (!construct) {
129    construct = function construct(Func, args) {
130      return _construct(Func, _toConsumableArray(args));
131    };
132  }
133
134  var arrayForEach = unapply(Array.prototype.forEach);
135  var arrayPop = unapply(Array.prototype.pop);
136  var arrayPush = unapply(Array.prototype.push);
137  var stringToLowerCase = unapply(String.prototype.toLowerCase);
138  var stringToString = unapply(String.prototype.toString);
139  var stringMatch = unapply(String.prototype.match);
140  var stringReplace = unapply(String.prototype.replace);
141  var stringIndexOf = unapply(String.prototype.indexOf);
142  var stringTrim = unapply(String.prototype.trim);
143  var regExpTest = unapply(RegExp.prototype.test);
144  var typeErrorCreate = unconstruct(TypeError);
145  function unapply(func) {
146    return function (thisArg) {
147      for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
148        args[_key - 1] = arguments[_key];
149      }
150
151      return apply(func, thisArg, args);
152    };
153  }
154  function unconstruct(func) {
155    return function () {
156      for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
157        args[_key2] = arguments[_key2];
158      }
159
160      return construct(func, args);
161    };
162  }
163  /* Add properties to a lookup table */
164
165  function addToSet(set, array, transformCaseFunc) {
166    transformCaseFunc = transformCaseFunc ? transformCaseFunc : stringToLowerCase;
167
168    if (setPrototypeOf) {
169      // Make 'in' and truthy checks like Boolean(set.constructor)
170      // independent of any properties defined on Object.prototype.
171      // Prevent prototype setters from intercepting set as a this value.
172      setPrototypeOf(set, null);
173    }
174
175    var l = array.length;
176
177    while (l--) {
178      var element = array[l];
179
180      if (typeof element === 'string') {
181        var lcElement = transformCaseFunc(element);
182
183        if (lcElement !== element) {
184          // Config presets (e.g. tags.js, attrs.js) are immutable.
185          if (!isFrozen(array)) {
186            array[l] = lcElement;
187          }
188
189          element = lcElement;
190        }
191      }
192
193      set[element] = true;
194    }
195
196    return set;
197  }
198  /* Shallow clone an object */
199
200  function clone(object) {
201    var newObject = create(null);
202    var property;
203
204    for (property in object) {
205      if (apply(hasOwnProperty, object, [property]) === true) {
206        newObject[property] = object[property];
207      }
208    }
209
210    return newObject;
211  }
212  /* IE10 doesn't support __lookupGetter__ so lets'
213   * simulate it. It also automatically checks
214   * if the prop is function or getter and behaves
215   * accordingly. */
216
217  function lookupGetter(object, prop) {
218    while (object !== null) {
219      var desc = getOwnPropertyDescriptor(object, prop);
220
221      if (desc) {
222        if (desc.get) {
223          return unapply(desc.get);
224        }
225
226        if (typeof desc.value === 'function') {
227          return unapply(desc.value);
228        }
229      }
230
231      object = getPrototypeOf(object);
232    }
233
234    function fallbackValue(element) {
235      console.warn('fallback value for', element);
236      return null;
237    }
238
239    return fallbackValue;
240  }
241
242  var html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
243
244  var svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
245  var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
246  // We still need to know them so that we can do namespace
247  // checks properly in case one wants to add them to
248  // allow-list.
249
250  var svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'fedropshadow', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
251  var mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover']); // Similarly to SVG, we want to know all MathML elements,
252  // even those that we disallow by default.
253
254  var mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'n

270  var IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
271  );
272  var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
273  var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
274  );
275  var DOCTYPE_NAME = seal(/^html$/i);
276
277  var getGlobal = function getGlobal() {
278    return typeof window === 'undefined' ? null : window;
279  };
280  /**
281   * Creates a no-op policy for internal use only.
282   * Don't export this function outside this module!
283   * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
284   * @param {Document} document The document object (to determine policy name suffix)
285   * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
286   * are not supported).
287   */
288
289
290  var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, document) {
291    if (_typeof(trustedTypes) !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
292      return null;
293    } // Allow the callers to control the unique policy name
294    // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
295    // Policy creation with duplicate names throws in Trusted Types.
296
297
298    var suffix = null;
299    var ATTR_NAME = 'data-tt-policy-suffix';
300
301    if (document.currentScript && document.currentScript.hasAttribute(ATTR_NAME)) {
302      suffix = document.currentScript.getAttribute(ATTR_NAME);
303    }
304
305    var policyName = 'dompurify' + (suffix ? '#' + suffix : '');
306
307    try {
308      return trustedTypes.createPolicy(policyName, {
309        createHTML: function createHTML(html) {
310          return html;
311        },
312        createScriptURL: function createScriptURL(scriptUrl) {
313          return scriptUrl;
314        }
315      });
316    } catch (_) {
317      // Policy creation failed (most likely another DOMPurify script has
318      // already run). Skip creating the policy, as this will only cause errors
319      // if TT are enforced.
320      console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
321      return null;
322    }
323  };
324
325  function createDOMPurify() {
326    var window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
327
328    var DOMPurify = function DOMPurify(root) {
329      return createDOMPurify(root);
330    };
331    /**
332     * Version label, exposed for easier checks
333     * if DOMPurify is up to date or not
334     */
335
336
337    DOMPurify.version = '2.4.4';
338    /**
339     * Array of elements that DOMPurify removed during sanitation.
340     * Empty if nothing was removed.
341     */
342
343    DOMPurify.removed = [];
344
345    if (!window || !window.document || window.document.nodeType !== 9) {
346      // Not running in a browser, provide a factory function
347      // so that you can pass your own Window
348      DOMPurify.isSupported = false;
349      return DOMPurify;
350    }
351
352    var originalDocument = window.document;
353    var document = window.document;
354    var DocumentFragment = window.DocumentFragment,
355        HTMLTemplateElement = window.HTMLTemplateElement,
356        Node = window.Node,
357        Element = window.Element,
358        NodeFilter = window.NodeFilter,
359        _window$NamedNodeMap = window.NamedNodeMap,
360        NamedNodeMap = _window$NamedNodeMap === void 0 ? window.NamedNodeMap || window.MozNamedAttrMap : _window$NamedNodeMap,
361        HTMLFormElement = window.HTMLFormElement,
362        DOMParser = window.DOMParser,
363        trustedTypes = window.trustedTypes;
364    var ElementPrototype = Element.prototype;
365    var cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
366    var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
367    var getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
368    var getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
369    // new document created via createHTMLDocument. As per the spec
370    // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
371    // a new empty registry is used when creating a template contents owner
372    // document, so we use that as our parent document to ensure nothing
373    // is inherited.
374
375    if (typeof HTMLTemplateElement === 'function') {
376      var template = document.createElement('template');
377
378      if (template.content && template.content.ownerDocument) {
379        document = template.content.ownerDocument;
380      }
381    }
382
383    var trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, originalDocument);
384
385    var emptyHTML = trustedTypesPolicy ? trustedTypesPolicy.createHTML('') : '';
386    var _document = document,
387        implementation = _document.implementation,
388        createNodeIterator = _document.createNodeIterator,
389        createDocumentFragment = _document.createDocumentFragment,
390        getElementsByTagName = _document.getElementsByTagName;
391    var importNode = originalDocument.importNode;
392    var documentMode = {};
393
394    try {
395      documentMode = clone(document).documentMode ? document.documentMode : {};
396    } catch (_) {}
397
398    var hooks = {};
399    /**
400     * Expose whether this browser supports running the full DOMPurify.
401     */
402
403    DOMPurify.isSupported = typeof getParentNode === 'function' && implementation && typeof implementation.createHTMLDocument !== 'undefined' && documentMode !== 9

403;
404    var MUSTACHE_EXPR$1 = MUSTACHE_EXPR,
405        ERB_EXPR$1 = ERB_EXPR,
406        TMPLIT_EXPR$1 = TMPLIT_EXPR,
407        DATA_ATTR$1 = DATA_ATTR,
408        ARIA_ATTR$1 = ARIA_ATTR,
409        IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA,
410        ATTR_WHITESPACE$1 = ATTR_WHITESPACE;
411    var IS_ALLOWED_URI$1 = IS_ALLOWED_URI;
412    /**
413     * We consider the elements and attributes below to be safe. Ideally
414     * don't add any new ones but feel free to remove unwanted ones.
415     */
416
417    /* allowed element names */
418
419    var ALLOWED_TAGS = null;
420    var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray(html$1), _toConsumableArray(svg$1), _toConsumableArray(svgFilters), _toConsumableArray(mathMl$1), _toConsumableArray(text)));
421    /* Allowed attribute names */
422
423    var ALLOWED_ATTR = null;
424    var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(_toConsumableArray(html), _toConsumableArray(svg), _toConsumableArray(mathMl), _toConsumableArray(xml)));
425    /*
426     * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
427     * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
428     * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
429     * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
430     */
431
432    var CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
433      tagNameCheck: {
434        writable: true,
435        configurable: false,
436        enumerable: true,
437        value: null
438      },
439      attributeNameCheck: {
440        writable: true,
441        configurable: false,
442        enumerable: true,
443        value: null
444      },
445      allowCustomizedBuiltInElements: {
446        writable: true,
447        configurable: false,
448        enumerable: true,
449        value: false
450      }
451    }));
452    /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
453
454    var FORBID_TAGS = null;
455    /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
456
457    var FORBID_ATTR = null;
458    /* Decide if ARIA attributes are okay */
459
460    var ALLOW_ARIA_ATTR = true;
461    /* Decide if custom data attributes are okay */
462
463    var ALLOW_DATA_ATTR = true;
464    /* Decide if unknown protocols are okay */
465
466    var ALLOW_UNKNOWN_PROTOCOLS = false;
467    /* Decide if self-closing tags in attributes are allowed.
468     * Usually removed due to a mXSS issue in jQuery 3.0 */
469
470    var ALLOW_SELF_CLOSE_IN_ATTR = true;
471    /* Output should be safe for common template engines.
472     * This means, DOMPurify removes data attributes, mustaches and ERB
473     */
474
475    var SAFE_FOR_TEMPLATES = false;
476    /* Decide if document with <html>... should be returned */
477
478    var WHOLE_DOCUMENT = false;
479    /* Track whether config is already set on this instance of DOMPurify. */
480
481    var SET_CONFIG = false;
482    /* Decide if all elements (e.g. style, script) must be children of
483     * document.body. By default, browsers might move them to document.head */
484
485    var FORCE_BODY = false;
486    /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
487     * string (or a TrustedHTML object if Trusted Types are supported).
488     * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
489     */
490
491    var RETURN_DOM = false;
492    /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
493     * string  (or a TrustedHTML object if Trusted Types are supported) */
494
495    var RETURN_DOM_FRAGMENT = false;
496    /* Try to return a Trusted Type object instead of a string, return a string in
497     * case Trusted Types are not supported  */
498
499    var RETURN_TRUSTED_TYPE = false;
500    /* Output should be free from DOM clobbering attacks?
501     * This sanitizes markups named with colliding, clobberable built-in DOM APIs.
502     */
503
504    var SANITIZE_DOM = true;
505    /* Achieve full DOM Clobbering protection by isolating the namespace of named
506     * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules.
507     *
508     * HTML/DOM spec rules that enable DOM Clobbering:
509     *   - Named Access on Window (§7.3.3)
510     *   - DOM Tree Accessors (§3.1.5)
511     *   - Form Element Parent-Child Relations (§4.10.3)
512     *   - Iframe srcdoc / Nested WindowProxies (§4.8.5)
513     *   - HTMLCollection (§4.2.10.2)
514     *
515     * Namespace isolation is implemented by prefixing `id` and `name` attributes
516     * with a constant string, i.e., `user-content-`
517     */
518
519    var SANITIZE_NAMED_PROPS = false;
520    var SANITIZE_NAMED_PROPS_PREFIX = 'user-content-';
521    /* Keep element content when removing element? */
522
523    var KEEP_CONTENT = true;
524    /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
525     * of importing it into a new Document and returning a sanitized copy */
526
527    var IN_PLACE = false;
528    /* Allow usage of profiles like html, svg and mathMl */
529
530    var USE_PROFILES = {};
531    /* Tags to ignore content of when KEEP_CONTENT is true */
532
533    var FORBID_CONTENTS = null;
534    var DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
535    /* Tags that are safe for data: URIs */
536
537    var DATA_URI_TAGS = null;
538    var DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
539    /* Attributes safe for values like "javascript:" */
540
541    var URI_SAFE_ATTRIBUTES = null;
542    var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
543    var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
544    var SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
545    var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
546    /* Document namespace */
547
548    var NAMESPACE = HTML_NAMESPACE;
549    var IS_EMPTY_INPUT = false;
550    /* Allowed XHTML+XML namespaces */
551
552    var ALLOWED_NAMESPACES = null;
553    var DEFAULT_ALLOWED_NAMESPACES = addToSet({}, [MATHML_NAMESPACE, SVG_NAMESPACE, HTML_NAMESPACE], stringToString);
554    /* Parsing of strict XHTML documents */
555
556    var PARSER_MEDIA_TYPE;
557    var SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
558    var DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
559    var transformCaseFunc;
560    /* Keep a reference to config to pass to hooks */
561
562    var CONFIG = null;
563    /* Ideally, do not touch anything below this line */
564
565    /* ______________________________________________ */
566
567    var formElement = document.createElement('form');
568
569    var isRegexOrFunction = function isRegexOrFunction(testValue) {
570      return testValue instanceof RegExp || testValue instanceof Function;
571    };
572    /**
573     * _parseConfig
574     *
575     * @param  {Object} cfg optional config literal
576     */
577    // eslint-disable-next-line complexity
578
579
580    var _parseConfig = function _parseConfig(cfg) {
581      if (CONFIG && CONFIG === cfg) {
582        return;
583      }
584      /* Shield configuration object from tampering */
585
586
587      if (!cfg || _typeof(cfg) !== 'object') {
588        cfg = {};
589      }
590      /* Shield configuration object from prototype pollution */
591
592
593      cfg = clone(cfg);
594      PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
595      SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
596
597      transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? stringToString : stringToLowerCase;
598      /* Set configuration parameters */
599
600      ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
601      ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
602      ALLOWED_NAMESPACES = 'ALLOWED_NAMESPACES' in cfg ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
603      URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), // eslint-disable-line indent
604      cfg.ADD_URI_SAFE_ATTR, // eslint-disable-line indent
605      transformCaseFunc // eslint-disable-line indent
606      ) // eslint-disable-line indent
607      : DEFAULT_URI_SAFE_ATTRIBUTES;
608      DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), // eslint-disable-line indent
609      cfg.ADD_DATA_URI_TAGS, // eslint-disable-line indent
610      transformCaseFunc // eslint-disable-line indent
611      ) // eslint-disable-line indent
612      : DEFAULT_DATA_URI_TAGS;
613      FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
614      FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : {};
615      FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : {};
616      USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
617      ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
618
619      ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
620
621      ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
622
623      ALLOW_SELF_CLOSE_IN_ATTR = cfg.ALLOW_SELF_CLOSE_IN_ATTR !== false; // Default true
624
625      SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
626
627      WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
628
629      RETURN_DOM = cfg.RETURN_DOM || false; // Default false
630
631      RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
632
633      RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
634
635      FORCE_BODY = cfg.FORCE_BODY || false; // Default false
636
637      SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
638
639      SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
640
641      KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
642
643      IN_PLACE = cfg.IN_PLACE || false; // Default false
644
645      IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$1;
646      NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
647
648      if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
649        CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
650      }
651
652      if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
653        CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
654      }
655
656      if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
657        CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
658      }
659
660      if (SAFE_FOR_TEMPLATES) {
661        ALLOW_DATA_ATTR = false;
662      }
663
664      if (RETURN_DOM_FRAGMENT) {
665        RETURN_DOM = true;
666      }
667      /* Parse profile info */
668
669
670      if (USE_PROFILES) {
671        ALLOWED_TAGS = addToSet({}, _toConsumableArray(text));
672        ALLOWED_ATTR = [];
673
674        if (USE_PROFILES.html === true) {
675          addToSet(ALLOWED_TAGS, html$1);
676          addToSet(ALLOWED_ATTR, html);
677        }
678
679        if (USE_PROFILES.svg === true) {
680          addToSet(ALLOWED_TAGS, svg$1);
681          addToSet(ALLOWED_ATTR, svg);
682          addToSet(ALLOWED_ATTR, xml);
683        }
684
685        if (USE_PROFILES.svgFilters === true) {
686          addToSet(ALLOWED_TAGS, svgFilters);
687          addToSet(ALLOWED_ATTR, svg);
688          addToSet(ALLOWED_ATTR, xml);
689        }
690
691        if (USE_PROFILES.mathMl === true) {
692          addToSet(ALLOWED_TAGS, mathMl$1);
693          addToSet(ALLOWED_ATTR, mathMl);
694          addToSet(ALLOWED_ATTR, xml);
695        }
696      }
697      /* Merge configuration parameters */
698
699
700      if (cfg.ADD_TAGS) {
701        if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
702          ALLOWED_TAGS = clone(ALLOWED_TAGS);
703        }
704
705        addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
706      }
707
708      if (cfg.ADD_ATTR) {
709        if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
710          ALLOWED_ATTR = clone(ALLOWED_ATTR);
711        }
712
713        addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
714      }
715
716      if (cfg.ADD_URI_SAFE_ATTR) {
717        addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
718      }
719
720      if (cfg.FORBID_CONTENTS) {
721        if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
722          FORBID_CONTENTS = clone(FORBID_CONTENTS);
723        }
724
725        addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
726      }
727      /* Add #text in case KEEP_CONTENT is set to true */
728
729
730      if (KEEP_CONTENT) {
731        ALLOWED_TAGS['#text'] = true;
732      }
733      /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
734
735
736      if (WHOLE_DOCUMENT) {
737        addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
738      }
739      /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
740
741
742      if (ALLOWED_TAGS.table) {
743        addToSet(ALLOWED_TAGS, ['tbody']);
744        delete FORBID_TAGS.tbody;
745      } // Prevent further manipulation of configuration.
746      // Not available in IE8, Safari 5, etc.
747
748
749      if (freeze) {
750        freeze(cfg);
751      }
752
753      CONFIG = cfg;
754    };
755
756    var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
757    var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
758    // namespace. We need to specify them explicitly
759    // so that they don't get erroneously deleted from
760    // HTML namespace.
761
762    var COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
763    /* Keep track of all possible SVG and MathML tags
764     * so that we can perform the namespace checks
765     * correctly. */
766
767    var ALL_SVG_TAGS = addToSet({}, svg$1);
768    addToSet(ALL_SVG_TAGS, svgFilters);
769    addToSet(ALL_SVG_TAGS, svgDisallowed);
770    var ALL_MATHML_TAGS = addToSet({}, mathMl$1);
771    addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
772    /**
773     *
774     *
775     * @param  {Element} element a DOM element whose namespace is being checked
776     * @returns {boolean} Return false if the element has a
777     *  namespace that a spec-compliant parser would never
778     *  return. Return true otherwise.
779     */
780
781    var _checkValidNamespace = function _checkValidNamespace(element) {
782      var parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
783      // can be null. We just simulate parent in this case.
784
785      if (!parent || !parent.tagName) {
786        parent = {
787          namespaceURI: NAMESPACE,
788          tagName: 'template'
789        };
790      }
791
792      var tagName = stringToLowerCase(element.tagName);
793      var parentTagName = stringToLowerCase(parent.tagName);
794
795      if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
796        return false;
797      }
798
799      if (element.namespaceURI === SVG_NAMESPACE) {
800        // The only way to switch from HTML namespace to SVG
801        // is via <svg>. If it happens via any other tag, then
802        // it should be killed.
803        if (parent.namespaceURI === HTML_NAMESPACE) {
804          return tagName === 'svg';
805        } // The only way to switch from MathML to SVG is via`
806        // svg if parent is either <annotation-xml> or MathML
807        // text integration points.
808
809
810        if (parent.namespaceURI === MATHML_NAMESPACE) {
811          return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
812        } // We only allow elements that are defined in SVG
813        // spec. All others are disallowed in SVG namespace.
814
815
816        return Boolean(ALL_SVG_TAGS[tagName]);
817      }
818
819      if (element.namespaceURI === MATHML_NAMESPACE) {
820        // The only way to switch from HTML namespace to MathML
821        // is via <math>. If it happens via any other tag, then
822        // it should be killed.
823        if (parent.namespaceURI === HTML_NAMESPACE) {
824          return tagName === 'math';
825        } // The only way to switch from SVG to MathML is via
826        // <math> and HTML integration points
827
828
829        if (parent.namespaceURI === SVG_NAMESPACE) {
830          return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
831        } // We only allow elements that are defined in MathML
832        // spec. All others are disallowed in MathML namespace.
833
834
835        return Boolean(ALL_MATHML_TAGS[tagName]);
836      }
837
838      if (element.namespaceURI === HTML_NAMESPACE) {
839        // The only way to switch from SVG to HTML is via
840        // HTML integration points, and from MathML to HTML
841        // is via MathML text integration points
842        if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
843          return false;
844        }
845
846        if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
847          return false;
848        } // We disallow tags that are specific for MathML
849        // or SVG and should never appear in HTML namespace
850
851
852        return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
853      } // For XHTML and XML documents that support custom namespaces
854
855
856      if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && ALLOWED_NAMESPACES[element.namespaceURI]) {
857        return true;
858      } // The code should never reach this place (this means
859      // that the element somehow got namespace that is not
860      // HTML, SVG, MathML or allowed via ALLOWED_NAMESPACES).
861      // Return false just in case.
862
863
864      return false;
865    };
866    /**
867     * _forceRemove
868     *
869     * @param  {Node} node a DOM node
870     */
871
872
873    var _forceRemove = function _forceRemove(node) {
874      arrayPush(DOMPurify.removed, {
875        element: node
876      });
877
878      try {
879        // eslint-disable-next-line unicorn/prefer-dom-node-remove
880        node.parentNode.removeChild(node);
881      } catch (_) {
882        

882try {
883          node.outerHTML = emptyHTML;
884        } catch (_) {
885          node.remove();
886        }
887      }
888    };
889    /**
890     * _removeAttribute
891     *
892     * @param  {String} name an Attribute name
893     * @param  {Node} node a DOM node
894     */
895
896
897    var _removeAttribute = function _removeAttribute(name, node) {
898      try {
899        arrayPush(DOMPurify.removed, {
900          attribute: node.getAttributeNode(name),
901          from: node
902        });
903      } catch (_) {
904        arrayPush(DOMPurify.removed, {
905          attribute: null,
906          from: node
907        });
908      }
909
910      node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
911
912      if (name === 'is' && !ALLOWED_ATTR[name]) {
913        if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
914          try {
915            _forceRemove(node);
916          } catch (_) {}
917        } else {
918          try {
919            node.setAttribute(name, '');
920          } catch (_) {}
921        }
922      }
923    };
924    /**
925     * _initDocument
926     *
927     * @param  {String} dirty a string of dirty markup
928     * @return {Document} a DOM, filled with the dirty markup
929     */
930
931
932    var _initDocument = function _initDocument(dirty) {
933      /* Create a HTML document */
934      var doc;
935      var leadingWhitespace;
936
937      if (FORCE_BODY) {
938        dirty = '<remove></remove>' + dirty;
939      } else {
940        /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
941        var matches = stringMatch(dirty, /^[\r\n\t ]+/);
942        leadingWhitespace = matches && matches[0];
943      }
944
945      if (PARSER_MEDIA_TYPE === 'application/xhtml+xml' && NAMESPACE === HTML_NAMESPACE) {
946        // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
947        dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
948      }
949
950      var dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
951      /*
952       * Use the DOMParser API by default, fallback later if needs be
953       * DOMParser not work for svg when has multiple root element.
954       */
955
956      if (NAMESPACE === HTML_NAMESPACE) {
957        try {
958          doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
959        } catch (_) {}
960      }
961      /* Use createHTMLDocument in case DOMParser is not available */
962
963
964      if (!doc || !doc.documentElement) {
965        doc = implementation.createDocument(NAMESPACE, 'template', null);
966
967        try {
968          doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
969        } catch (_) {// Syntax error if dirtyPayload is invalid xml
970        }
971      }
972
973      var body = doc.body || doc.documentElement;
974
975      if (dirty && leadingWhitespace) {
976        body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
977      }
978      /* Work on whole document or just its body */
979
980
981      if (NAMESPACE === HTML_NAMESPACE) {
982        return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
983      }
984
985      return WHOLE_DOCUMENT ? doc.documentElement : body;
986    };
987    /**
988     * _createIterator
989     *
990     * @param  {Document} root document/fragment to create iterator for
991     * @return {Iterator} iterator instance
992     */
993
994
995    var _createIterator = function _createIterator(root) {
996      return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
997      NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
998    };
999    /**
1000     * _isClobbered
1001     *
1002     * @param  {Node} elm element to check for clobbering attacks
1003     * @return {Boolean} true if clobbered, false if safe
1004     */
1005
1006
1007    var _isClobbered = function _isClobbered(elm) {
1008      return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function' || typeof elm.hasChildNodes !== 'function');
1009    };
1010    /**
1011     * _isNode
1012     *
1013     * @param  {Node} obj object to check whether it's a DOM node
1014     * @return {Boolean} true is object is a DOM node
1015     */
1016
1017
1018    var _isNode = function _isNode(object) {
1019      return _typeof(Node) === 'object' ? object instanceof Node : object && _typeof(object) === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
1020    };
1021    /**
1022     * _executeHook
1023     * Execute user configurable hooks
1024     *
1025     * @param  {String} entryPoint  Name of the hook's entry point
1026     * @param  {Node} currentNode node to work on with the hook
1027     * @param  {Object} data additional hook parameters
1028     */
1029
1030
1031    var _executeHook = function _executeHook(entryPoint, currentNode, data) {
1032      if (!hooks[entryPoint]) {
1033        return;
1034      }
1035
1036      arrayForEach(hooks[entryPoint], function (hook) {
1037        hook.call(DOMPurify, currentNode, data, CONFIG);
1038      });
1039    };
1040    /**
1041     * _sanitizeElements
1042     *
1043     * @protect nodeName
1044     * @protect textContent
1045     * @protect removeChild
1046     *
1047     * @param   {Node} currentNode to check for permission to exist
1048     * @return  {Boolean} true if node was killed, false if left alive
1049     */
1050
1051
1052    var _sanitizeElements = function _sanitizeElements(currentNode) {
1053      var content;
1054      /* Execute a hook if present */
1055
1056      _executeHook('beforeSanitizeElements', currentNode, null);
1057      /* Check if element is clobbered or can clobber */
1058
1059
1060      if (_isClobbered(currentNode)) {
1061        _forceRemove(currentNode);
1062
1063        return true;
1064      }
1065      /* Check if tagname contains Unicode */
1066
1067
1068      if (regExpTest(/[\u0080-\uFFFF]/, currentNode.nodeName)) {
1069        _forceRemove(currentNode);
1070
1071        return true;
1072      }
1073      /* Now let's check the element's type and name */
1074
1075
1076      var tagName = transformCaseFunc(currentNode.nodeName);
1077      /* Execute a hook if present */
1078
1079      _executeHook('uponSanitizeElement', currentNode, {
1080        tagName: tagName,
1081        allowedTags: ALLOWED_TAGS
1082      });
1083      /* Detect mXSS attempts abusing namespace confusion */
1084
1085
1086      if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
1087        _forceRemove(currentNode);
1088
1089        return true;
1090      }
1091      /* Mitigate a problem with templates inside select */
1092
1093
1094      if (tagName === 'select' && regExpTest(/<template/i, currentNode.innerHTML)) {
1095        _forceRemove(currentNode);
1096
1097        return true;
1098      }
1099      /* Remove element if anything forbids its presence */
1100
1101
1102      if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1103        /* Check if we have a custom element to handle */

1104        if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
1105          if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
1106          if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
1107        }
1108        /* Keep content except for bad-listed elements */
1109
1110
1111        if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
1112          var parentNode = getParentNode(currentNode) || currentNode.parentNode;
1113          var childNodes = getChildNodes(currentNode) || currentNode.childNodes;
1114
1115          if (childNodes && parentNode) {
1116            var childCount = childNodes.length;
1117
1118            for (var i = childCount - 1; i >= 0; --i) {
1119              parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
1120            }
1121          }
1122        }
1123
1124        _forceRemove(currentNode);
1125
1126        return true;
1127      }
1128      /* Check whether element has a valid namespace */
1129
1130
1131      if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
1132        _forceRemove(currentNode);
1133
1134        return true;
1135      }

1135
1136
1137      if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
1138        _forceRemove(currentNode);
1139
1140        return true;
1141      }
1142      /* Sanitize element content to be template-safe */
1143
1144
1145      if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
1146        /* Get the element's text content */
1147        content = currentNode.textContent;
1148        content = stringReplace(content, MUSTACHE_EXPR$1, ' ');
1149        content = stringReplace(content, ERB_EXPR$1, ' ');
1150        content = stringReplace(content, TMPLIT_EXPR$1, ' ');
1151
1152        if (currentNode.textContent !== content) {
1153          arrayPush(DOMPurify.removed, {
1154            element: currentNode.cloneNode()
1155          });
1156          currentNode.textContent = content;
1157        }
1158      }
1159      /* Execute a hook if present */
1160
1161
1162      _executeHook('afterSanitizeElements', currentNode, null);
1163
1164      return false;
1165    };
1166    /**
1167     * _isValidAttribute
1168     *
1169     * @param  {string} lcTag Lowercase tag name of containing element.
1170     * @param  {string} lcName Lowercase attribute name.
1171     * @param  {string} value Attribute value.
1172     * @return {Boolean} Returns true if `value` is valid, otherwise false.
1173     */
1174    // eslint-disable-next-line complexity
1175
1176
1177    var _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
1178      /* Make sure attribute cannot clobber */
1179      if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
1180        return false;
1181      }
1182      /* Allow valid data-* attributes: At least one character after "-"
1183          (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
1184          XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
1185          We don't need to check the value; it's always URI safe. */
1186
1187
1188      if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
1189        if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
1190        // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1191        // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
1192        _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
1193        // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1194        lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
1195          return false;
1196        }
1197        /* Check value is safe. First, is attr inert? If so, is safe */
1198
1199      } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if (!value) ; else {
1200        return false;
1201      }
1202
1203      return true;
1204    };
1205    /**
1206     * _basicCustomElementCheck
1207     * checks if at least one dash is included in tagName, and it's not the first char
1208     * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
1209     * @param {string} tagName name of the tag of the node to sanitize
1210     */
1211
1212
1213    var _basicCustomElementTest = function _basicCustomElementTest(tagName) {
1214      return tagName.indexOf('-') > 0;
1215    };
1216    /**
1217     * _sanitizeAttributes
1218     *
1219     * @protect attributes
1220     * @protect nodeName
1221     * @protect removeAttribute
1222     * @protect setAttribute
1223     *
1224     * @param  {Node} currentNode to sanitize
1225     */
1226
1227
1228    var _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
1229      var attr;
1230      var value;
1231      var lcName;
1232      var l;
1233      /* Execute a hook if present */
1234
1235      _executeHook('beforeSanitizeAttributes', currentNode, null);
1236
1237      var attributes = currentNode.attributes;
1238      /* Check if we have attributes; if not we might have a text node */
1239
1240      if (!attributes) {
1241        return;
1242      }
1243
1244      var hookEvent = {
1245        attrName: '',
1246        attrValue: '',
1247        keepAttr: true,
1248        allowedAttributes: ALLOWED_ATTR
1249      };
1250      l = attributes.length;
1251      /* Go backwards over all attributes; safely remove bad ones */
1252
1253      while (l--) {
1254        attr = attributes[l];
1255        var _attr = attr,
1256            name = _attr.name,
1257            namespaceURI = _attr.namespaceURI;
1258        value = name === 'value' ? attr.value : stringTrim(attr.value);
1259        lcName = transformCaseFunc(name);
1260        /* Execute a hook if present */
1261
1262        hookEvent.attrName = lcName;
1263        hookEvent.attrValue = value;
1264        hookEvent.keepAttr = true;
1265        hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
1266
1267        _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
1268
1269        value = hookEvent.attrValue;
1270        /* Did the hooks approve of the attribute? */
1271
1272        if (hookEvent.forceKeepAttr) {
1273          continue;
1274        }
1275        /* Remove attribute */
1276
1277
1278        _removeAttribute(name, currentNode);
1279        /* Did the hooks approve of the attribute? */
1280
1281
1282        if (!hookEvent.keepAttr) {
1283          continue;
1284        }
1285        /* Work around a security issue in jQuery 3.0 */
1286
1287
1288        if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
1289          _removeAttribute(name, currentNode);
1290
1291          continue;
1292        }
1293        /* Sanitize attribute content to be template-safe */
1294
1295
1296        if (SAFE_FOR_TEMPLATES) {
1297          value = stringReplace(value, MUSTACHE_EXPR$1, ' ');
1298          value = stringReplace(value, ERB_EXPR$1, ' ');
1299          value = stringReplace(value, TMPLIT_EXPR$1, ' ');
1300        }
1301        /* Is `value` valid for this attribute? */
1302
1303
1304        var lcTag = transformCaseFunc(currentNode.nodeName);
1305
1306        if (!_isValidAttribute(lcTag, lcName, value)) {
1307          continue;
1308        }
1309        /* Full DOM Clobbering protection via namespace isolation,
1310         * Prefix id and name attributes with `user-content-`
1311         */
1312
1313
1314        if (SANITIZE_NAMED_PROPS && (lcName === 'id' || lcName === 'name')) {
1315          // Remove the attribute with this value
1316          _removeAttribute(name, currentNode); // Prefix the value and later re-create the attribute with the sanitized value
1317
1318
1319          value = SANITIZE_NAMED_PROPS_PREFIX + value;
1320        }
1321        /* Handle attributes that require Trusted Types */
1322
1323
1324        if (trustedTypesPolicy && _typeof(trustedTypes) === 'object' && typeof trustedTypes.getAttributeType === 'function') {
1325          if (namespaceURI) ; else {
1326            switch (trustedTypes.getAttributeType(lcTag, lcName)) {
1327              case 'TrustedHTML':
1328                value = trustedTypesPolicy.createHTML(value);
1329                break;
1330
1331              case 'TrustedScriptURL':
1332                value = trustedTypesPolicy.createScriptURL(value);
1333                break;
1334            }
1335          }
1336        }
1337        /* Handle invalid data-* attribute set by try-catching it */
1338
1339
1340        try {
1341          if (namespaceURI) {
1342            currentNode.setAttributeNS(namespaceURI, name, value);
1343          } else {
1344            /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1345            currentNode.setAttribute(name, value);
1346          }
1347
1348          arrayPop(DOMPurify.removed);
1349        } catch (_) {}
1350      }
1351      /* Execute a hook if present */
1352
1353
1354      _executeHook('afterSanitizeAttributes', currentNode, null);
1355    };
1356    /**
1357     * _sanitizeShadowDOM
1358     *
1359     * @param  {DocumentFragment} fragment to iterate over recursively
1360     */
1361
1362
1363    var _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
1364      var shadowNode;
1365
1366      var shadowIterator = _createIterator(fragment);
1367      /* Execute a hook if present */
1368
1369
1370      _executeHook('beforeSanitizeShadowDOM', fragment, null);
1371
1372      while (shadowNode = shadowIterator.nextNode()) {
1373        /* Execute a hook if present */
1374        _executeHook('uponSanitizeShadowNode', shadowNode, null);
1375        /* Sanitize tags and elements */
1376
1377
1378        if (_sanitizeElements(shadowNode)) {
1379          continue;
1380        }
1381        /* Deep shadow DOM detected */
1382
1383
1384        if (shadowNode.content instanceof DocumentFragment) {
1385          _sanitizeShadowDOM(shadowNode.content);
1386        }
1387        /* Check attributes, sanitize if necessary */
1388
1389
1390        _sanitizeAttributes(shadowNode);
1391      }
1392      /* Execute a hook if present */
1393
1394
1395      _executeHook('afterSanitizeShadowDOM', fragment, null);
1396    };
1397    /**
1398     * Sanitize
1399     * Public method providing core sanitation functionality
1400     *
1401     * @param {String|Node} dirty string or DOM node
1402     * @param {Object} configuration object
1403     */
1404    // eslint-disable-next-line complexity
1405
1406
1407    DOMPurify.sanitize = function (dirty) {
1408      var cfg = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
1409      var body;
1410      var importedNode;
1411      var currentNode;
1412      var 

1412oldNode;
1413      var returnNode;
1414      /* Make sure we have a string to sanitize.
1415        DO NOT return early, as this will return the wrong type if
1416        the user has requested a DOM object rather than a string */
1417
1418      IS_EMPTY_INPUT = !dirty;
1419
1420      if (IS_EMPTY_INPUT) {
1421        dirty = '<!-->';
1422      }
1423      /* Stringify, in case dirty is an object */
1424
1425
1426      if (typeof dirty !== 'string' && !_isNode(dirty)) {
1427        // eslint-disable-next-line no-negated-condition
1428        if (typeof dirty.toString !== 'function') {
1429          throw typeErrorCreate('toString is not a function');
1430        } else {
1431          dirty = dirty.toString();
1432
1433          if (typeof dirty !== 'string') {
1434            throw typeErrorCreate('dirty is not a string, aborting');
1435          }
1436        }
1437      }
1438      /* Check we can run. Otherwise fall back or ignore */
1439
1440
1441      if (!DOMPurify.isSupported) {
1442        if (_typeof(window.toStaticHTML) === 'object' || typeof window.toStaticHTML === 'function') {
1443          if (typeof dirty === 'string') {
1444            return window.toStaticHTML(dirty);
1445          }
1446
1447          if (_isNode(dirty)) {
1448            return window.toStaticHTML(dirty.outerHTML);
1449          }
1450        }
1451
1452        return dirty;
1453      }
1454      /* Assign config vars */
1455
1456
1457      if (!SET_CONFIG) {
1458        _parseConfig(cfg);
1459      }
1460      /* Clean up removed elements */
1461
1462
1463      DOMPurify.removed = [];
1464      /* Check if dirty is correctly typed for IN_PLACE */
1465
1466      if (typeof dirty === 'string') {
1467        IN_PLACE = false;
1468      }
1469
1470      if (IN_PLACE) {
1471        /* Do some early pre-sanitization to avoid unsafe root nodes */
1472        if (dirty.nodeName) {
1473          var tagName = transformCaseFunc(dirty.nodeName);
1474
1475          if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1476            throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
1477          }
1478        }
1479      } else if (dirty instanceof Node) {
1480        /* If dirty is a DOM element, append to an empty document to avoid
1481           elements being stripped by the parser */
1482        body = _initDocument('<!---->');
1483        importedNode = body.ownerDocument.importNode(dirty, true);
1484
1485        if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
1486          /* Node is already a body, use as is */
1487          body = importedNode;
1488        } else if (importedNode.nodeName === 'HTML') {
1489          body = importedNode;
1490        } else {
1491          // eslint-disable-next-line unicorn/prefer-dom-node-append
1492          body.appendChild(importedNode);
1493        }
1494      } else {
1495        /* Exit directly if we have nothing to do */
1496        if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
1497        dirty.indexOf('<') === -1) {
1498          return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
1499        }
1500        /* Initialize the document to work on */
1501
1502
1503        body = _initDocument(dirty);
1504        /* Check we have a DOM node from the data */
1505
1506        if (!body) {
1507          return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
1508        }
1509      }
1510      /* Remove first element node (ours) if FORCE_BODY is set */
1511
1512
1513      if (body && FORCE_BODY) {
1514        _forceRemove(body.firstChild);
1515      }
1516      /* Get node iterator */
1517
1518
1519      var nodeIterator = _createIterator(IN_PLACE ? dirty : body);
1520      /* Now start iterating over the created document */
1521
1522
1523      while (currentNode = nodeIterator.nextNode()) {
1524        /* Fix IE's strange behavior with manipulated textNodes #89 */
1525        if (currentNode.nodeType === 3 && currentNode === oldNode) {
1526          continue;
1527        }
1528        /* Sanitize tags and elements */
1529
1530
1531        if (_sanitizeElements(currentNode)) {
1532          continue;
1533        }
1534        /* Shadow DOM detected, sanitize it */
1535
1536
1537        if (currentNode.content instanceof DocumentFragment) {
1538          _sanitizeShadowDOM(currentNode.content);
1539        }
1540        /* Check attributes, sanitize if necessary */
1541
1542
1543        _sanitizeAttributes(currentNode);
1544
1545        oldNode = currentNode;
1546      }
1547
1548      oldNode = null;
1549      /* If we sanitized `dirty` in-place, return it. */
1550
1551      if (IN_PLACE) {
1552        return dirty;
1553      }
1554      /* Return sanitized string or DOM */
1555
1556
1557      if (RETURN_DOM) {
1558        if (RETURN_DOM_FRAGMENT) {
1559          returnNode = createDocumentFragment.call(body.ownerDocument);
1560
1561          while (body.firstChild) {
1562            // eslint-disable-next-line unicorn/prefer-dom-node-append
1563            returnNode.appendChild(body.firstChild);
1564          }
1565        } else {
1566          returnNode = body;
1567        }
1568
1569        if (ALLOWED_ATTR.shadowroot

1569 || ALLOWED_ATTR.shadowrootmod) {
1570          /*
1571            AdoptNode() is not used because internal state is not reset
1572            (e.g. the past names map of a HTMLFormElement), this is safe
1573            in theory but we would rather not risk another attack vector.
1574            The state that is cloned by importNode() is explicitly defined
1575            by the specs.
1576          */
1577          returnNode = importNode.call(originalDocument, returnNode, true);
1578        }
1579
1580        return returnNode;
1581      }
1582
1583      var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1584      /* Serialize doctype if allowed */
1585
1586      if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1587        serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
1588      }
1589      /* Sanitize final string template-safe */
1590
1591
1592      if (SAFE_FOR_TEMPLATES) {
1593        serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR$1, ' ');
1594        serializedHTML = stringReplace(serializedHTML, ERB_EXPR$1, ' ');
1595        serializedHTML = stringReplace(serializedHTML, TMPLIT_EXPR$1, ' ');
1596      }
1597
1598      return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1599    };
1600    /**
1601     * Public method to set the configuration once
1602     * setConfig
1603     *
1604     * @param {Object} cfg configuration object
1605     */
1606
1607
1608    DOMPurify.setConfig = function (cfg) {
1609      _parseConfig(cfg);
1610
1611      SET_CONFIG = true;
1612    };
1613    /**
1614     * Public method to remove the configuration
1615     * clearConfig
1616     *
1617     */
1618
1619
1620    DOMPurify.clearConfig = function () {
1621      CONFIG = null;
1622      SET_CONFIG = false;
1623    };
1624    /**
1625     * Public method to check if an attribute value is valid.
1626     * Uses last set config, if any. Otherwise, uses config defaults.
1627     * isValidAttribute
1628     *
1629     * @param  {string} tag Tag name of containing element.
1630     * @param  {string} attr Attribute name.
1631     * @param  {string} value Attribute value.
1632     * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
1633     */
1634
1635
1636    DOMPurify.isValidAttribute = function (tag, attr, value) {
1637      /* Initialize shared config vars if necessary. */
1638      if (!CONFIG) {
1639        _parseConfig({});
1640      }
1641
1642      var lcTag = transformCaseFunc(tag);
1643      var lcName = transformCaseFunc(attr);
1644      return _isValidAttribute(lcTag, lcName, value);
1645    };
1646    /**
1647     * AddHook
1648     * Public method to add DOMPurify hooks
1649     *
1650     * @param {String} entryPoint entry point for the hook to add
1651     * @param {Function} hookFunction function to execute
1652     */
1653
1654
1655    DOMPurify.addHook = function (entryPoint, hookFunction) {
1656      if (typeof hookFunction !== 'function') {
1657        return;
1658      }
1659
1660      hooks[entryPoint] = hooks[entryPoint] || [];
1661      arrayPush(hooks[entryPoint], hookFunction);
1662    };
1663    /**
1664     * RemoveHook
1665     * Public method to remove a DOMPurify hook at a given entryPoint
1666     * (pops it from the stack of hooks if more are present)
1667     *
1668     * @param {String} entryPoint entry point for the hook to remove
1669     * @return {Function} removed(popped) hook
1670     */
1671
1672
1673    DOMPurify.removeHook = function (entryPoint) {
1674      if (hooks[entryPoint]) {
1675        return arrayPop(hooks[entryPoint]);
1676      }
1677    };
1678    /**
1679     * RemoveHooks
1680     * Public method to remove all DOMPurify hooks at a given entryPoint
1681     *
1682     * @param  {String} entryPoint entry point for the hooks to remove
1683     */
1684
1685
1686    DOMPurify.removeHooks = function (entryPoint) {
1687      if (hooks[entryPoint]) {
1688        hooks[entryPoint] = [];
1689      }
1690    };
1691    /**
1692     * RemoveAllHooks
1693     * Public method to remove all DOMPurify hooks
1694     *
1695     */
1696
1697
1698    DOMPurify.removeAllHooks = function () {
1699      hooks = {};
1700    };
1701
1702    return DOMPurify;
1703  }
1704
1705  var purify = createDOMPurify();
1706
1707  return purify;
1708
1709}));
1710//# sourceMappingURL=purify.js.map
1711
1712/**
1713 * jQuery fixes
1714 *
1715 * Note: The following analysis and/or changes was required also to be applied in our code base:
1716 *	- Ensure there is no JSONP ajax call
1717 *	- Ensure to not use self closing tag when a closing tag is usally needed.