SVG Support - Version 2.5

Version Description

  • Cleaned up spelling mistakes and general formatting.
  • Addressed security concern.
  • Added more sanitization options - frontend and admin both supported.
  • Added support for SVG minification.
  • Added ability to choose jQuery or vanilla JS.
  • Added DB cleanup on uninstall.
  • Fixed dimensions fallback.
Download this release

Release Info

Developer Benbodhi
Plugin Icon 128x128 SVG Support
Version 2.5
Comparing to
See all releases

Code changes from version 2.4.2 to 2.5

Files changed (15) hide show
  1. admin/admin-init.php +10 -1
  2. admin/svgs-settings-page.php +79 -31
  3. config.codekit3 +52 -0
  4. functions/attachment.php +2 -2
  5. functions/enqueue.php +207 -169
  6. js/min/svgs-inline-min.js +1 -1
  7. js/min/svgs-inline-vanilla-min.js +1 -0
  8. js/svgs-inline-vanilla.js +184 -0
  9. js/svgs-inline.js +67 -103
  10. readme.txt +14 -2
  11. svg-support.php +23 -11
  12. uninstall.php +12 -0
  13. vendor/DOMPurify/DOMPurify.js +1617 -0
  14. vendor/DOMPurify/DOMPurify.min.js +2 -0
  15. vendor/composer/platform_check.php +2 -2
admin/admin-init.php CHANGED
@@ -51,9 +51,18 @@ function bodhi_svg_support_settings_page() {
51
  */
52
 
53
  function bodhi_sanitize_fields( $value ) {
 
 
 
54
 
55
  $value['css_target'] = esc_attr( sanitize_text_field( $value['css_target'] ) );
56
-
 
 
 
 
 
 
57
  return $value;
58
 
59
  }
51
  */
52
 
53
  function bodhi_sanitize_fields( $value ) {
54
+
55
+ global $bodhi_svgs_options;
56
+ $bodhi_plugin_version_stored = get_option( 'bodhi_svgs_plugin_version' );
57
 
58
  $value['css_target'] = esc_attr( sanitize_text_field( $value['css_target'] ) );
59
+
60
+ if( $value['sanitize_svg_front_end'] !== 'on' ) {
61
+
62
+ $value['sanitize_svg_front_end'] = false;
63
+
64
+ }
65
+
66
  return $value;
67
 
68
  }
admin/svgs-settings-page.php CHANGED
@@ -90,6 +90,48 @@
90
  </td>
91
  </tr>
92
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
93
  <tr valign="top" class="svgs-simple">
94
  <!-- Simple/Advanced mode selector -->
95
  <th scope="row">
@@ -114,44 +156,45 @@
114
  </td>
115
  </tr>
116
 
117
- <tr valign="top" class="svgs-advanced">
118
- <!-- Allow sanitization of svg -->
 
119
  <th scope="row">
120
- <strong><?php _e( 'Sanitize SVG', 'svg-support' ); ?></strong>
121
  </th>
122
  <td>
123
- <label for="bodhi_svgs_settings[sanitize_svg]">
124
  <?php printf(
125
- '<input id="bodhi_svgs_settings[sanitize_svg]" name="bodhi_svgs_settings[sanitize_svg]" type="checkbox" %2$s />', 'bodhi_svgs_settings_sanitize_svg', checked( isset( $bodhi_svgs_options['sanitize_svg'] ), true, false ) ); ?>
126
- <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e('Enhance security of SVG uploads by saniziting all svg images before being uploaded. This is helpful when non-admins are allowed to upload SVG images.<br><em>All external references are automatically removed during sanitization to prevent XSS and Injection attacks.</em>', 'svg-support' ); ?></small>
127
  </label>
128
  </td>
129
  </tr>
130
 
131
  <tr valign="top" class="svgs-advanced">
132
- <!-- Allow minification of svg -->
133
  <th scope="row">
134
- <label for="bodhi_svgs_settings[minify_svg]"><strong><?php _e( 'Minify SVG', 'svg-support' ); ?></strong>
135
  </th>
136
  <td>
137
- <label for="bodhi_svgs_settings[minify_svg]">
138
  <?php printf(
139
- '<input id="bodhi_svgs_settings[minify_svg]" name="bodhi_svgs_settings[minify_svg]" type="checkbox" %2$s />', 'bodhi_svgs_settings_minify_svg', checked( isset( $bodhi_svgs_options['minify_svg'] ), true, false ) ); ?>
140
- <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e('Enabling this option will auto-minify all svg uploads.', 'svg-support' ); ?></small>
141
  </label>
142
  </td>
143
  </tr>
144
 
145
  <tr valign="top" class="svgs-advanced">
146
- <!-- Allow choice of js in footer true or false -->
147
  <th scope="row">
148
- <strong><?php _e( 'Output JS in Footer?', 'svg-support' ); ?></strong>
149
  </th>
150
  <td>
151
- <label for="bodhi_svgs_settings[js_foot_choice]">
152
  <?php printf(
153
- '<input id="bodhi_svgs_settings[js_foot_choice]" name="bodhi_svgs_settings[js_foot_choice]" type="checkbox" %2$s />', 'bodhi_svgs_settings_js_foot_choice', checked( isset( $bodhi_svgs_options['js_foot_choice'] ), true, false ) ); ?>
154
- <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' Normally, scripts are placed in <code>head</code> of the HTML document. If "Yes" is selected, the script is placed before the closing <code>body</code> tag. This requires the theme to have the <code>wp_footer()</code> template tag in the appropriate place.', 'svg-support' ); ?></small>
155
  </label>
156
  </td>
157
  </tr>
@@ -184,29 +227,39 @@
184
  </tr>
185
 
186
  <tr valign="top" class="svgs-advanced">
187
- <!-- Automatically insert class to target in images when inserting into posts/pages from admin edit screen -->
188
  <th scope="row">
189
- <strong><?php _e( 'Automatically insert class?', 'svg-support' ); ?></strong></label>
190
  </th>
191
  <td>
192
- <label for="bodhi_svgs_settings[auto_insert_class]">
193
  <?php printf(
194
- '<input id="bodhi_svgs_settings[auto_insert_class]" name="bodhi_svgs_settings[auto_insert_class]" type="checkbox" %2$s />', 'bodhi_svgs_settings_auto_insert_class', checked( isset( $bodhi_svgs_options['auto_insert_class'] ), true, false ) ); ?>
195
- <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' Checking this will make sure that either the default class or the custom one you set below is inserted into the style attributes of <code>img</code> tags when you insert SVG images into a post. Additionally, it will remove all of the default WordPress classes. It will leave normal image types as default and only affect SVG files.', 'svg-support' ); ?></small>
196
  </label>
197
  </td>
198
  </tr>
199
 
200
  <tr valign="top" class="svgs-advanced">
201
- <!-- Automatically insert class to target in images on front end page via jQuery -->
202
  <th scope="row">
203
- <strong><?php _e( 'Force Inline SVG?', 'svg-support' ); ?></strong></label>
204
  </th>
205
  <td>
206
- <label for="bodhi_svgs_settings[force_inline_svg]">
 
 
 
 
 
 
 
 
 
 
207
  <?php printf(
208
- '<input id="bodhi_svgs_settings[force_inline_svg]" name="bodhi_svgs_settings[force_inline_svg]" type="checkbox" %2$s />', 'bodhi_svgs_settings_force_inline_svg', checked( isset( $bodhi_svgs_options['force_inline_svg'] ), true, false ) ); ?>
209
- <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' <strong>Use with caution!</strong> Checking this will automatically add the SVG class to ALL image tags containing SVG file sources in the rendered HTML via javascript and will therefore render all of your SVG files inline.<br /><em>Use case scenario: When using a visual builder such as in the Divi Theme or The Divi Builder, the class is not automatically added with the "Automatically insert class?" option selected or the builder module doesn\'t give you the option to manually add a CSS class directly to your image.</em>', 'svg-support' ); ?></small>
210
  </label>
211
  </td>
212
  </tr>
@@ -347,11 +400,6 @@
347
  </div> <!-- .inside -->
348
  </div> <!-- .postbox -->
349
 
350
- <!-- <a href="https://www.cloudways.com/en/woocommerce-hosting.php?id=731275&amp;a_bid=7c9dd1c5" target="_top"><img style="width:100%;" src="//www.cloudways.com/affiliate/accounts/default1/banners/7c9dd1c5.jpg" alt="Load WooCommerce Stores in 249ms!" title="Load WooCommerce Stores in 249ms!" width="" height="" /></a><img style="border:0" src="https://www.cloudways.com/affiliate/scripts/imp.php?id=731275&amp;a_bid=7c9dd1c5" width="1" height="1" alt="" /> -->
351
- <a href="https://www.cloudways.com/en/wordpress-cloud-hosting.php?id=731275&amp;a_bid=19515e01" target="_top"><img style="width:100%;" src="//www.cloudways.com/affiliate/accounts/default1/banners/19515e01.jpg" alt="Load WordPress Sites in as fast as 37ms!" title="Load WordPress Sites in as fast as 37ms!" width="" height="" /></a><img style="border:0" src="https://www.cloudways.com/affiliate/scripts/imp.php?id=731275&amp;a_bid=19515e01" width="1" height="1" alt="" />
352
- <!-- <a href="https://www.cloudways.com/en/wordpress-cloud-hosting.php?id=731275&amp;a_bid=08e2b8f4" target="_top"><img style="width:100%;" src="//www.cloudways.com/affiliate/accounts/default1/banners/08e2b8f4.jpg" alt="Load WordPress Sites in as fast as 37ms!" title="Load WordPress Sites in as fast as 37ms!" width="" height="" /></a><img style="border:0" src="https://www.cloudways.com/affiliate/scripts/imp.php?id=731275&amp;a_bid=08e2b8f4" width="1" height="1" alt="" /> -->
353
- <a href="https://www.cloudways.com/en/woocommerce-hosting.php?id=731275&amp;a_bid=ed78b3a7" target="_top"><img style="width:100%;" src="//www.cloudways.com/affiliate/accounts/default1/banners/ed78b3a7.jpg" alt="Load WooCommerce Stores in 249ms!" title="Load WooCommerce Stores in 249ms!" width="" height="" /></a><img style="border:0" src="https://www.cloudways.com/affiliate/scripts/imp.php?id=731275&amp;a_bid=ed78b3a7" width="1" height="1" alt="" />
354
-
355
  </div> <!-- .meta-box-sortables -->
356
 
357
  </div> <!-- #postbox-container-1 .postbox-container -->
90
  </td>
91
  </tr>
92
 
93
+ <tr valign="top">
94
+ <!-- Allow sanitization of svg -->
95
+ <th scope="row">
96
+ <strong><?php _e( 'Sanitize SVG while uploading', 'svg-support' ); ?></strong>
97
+ </th>
98
+ <td>
99
+ <label for="bodhi_svgs_settings[sanitize_svg]">
100
+ <?php printf(
101
+ '<input id="bodhi_svgs_settings[sanitize_svg]" name="bodhi_svgs_settings[sanitize_svg]" type="checkbox" %2$s />', 'bodhi_svgs_settings_sanitize_svg', checked( isset( $bodhi_svgs_options['sanitize_svg'] ), true, false ) ); ?>
102
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e('Enhance security of SVG uploads by sanitizing all svg images before being uploaded. This is helpful when non-admins are allowed to upload SVG images.<br><em>All external references are automatically removed during sanitization to prevent XSS and Injection attacks.</em>', 'svg-support' ); ?></small>
103
+ </label>
104
+ </td>
105
+ </tr>
106
+
107
+ <tr valign="top">
108
+ <!-- Allow minification of svg -->
109
+ <th scope="row">
110
+ <label for="bodhi_svgs_settings[minify_svg]"><strong><?php _e( 'Minify SVG', 'svg-support' ); ?></strong>
111
+ </th>
112
+ <td>
113
+ <label for="bodhi_svgs_settings[minify_svg]">
114
+ <?php printf(
115
+ '<input id="bodhi_svgs_settings[minify_svg]" name="bodhi_svgs_settings[minify_svg]" type="checkbox" %2$s />', 'bodhi_svgs_settings_minify_svg', checked( isset( $bodhi_svgs_options['minify_svg'] ), true, false ) ); ?>
116
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e('Enabling this option will auto-minify all svg uploads. Sanitization must be turned on for minification to work.', 'svg-support' ); ?></small>
117
+ </label>
118
+ </td>
119
+ </tr>
120
+
121
+ <tr valign="top">
122
+ <!-- Delete all plugin's data upon deletion -->
123
+ <th scope="row">
124
+ <label for="bodhi_svgs_settings[del_plugin_data]"><strong><?php _e( 'Delete Plugin\'s Data', 'svg-support' ); ?></strong>
125
+ </th>
126
+ <td>
127
+ <label for="bodhi_svgs_settings[del_plugin_data]">
128
+ <?php printf(
129
+ '<input id="bodhi_svgs_settings[del_plugin_data]" name="bodhi_svgs_settings[del_plugin_data]" type="checkbox" %2$s />', 'bodhi_svgs_settings_del_plugin_data', checked( isset( $bodhi_svgs_options['del_plugin_data'] ), true, false ) ); ?>
130
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e('Delete all plugin\'s data during uninstallation process.', 'svg-support' ); ?></small>
131
+ </label>
132
+ </td>
133
+ </tr>
134
+
135
  <tr valign="top" class="svgs-simple">
136
  <!-- Simple/Advanced mode selector -->
137
  <th scope="row">
156
  </td>
157
  </tr>
158
 
159
+ <tr valign="top" class="svgs-advanced">
160
+ <!-- Allow sanitization of svg on Front-end -->
161
+
162
  <th scope="row">
163
+ <strong><?php _e( 'Sanitize SVG on Front-end', 'svg-support' ); ?></strong>
164
  </th>
165
  <td>
166
+ <label for="bodhi_svgs_settings[sanitize_svg_front_end]">
167
  <?php printf(
168
+ '<input id="bodhi_svgs_settings[sanitize_svg_front_end]" name="bodhi_svgs_settings[sanitize_svg_front_end]" type="checkbox" %2$s />', 'bodhi_svgs_settings_sanitize_svg_front_end', checked( $bodhi_svgs_options['sanitize_svg_front_end'], 'on', false ) ); ?>
169
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e('Enhance security by sanitizing svg images on Front-end. This will help to prevent XSS and Injection attacks.', 'svg-support' ); ?></small>
170
  </label>
171
  </td>
172
  </tr>
173
 
174
  <tr valign="top" class="svgs-advanced">
175
+ <!-- Allow choice of js in footer true or false -->
176
  <th scope="row">
177
+ <strong><?php _e( 'Output JS in Footer?', 'svg-support' ); ?></strong>
178
  </th>
179
  <td>
180
+ <label for="bodhi_svgs_settings[js_foot_choice]">
181
  <?php printf(
182
+ '<input id="bodhi_svgs_settings[js_foot_choice]" name="bodhi_svgs_settings[js_foot_choice]" type="checkbox" %2$s />', 'bodhi_svgs_settings_js_foot_choice', checked( isset( $bodhi_svgs_options['js_foot_choice'] ), true, false ) ); ?>
183
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' Normally, scripts are placed in <code>head</code> of the HTML document. If "Yes" is selected, the script is placed before the closing <code>body</code> tag. This requires the theme to have the <code>wp_footer()</code> template tag in the appropriate place.', 'svg-support' ); ?></small>
184
  </label>
185
  </td>
186
  </tr>
187
 
188
  <tr valign="top" class="svgs-advanced">
189
+ <!-- Select whether to use vanilla Js or jQuery -->
190
  <th scope="row">
191
+ <strong><?php _e( 'Use Vanilla JS?', 'svg-support' ); ?></strong>
192
  </th>
193
  <td>
194
+ <label for="bodhi_svgs_settings[use_vanilla_js]">
195
  <?php printf(
196
+ '<input id="bodhi_svgs_settings[use_vanilla_js]" name="bodhi_svgs_settings[use_vanilla_js]" type="checkbox" %2$s />', 'bodhi_svgs_settings_use_vanilla_js', checked( isset( $bodhi_svgs_options['use_vanilla_js'] ), true, false ) ); ?>
197
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' Checking this will use vanilla JS file instead of the jQuery.', 'svg-support' ); ?></small>
198
  </label>
199
  </td>
200
  </tr>
227
  </tr>
228
 
229
  <tr valign="top" class="svgs-advanced">
230
+ <!-- Automatically insert class to target in images on front end page via jQuery -->
231
  <th scope="row">
232
+ <strong><?php _e( 'Force Inline SVG?', 'svg-support' ); ?></strong></label>
233
  </th>
234
  <td>
235
+ <label for="bodhi_svgs_settings[force_inline_svg]">
236
  <?php printf(
237
+ '<input id="bodhi_svgs_settings[force_inline_svg]" name="bodhi_svgs_settings[force_inline_svg]" type="checkbox" %2$s />', 'bodhi_svgs_settings_force_inline_svg', checked( isset( $bodhi_svgs_options['force_inline_svg'] ), true, false ) ); ?>
238
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' <strong>Use with caution!</strong> Checking this will automatically add the SVG class to ALL image tags containing SVG file sources in the rendered HTML via javascript and will therefore render all of your SVG files inline.<br /><em>Use case scenario: When using a visual builder such as in the Divi Theme or The Divi Builder, the class is not automatically added with the "Automatically insert class?" option selected or the builder module doesn\'t give you the option to manually add a CSS class directly to your image.</em>', 'svg-support' ); ?></small>
239
  </label>
240
  </td>
241
  </tr>
242
 
243
  <tr valign="top" class="svgs-advanced">
244
+ <!-- Classic Editor Options Header -->
245
  <th scope="row">
246
+ <h3 class="inner-title"><?php _e( 'Settings for Classic Editor', 'svg-support' ); ?></h3>
247
  </th>
248
  <td>
249
+ <hr>
250
+ </td>
251
+ </tr>
252
+
253
+ <tr valign="top" class="svgs-advanced">
254
+ <!-- Automatically insert class to target in images when inserting into posts/pages from admin edit screen -->
255
+ <th scope="row">
256
+ <strong><?php _e( 'Automatically insert class?', 'svg-support' ); ?></strong></label>
257
+ </th>
258
+ <td>
259
+ <label for="bodhi_svgs_settings[auto_insert_class]">
260
  <?php printf(
261
+ '<input id="bodhi_svgs_settings[auto_insert_class]" name="bodhi_svgs_settings[auto_insert_class]" type="checkbox" %2$s />', 'bodhi_svgs_settings_auto_insert_class', checked( isset( $bodhi_svgs_options['auto_insert_class'] ), true, false ) ); ?>
262
+ <?php _e( 'Yes', 'svg-support' ); ?><br /><small class="description"><?php _e(' Checking this will make sure that either the default class or the custom one you set in <b>"CSS Class to target"</b> option will be inserted into the style attributes of <code>img</code> tags when you insert SVG images into a post. Additionally, it will remove all of the default WordPress classes. It will leave normal image types as default and only affect SVG files.', 'svg-support' ); ?></small>
263
  </label>
264
  </td>
265
  </tr>
400
  </div> <!-- .inside -->
401
  </div> <!-- .postbox -->
402
 
 
 
 
 
 
403
  </div> <!-- .meta-box-sortables -->
404
 
405
  </div> <!-- #postbox-container-1 .postbox-container -->
config.codekit3 CHANGED
@@ -207,6 +207,28 @@
207
  "sC" : 3,
208
  "tS" : 0
209
  },
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
210
  "\/js\/svgs-inline.js" : {
211
  "bF" : 0,
212
  "ft" : 64,
@@ -347,6 +369,14 @@
347
  "q" : 100,
348
  "rq" : 75
349
  },
 
 
 
 
 
 
 
 
350
  "\/vendor\/autoload.php" : {
351
  "cB" : 0,
352
  "ft" : 8192,
@@ -443,6 +473,28 @@
443
  "oAP" : "\/vendor\/composer\/platform_check.php",
444
  "oF" : 0
445
  },
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
446
  "\/vendor\/enshrined\/svg-sanitize\/.github\/workflows\/tests.yml" : {
447
  "cB" : 0,
448
  "ft" : 8192,
207
  "sC" : 3,
208
  "tS" : 0
209
  },
210
+ "\/js\/min\/svgs-inline-vanilla-min.js" : {
211
+ "bF" : 0,
212
+ "ft" : 64,
213
+ "ma" : 0,
214
+ "mi" : 1,
215
+ "oA" : 0,
216
+ "oAP" : "\/js\/min\/svgs-inline-vanilla-min-min.js",
217
+ "oF" : 0,
218
+ "sC" : 3,
219
+ "tS" : 0
220
+ },
221
+ "\/js\/svgs-inline-vanilla.js" : {
222
+ "bF" : 0,
223
+ "ft" : 64,
224
+ "ma" : 0,
225
+ "mi" : 1,
226
+ "oA" : 0,
227
+ "oAP" : "\/js\/min\/svgs-inline-vanilla-min.js",
228
+ "oF" : 2,
229
+ "sC" : 3,
230
+ "tS" : 0
231
+ },
232
  "\/js\/svgs-inline.js" : {
233
  "bF" : 0,
234
  "ft" : 64,
369
  "q" : 100,
370
  "rq" : 75
371
  },
372
+ "\/uninstall.php" : {
373
+ "cB" : 0,
374
+ "ft" : 8192,
375
+ "hM" : 0,
376
+ "oA" : 2,
377
+ "oAP" : "\/uninstall.php",
378
+ "oF" : 0
379
+ },
380
  "\/vendor\/autoload.php" : {
381
  "cB" : 0,
382
  "ft" : 8192,
473
  "oAP" : "\/vendor\/composer\/platform_check.php",
474
  "oF" : 0
475
  },
476
+ "\/vendor\/DOMPurify\/DOMPurify.js" : {
477
+ "bF" : 0,
478
+ "ft" : 64,
479
+ "ma" : 0,
480
+ "mi" : 1,
481
+ "oA" : 0,
482
+ "oAP" : "\/vendor\/DOMPurify\/DOMPurify-min.js",
483
+ "oF" : 0,
484
+ "sC" : 3,
485
+ "tS" : 0
486
+ },
487
+ "\/vendor\/DOMPurify\/DOMPurify.min.js" : {
488
+ "bF" : 0,
489
+ "ft" : 64,
490
+ "ma" : 0,
491
+ "mi" : 1,
492
+ "oA" : 0,
493
+ "oAP" : "\/vendor\/DOMPurify\/DOMPurify.min-min.js",
494
+ "oF" : 0,
495
+ "sC" : 3,
496
+ "tS" : 0
497
+ },
498
  "\/vendor\/enshrined\/svg-sanitize\/.github\/workflows\/tests.yml" : {
499
  "cB" : 0,
500
  "ft" : 8192,
functions/attachment.php CHANGED
@@ -298,10 +298,10 @@ function bodhi_svgs_dimension_fallback( $image, $attachment_id, $size, $icon ) {
298
  // only manipulate for svgs
299
  if ( get_post_mime_type($attachment_id) == 'image/svg+xml' ) {
300
 
301
- if ( !isset($image[1]) or $image[1] === 0 ) {
302
  $image[1] = 1;
303
  }
304
- if ( !isset($image[2]) or $image[2] === 0 ) {
305
  $image[2] = 1;
306
  }
307
 
298
  // only manipulate for svgs
299
  if ( get_post_mime_type($attachment_id) == 'image/svg+xml' ) {
300
 
301
+ if ( isset($image[1]) && $image[1] === 0 ) {
302
  $image[1] = 1;
303
  }
304
+ if ( isset($image[2]) && $image[2] === 0 ) {
305
  $image[2] = 1;
306
  }
307
 
functions/enqueue.php CHANGED
@@ -1,170 +1,208 @@
1
- <?php
2
- /**
3
- * Enqueue scripts and styles
4
- * This file is to enqueue the scripts and styles both admin and front end
5
- */
6
- if ( ! defined( 'ABSPATH' ) ) {
7
- exit; // Exit if accessed directly
8
- }
9
-
10
- /**
11
- * Enqueue the admin CSS using screen check functions
12
- */
13
- function bodhi_svgs_admin_css() {
14
-
15
- // check if user is on SVG Support settings page or media library page
16
- if ( bodhi_svgs_specific_pages_settings() || bodhi_svgs_specific_pages_media_library() ) {
17
-
18
- // enqueue the admin CSS
19
- wp_enqueue_style( 'bodhi-svgs-admin', BODHI_SVGS_PLUGIN_URL . 'css/svgs-admin.css' );
20
-
21
- }
22
-
23
- // check if user is on SVG Support settings page and not in "Advanced Mode"
24
- if ( bodhi_svgs_specific_pages_settings() && ! bodhi_svgs_advanced_mode() ) {
25
-
26
- // enqueue the simple mode admin CSS
27
- wp_enqueue_style( 'bodhi-svgs-admin-simple-mode', BODHI_SVGS_PLUGIN_URL . 'css/svgs-admin-simple-mode.css' );
28
-
29
- }
30
-
31
- // check if user is on an edit post page
32
- if ( bodhi_svgs_is_edit_page() ) {
33
-
34
- // enqueue the edit post CSS
35
- wp_enqueue_style( 'bodhi-svgs-admin-edit-post', BODHI_SVGS_PLUGIN_URL . 'css/svgs-admin-edit-post.css' );
36
-
37
- }
38
-
39
- }
40
- add_action( 'admin_enqueue_scripts', 'bodhi_svgs_admin_css' );
41
-
42
- /*
43
- * Enqueue Block editor JS
44
- */
45
-
46
- function bodhi_svgs_block_editor() {
47
-
48
- if ( bodhi_svgs_advanced_mode() ) {
49
- wp_enqueue_script('bodhi-svgs-gutenberg-filters', BODHI_SVGS_PLUGIN_URL . '/js/gutenberg-filters.js', ['wp-edit-post']);
50
- }
51
-
52
- }
53
-
54
- add_action( 'enqueue_block_editor_assets', 'bodhi_svgs_block_editor' );
55
-
56
- /**
57
- * Enqueue front end CSS
58
- */
59
- function bodhi_svgs_frontend_css() {
60
-
61
- // get the settings
62
- global $bodhi_svgs_options;
63
-
64
- if ( ! empty( $bodhi_svgs_options['frontend_css'] ) ) {
65
-
66
- // enqueue attachment CSS
67
- wp_enqueue_style( 'bodhi-svgs-attachment', BODHI_SVGS_PLUGIN_URL . 'css/svgs-attachment.css' );
68
-
69
- }
70
-
71
- }
72
- add_action( 'wp_enqueue_scripts', 'bodhi_svgs_frontend_css' );
73
-
74
- /**
75
- * Enqueue and localize JS for IMG tag replacement
76
- */
77
- function bodhi_svgs_inline() {
78
-
79
- if ( bodhi_svgs_advanced_mode() ) {
80
-
81
- // get the settings
82
- global $bodhi_svgs_options;
83
-
84
- // check if force inline svg is active
85
- if ( ! empty( $bodhi_svgs_options['force_inline_svg'] ) ) {
86
-
87
- // set variable as true to pass to js
88
- $force_inline_svg_active = 'true';
89
-
90
- // set the class for use in JS
91
- if ( ! empty( $bodhi_svgs_options['css_target'] ) ) {
92
-
93
- // use custom class if set
94
- $css_target_array = array(
95
- 'Bodhi' => 'img.'. esc_attr($bodhi_svgs_options['css_target']),
96
- 'ForceInlineSVG' => esc_attr($bodhi_svgs_options['css_target'])
97
- );
98
-
99
- } else {
100
-
101
- // set default class
102
- $css_target_array = array(
103
- 'Bodhi' => 'img.style-svg',
104
- 'ForceInlineSVG' => 'style-svg'
105
- );
106
-
107
- }
108
-
109
- } else {
110
-
111
- // set variable as false to pass to JS
112
- $force_inline_svg_active = 'false';
113
-
114
- // if custom target is set, use that, otherwise use default
115
- if ( ! empty( $bodhi_svgs_options['css_target'] ) ) {
116
- $css_target = 'img.'. esc_attr($bodhi_svgs_options['css_target']);
117
- } else {
118
- $css_target = 'img.style-svg';
119
- }
120
-
121
- // set the array to target for passing to JS
122
- $css_target_array = $css_target;
123
-
124
- }
125
-
126
- // use expanded or minified JS
127
- if ( ! empty( $bodhi_svgs_options['use_expanded_js'] ) ) {
128
-
129
- // set variables to blank so we use the full JS version
130
- $bodhi_svgs_js_folder = '';
131
- $bodhi_svgs_js_file = '';
132
-
133
- } else {
134
-
135
- // set variables to the minified version in the min folder
136
- $bodhi_svgs_js_folder = 'min/'; // min folder
137
- $bodhi_svgs_js_file = '-min'; // min file
138
-
139
- }
140
-
141
- // check where the JS should be placed, header or footer
142
- if ( ! empty( $bodhi_svgs_options['js_foot_choice'] ) ) {
143
-
144
- $bodhi_svgs_js_footer = true;
145
-
146
- } else {
147
-
148
- $bodhi_svgs_js_footer = false;
149
-
150
- }
151
-
152
- // create path for the correct js file
153
- $bodhi_svgs_js_path = 'js/' . $bodhi_svgs_js_folder .'svgs-inline' . $bodhi_svgs_js_file . '.js' ;
154
-
155
- wp_register_script( 'bodhi_svg_inline', BODHI_SVGS_PLUGIN_URL . $bodhi_svgs_js_path, array( 'jquery' ), '1.0.0', $bodhi_svgs_js_footer );
156
- wp_enqueue_script( 'bodhi_svg_inline' );
157
-
158
- wp_add_inline_script(
159
- 'bodhi_svg_inline',
160
- sprintf(
161
- 'cssTarget=%s;ForceInlineSVGActive=%s;',
162
- json_encode($css_target_array),
163
- json_encode($force_inline_svg_active)
164
- )
165
- );
166
-
167
- }
168
-
169
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
170
  add_action( 'wp_enqueue_scripts', 'bodhi_svgs_inline' );
1
+ <?php
2
+ /**
3
+ * Enqueue scripts and styles
4
+ * This file is to enqueue the scripts and styles both admin and front end
5
+ */
6
+ if ( ! defined( 'ABSPATH' ) ) {
7
+ exit; // Exit if accessed directly
8
+ }
9
+
10
+ /**
11
+ * Enqueue the admin CSS using screen check functions
12
+ */
13
+ function bodhi_svgs_admin_css() {
14
+
15
+ // check if user is on SVG Support settings page or media library page
16
+ if ( bodhi_svgs_specific_pages_settings() || bodhi_svgs_specific_pages_media_library() ) {
17
+
18
+ // enqueue the admin CSS
19
+ wp_enqueue_style( 'bodhi-svgs-admin', BODHI_SVGS_PLUGIN_URL . 'css/svgs-admin.css' );
20
+
21
+ }
22
+
23
+ // check if user is on SVG Support settings page and not in "Advanced Mode"
24
+ if ( bodhi_svgs_specific_pages_settings() && ! bodhi_svgs_advanced_mode() ) {
25
+
26
+ // enqueue the simple mode admin CSS
27
+ wp_enqueue_style( 'bodhi-svgs-admin-simple-mode', BODHI_SVGS_PLUGIN_URL . 'css/svgs-admin-simple-mode.css' );
28
+
29
+ }
30
+
31
+ // check if user is on an edit post page
32
+ if ( bodhi_svgs_is_edit_page() ) {
33
+
34
+ // enqueue the edit post CSS
35
+ wp_enqueue_style( 'bodhi-svgs-admin-edit-post', BODHI_SVGS_PLUGIN_URL . 'css/svgs-admin-edit-post.css' );
36
+
37
+ }
38
+
39
+ }
40
+ add_action( 'admin_enqueue_scripts', 'bodhi_svgs_admin_css' );
41
+
42
+ /*
43
+ * Enqueue Block editor JS
44
+ */
45
+
46
+ function bodhi_svgs_block_editor() {
47
+
48
+ if ( bodhi_svgs_advanced_mode() ) {
49
+ wp_enqueue_script('bodhi-svgs-gutenberg-filters', BODHI_SVGS_PLUGIN_URL . '/js/gutenberg-filters.js', ['wp-edit-post']);
50
+ }
51
+
52
+ }
53
+
54
+ add_action( 'enqueue_block_editor_assets', 'bodhi_svgs_block_editor' );
55
+
56
+ /**
57
+ * Enqueue front end CSS
58
+ */
59
+ function bodhi_svgs_frontend_css() {
60
+
61
+ // get the settings
62
+ global $bodhi_svgs_options;
63
+
64
+ if ( ! empty( $bodhi_svgs_options['frontend_css'] ) ) {
65
+
66
+ // enqueue attachment CSS
67
+ wp_enqueue_style( 'bodhi-svgs-attachment', BODHI_SVGS_PLUGIN_URL . 'css/svgs-attachment.css' );
68
+
69
+ }
70
+
71
+ }
72
+ add_action( 'wp_enqueue_scripts', 'bodhi_svgs_frontend_css' );
73
+
74
+ /**
75
+ * Enqueue front end JS
76
+ */
77
+ function bodhi_svgs_frontend_js() {
78
+
79
+ // get the settings
80
+ global $bodhi_svgs_options;
81
+
82
+ if ( !empty( $bodhi_svgs_options['sanitize_svg_front_end'] ) && $bodhi_svgs_options['sanitize_svg_front_end'] == 'on' && bodhi_svgs_advanced_mode() == true ) {
83
+
84
+ // check where the JS should be placed, header or footer
85
+ if ( ! empty( $bodhi_svgs_options['js_foot_choice'] ) ) {
86
+ $bodhi_svgs_js_footer = true;
87
+ } else {
88
+ $bodhi_svgs_js_footer = false;
89
+ }
90
+
91
+ // enqueue dompurify library js
92
+ wp_enqueue_script( 'bodhi-dompurify-library', BODHI_SVGS_PLUGIN_URL . 'vendor/DOMPurify/DOMPurify.min.js', array(), '1.0.1', $bodhi_svgs_js_footer );
93
+
94
+ }
95
+
96
+ }
97
+
98
+ add_action( 'wp_enqueue_scripts', 'bodhi_svgs_frontend_js', 9 );
99
+
100
+ /**
101
+ * Enqueue and localize JS for IMG tag replacement
102
+ */
103
+ function bodhi_svgs_inline() {
104
+
105
+ if ( bodhi_svgs_advanced_mode() ) {
106
+
107
+ // get the settings
108
+ global $bodhi_svgs_options;
109
+
110
+ // check if force inline svg is active
111
+ if ( ! empty( $bodhi_svgs_options['force_inline_svg'] ) ) {
112
+
113
+ // set variable as true to pass to js
114
+ $force_inline_svg_active = 'true';
115
+
116
+ // set the class for use in JS
117
+ if ( ! empty( $bodhi_svgs_options['css_target'] ) ) {
118
+
119
+ // use custom class if set
120
+ $css_target_array = array(
121
+ 'Bodhi' => 'img.'. esc_attr($bodhi_svgs_options['css_target']),
122
+ 'ForceInlineSVG' => esc_attr($bodhi_svgs_options['css_target'])
123
+ );
124
+
125
+ } else {
126
+
127
+ // set default class
128
+ $css_target_array = array(
129
+ 'Bodhi' => 'img.style-svg',
130
+ 'ForceInlineSVG' => 'style-svg'
131
+ );
132
+
133
+ }
134
+
135
+ } else {
136
+
137
+ // set variable as false to pass to JS
138
+ $force_inline_svg_active = 'false';
139
+
140
+ // if custom target is set, use that, otherwise use default
141
+ if ( ! empty( $bodhi_svgs_options['css_target'] ) ) {
142
+ $css_target = 'img.'. esc_attr($bodhi_svgs_options['css_target']);
143
+ } else {
144
+ $css_target = 'img.style-svg';
145
+ }
146
+
147
+ // set the array to target for passing to JS
148
+ $css_target_array = $css_target;
149
+
150
+ }
151
+
152
+ // use expanded or minified JS
153
+ if ( ! empty( $bodhi_svgs_options['use_expanded_js'] ) ) {
154
+
155
+ // set variables to blank so we use the full JS version
156
+ $bodhi_svgs_js_folder = '';
157
+ $bodhi_svgs_js_file = '';
158
+
159
+ } else {
160
+
161
+ // set variables to the minified version in the min folder
162
+ $bodhi_svgs_js_folder = 'min/'; // min folder
163
+ $bodhi_svgs_js_file = '-min'; // min file
164
+
165
+ }
166
+
167
+ // check where the JS should be placed, header or footer
168
+ if ( ! empty( $bodhi_svgs_options['js_foot_choice'] ) ) {
169
+
170
+ $bodhi_svgs_js_footer = true;
171
+
172
+ } else {
173
+
174
+ $bodhi_svgs_js_footer = false;
175
+
176
+ }
177
+
178
+ // use vanilla js if user has enabled option in settings
179
+ if ( ! empty( $bodhi_svgs_options['use_vanilla_js'] ) ) {
180
+
181
+ $bodhi_svgs_js_vanilla = '-vanilla';
182
+
183
+ }else{
184
+
185
+ $bodhi_svgs_js_vanilla = '';
186
+
187
+ }
188
+
189
+ // create path for the correct js file
190
+ $bodhi_svgs_js_path = 'js/' . $bodhi_svgs_js_folder .'svgs-inline' . $bodhi_svgs_js_vanilla . $bodhi_svgs_js_file . '.js' ;
191
+
192
+ wp_register_script( 'bodhi_svg_inline', BODHI_SVGS_PLUGIN_URL . $bodhi_svgs_js_path, array( 'jquery' ), '1.0.1', $bodhi_svgs_js_footer );
193
+ wp_enqueue_script( 'bodhi_svg_inline' );
194
+
195
+ wp_add_inline_script(
196
+ 'bodhi_svg_inline',
197
+ sprintf(
198
+ 'cssTarget=%s;ForceInlineSVGActive=%s;frontSanitizationEnabled=%s;',
199
+ json_encode($css_target_array),
200
+ json_encode($force_inline_svg_active),
201
+ json_encode($bodhi_svgs_options['sanitize_svg_front_end'])
202
+ )
203
+ );
204
+
205
+ }
206
+
207
+ }
208
  add_action( 'wp_enqueue_scripts', 'bodhi_svgs_inline' );
js/min/svgs-inline-min.js CHANGED
@@ -1 +1 @@
1
- document.addEventListener("DOMContentLoaded",(function(e){function t(e){if("IMG"===e.nodeName){var t=e.id,s=e.classList,i=e.src;if(i.endsWith("svg")){var r=new XMLHttpRequest;r.onreadystatechange=function(){if(4==r.readyState&&200==r.status){let o;data=r.responseText;const d=undefined;var i=(new DOMParser).parseFromString(data,"text/html").getElementsByTagName("svg")[0],a=i.id;void 0===t?void 0===a?(t="svg-replaced-"+n,i.setAttribute("id",t)):t=a:i.setAttribute("id",t),void 0!==s&&i.setAttribute("class",s+" replaced-svg svg-replaced-"+n),i.removeAttribute("xmlns:a"),e.replaceWith(i),n++}},r.open("GET",i,!1),r.send(null)}}}function s(e){if(e.childNodes.length>0)for(var n=0;n<e.childNodes.length;n++){var i;if("IMG"==e.childNodes[n].nodeName)t(e.childNodes[n]);else s(e.childNodes[n])}}let n=0;(bodhisvgsInlineSupport=function(){if("true"===ForceInlineSVGActive)for(var e=document.getElementsByTagName("img"),n=0;n<e.length;n++)void 0!==e[n].src&&e[n].src.match(/\.(svg)/)&&(e[n].classList.contains(cssTarget.ForceInlineSVG)||e[n].classList.add(cssTarget.ForceInlineSVG));if(String.prototype.endsWith||(String.prototype.endsWith=function(e,t){var s=this.toString();("number"!=typeof t||!isFinite(t)||Math.floor(t)!==t||t>s.length)&&(t=s.length),t-=e.length;var n=s.lastIndexOf(e,t);return-1!==n&&n===t}),String.prototype.endsWith=function(e){var t=this.length-e.length;return t>=0&&this.lastIndexOf(e)===t},"true"===ForceInlineSVGActive)var i="img."!==cssTarget.Bodhi?cssTarget.ForceInlineSVG:"style-svg";else var i="img."!==cssTarget?cssTarget:"style-svg";i=i.replace("img.","");for(var e=document.getElementsByClassName(i),n=0;n<e.length;n++){var r;if(void 0===e[n].src)s(e[n]);else t(e[n])}})()}));
1
+ jQuery(document).ready((function($){function t(t){var e=t.attr("id"),i=t.attr("class"),s=t.attr("src");s.endsWith("svg")&&$.get(s,(function(s){var n=$(s).find("svg"),a=n.attr("id");void 0===e?void 0===a?(e="svg-replaced-"+r,n=n.attr("id",e)):e=a:n=n.attr("id",e),void 0!==i&&(n=n.attr("class",i+" replaced-svg svg-replaced-"+r)),n=n.removeAttr("xmlns:a"),"on"==frontSanitizationEnabled&&""!=n[0].outerHTML&&(n=DOMPurify.sanitize(n[0].outerHTML)),t.replaceWith(n),$(document).trigger("svg.loaded",[e]),r++}),"xml")}let r=0;(bodhisvgsInlineSupport=function(){if("true"===ForceInlineSVGActive&&jQuery("img").each((function(){void 0!==jQuery(this).attr("src")&&!1!==jQuery(this).attr("src")&&jQuery(this).attr("src").match(/\.(svg)/)&&(jQuery(this).hasClass(cssTarget.ForceInlineSVG)||jQuery(this).addClass(cssTarget.ForceInlineSVG))})),String.prototype.endsWith||(String.prototype.endsWith=function(t,r){var e=this.toString();("number"!=typeof r||!isFinite(r)||Math.floor(r)!==r||r>e.length)&&(r=e.length),r-=t.length;var i=e.lastIndexOf(t,r);return-1!==i&&i===r}),String.prototype.endsWith=function(t){var r=this.length-t.length;return r>=0&&this.lastIndexOf(t)===r},"true"===ForceInlineSVGActive)var r="img."!==cssTarget.Bodhi?cssTarget.Bodhi:".style-svg";else var r="img."!==cssTarget?cssTarget:".style-svg";r=r.replace("img",""),$(r).each((function(r){void 0!==$(this).attr("src")&&!1!==$(this).attr("src")?t($(this)):$(this).find("img").each((function(r){void 0!==$(this).attr("src")&&!1!==$(this).attr("src")&&t($(this))}))}))})()}));
js/min/svgs-inline-vanilla-min.js ADDED
@@ -0,0 +1 @@
 
1
+ document.addEventListener("DOMContentLoaded",(function(e){function t(e){if("IMG"===e.nodeName){var t=e.id,n=e.classList,i=e.src;if(i.endsWith("svg")){var r=new XMLHttpRequest;r.onreadystatechange=function(){if(4==r.readyState&&200==r.status){let o;data=r.responseText;const d=undefined;var i,a=(i=(new DOMParser).parseFromString(data,"text/html").getElementsByTagName("svg")[0]).id;if(void 0===t?void 0===a?(t="svg-replaced-"+s,i.setAttribute("id",t)):t=a:i.setAttribute("id",t),void 0!==n&&i.setAttribute("class",n+" replaced-svg svg-replaced-"+s),i.removeAttribute("xmlns:a"),"on"==frontSanitizationEnabled&&""!=i.outerHTML){var i=DOMPurify.sanitize(i.outerHTML);e.outerHTML=i}else e.replaceWith(i);s++}},r.open("GET",i,!1),r.send(null)}}}function n(e){if(e.childNodes.length>0)for(var s=0;s<e.childNodes.length;s++){var i;if("IMG"==e.childNodes[s].nodeName)t(e.childNodes[s]);else n(e.childNodes[s])}}let s=0;(bodhisvgsInlineSupport=function(){if("true"===ForceInlineSVGActive)for(var e=document.getElementsByTagName("img"),s=0;s<e.length;s++)void 0!==e[s].src&&e[s].src.match(/\.(svg)/)&&(e[s].classList.contains(cssTarget.ForceInlineSVG)||e[s].classList.add(cssTarget.ForceInlineSVG));if(String.prototype.endsWith||(String.prototype.endsWith=function(e,t){var n=this.toString();("number"!=typeof t||!isFinite(t)||Math.floor(t)!==t||t>n.length)&&(t=n.length),t-=e.length;var s=n.lastIndexOf(e,t);return-1!==s&&s===t}),String.prototype.endsWith=function(e){var t=this.length-e.length;return t>=0&&this.lastIndexOf(e)===t},"true"===ForceInlineSVGActive)var i="img."!==cssTarget.Bodhi?cssTarget.ForceInlineSVG:"style-svg";else var i="img."!==cssTarget?cssTarget:"style-svg";i=i.replace("img.","");for(var e=document.getElementsByClassName(i),s=0;s<e.length;s++){var r;if(void 0===e[s].src)n(e[s]);else t(e[s])}})()}));
js/svgs-inline-vanilla.js ADDED
@@ -0,0 +1,184 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ // wait for document to be ready
2
+ document.addEventListener("DOMContentLoaded", function(event) {
3
+
4
+ let bodhisvgsReplacements = 0;
5
+
6
+ function bodhisvgsReplace(img) {
7
+
8
+ // must be an image
9
+ if( img.nodeName !== 'IMG' ){
10
+ return;
11
+ }
12
+
13
+ var imgID = img.id;
14
+ var imgClass = img.classList;
15
+ var imgURL = img.src;
16
+
17
+ // must be svg
18
+ if( !imgURL.endsWith('svg') ){
19
+ return;
20
+ }
21
+
22
+ var xmlHttp = new XMLHttpRequest();
23
+ xmlHttp.onreadystatechange = function() {
24
+
25
+ if (xmlHttp.readyState == 4 && xmlHttp.status == 200){
26
+
27
+ data = xmlHttp.responseText;
28
+
29
+ let parser = new DOMParser();
30
+ const doc = parser.parseFromString(data, 'text/html');
31
+
32
+ // get svg now
33
+ var svg = doc.getElementsByTagName('svg')[0];
34
+
35
+ var svgID = svg.id;
36
+
37
+ // Add replaced image's ID to the new SVG if necessary
38
+ if( typeof imgID === 'undefined' ){
39
+ if( typeof svgID === 'undefined' ) {
40
+ imgID = 'svg-replaced-'+bodhisvgsReplacements;
41
+ svg.setAttribute('id', imgID);
42
+ } else {
43
+ imgID = svgID;
44
+ }
45
+ } else {
46
+ svg.setAttribute('id', imgID);
47
+ }
48
+
49
+ // Add replaced image's classes to the new SVG
50
+ if(typeof imgClass !== 'undefined') {
51
+ svg.setAttribute('class', imgClass+' replaced-svg svg-replaced-'+bodhisvgsReplacements);
52
+ }
53
+
54
+ // Remove any invalid XML tags as per http://validator.w3.org
55
+ svg.removeAttribute('xmlns:a');
56
+
57
+ if(frontSanitizationEnabled == 'on' && svg["outerHTML"] != "") { // Is sanitization enabled?
58
+ var svg = DOMPurify.sanitize(svg.outerHTML); // Sanitize SVG code via DOMPurify library
59
+ img.outerHTML = svg; // Replacing img tag with new SVG sanitized content
60
+ }
61
+ else {
62
+ // Replace image with new SVG
63
+ img.replaceWith(svg);
64
+ }
65
+
66
+ bodhisvgsReplacements++;
67
+
68
+ }
69
+
70
+ }
71
+
72
+ xmlHttp.open("GET", imgURL, false);
73
+ xmlHttp.send(null);
74
+
75
+ }
76
+
77
+ function bodhisvgsIterator(node) {
78
+
79
+ if( node.childNodes.length > 0 ){
80
+
81
+ for (var i = 0; i < node.childNodes.length; i++) {
82
+
83
+ if( node.childNodes[i].nodeName == 'IMG' ){
84
+
85
+ // its an image... replace it too
86
+ var img = node.childNodes[i];
87
+ bodhisvgsReplace(img);
88
+
89
+ }else{
90
+
91
+ // go to another level
92
+ bodhisvgsIterator(node.childNodes[i]);
93
+
94
+ }
95
+ }
96
+
97
+ }
98
+
99
+ }
100
+
101
+ // Wrap in IIFE so that it can be called again later as bodhisvgsInlineSupport();
102
+ (bodhisvgsInlineSupport = function() {
103
+
104
+ // If force inline SVG option is active then add class
105
+ if ( ForceInlineSVGActive === 'true' ) {
106
+
107
+ var allImages = document.getElementsByTagName('img'); // find all images on page
108
+
109
+ // loop on images
110
+ for(var i = 0; i < allImages.length ; i++) {
111
+
112
+ if( typeof allImages[i].src !== 'undefined' ){
113
+
114
+ // check if it has svg
115
+ if( allImages[i].src.match(/\.(svg)/) ){
116
+
117
+ // add our class - if not already added
118
+ if( !allImages[i].classList.contains(cssTarget.ForceInlineSVG) ){
119
+
120
+ // add class now
121
+ allImages[i].classList.add(cssTarget.ForceInlineSVG);
122
+
123
+ }
124
+
125
+ }
126
+
127
+ }
128
+
129
+
130
+ }
131
+
132
+ }
133
+
134
+ // Polyfill to support all ye old browsers
135
+ // delete when not needed in the future
136
+ if (!String.prototype.endsWith) {
137
+ String.prototype.endsWith = function(searchString, position) {
138
+ var subjectString = this.toString();
139
+ if (typeof position !== 'number' || !isFinite(position) || Math.floor(position) !== position || position > subjectString.length) {
140
+ position = subjectString.length;
141
+ }
142
+ position -= searchString.length;
143
+ var lastIndex = subjectString.lastIndexOf(searchString, position);
144
+ return lastIndex !== -1 && lastIndex === position;
145
+ };
146
+ } // end polyfill
147
+
148
+ // Another snippet to support IE11
149
+ String.prototype.endsWith = function(pattern) {
150
+ var d = this.length - pattern.length;
151
+ return d >= 0 && this.lastIndexOf(pattern) === d;
152
+ };
153
+ // End snippet to support IE11
154
+
155
+ // Check to see if user set alternate class
156
+ if ( ForceInlineSVGActive === 'true' ) {
157
+ var target = ( cssTarget.Bodhi !== 'img.' ? cssTarget.ForceInlineSVG : 'style-svg' );
158
+ } else {
159
+ var target = ( cssTarget !== 'img.' ? cssTarget : 'style-svg' );
160
+ }
161
+
162
+ // remove .img from class
163
+ target = target.replace("img.","");
164
+
165
+ var allImages = document.getElementsByClassName(target); // find all images with force svg class
166
+
167
+ for(var i = 0; i < allImages.length ; i++) {
168
+
169
+ if( typeof allImages[i].src == 'undefined' ){ // not an image
170
+
171
+ bodhisvgsIterator(allImages[i]);
172
+
173
+ }else{
174
+
175
+ var img = allImages[i];
176
+ bodhisvgsReplace(img);
177
+
178
+ }
179
+
180
+ }
181
+
182
+ })(); // Execute immediately
183
+
184
+ });
js/svgs-inline.js CHANGED
@@ -1,94 +1,64 @@
1
- // wait for document to be ready
2
- document.addEventListener("DOMContentLoaded", function(event) {
3
 
4
  let bodhisvgsReplacements = 0;
5
 
6
  function bodhisvgsReplace(img) {
7
 
8
- // must be an image
9
- if( img.nodeName !== 'IMG' ){
10
- return;
11
- }
12
 
13
- var imgID = img.id;
14
- var imgClass = img.classList;
15
- var imgURL = img.src;
16
 
17
- // must be svg
18
- if( !imgURL.endsWith('svg') ){
19
  return;
20
  }
21
 
22
- var xmlHttp = new XMLHttpRequest();
23
- xmlHttp.onreadystatechange = function() {
24
-
25
- if (xmlHttp.readyState == 4 && xmlHttp.status == 200){
26
 
27
- data = xmlHttp.responseText;
 
28
 
29
- let parser = new DOMParser();
30
- const doc = parser.parseFromString(data, 'text/html');
31
 
32
- // get svg now
33
- var svg = doc.getElementsByTagName('svg')[0];
34
-
35
- var svgID = svg.id;
36
-
37
- // Add replaced image's ID to the new SVG if necessary
38
- if( typeof imgID === 'undefined' ){
39
- if( typeof svgID === 'undefined' ) {
40
- imgID = 'svg-replaced-'+bodhisvgsReplacements;
41
- svg.setAttribute('id', imgID);
42
- } else {
43
- imgID = svgID;
44
- }
45
  } else {
46
- svg.setAttribute('id', imgID);
47
  }
48
-
49
- // Add replaced image's classes to the new SVG
50
- if(typeof imgClass !== 'undefined') {
51
- svg.setAttribute('class', imgClass+' replaced-svg svg-replaced-'+bodhisvgsReplacements);
52
- }
53
-
54
- // Remove any invalid XML tags as per http://validator.w3.org
55
- svg.removeAttribute('xmlns:a');
56
-
57
- // Replace image with new SVG
58
- img.replaceWith(svg);
59
-
60
- bodhisvgsReplacements++;
61
-
62
  }
63
 
64
- }
65
-
66
- xmlHttp.open("GET", imgURL, false);
67
- xmlHttp.send(null);
68
-
69
- }
70
-
71
- function bodhisvgsIterator(node) {
72
-
73
- if( node.childNodes.length > 0 ){
74
-
75
- for (var i = 0; i < node.childNodes.length; i++) {
76
-
77
- if( node.childNodes[i].nodeName == 'IMG' ){
78
 
79
- // its an image... replace it too
80
- var img = node.childNodes[i];
81
- bodhisvgsReplace(img);
 
 
 
 
 
 
 
82
 
83
- }else{
 
84
 
85
- // go to another level
86
- bodhisvgsIterator(node.childNodes[i]);
87
 
88
- }
89
- }
90
 
91
- }
92
 
93
  }
94
 
@@ -98,31 +68,22 @@ document.addEventListener("DOMContentLoaded", function(event) {
98
  // If force inline SVG option is active then add class
99
  if ( ForceInlineSVGActive === 'true' ) {
100
 
101
- var allImages = document.getElementsByTagName('img'); // find all images on page
102
-
103
- // loop on images
104
- for(var i = 0; i < allImages.length ; i++) {
105
 
106
- if( typeof allImages[i].src !== 'undefined' ){
 
107
 
108
- // check if it has svg
109
- if( allImages[i].src.match(/\.(svg)/) ){
110
-
111
- // add our class - if not already added
112
- if( !allImages[i].classList.contains(cssTarget.ForceInlineSVG) ){
113
-
114
- // add class now
115
- allImages[i].classList.add(cssTarget.ForceInlineSVG);
116
 
 
 
 
117
  }
118
-
119
  }
120
-
121
  }
122
-
123
-
124
- }
125
-
126
  }
127
 
128
  // Polyfill to support all ye old browsers
@@ -148,31 +109,34 @@ document.addEventListener("DOMContentLoaded", function(event) {
148
 
149
  // Check to see if user set alternate class
150
  if ( ForceInlineSVGActive === 'true' ) {
151
- var target = ( cssTarget.Bodhi !== 'img.' ? cssTarget.ForceInlineSVG : 'style-svg' );
152
  } else {
153
- var target = ( cssTarget !== 'img.' ? cssTarget : 'style-svg' );
154
  }
155
 
156
- // remove .img from class
157
- target = target.replace("img.","");
158
-
159
- var allImages = document.getElementsByClassName(target); // find all images with force svg class
160
-
161
- for(var i = 0; i < allImages.length ; i++) {
162
 
163
- if( typeof allImages[i].src == 'undefined' ){ // not an image
 
 
 
 
 
164
 
165
- bodhisvgsIterator(allImages[i]);
 
166
 
167
- }else{
 
 
168
 
169
- var img = allImages[i];
170
- bodhisvgsReplace(img);
171
 
172
  }
173
 
174
- }
 
175
 
176
  })(); // Execute immediately
177
 
178
- });
1
+ jQuery(document).ready(function ($) {
 
2
 
3
  let bodhisvgsReplacements = 0;
4
 
5
  function bodhisvgsReplace(img) {
6
 
7
+ var imgID = img.attr('id');
8
+ var imgClass = img.attr('class');
9
+ var imgURL = img.attr('src');
 
10
 
11
+ // Set svg size to the original img size
12
+ // var imgWidth = $img.attr('width');
13
+ // var imgHeight = $img.attr('height');
14
 
15
+ if (!imgURL.endsWith('svg')) {
 
16
  return;
17
  }
18
 
19
+ $.get(imgURL, function(data) {
 
 
 
20
 
21
+ // Get the SVG tag, ignore the rest
22
+ var $svg = $(data).find('svg');
23
 
24
+ var svgID = $svg.attr('id');
 
25
 
26
+ // Add replaced image's ID to the new SVG if necessary
27
+ if(typeof imgID === 'undefined') {
28
+ if(typeof svgID === 'undefined') {
29
+ imgID = 'svg-replaced-'+bodhisvgsReplacements;
30
+ $svg = $svg.attr('id', imgID);
 
 
 
 
 
 
 
 
31
  } else {
32
+ imgID = svgID;
33
  }
34
+ } else {
35
+ $svg = $svg.attr('id', imgID);
 
 
 
 
 
 
 
 
 
 
 
 
36
  }
37
 
38
+ // Add replaced image's classes to the new SVG
39
+ if(typeof imgClass !== 'undefined') {
40
+ $svg = $svg.attr('class', imgClass+' replaced-svg svg-replaced-'+bodhisvgsReplacements);
41
+ }
 
 
 
 
 
 
 
 
 
 
42
 
43
+ // Remove any invalid XML tags as per http://validator.w3.org
44
+ $svg = $svg.removeAttr('xmlns:a');
45
+
46
+ if(frontSanitizationEnabled == 'on' && $svg[0]['outerHTML'] != "") { // Is sanitization enabled?
47
+ $svg = DOMPurify.sanitize($svg[0]['outerHTML']); // Sanitize SVG code via DOMPurify library
48
+ }
49
+
50
+ // Add size attributes
51
+ // $svg = $svg.attr('width', imgWidth);
52
+ // $svg = $svg.attr('height', imgHeight);
53
 
54
+ // Replace image with new SVG
55
+ img.replaceWith($svg);
56
 
57
+ $(document).trigger('svg.loaded', [imgID]);
 
58
 
59
+ bodhisvgsReplacements++;
 
60
 
61
+ }, 'xml');
62
 
63
  }
64
 
68
  // If force inline SVG option is active then add class
69
  if ( ForceInlineSVGActive === 'true' ) {
70
 
71
+ // Find all SVG inside img and add class if it hasn't got it
72
+ jQuery('img').each(function() {
 
 
73
 
74
+ // Check if the SRC attribute is present at all
75
+ if ( typeof jQuery(this).attr('src') !== typeof undefined && jQuery(this).attr('src') !== false) {
76
 
77
+ // Pick only those with the extension we want
78
+ if ( jQuery(this).attr('src').match(/\.(svg)/) ) {
 
 
 
 
 
 
79
 
80
+ // Add our class name
81
+ if ( !jQuery(this).hasClass(cssTarget.ForceInlineSVG) ) {
82
+ jQuery(this).addClass(cssTarget.ForceInlineSVG);
83
  }
 
84
  }
 
85
  }
86
+ });
 
 
 
87
  }
88
 
89
  // Polyfill to support all ye old browsers
109
 
110
  // Check to see if user set alternate class
111
  if ( ForceInlineSVGActive === 'true' ) {
112
+ var target = ( cssTarget.Bodhi !== 'img.' ? cssTarget.Bodhi : '.style-svg' );
113
  } else {
114
+ var target = ( cssTarget !== 'img.' ? cssTarget : '.style-svg' );
115
  }
116
 
117
+ target = target.replace("img","");
 
 
 
 
 
118
 
119
+ $(target).each(function(index){
120
+
121
+ // if image then send for replacement
122
+ if ( typeof $(this).attr('src') !== typeof undefined && $(this).attr('src') !== false) {
123
+ bodhisvgsReplace($(this));
124
+ }else{
125
 
126
+ // look for svg children and send for replacement
127
+ $(this).find("img").each(function(i){
128
 
129
+ if( typeof $(this).attr('src') !== typeof undefined && $(this).attr('src') !== false ){
130
+ bodhisvgsReplace($(this));
131
+ }
132
 
133
+ });
 
134
 
135
  }
136
 
137
+
138
+ });
139
 
140
  })(); // Execute immediately
141
 
142
+ });
readme.txt CHANGED
@@ -4,8 +4,8 @@ Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_i
4
  Tags: svg, vector, safesvg, safe svg, sanitization, sanitisation, sanitizer, sanitiser, sanitized, sanitised, sanitize, sanitise, css, style, mime, mime type, embed, img, render, inline, animation, animation, animate, js
5
  Requires at least: 4.8
6
  Tested up to: 6.0
7
- Requires PHP: 5.3
8
- Stable tag: 2.4.2
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
@@ -161,6 +161,15 @@ You need to add the mime type for svg and svgz to: "MLA Settings > Media Library
161
 
162
  == Changelog ==
163
 
 
 
 
 
 
 
 
 
 
164
  = 2.4.2 =
165
  * Fixed srcset warning for some premium themes.
166
  * Fixed original IMG IDs not getting preserved on replacement.
@@ -369,6 +378,9 @@ You need to add the mime type for svg and svgz to: "MLA Settings > Media Library
369
 
370
  == Upgrade Notice ==
371
 
 
 
 
372
  = 2.4.2 =
373
  2.4.2 fixes srcset issue firing PHP warnings for some themes and original image IDs missing on replacement to inline SVG.
374
 
4
  Tags: svg, vector, safesvg, safe svg, sanitization, sanitisation, sanitizer, sanitiser, sanitized, sanitised, sanitize, sanitise, css, style, mime, mime type, embed, img, render, inline, animation, animation, animate, js
5
  Requires at least: 4.8
6
  Tested up to: 6.0
7
+ Requires PHP: 7.2
8
+ Stable tag: 2.5
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
161
 
162
  == Changelog ==
163
 
164
+ = 2.5 =
165
+ * Cleaned up spelling mistakes and general formatting.
166
+ * Addressed security concern.
167
+ * Added more sanitization options - frontend and admin both supported.
168
+ * Added support for SVG minification.
169
+ * Added ability to choose jQuery or vanilla JS.
170
+ * Added DB cleanup on uninstall.
171
+ * Fixed dimensions fallback.
172
+
173
  = 2.4.2 =
174
  * Fixed srcset warning for some premium themes.
175
  * Fixed original IMG IDs not getting preserved on replacement.
378
 
379
  == Upgrade Notice ==
380
 
381
+ = 2.5 =
382
+ Adds new features and addresses a number of recent issues raised. Please take a backup before updating!
383
+
384
  = 2.4.2 =
385
  2.4.2 fixes srcset issue firing PHP warnings for some themes and original image IDs missing on replacement to inline SVG.
386
 
svg-support.php CHANGED
@@ -3,7 +3,7 @@
3
  Plugin Name: SVG Support
4
  Plugin URI: http://wordpress.org/plugins/svg-support/
5
  Description: Upload SVG files to the Media Library and render SVG files inline for direct styling/animation of an SVG's internal elements using CSS/JS.
6
- Version: 2.4.2
7
  Author: Benbodhi
8
  Author URI: https://benbodhi.com
9
  Text Domain: svg-support
@@ -22,23 +22,28 @@ if ( ! defined( 'ABSPATH' ) ) {
22
  /**
23
  * Global variables
24
  */
25
- $svgs_plugin_version = '2.4.2'; // for use on admin pages
26
  $plugin_file = plugin_basename(__FILE__); // plugin file for reference
27
  define( 'BODHI_SVGS_PLUGIN_PATH', plugin_dir_path( __FILE__ ) ); // define the absolute plugin path for includes
28
  define( 'BODHI_SVGS_PLUGIN_URL', plugin_dir_url( __FILE__ ) ); // define the plugin url for use in enqueue
29
  $bodhi_svgs_options = get_option('bodhi_svgs_settings'); // retrieve our plugin settings from the options table
30
 
31
- /*
32
- * SVG Sanitizer class
33
- */
34
- include( BODHI_SVGS_PLUGIN_PATH . 'vendor/autoload.php' ); // svg sanitizer
35
 
36
- // interfaces to enable custom whitelisting of svg tags and attributes
37
- include( BODHI_SVGS_PLUGIN_PATH . 'includes/svg-tags.php' );
38
- include( BODHI_SVGS_PLUGIN_PATH . 'includes/svg-attributes.php' );
39
 
40
- use enshrined\svgSanitize\Sanitizer; // init svg sanitizer for usage
41
- $sanitizer = new Sanitizer(); // initialize if enabled
 
 
 
 
 
 
 
 
 
 
42
 
43
  /**
44
  * Includes - keeping it modular
@@ -74,3 +79,10 @@ if ( empty( $svgs_plugin_version_stored ) ) {
74
  update_option( 'bodhi_svgs_plugin_version', $svgs_plugin_version );
75
 
76
  }
 
 
 
 
 
 
 
3
  Plugin Name: SVG Support
4
  Plugin URI: http://wordpress.org/plugins/svg-support/
5
  Description: Upload SVG files to the Media Library and render SVG files inline for direct styling/animation of an SVG's internal elements using CSS/JS.
6
+ Version: 2.5
7
  Author: Benbodhi
8
  Author URI: https://benbodhi.com
9
  Text Domain: svg-support
22
  /**
23
  * Global variables
24
  */
25
+ $svgs_plugin_version = '2.5'; // for use on admin pages
26
  $plugin_file = plugin_basename(__FILE__); // plugin file for reference
27
  define( 'BODHI_SVGS_PLUGIN_PATH', plugin_dir_path( __FILE__ ) ); // define the absolute plugin path for includes
28
  define( 'BODHI_SVGS_PLUGIN_URL', plugin_dir_url( __FILE__ ) ); // define the plugin url for use in enqueue
29
  $bodhi_svgs_options = get_option('bodhi_svgs_settings'); // retrieve our plugin settings from the options table
30
 
31
+ use enshrined\svgSanitize\Sanitizer; // init svg sanitizer for usage
 
 
 
32
 
33
+ if ( ( !empty($bodhi_svgs_options['sanitize_svg']) && $bodhi_svgs_options['sanitize_svg'] === 'on' ) || ( !empty($bodhi_svgs_options['minify_svg']) && $bodhi_svgs_options['minify_svg'] === 'on' ) ) {
 
 
34
 
35
+ /*
36
+ * SVG Sanitizer class
37
+ */
38
+ include( BODHI_SVGS_PLUGIN_PATH . 'vendor/autoload.php' ); // svg sanitizer
39
+
40
+ // interfaces to enable custom whitelisting of svg tags and attributes
41
+ include( BODHI_SVGS_PLUGIN_PATH . 'includes/svg-tags.php' );
42
+ include( BODHI_SVGS_PLUGIN_PATH . 'includes/svg-attributes.php' );
43
+
44
+ $sanitizer = new Sanitizer(); // initialize if enabled
45
+
46
+ }
47
 
48
  /**
49
  * Includes - keeping it modular
79
  update_option( 'bodhi_svgs_plugin_version', $svgs_plugin_version );
80
 
81
  }
82
+
83
+ // For version >= 2.5. | Enable 'sanitize_svg_front_end' by default
84
+ if ( !isset($bodhi_svgs_options['sanitize_svg_front_end']) ) {
85
+ $bodhi_svgs_options['sanitize_svg_front_end'] = 'on';
86
+ update_option( 'bodhi_svgs_settings', $bodhi_svgs_options );
87
+ }
88
+
uninstall.php ADDED
@@ -0,0 +1,12 @@
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <?php if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
2
+ exit;
3
+ }
4
+
5
+ $bodhi_options_on_deletion = get_option('bodhi_svgs_settings');
6
+
7
+ if( $bodhi_options_on_deletion[del_plugin_data] === 'on' ) {
8
+ delete_option( 'bodhi_svgs_plugin_version' );
9
+ delete_option( 'bodhi_svgs_settings' );
10
+ }
11
+
12
+ ?>
vendor/DOMPurify/DOMPurify.js ADDED
@@ -0,0 +1,1617 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ /*! @license DOMPurify 2.3.8 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.8/LICENSE */
2
+
3
+ (function (global, factory) {
4
+ typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
5
+ typeof define === 'function' && define.amd ? define(factory) :
6
+ (global = typeof globalThis !== 'undefined' ? globalThis : global || self, global.DOMPurify = factory());
7
+ })(this, (function () { 'use strict';
8
+
9
+ function _typeof(obj) {
10
+ "@babel/helpers - typeof";
11
+
12
+ return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (obj) {
13
+ return typeof obj;
14
+ } : function (obj) {
15
+ return obj && "function" == typeof Symbol && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj;
16
+ }, _typeof(obj);
17
+ }
18
+
19
+ function _setPrototypeOf(o, p) {
20
+ _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf(o, p) {
21
+ o.__proto__ = p;
22
+ return o;
23
+ };
24
+
25
+ return _setPrototypeOf(o, p);
26
+ }
27
+
28
+ function _isNativeReflectConstruct() {
29
+ if (typeof Reflect === "undefined" || !Reflect.construct) return false;
30
+ if (Reflect.construct.sham) return false;
31
+ if (typeof Proxy === "function") return true;
32
+
33
+ try {
34
+ Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {}));
35
+ return true;
36
+ } catch (e) {
37
+ return false;
38
+ }
39
+ }
40
+
41
+ function _construct(Parent, args, Class) {
42
+ if (_isNativeReflectConstruct()) {
43
+ _construct = Reflect.construct;
44
+ } else {
45
+ _construct = function _construct(Parent, args, Class) {
46
+ var a = [null];
47
+ a.push.apply(a, args);
48
+ var Constructor = Function.bind.apply(Parent, a);
49
+ var instance = new Constructor();
50
+ if (Class) _setPrototypeOf(instance, Class.prototype);
51
+ return instance;
52
+ };
53
+ }
54
+
55
+ return _construct.apply(null, arguments);
56
+ }
57
+
58
+ function _toConsumableArray(arr) {
59
+ return _arrayWithoutHoles(arr) || _iterableToArray(arr) || _unsupportedIterableToArray(arr) || _nonIterableSpread();
60
+ }
61
+
62
+ function _arrayWithoutHoles(arr) {
63
+ if (Array.isArray(arr)) return _arrayLikeToArray(arr);
64
+ }
65
+
66
+ function _iterableToArray(iter) {
67
+ if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
68
+ }
69
+
70
+ function _unsupportedIterableToArray(o, minLen) {
71
+ if (!o) return;
72
+ if (typeof o === "string") return _arrayLikeToArray(o, minLen);
73
+ var n = Object.prototype.toString.call(o).slice(8, -1);
74
+ if (n === "Object" && o.constructor) n = o.constructor.name;
75
+ if (n === "Map" || n === "Set") return Array.from(o);
76
+ if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen);
77
+ }
78
+
79
+ function _arrayLikeToArray(arr, len) {
80
+ if (len == null || len > arr.length) len = arr.length;
81
+
82
+ for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i];
83
+
84
+ return arr2;
85
+ }
86
+
87
+ function _nonIterableSpread() {
88
+ throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
89
+ }
90
+
91
+ var hasOwnProperty = Object.hasOwnProperty,
92
+ setPrototypeOf = Object.setPrototypeOf,
93
+ isFrozen = Object.isFrozen,
94
+ getPrototypeOf = Object.getPrototypeOf,
95
+ getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
96
+ var freeze = Object.freeze,
97
+ seal = Object.seal,
98
+ create = Object.create; // eslint-disable-line import/no-mutable-exports
99
+
100
+ var _ref = typeof Reflect !== 'undefined' && Reflect,
101
+ apply = _ref.apply,
102
+ construct = _ref.construct;
103
+
104
+ if (!apply) {
105
+ apply = function apply(fun, thisValue, args) {
106
+ return fun.apply(thisValue, args);
107
+ };
108
+ }
109
+
110
+ if (!freeze) {
111
+ freeze = function freeze(x) {
112
+ return x;
113
+ };
114
+ }
115
+
116
+ if (!seal) {
117
+ seal = function seal(x) {
118
+ return x;
119
+ };
120
+ }
121
+
122
+ if (!construct) {
123
+ construct = function construct(Func, args) {
124
+ return _construct(Func, _toConsumableArray(args));
125
+ };
126
+ }
127
+
128
+ var arrayForEach = unapply(Array.prototype.forEach);
129
+ var arrayPop = unapply(Array.prototype.pop);
130
+ var arrayPush = unapply(Array.prototype.push);
131
+ var stringToLowerCase = unapply(String.prototype.toLowerCase);
132
+ var stringMatch = unapply(String.prototype.match);
133
+ var stringReplace = unapply(String.prototype.replace);
134
+ var stringIndexOf = unapply(String.prototype.indexOf);
135
+ var stringTrim = unapply(String.prototype.trim);
136
+ var regExpTest = unapply(RegExp.prototype.test);
137
+ var typeErrorCreate = unconstruct(TypeError);
138
+ function unapply(func) {
139
+ return function (thisArg) {
140
+ for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
141
+ args[_key - 1] = arguments[_key];
142
+ }
143
+
144
+ return apply(func, thisArg, args);
145
+ };
146
+ }
147
+ function unconstruct(func) {
148
+ return function () {
149
+ for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
150
+ args[_key2] = arguments[_key2];
151
+ }
152
+
153
+ return construct(func, args);
154
+ };
155
+ }
156
+ /* Add properties to a lookup table */
157
+
158
+ function addToSet(set, array) {
159
+ if (setPrototypeOf) {
160
+ // Make 'in' and truthy checks like Boolean(set.constructor)
161
+ // independent of any properties defined on Object.prototype.
162
+ // Prevent prototype setters from intercepting set as a this value.
163
+ setPrototypeOf(set, null);
164
+ }
165
+
166
+ var l = array.length;
167
+
168
+ while (l--) {
169
+ var element = array[l];
170
+
171
+ if (typeof element === 'string') {
172
+ var lcElement = stringToLowerCase(element);
173
+
174
+ if (lcElement !== element) {
175
+ // Config presets (e.g. tags.js, attrs.js) are immutable.
176
+ if (!isFrozen(array)) {
177
+ array[l] = lcElement;
178
+ }
179
+
180
+ element = lcElement;
181
+ }
182
+ }
183
+
184
+ set[element] = true;
185
+ }
186
+
187
+ return set;
188
+ }
189
+ /* Shallow clone an object */
190
+
191
+ function clone(object) {
192
+ var newObject = create(null);
193
+ var property;
194
+
195
+ for (property in object) {
196
+ if (apply(hasOwnProperty, object, [property])) {
197
+ newObject[property] = object[property];
198
+ }
199
+ }
200
+
201
+ return newObject;
202
+ }
203
+ /* IE10 doesn't support __lookupGetter__ so lets'
204
+ * simulate it. It also automatically checks
205
+ * if the prop is function or getter and behaves
206
+ * accordingly. */
207
+
208
+ function lookupGetter(object, prop) {
209
+ while (object !== null) {
210
+ var desc = getOwnPropertyDescriptor(object, prop);
211
+
212
+ if (desc) {
213
+ if (desc.get) {
214
+ return unapply(desc.get);
215
+ }
216
+
217
+ if (typeof desc.value === 'function') {
218
+ return unapply(desc.value);
219
+ }
220
+ }
221
+
222
+ object = getPrototypeOf(object);
223
+ }
224
+
225
+ function fallbackValue(element) {
226
+ console.warn('fallback value for', element);
227
+ return null;
228
+ }
229
+
230
+ return fallbackValue;
231
+ }
232
+
233
+ var html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); // SVG
234
+
235
+ var svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']);
236
+ var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); // List of SVG elements that are disallowed by default.
237
+ // We still need to know them so that we can do namespace
238
+ // checks properly in case one wants to add them to
239
+ // allow-list.
240
+
241
+ var svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'fedropshadow', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']);
242
+ var mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover']); // Similarly to SVG, we want to know all MathML elements,
243
+ // even those that we disallow by default.
244
+
245
+ var mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']);
246
+ var text = freeze(['#text']);
247
+
248
+ var html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']);
249
+ var svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']);
250
+ var mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']);
251
+ var xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']);
252
+
253
+ var MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
254
+
255
+ var ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
256
+ var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
257
+
258
+ var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
259
+
260
+ var IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape
261
+ );
262
+ var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
263
+ var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex
264
+ );
265
+ var DOCTYPE_NAME = seal(/^html$/i);
266
+
267
+ var getGlobal = function getGlobal() {
268
+ return typeof window === 'undefined' ? null : window;
269
+ };
270
+ /**
271
+ * Creates a no-op policy for internal use only.
272
+ * Don't export this function outside this module!
273
+ * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory.
274
+ * @param {Document} document The document object (to determine policy name suffix)
275
+ * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types
276
+ * are not supported).
277
+ */
278
+
279
+
280
+ var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, document) {
281
+ if (_typeof(trustedTypes) !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
282
+ return null;
283
+ } // Allow the callers to control the unique policy name
284
+ // by adding a data-tt-policy-suffix to the script element with the DOMPurify.
285
+ // Policy creation with duplicate names throws in Trusted Types.
286
+
287
+
288
+ var suffix = null;
289
+ var ATTR_NAME = 'data-tt-policy-suffix';
290
+
291
+ if (document.currentScript && document.currentScript.hasAttribute(ATTR_NAME)) {
292
+ suffix = document.currentScript.getAttribute(ATTR_NAME);
293
+ }
294
+
295
+ var policyName = 'dompurify' + (suffix ? '#' + suffix : '');
296
+
297
+ try {
298
+ return trustedTypes.createPolicy(policyName, {
299
+ createHTML: function createHTML(html) {
300
+ return html;
301
+ }
302
+ });
303
+ } catch (_) {
304
+ // Policy creation failed (most likely another DOMPurify script has
305
+ // already run). Skip creating the policy, as this will only cause errors
306
+ // if TT are enforced.
307
+ console.warn('TrustedTypes policy ' + policyName + ' could not be created.');
308
+ return null;
309
+ }
310
+ };
311
+
312
+ function createDOMPurify() {
313
+ var window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
314
+
315
+ var DOMPurify = function DOMPurify(root) {
316
+ return createDOMPurify(root);
317
+ };
318
+ /**
319
+ * Version label, exposed for easier checks
320
+ * if DOMPurify is up to date or not
321
+ */
322
+
323
+
324
+ DOMPurify.version = '2.3.8';
325
+ /**
326
+ * Array of elements that DOMPurify removed during sanitation.
327
+ * Empty if nothing was removed.
328
+ */
329
+
330
+ DOMPurify.removed = [];
331
+
332
+ if (!window || !window.document || window.document.nodeType !== 9) {
333
+ // Not running in a browser, provide a factory function
334
+ // so that you can pass your own Window
335
+ DOMPurify.isSupported = false;
336
+ return DOMPurify;
337
+ }
338
+
339
+ var originalDocument = window.document;
340
+ var document = window.document;
341
+ var DocumentFragment = window.DocumentFragment,
342
+ HTMLTemplateElement = window.HTMLTemplateElement,
343
+ Node = window.Node,
344
+ Element = window.Element,
345
+ NodeFilter = window.NodeFilter,
346
+ _window$NamedNodeMap = window.NamedNodeMap,
347
+ NamedNodeMap = _window$NamedNodeMap === void 0 ? window.NamedNodeMap || window.MozNamedAttrMap : _window$NamedNodeMap,
348
+ HTMLFormElement = window.HTMLFormElement,
349
+ DOMParser = window.DOMParser,
350
+ trustedTypes = window.trustedTypes;
351
+ var ElementPrototype = Element.prototype;
352
+ var cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
353
+ var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
354
+ var getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
355
+ var getParentNode = lookupGetter(ElementPrototype, 'parentNode'); // As per issue #47, the web-components registry is inherited by a
356
+ // new document created via createHTMLDocument. As per the spec
357
+ // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
358
+ // a new empty registry is used when creating a template contents owner
359
+ // document, so we use that as our parent document to ensure nothing
360
+ // is inherited.
361
+
362
+ if (typeof HTMLTemplateElement === 'function') {
363
+ var template = document.createElement('template');
364
+
365
+ if (template.content && template.content.ownerDocument) {
366
+ document = template.content.ownerDocument;
367
+ }
368
+ }
369
+
370
+ var trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, originalDocument);
371
+
372
+ var emptyHTML = trustedTypesPolicy ? trustedTypesPolicy.createHTML('') : '';
373
+ var _document = document,
374
+ implementation = _document.implementation,
375
+ createNodeIterator = _document.createNodeIterator,
376
+ createDocumentFragment = _document.createDocumentFragment,
377
+ getElementsByTagName = _document.getElementsByTagName;
378
+ var importNode = originalDocument.importNode;
379
+ var documentMode = {};
380
+
381
+ try {
382
+ documentMode = clone(document).documentMode ? document.documentMode : {};
383
+ } catch (_) {}
384
+
385
+ var hooks = {};
386
+ /**
387
+ * Expose whether this browser supports running the full DOMPurify.
388
+ */
389
+
390
+ DOMPurify.isSupported = typeof getParentNode === 'function' && implementation && typeof implementation.createHTMLDocument !== 'undefined' && documentMode !== 9;
391
+ var MUSTACHE_EXPR$1 = MUSTACHE_EXPR,
392
+ ERB_EXPR$1 = ERB_EXPR,
393
+ DATA_ATTR$1 = DATA_ATTR,
394
+ ARIA_ATTR$1 = ARIA_ATTR,
395
+ IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA,
396
+ ATTR_WHITESPACE$1 = ATTR_WHITESPACE;
397
+ var IS_ALLOWED_URI$1 = IS_ALLOWED_URI;
398
+ /**
399
+ * We consider the elements and attributes below to be safe. Ideally
400
+ * don't add any new ones but feel free to remove unwanted ones.
401
+ */
402
+
403
+ /* allowed element names */
404
+
405
+ var ALLOWED_TAGS = null;
406
+ var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray(html$1), _toConsumableArray(svg$1), _toConsumableArray(svgFilters), _toConsumableArray(mathMl$1), _toConsumableArray(text)));
407
+ /* Allowed attribute names */
408
+
409
+ var ALLOWED_ATTR = null;
410
+ var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(_toConsumableArray(html), _toConsumableArray(svg), _toConsumableArray(mathMl), _toConsumableArray(xml)));
411
+ /*
412
+ * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
413
+ * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
414
+ * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
415
+ * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
416
+ */
417
+
418
+ var CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, {
419
+ tagNameCheck: {
420
+ writable: true,
421
+ configurable: false,
422
+ enumerable: true,
423
+ value: null
424
+ },
425
+ attributeNameCheck: {
426
+ writable: true,
427
+ configurable: false,
428
+ enumerable: true,
429
+ value: null
430
+ },
431
+ allowCustomizedBuiltInElements: {
432
+ writable: true,
433
+ configurable: false,
434
+ enumerable: true,
435
+ value: false
436
+ }
437
+ }));
438
+ /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
439
+
440
+ var FORBID_TAGS = null;
441
+ /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
442
+
443
+ var FORBID_ATTR = null;
444
+ /* Decide if ARIA attributes are okay */
445
+
446
+ var ALLOW_ARIA_ATTR = true;
447
+ /* Decide if custom data attributes are okay */
448
+
449
+ var ALLOW_DATA_ATTR = true;
450
+ /* Decide if unknown protocols are okay */
451
+
452
+ var ALLOW_UNKNOWN_PROTOCOLS = false;
453
+ /* Output should be safe for common template engines.
454
+ * This means, DOMPurify removes data attributes, mustaches and ERB
455
+ */
456
+
457
+ var SAFE_FOR_TEMPLATES = false;
458
+ /* Decide if document with <html>... should be returned */
459
+
460
+ var WHOLE_DOCUMENT = false;
461
+ /* Track whether config is already set on this instance of DOMPurify. */
462
+
463
+ var SET_CONFIG = false;
464
+ /* Decide if all elements (e.g. style, script) must be children of
465
+ * document.body. By default, browsers might move them to document.head */
466
+
467
+ var FORCE_BODY = false;
468
+ /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html
469
+ * string (or a TrustedHTML object if Trusted Types are supported).
470
+ * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
471
+ */
472
+
473
+ var RETURN_DOM = false;
474
+ /* Decide if a DOM `DocumentFragment` should be returned, instead of a html
475
+ * string (or a TrustedHTML object if Trusted Types are supported) */
476
+
477
+ var RETURN_DOM_FRAGMENT = false;
478
+ /* Try to return a Trusted Type object instead of a string, return a string in
479
+ * case Trusted Types are not supported */
480
+
481
+ var RETURN_TRUSTED_TYPE = false;
482
+ /* Output should be free from DOM clobbering attacks? */
483
+
484
+ var SANITIZE_DOM = true;
485
+ /* Keep element content when removing element? */
486
+
487
+ var KEEP_CONTENT = true;
488
+ /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
489
+ * of importing it into a new Document and returning a sanitized copy */
490
+
491
+ var IN_PLACE = false;
492
+ /* Allow usage of profiles like html, svg and mathMl */
493
+
494
+ var USE_PROFILES = {};
495
+ /* Tags to ignore content of when KEEP_CONTENT is true */
496
+
497
+ var FORBID_CONTENTS = null;
498
+ var DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']);
499
+ /* Tags that are safe for data: URIs */
500
+
501
+ var DATA_URI_TAGS = null;
502
+ var DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']);
503
+ /* Attributes safe for values like "javascript:" */
504
+
505
+ var URI_SAFE_ATTRIBUTES = null;
506
+ var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']);
507
+ var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML';
508
+ var SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
509
+ var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
510
+ /* Document namespace */
511
+
512
+ var NAMESPACE = HTML_NAMESPACE;
513
+ var IS_EMPTY_INPUT = false;
514
+ /* Parsing of strict XHTML documents */
515
+
516
+ var PARSER_MEDIA_TYPE;
517
+ var SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html'];
518
+ var DEFAULT_PARSER_MEDIA_TYPE = 'text/html';
519
+ var transformCaseFunc;
520
+ /* Keep a reference to config to pass to hooks */
521
+
522
+ var CONFIG = null;
523
+ /* Ideally, do not touch anything below this line */
524
+
525
+ /* ______________________________________________ */
526
+
527
+ var formElement = document.createElement('form');
528
+
529
+ var isRegexOrFunction = function isRegexOrFunction(testValue) {
530
+ return testValue instanceof RegExp || testValue instanceof Function;
531
+ };
532
+ /**
533
+ * _parseConfig
534
+ *
535
+ * @param {Object} cfg optional config literal
536
+ */
537
+ // eslint-disable-next-line complexity
538
+
539
+
540
+ var _parseConfig = function _parseConfig(cfg) {
541
+ if (CONFIG && CONFIG === cfg) {
542
+ return;
543
+ }
544
+ /* Shield configuration object from tampering */
545
+
546
+
547
+ if (!cfg || _typeof(cfg) !== 'object') {
548
+ cfg = {};
549
+ }
550
+ /* Shield configuration object from prototype pollution */
551
+
552
+
553
+ cfg = clone(cfg);
554
+ /* Set configuration parameters */
555
+
556
+ ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS) : DEFAULT_ALLOWED_TAGS;
557
+ ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR) : DEFAULT_ALLOWED_ATTR;
558
+ URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR) : DEFAULT_URI_SAFE_ATTRIBUTES;
559
+ DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS) : DEFAULT_DATA_URI_TAGS;
560
+ FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS) : DEFAULT_FORBID_CONTENTS;
561
+ FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS) : {};
562
+ FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR) : {};
563
+ USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false;
564
+ ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true
565
+
566
+ ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
567
+
568
+ ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
569
+
570
+ SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
571
+
572
+ WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
573
+
574
+ RETURN_DOM = cfg.RETURN_DOM || false; // Default false
575
+
576
+ RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
577
+
578
+ RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false
579
+
580
+ FORCE_BODY = cfg.FORCE_BODY || false; // Default false
581
+
582
+ SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
583
+
584
+ KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
585
+
586
+ IN_PLACE = cfg.IN_PLACE || false; // Default false
587
+
588
+ IS_ALLOWED_URI$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$1;
589
+ NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
590
+
591
+ if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) {
592
+ CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck;
593
+ }
594
+
595
+ if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) {
596
+ CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck;
597
+ }
598
+
599
+ if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') {
600
+ CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements;
601
+ }
602
+
603
+ PARSER_MEDIA_TYPE = // eslint-disable-next-line unicorn/prefer-includes
604
+ SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
605
+
606
+ transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? function (x) {
607
+ return x;
608
+ } : stringToLowerCase;
609
+
610
+ if (SAFE_FOR_TEMPLATES) {
611
+ ALLOW_DATA_ATTR = false;
612
+ }
613
+
614
+ if (RETURN_DOM_FRAGMENT) {
615
+ RETURN_DOM = true;
616
+ }
617
+ /* Parse profile info */
618
+
619
+
620
+ if (USE_PROFILES) {
621
+ ALLOWED_TAGS = addToSet({}, _toConsumableArray(text));
622
+ ALLOWED_ATTR = [];
623
+
624
+ if (USE_PROFILES.html === true) {
625
+ addToSet(ALLOWED_TAGS, html$1);
626
+ addToSet(ALLOWED_ATTR, html);
627
+ }
628
+
629
+ if (USE_PROFILES.svg === true) {
630
+ addToSet(ALLOWED_TAGS, svg$1);
631
+ addToSet(ALLOWED_ATTR, svg);
632
+ addToSet(ALLOWED_ATTR, xml);
633
+ }
634
+
635
+ if (USE_PROFILES.svgFilters === true) {
636
+ addToSet(ALLOWED_TAGS, svgFilters);
637
+ addToSet(ALLOWED_ATTR, svg);
638
+ addToSet(ALLOWED_ATTR, xml);
639
+ }
640
+
641
+ if (USE_PROFILES.mathMl === true) {
642
+ addToSet(ALLOWED_TAGS, mathMl$1);
643
+ addToSet(ALLOWED_ATTR, mathMl);
644
+ addToSet(ALLOWED_ATTR, xml);
645
+ }
646
+ }
647
+ /* Merge configuration parameters */
648
+
649
+
650
+ if (cfg.ADD_TAGS) {
651
+ if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
652
+ ALLOWED_TAGS = clone(ALLOWED_TAGS);
653
+ }
654
+
655
+ addToSet(ALLOWED_TAGS, cfg.ADD_TAGS);
656
+ }
657
+
658
+ if (cfg.ADD_ATTR) {
659
+ if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
660
+ ALLOWED_ATTR = clone(ALLOWED_ATTR);
661
+ }
662
+
663
+ addToSet(ALLOWED_ATTR, cfg.ADD_ATTR);
664
+ }
665
+
666
+ if (cfg.ADD_URI_SAFE_ATTR) {
667
+ addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR);
668
+ }
669
+
670
+ if (cfg.FORBID_CONTENTS) {
671
+ if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) {
672
+ FORBID_CONTENTS = clone(FORBID_CONTENTS);
673
+ }
674
+
675
+ addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS);
676
+ }
677
+ /* Add #text in case KEEP_CONTENT is set to true */
678
+
679
+
680
+ if (KEEP_CONTENT) {
681
+ ALLOWED_TAGS['#text'] = true;
682
+ }
683
+ /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */
684
+
685
+
686
+ if (WHOLE_DOCUMENT) {
687
+ addToSet(ALLOWED_TAGS, ['html', 'head', 'body']);
688
+ }
689
+ /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */
690
+
691
+
692
+ if (ALLOWED_TAGS.table) {
693
+ addToSet(ALLOWED_TAGS, ['tbody']);
694
+ delete FORBID_TAGS.tbody;
695
+ } // Prevent further manipulation of configuration.
696
+ // Not available in IE8, Safari 5, etc.
697
+
698
+
699
+ if (freeze) {
700
+ freeze(cfg);
701
+ }
702
+
703
+ CONFIG = cfg;
704
+ };
705
+
706
+ var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
707
+ var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); // Certain elements are allowed in both SVG and HTML
708
+ // namespace. We need to specify them explicitly
709
+ // so that they don't get erroneously deleted from
710
+ // HTML namespace.
711
+
712
+ var COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, ['title', 'style', 'font', 'a', 'script']);
713
+ /* Keep track of all possible SVG and MathML tags
714
+ * so that we can perform the namespace checks
715
+ * correctly. */
716
+
717
+ var ALL_SVG_TAGS = addToSet({}, svg$1);
718
+ addToSet(ALL_SVG_TAGS, svgFilters);
719
+ addToSet(ALL_SVG_TAGS, svgDisallowed);
720
+ var ALL_MATHML_TAGS = addToSet({}, mathMl$1);
721
+ addToSet(ALL_MATHML_TAGS, mathMlDisallowed);
722
+ /**
723
+ *
724
+ *
725
+ * @param {Element} element a DOM element whose namespace is being checked
726
+ * @returns {boolean} Return false if the element has a
727
+ * namespace that a spec-compliant parser would never
728
+ * return. Return true otherwise.
729
+ */
730
+
731
+ var _checkValidNamespace = function _checkValidNamespace(element) {
732
+ var parent = getParentNode(element); // In JSDOM, if we're inside shadow DOM, then parentNode
733
+ // can be null. We just simulate parent in this case.
734
+
735
+ if (!parent || !parent.tagName) {
736
+ parent = {
737
+ namespaceURI: HTML_NAMESPACE,
738
+ tagName: 'template'
739
+ };
740
+ }
741
+
742
+ var tagName = stringToLowerCase(element.tagName);
743
+ var parentTagName = stringToLowerCase(parent.tagName);
744
+
745
+ if (element.namespaceURI === SVG_NAMESPACE) {
746
+ // The only way to switch from HTML namespace to SVG
747
+ // is via <svg>. If it happens via any other tag, then
748
+ // it should be killed.
749
+ if (parent.namespaceURI === HTML_NAMESPACE) {
750
+ return tagName === 'svg';
751
+ } // The only way to switch from MathML to SVG is via
752
+ // svg if parent is either <annotation-xml> or MathML
753
+ // text integration points.
754
+
755
+
756
+ if (parent.namespaceURI === MATHML_NAMESPACE) {
757
+ return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
758
+ } // We only allow elements that are defined in SVG
759
+ // spec. All others are disallowed in SVG namespace.
760
+
761
+
762
+ return Boolean(ALL_SVG_TAGS[tagName]);
763
+ }
764
+
765
+ if (element.namespaceURI === MATHML_NAMESPACE) {
766
+ // The only way to switch from HTML namespace to MathML
767
+ // is via <math>. If it happens via any other tag, then
768
+ // it should be killed.
769
+ if (parent.namespaceURI === HTML_NAMESPACE) {
770
+ return tagName === 'math';
771
+ } // The only way to switch from SVG to MathML is via
772
+ // <math> and HTML integration points
773
+
774
+
775
+ if (parent.namespaceURI === SVG_NAMESPACE) {
776
+ return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
777
+ } // We only allow elements that are defined in MathML
778
+ // spec. All others are disallowed in MathML namespace.
779
+
780
+
781
+ return Boolean(ALL_MATHML_TAGS[tagName]);
782
+ }
783
+
784
+ if (element.namespaceURI === HTML_NAMESPACE) {
785
+ // The only way to switch from SVG to HTML is via
786
+ // HTML integration points, and from MathML to HTML
787
+ // is via MathML text integration points
788
+ if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) {
789
+ return false;
790
+ }
791
+
792
+ if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) {
793
+ return false;
794
+ } // We disallow tags that are specific for MathML
795
+ // or SVG and should never appear in HTML namespace
796
+
797
+
798
+ return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
799
+ } // The code should never reach this place (this means
800
+ // that the element somehow got namespace that is not
801
+ // HTML, SVG or MathML). Return false just in case.
802
+
803
+
804
+ return false;
805
+ };
806
+ /**
807
+ * _forceRemove
808
+ *
809
+ * @param {Node} node a DOM node
810
+ */
811
+
812
+
813
+ var _forceRemove = function _forceRemove(node) {
814
+ arrayPush(DOMPurify.removed, {
815
+ element: node
816
+ });
817
+
818
+ try {
819
+ // eslint-disable-next-line unicorn/prefer-dom-node-remove
820
+ node.parentNode.removeChild(node);
821
+ } catch (_) {
822
+ try {
823
+ node.outerHTML = emptyHTML;
824
+ } catch (_) {
825
+ node.remove();
826
+ }
827
+ }
828
+ };
829
+ /**
830
+ * _removeAttribute
831
+ *
832
+ * @param {String} name an Attribute name
833
+ * @param {Node} node a DOM node
834
+ */
835
+
836
+
837
+ var _removeAttribute = function _removeAttribute(name, node) {
838
+ try {
839
+ arrayPush(DOMPurify.removed, {
840
+ attribute: node.getAttributeNode(name),
841
+ from: node
842
+ });
843
+ } catch (_) {
844
+ arrayPush(DOMPurify.removed, {
845
+ attribute: null,
846
+ from: node
847
+ });
848
+ }
849
+
850
+ node.removeAttribute(name); // We void attribute values for unremovable "is"" attributes
851
+
852
+ if (name === 'is' && !ALLOWED_ATTR[name]) {
853
+ if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
854
+ try {
855
+ _forceRemove(node);
856
+ } catch (_) {}
857
+ } else {
858
+ try {
859
+ node.setAttribute(name, '');
860
+ } catch (_) {}
861
+ }
862
+ }
863
+ };
864
+ /**
865
+ * _initDocument
866
+ *
867
+ * @param {String} dirty a string of dirty markup
868
+ * @return {Document} a DOM, filled with the dirty markup
869
+ */
870
+
871
+
872
+ var _initDocument = function _initDocument(dirty) {
873
+ /* Create a HTML document */
874
+ var doc;
875
+ var leadingWhitespace;
876
+
877
+ if (FORCE_BODY) {
878
+ dirty = '<remove></remove>' + dirty;
879
+ } else {
880
+ /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */
881
+ var matches = stringMatch(dirty, /^[\r\n\t ]+/);
882
+ leadingWhitespace = matches && matches[0];
883
+ }
884
+
885
+ if (PARSER_MEDIA_TYPE === 'application/xhtml+xml') {
886
+ // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)
887
+ dirty = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + dirty + '</body></html>';
888
+ }
889
+
890
+ var dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty;
891
+ /*
892
+ * Use the DOMParser API by default, fallback later if needs be
893
+ * DOMParser not work for svg when has multiple root element.
894
+ */
895
+
896
+ if (NAMESPACE === HTML_NAMESPACE) {
897
+ try {
898
+ doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);
899
+ } catch (_) {}
900
+ }
901
+ /* Use createHTMLDocument in case DOMParser is not available */
902
+
903
+
904
+ if (!doc || !doc.documentElement) {
905
+ doc = implementation.createDocument(NAMESPACE, 'template', null);
906
+
907
+ try {
908
+ doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload;
909
+ } catch (_) {// Syntax error if dirtyPayload is invalid xml
910
+ }
911
+ }
912
+
913
+ var body = doc.body || doc.documentElement;
914
+
915
+ if (dirty && leadingWhitespace) {
916
+ body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null);
917
+ }
918
+ /* Work on whole document or just its body */
919
+
920
+
921
+ if (NAMESPACE === HTML_NAMESPACE) {
922
+ return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0];
923
+ }
924
+
925
+ return WHOLE_DOCUMENT ? doc.documentElement : body;
926
+ };
927
+ /**
928
+ * _createIterator
929
+ *
930
+ * @param {Document} root document/fragment to create iterator for
931
+ * @return {Iterator} iterator instance
932
+ */
933
+
934
+
935
+ var _createIterator = function _createIterator(root) {
936
+ return createNodeIterator.call(root.ownerDocument || root, root, // eslint-disable-next-line no-bitwise
937
+ NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false);
938
+ };
939
+ /**
940
+ * _isClobbered
941
+ *
942
+ * @param {Node} elm element to check for clobbering attacks
943
+ * @return {Boolean} true if clobbered, false if safe
944
+ */
945
+
946
+
947
+ var _isClobbered = function _isClobbered(elm) {
948
+ return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function');
949
+ };
950
+ /**
951
+ * _isNode
952
+ *
953
+ * @param {Node} obj object to check whether it's a DOM node
954
+ * @return {Boolean} true is object is a DOM node
955
+ */
956
+
957
+
958
+ var _isNode = function _isNode(object) {
959
+ return _typeof(Node) === 'object' ? object instanceof Node : object && _typeof(object) === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string';
960
+ };
961
+ /**
962
+ * _executeHook
963
+ * Execute user configurable hooks
964
+ *
965
+ * @param {String} entryPoint Name of the hook's entry point
966
+ * @param {Node} currentNode node to work on with the hook
967
+ * @param {Object} data additional hook parameters
968
+ */
969
+
970
+
971
+ var _executeHook = function _executeHook(entryPoint, currentNode, data) {
972
+ if (!hooks[entryPoint]) {
973
+ return;
974
+ }
975
+
976
+ arrayForEach(hooks[entryPoint], function (hook) {
977
+ hook.call(DOMPurify, currentNode, data, CONFIG);
978
+ });
979
+ };
980
+ /**
981
+ * _sanitizeElements
982
+ *
983
+ * @protect nodeName
984
+ * @protect textContent
985
+ * @protect removeChild
986
+ *
987
+ * @param {Node} currentNode to check for permission to exist
988
+ * @return {Boolean} true if node was killed, false if left alive
989
+ */
990
+
991
+
992
+ var _sanitizeElements = function _sanitizeElements(currentNode) {
993
+ var content;
994
+ /* Execute a hook if present */
995
+
996
+ _executeHook('beforeSanitizeElements', currentNode, null);
997
+ /* Check if element is clobbered or can clobber */
998
+
999
+
1000
+ if (_isClobbered(currentNode)) {
1001
+ _forceRemove(currentNode);
1002
+
1003
+ return true;
1004
+ }
1005
+ /* Check if tagname contains Unicode */
1006
+
1007
+
1008
+ if (regExpTest(/[\u0080-\uFFFF]/, currentNode.nodeName)) {
1009
+ _forceRemove(currentNode);
1010
+
1011
+ return true;
1012
+ }
1013
+ /* Now let's check the element's type and name */
1014
+
1015
+
1016
+ var tagName = transformCaseFunc(currentNode.nodeName);
1017
+ /* Execute a hook if present */
1018
+
1019
+ _executeHook('uponSanitizeElement', currentNode, {
1020
+ tagName: tagName,
1021
+ allowedTags: ALLOWED_TAGS
1022
+ });
1023
+ /* Detect mXSS attempts abusing namespace confusion */
1024
+
1025
+
1026
+ if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
1027
+ _forceRemove(currentNode);
1028
+
1029
+ return true;
1030
+ }
1031
+ /* Mitigate a problem with templates inside select */
1032
+
1033
+
1034
+ if (tagName === 'select' && regExpTest(/<template/i, currentNode.innerHTML)) {
1035
+ _forceRemove(currentNode);
1036
+
1037
+ return true;
1038
+ }
1039
+ /* Remove element if anything forbids its presence */
1040
+
1041
+
1042
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1043
+ /* Check if we have a custom element to handle */
1044
+ if (!FORBID_TAGS[tagName] && _basicCustomElementTest(tagName)) {
1045
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
1046
+ if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
1047
+ }
1048
+ /* Keep content except for bad-listed elements */
1049
+
1050
+
1051
+ if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
1052
+ var parentNode = getParentNode(currentNode) || currentNode.parentNode;
1053
+ var childNodes = getChildNodes(currentNode) || currentNode.childNodes;
1054
+
1055
+ if (childNodes && parentNode) {
1056
+ var childCount = childNodes.length;
1057
+
1058
+ for (var i = childCount - 1; i >= 0; --i) {
1059
+ parentNode.insertBefore(cloneNode(childNodes[i], true), getNextSibling(currentNode));
1060
+ }
1061
+ }
1062
+ }
1063
+
1064
+ _forceRemove(currentNode);
1065
+
1066
+ return true;
1067
+ }
1068
+ /* Check whether element has a valid namespace */
1069
+
1070
+
1071
+ if (currentNode instanceof Element && !_checkValidNamespace(currentNode)) {
1072
+ _forceRemove(currentNode);
1073
+
1074
+ return true;
1075
+ }
1076
+
1077
+ if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
1078
+ _forceRemove(currentNode);
1079
+
1080
+ return true;
1081
+ }
1082
+ /* Sanitize element content to be template-safe */
1083
+
1084
+
1085
+ if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
1086
+ /* Get the element's text content */
1087
+ content = currentNode.textContent;
1088
+ content = stringReplace(content, MUSTACHE_EXPR$1, ' ');
1089
+ content = stringReplace(content, ERB_EXPR$1, ' ');
1090
+
1091
+ if (currentNode.textContent !== content) {
1092
+ arrayPush(DOMPurify.removed, {
1093
+ element: currentNode.cloneNode()
1094
+ });
1095
+ currentNode.textContent = content;
1096
+ }
1097
+ }
1098
+ /* Execute a hook if present */
1099
+
1100
+
1101
+ _executeHook('afterSanitizeElements', currentNode, null);
1102
+
1103
+ return false;
1104
+ };
1105
+ /**
1106
+ * _isValidAttribute
1107
+ *
1108
+ * @param {string} lcTag Lowercase tag name of containing element.
1109
+ * @param {string} lcName Lowercase attribute name.
1110
+ * @param {string} value Attribute value.
1111
+ * @return {Boolean} Returns true if `value` is valid, otherwise false.
1112
+ */
1113
+ // eslint-disable-next-line complexity
1114
+
1115
+
1116
+ var _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
1117
+ /* Make sure attribute cannot clobber */
1118
+ if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
1119
+ return false;
1120
+ }
1121
+ /* Allow valid data-* attributes: At least one character after "-"
1122
+ (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
1123
+ XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
1124
+ We don't need to check the value; it's always URI safe. */
1125
+
1126
+
1127
+ if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName)) ; else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) ; else if (!ALLOWED_ATTR[lcName] || FORBID_ATTR[lcName]) {
1128
+ if ( // First condition does a very basic check if a) it's basically a valid custom element tagname AND
1129
+ // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1130
+ // and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck
1131
+ _basicCustomElementTest(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName)) || // Alternative, second condition checks if it's an `is`-attribute, AND
1132
+ // the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
1133
+ lcName === 'is' && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value))) ; else {
1134
+ return false;
1135
+ }
1136
+ /* Check value is safe. First, is attr inert? If so, is safe */
1137
+
1138
+ } else if (URI_SAFE_ATTRIBUTES[lcName]) ; else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if ((lcName === 'src' || lcName === 'xlink:href' || lcName === 'href') && lcTag !== 'script' && stringIndexOf(value, 'data:') === 0 && DATA_URI_TAGS[lcTag]) ; else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ''))) ; else if (!value) ; else {
1139
+ return false;
1140
+ }
1141
+
1142
+ return true;
1143
+ };
1144
+ /**
1145
+ * _basicCustomElementCheck
1146
+ * checks if at least one dash is included in tagName, and it's not the first char
1147
+ * for more sophisticated checking see https://github.com/sindresorhus/validate-element-name
1148
+ * @param {string} tagName name of the tag of the node to sanitize
1149
+ */
1150
+
1151
+
1152
+ var _basicCustomElementTest = function _basicCustomElementTest(tagName) {
1153
+ return tagName.indexOf('-') > 0;
1154
+ };
1155
+ /**
1156
+ * _sanitizeAttributes
1157
+ *
1158
+ * @protect attributes
1159
+ * @protect nodeName
1160
+ * @protect removeAttribute
1161
+ * @protect setAttribute
1162
+ *
1163
+ * @param {Node} currentNode to sanitize
1164
+ */
1165
+
1166
+
1167
+ var _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
1168
+ var attr;
1169
+ var value;
1170
+ var lcName;
1171
+ var l;
1172
+ /* Execute a hook if present */
1173
+
1174
+ _executeHook('beforeSanitizeAttributes', currentNode, null);
1175
+
1176
+ var attributes = currentNode.attributes;
1177
+ /* Check if we have attributes; if not we might have a text node */
1178
+
1179
+ if (!attributes) {
1180
+ return;
1181
+ }
1182
+
1183
+ var hookEvent = {
1184
+ attrName: '',
1185
+ attrValue: '',
1186
+ keepAttr: true,
1187
+ allowedAttributes: ALLOWED_ATTR
1188
+ };
1189
+ l = attributes.length;
1190
+ /* Go backwards over all attributes; safely remove bad ones */
1191
+
1192
+ while (l--) {
1193
+ attr = attributes[l];
1194
+ var _attr = attr,
1195
+ name = _attr.name,
1196
+ namespaceURI = _attr.namespaceURI;
1197
+ value = name === 'value' ? attr.value : stringTrim(attr.value);
1198
+ lcName = transformCaseFunc(name);
1199
+ /* Execute a hook if present */
1200
+
1201
+ hookEvent.attrName = lcName;
1202
+ hookEvent.attrValue = value;
1203
+ hookEvent.keepAttr = true;
1204
+ hookEvent.forceKeepAttr = undefined; // Allows developers to see this is a property they can set
1205
+
1206
+ _executeHook('uponSanitizeAttribute', currentNode, hookEvent);
1207
+
1208
+ value = hookEvent.attrValue;
1209
+ /* Did the hooks approve of the attribute? */
1210
+
1211
+ if (hookEvent.forceKeepAttr) {
1212
+ continue;
1213
+ }
1214
+ /* Remove attribute */
1215
+
1216
+
1217
+ _removeAttribute(name, currentNode);
1218
+ /* Did the hooks approve of the attribute? */
1219
+
1220
+
1221
+ if (!hookEvent.keepAttr) {
1222
+ continue;
1223
+ }
1224
+ /* Work around a security issue in jQuery 3.0 */
1225
+
1226
+
1227
+ if (regExpTest(/\/>/i, value)) {
1228
+ _removeAttribute(name, currentNode);
1229
+
1230
+ continue;
1231
+ }
1232
+ /* Sanitize attribute content to be template-safe */
1233
+
1234
+
1235
+ if (SAFE_FOR_TEMPLATES) {
1236
+ value = stringReplace(value, MUSTACHE_EXPR$1, ' ');
1237
+ value = stringReplace(value, ERB_EXPR$1, ' ');
1238
+ }
1239
+ /* Is `value` valid for this attribute? */
1240
+
1241
+
1242
+ var lcTag = transformCaseFunc(currentNode.nodeName);
1243
+
1244
+ if (!_isValidAttribute(lcTag, lcName, value)) {
1245
+ continue;
1246
+ }
1247
+ /* Handle invalid data-* attribute set by try-catching it */
1248
+
1249
+
1250
+ try {
1251
+ if (namespaceURI) {
1252
+ currentNode.setAttributeNS(namespaceURI, name, value);
1253
+ } else {
1254
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
1255
+ currentNode.setAttribute(name, value);
1256
+ }
1257
+
1258
+ arrayPop(DOMPurify.removed);
1259
+ } catch (_) {}
1260
+ }
1261
+ /* Execute a hook if present */
1262
+
1263
+
1264
+ _executeHook('afterSanitizeAttributes', currentNode, null);
1265
+ };
1266
+ /**
1267
+ * _sanitizeShadowDOM
1268
+ *
1269
+ * @param {DocumentFragment} fragment to iterate over recursively
1270
+ */
1271
+
1272
+
1273
+ var _sanitizeShadowDOM = function _sanitizeShadowDOM(fragment) {
1274
+ var shadowNode;
1275
+
1276
+ var shadowIterator = _createIterator(fragment);
1277
+ /* Execute a hook if present */
1278
+
1279
+
1280
+ _executeHook('beforeSanitizeShadowDOM', fragment, null);
1281
+
1282
+ while (shadowNode = shadowIterator.nextNode()) {
1283
+ /* Execute a hook if present */
1284
+ _executeHook('uponSanitizeShadowNode', shadowNode, null);
1285
+ /* Sanitize tags and elements */
1286
+
1287
+
1288
+ if (_sanitizeElements(shadowNode)) {
1289
+ continue;
1290
+ }
1291
+ /* Deep shadow DOM detected */
1292
+
1293
+
1294
+ if (shadowNode.content instanceof DocumentFragment) {
1295
+ _sanitizeShadowDOM(shadowNode.content);
1296
+ }
1297
+ /* Check attributes, sanitize if necessary */
1298
+
1299
+
1300
+ _sanitizeAttributes(shadowNode);
1301
+ }
1302
+ /* Execute a hook if present */
1303
+
1304
+
1305
+ _executeHook('afterSanitizeShadowDOM', fragment, null);
1306
+ };
1307
+ /**
1308
+ * Sanitize
1309
+ * Public method providing core sanitation functionality
1310
+ *
1311
+ * @param {String|Node} dirty string or DOM node
1312
+ * @param {Object} configuration object
1313
+ */
1314
+ // eslint-disable-next-line complexity
1315
+
1316
+
1317
+ DOMPurify.sanitize = function (dirty, cfg) {
1318
+ var body;
1319
+ var importedNode;
1320
+ var currentNode;
1321
+ var oldNode;
1322
+ var returnNode;
1323
+ /* Make sure we have a string to sanitize.
1324
+ DO NOT return early, as this will return the wrong type if
1325
+ the user has requested a DOM object rather than a string */
1326
+
1327
+ IS_EMPTY_INPUT = !dirty;
1328
+
1329
+ if (IS_EMPTY_INPUT) {
1330
+ dirty = '<!-->';
1331
+ }
1332
+ /* Stringify, in case dirty is an object */
1333
+
1334
+
1335
+ if (typeof dirty !== 'string' && !_isNode(dirty)) {
1336
+ // eslint-disable-next-line no-negated-condition
1337
+ if (typeof dirty.toString !== 'function') {
1338
+ throw typeErrorCreate('toString is not a function');
1339
+ } else {
1340
+ dirty = dirty.toString();
1341
+
1342
+ if (typeof dirty !== 'string') {
1343
+ throw typeErrorCreate('dirty is not a string, aborting');
1344
+ }
1345
+ }
1346
+ }
1347
+ /* Check we can run. Otherwise fall back or ignore */
1348
+
1349
+
1350
+ if (!DOMPurify.isSupported) {
1351
+ if (_typeof(window.toStaticHTML) === 'object' || typeof window.toStaticHTML === 'function') {
1352
+ if (typeof dirty === 'string') {
1353
+ return window.toStaticHTML(dirty);
1354
+ }
1355
+
1356
+ if (_isNode(dirty)) {
1357
+ return window.toStaticHTML(dirty.outerHTML);
1358
+ }
1359
+ }
1360
+
1361
+ return dirty;
1362
+ }
1363
+ /* Assign config vars */
1364
+
1365
+
1366
+ if (!SET_CONFIG) {
1367
+ _parseConfig(cfg);
1368
+ }
1369
+ /* Clean up removed elements */
1370
+
1371
+
1372
+ DOMPurify.removed = [];
1373
+ /* Check if dirty is correctly typed for IN_PLACE */
1374
+
1375
+ if (typeof dirty === 'string') {
1376
+ IN_PLACE = false;
1377
+ }
1378
+
1379
+ if (IN_PLACE) {
1380
+ /* Do some early pre-sanitization to avoid unsafe root nodes */
1381
+ if (dirty.nodeName) {
1382
+ var tagName = transformCaseFunc(dirty.nodeName);
1383
+
1384
+ if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
1385
+ throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');
1386
+ }
1387
+ }
1388
+ } else if (dirty instanceof Node) {
1389
+ /* If dirty is a DOM element, append to an empty document to avoid
1390
+ elements being stripped by the parser */
1391
+ body = _initDocument('<!---->');
1392
+ importedNode = body.ownerDocument.importNode(dirty, true);
1393
+
1394
+ if (importedNode.nodeType === 1 && importedNode.nodeName === 'BODY') {
1395
+ /* Node is already a body, use as is */
1396
+ body = importedNode;
1397
+ } else if (importedNode.nodeName === 'HTML') {
1398
+ body = importedNode;
1399
+ } else {
1400
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
1401
+ body.appendChild(importedNode);
1402
+ }
1403
+ } else {
1404
+ /* Exit directly if we have nothing to do */
1405
+ if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && // eslint-disable-next-line unicorn/prefer-includes
1406
+ dirty.indexOf('<') === -1) {
1407
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(dirty) : dirty;
1408
+ }
1409
+ /* Initialize the document to work on */
1410
+
1411
+
1412
+ body = _initDocument(dirty);
1413
+ /* Check we have a DOM node from the data */
1414
+
1415
+ if (!body) {
1416
+ return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : '';
1417
+ }
1418
+ }
1419
+ /* Remove first element node (ours) if FORCE_BODY is set */
1420
+
1421
+
1422
+ if (body && FORCE_BODY) {
1423
+ _forceRemove(body.firstChild);
1424
+ }
1425
+ /* Get node iterator */
1426
+
1427
+
1428
+ var nodeIterator = _createIterator(IN_PLACE ? dirty : body);
1429
+ /* Now start iterating over the created document */
1430
+
1431
+
1432
+ while (currentNode = nodeIterator.nextNode()) {
1433
+ /* Fix IE's strange behavior with manipulated textNodes #89 */
1434
+ if (currentNode.nodeType === 3 && currentNode === oldNode) {
1435
+ continue;
1436
+ }
1437
+ /* Sanitize tags and elements */
1438
+
1439
+
1440
+ if (_sanitizeElements(currentNode)) {
1441
+ continue;
1442
+ }
1443
+ /* Shadow DOM detected, sanitize it */
1444
+
1445
+
1446
+ if (currentNode.content instanceof DocumentFragment) {
1447
+ _sanitizeShadowDOM(currentNode.content);
1448
+ }
1449
+ /* Check attributes, sanitize if necessary */
1450
+
1451
+
1452
+ _sanitizeAttributes(currentNode);
1453
+
1454
+ oldNode = currentNode;
1455
+ }
1456
+
1457
+ oldNode = null;
1458
+ /* If we sanitized `dirty` in-place, return it. */
1459
+
1460
+ if (IN_PLACE) {
1461
+ return dirty;
1462
+ }
1463
+ /* Return sanitized string or DOM */
1464
+
1465
+
1466
+ if (RETURN_DOM) {
1467
+ if (RETURN_DOM_FRAGMENT) {
1468
+ returnNode = createDocumentFragment.call(body.ownerDocument);
1469
+
1470
+ while (body.firstChild) {
1471
+ // eslint-disable-next-line unicorn/prefer-dom-node-append
1472
+ returnNode.appendChild(body.firstChild);
1473
+ }
1474
+ } else {
1475
+ returnNode = body;
1476
+ }
1477
+
1478
+ if (ALLOWED_ATTR.shadowroot) {
1479
+ /*
1480
+ AdoptNode() is not used because internal state is not reset
1481
+ (e.g. the past names map of a HTMLFormElement), this is safe
1482
+ in theory but we would rather not risk another attack vector.
1483
+ The state that is cloned by importNode() is explicitly defined
1484
+ by the specs.
1485
+ */
1486
+ returnNode = importNode.call(originalDocument, returnNode, true);
1487
+ }
1488
+
1489
+ return returnNode;
1490
+ }
1491
+
1492
+ var serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
1493
+ /* Serialize doctype if allowed */
1494
+
1495
+ if (WHOLE_DOCUMENT && ALLOWED_TAGS['!doctype'] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) {
1496
+ serializedHTML = '<!DOCTYPE ' + body.ownerDocument.doctype.name + '>\n' + serializedHTML;
1497
+ }
1498
+ /* Sanitize final string template-safe */
1499
+
1500
+
1501
+ if (SAFE_FOR_TEMPLATES) {
1502
+ serializedHTML = stringReplace(serializedHTML, MUSTACHE_EXPR$1, ' ');
1503
+ serializedHTML = stringReplace(serializedHTML, ERB_EXPR$1, ' ');
1504
+ }
1505
+
1506
+ return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? trustedTypesPolicy.createHTML(serializedHTML) : serializedHTML;
1507
+ };
1508
+ /**
1509
+ * Public method to set the configuration once
1510
+ * setConfig
1511
+ *
1512
+ * @param {Object} cfg configuration object
1513
+ */
1514
+
1515
+
1516
+ DOMPurify.setConfig = function (cfg) {
1517
+ _parseConfig(cfg);
1518
+
1519
+ SET_CONFIG = true;
1520
+ };
1521
+ /**
1522
+ * Public method to remove the configuration
1523
+ * clearConfig
1524
+ *
1525
+ */
1526
+
1527
+
1528
+ DOMPurify.clearConfig = function () {
1529
+ CONFIG = null;
1530
+ SET_CONFIG = false;
1531
+ };
1532
+ /**
1533
+ * Public method to check if an attribute value is valid.
1534
+ * Uses last set config, if any. Otherwise, uses config defaults.
1535
+ * isValidAttribute
1536
+ *
1537
+ * @param {string} tag Tag name of containing element.
1538
+ * @param {string} attr Attribute name.
1539
+ * @param {string} value Attribute value.
1540
+ * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
1541
+ */
1542
+
1543
+
1544
+ DOMPurify.isValidAttribute = function (tag, attr, value) {
1545
+ /* Initialize shared config vars if necessary. */
1546
+ if (!CONFIG) {
1547
+ _parseConfig({});
1548
+ }
1549
+
1550
+ var lcTag = transformCaseFunc(tag);
1551
+ var lcName = transformCaseFunc(attr);
1552
+ return _isValidAttribute(lcTag, lcName, value);
1553
+ };
1554
+ /**
1555
+ * AddHook
1556
+ * Public method to add DOMPurify hooks
1557
+ *
1558
+ * @param {String} entryPoint entry point for the hook to add
1559
+ * @param {Function} hookFunction function to execute
1560
+ */
1561
+
1562
+
1563
+ DOMPurify.addHook = function (entryPoint, hookFunction) {
1564
+ if (typeof hookFunction !== 'function') {
1565
+ return;
1566
+ }
1567
+
1568
+ hooks[entryPoint] = hooks[entryPoint] || [];
1569
+ arrayPush(hooks[entryPoint], hookFunction);
1570
+ };
1571
+ /**
1572
+ * RemoveHook
1573
+ * Public method to remove a DOMPurify hook at a given entryPoint
1574
+ * (pops it from the stack of hooks if more are present)
1575
+ *
1576
+ * @param {String} entryPoint entry point for the hook to remove
1577
+ * @return {Function} removed(popped) hook
1578
+ */
1579
+
1580
+
1581
+ DOMPurify.removeHook = function (entryPoint) {
1582
+ if (hooks[entryPoint]) {
1583
+ return arrayPop(hooks[entryPoint]);
1584
+ }
1585
+ };
1586
+ /**
1587
+ * RemoveHooks
1588
+ * Public method to remove all DOMPurify hooks at a given entryPoint
1589
+ *
1590
+ * @param {String} entryPoint entry point for the hooks to remove
1591
+ */
1592
+
1593
+
1594
+ DOMPurify.removeHooks = function (entryPoint) {
1595
+ if (hooks[entryPoint]) {
1596
+ hooks[entryPoint] = [];
1597
+ }
1598
+ };
1599
+ /**
1600
+ * RemoveAllHooks
1601
+ * Public method to remove all DOMPurify hooks
1602
+ *
1603
+ */
1604
+
1605
+
1606
+ DOMPurify.removeAllHooks = function () {
1607
+ hooks = {};
1608
+ };
1609
+
1610
+ return DOMPurify;
1611
+ }
1612
+
1613
+ var purify = createDOMPurify();
1614
+
1615
+ return purify;
1616
+
1617
+ }));
vendor/DOMPurify/DOMPurify.min.js ADDED
@@ -0,0 +1,2 @@
 
 
1
+ /*! @license DOMPurify 2.3.8 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.8/LICENSE */
2
+ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).DOMPurify=t()}(this,(function(){"use strict";function e(t){return(e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(t)}function t(e,n){return(t=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e})(e,n)}function n(){if("undefined"==typeof Reflect||!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catch(e){return!1}}function r(e,o,a){return(r=n()?Reflect.construct:function(e,n,r){var o=[null];o.push.apply(o,n);var a=new(Function.bind.apply(e,o));return r&&t(a,r.prototype),a}).apply(null,arguments)}function o(e){return function(e){if(Array.isArray(e))return a(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return a(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return a(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function a(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var i=Object.hasOwnProperty,l=Object.setPrototypeOf,c=Object.isFrozen,u=Object.getPrototypeOf,s=Object.getOwnPropertyDescriptor,m=Object.freeze,f=Object.seal,p=Object.create,d="undefined"!=typeof Reflect&&Reflect,h=d.apply,g=d.construct;h||(h=function(e,t,n){return e.apply(t,n)}),m||(m=function(e){return e}),f||(f=function(e){return e}),g||(g=function(e,t){return r(e,o(t))});var y,b=_(Array.prototype.forEach),v=_(Array.prototype.pop),T=_(Array.prototype.push),N=_(String.prototype.toLowerCase),E=_(String.prototype.match),A=_(String.prototype.replace),w=_(String.prototype.indexOf),x=_(String.prototype.trim),k=_(RegExp.prototype.test),S=(y=TypeError,function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];return g(y,t)});function _(e){return function(t){for(var n=arguments.length,r=new Array(n>1?n-1:0),o=1;o<n;o++)r[o-1]=arguments[o];return h(e,t,r)}}function O(e,t){l&&l(e,null);for(var n=t.length;n--;){var r=t[n];if("string"==typeof r){var o=N(r);o!==r&&(c(t)||(t[n]=o),r=o)}e[r]=!0}return e}function D(e){var t,n=p(null);for(t in e)h(i,e,[t])&&(n[t]=e[t]);return n}function C(e,t){for(;null!==e;){var n=s(e,t);if(n){if(n.get)return _(n.get);if("function"==typeof n.value)return _(n.value)}e=u(e)}return function(e){return console.warn("fallback value for",e),null}}var M=m(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","section","select","shadow","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),R=m(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","filter","font","g","glyph","glyphref","hkern","image","line","lineargradient","marker","mask","metadata","mpath","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),L=m(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),I=m(["animate","color-profile","cursor","discard","fedropshadow","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),F=m(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover"]),H=m(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),U=m(["#text"]),z=m(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","controls","controlslist","coords","crossorigin","datetime","decoding","default","dir","disabled","disablepictureinpicture","disableremoteplayback","download","draggable","enctype","enterkeyhint","face","for","headers","height","hidden","high","href","hreflang","id","inputmode","integrity","ismap","kind","label","lang","list","loading","loop","low","max","maxlength","media","method","min","minlength","multiple","muted","name","nonce","noshade","novalidate","nowrap","open","optimum","pattern","placeholder","playsinline","poster","preload","pubdate","radiogroup","readonly","rel","required","rev","reversed","role","rows","rowspan","spellcheck","scope","selected","shape","size","sizes","span","srclang","start","src","srcset","step","style","summary","tabindex","title","translate","type","usemap","valign","value","width","xmlns","slot"]),B=m(["accent-height","accumulate","additive","alignment-baseline","ascent","attributename","attributetype","azimuth","basefrequency","baseline-shift","begin","bias","by","class","clip","clippathunits","clip-path","clip-rule","color","color-interpolation","color-interpolation-filters","color-profile","color-rendering","cx","cy","d","dx","dy","diffuseconstant","direction","display","divisor","dur","edgemode","elevation","end","fill","fill-opacity","fill-rule","filter","filterunits","flood-color","flood-opacity","font-family","font-size","font-size-adjust","font-stretch","font-style","font-variant","font-weight","fx","fy","g1","g2","glyph-name","glyphref","gradientunits","gradienttransform","height","href","id","image-rendering","in","in2","k","k1","k2","k3","k4","kerning","keypoints","keysplines","keytimes","lang","lengthadjust","letter-spacing","kernelmatrix","kernelunitlength","lighting-color","local","marker-end","marker-mid","marker-start","markerheight","markerunits","markerwidth","maskcontentunits","maskunits","max","mask","media","method","mode","min","name","numoctaves","offset","operator","opacity","order","orient","orientation","origin","overflow","paint-order","path","pathlength","patterncontentunits","patterntransform","patternunits","points","preservealpha","preserveaspectratio","primitiveunits","r","rx","ry","radius","refx","refy","repeatcount","repeatdur","restart","result","rotate","scale","seed","shape-rendering","specularconstant","specularexponent","spreadmethod","startoffset","stddeviation","stitchtiles","stop-color","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-linecap","stroke-linejoin","stroke-miterlimit","stroke-opacity","stroke","stroke-width","style","surfacescale","systemlanguage","tabindex","targetx","targety","transform","transform-origin","text-anchor","text-decoration","text-rendering","textlength","type","u1","u2","unicode","values","viewbox","visibility","version","vert-adv-y","vert-origin-x","vert-origin-y","width","word-spacing","wrap","writing-mode","xchannelselector","ychannelselector","x","x1","x2","xmlns","y","y1","y2","z","zoomandpan"]),j=m(["accent","accentunder","align","bevelled","close","columnsalign","columnlines","columnspan","denomalign","depth","dir","display","displaystyle","encoding","fence","frame","height","href","id","largeop","length","linethickness","lspace","lquote","mathbackground","mathcolor","mathsize","mathvariant","maxsize","minsize","movablelimits","notation","numalign","open","rowalign","rowlines","rowspacing","rowspan","rspace","rquote","scriptlevel","scriptminsize","scriptsizemultiplier","selection","separator","separators","stretchy","subscriptshift","supscriptshift","symmetric","voffset","width","xmlns"]),P=m(["xlink:href","xml:id","xlink:title","xml:space","xmlns:xlink"]),G=f(/\{\{[\w\W]*|[\w\W]*\}\}/gm),W=f(/<%[\w\W]*|[\w\W]*%>/gm),q=f(/^data-[\-\w.\u00B7-\uFFFF]/),Y=f(/^aria-[\-\w]+$/),K=f(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),V=f(/^(?:\w+script|data):/i),$=f(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),X=f(/^html$/i),Z=function(){return"undefined"==typeof window?null:window},J=function(t,n){if("object"!==e(t)||"function"!=typeof t.createPolicy)return null;var r=null,o="data-tt-policy-suffix";n.currentScript&&n.currentScript.hasAttribute(o)&&(r=n.currentScript.getAttribute(o));var a="dompurify"+(r?"#"+r:"");try{return t.createPolicy(a,{createHTML:function(e){return e}})}catch(e){return console.warn("TrustedTypes policy "+a+" could not be created."),null}};return function t(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:Z(),r=function(e){return t(e)};if(r.version="2.3.8",r.removed=[],!n||!n.document||9!==n.document.nodeType)return r.isSupported=!1,r;var a=n.document,i=n.document,l=n.DocumentFragment,c=n.HTMLTemplateElement,u=n.Node,s=n.Element,f=n.NodeFilter,p=n.NamedNodeMap,d=void 0===p?n.NamedNodeMap||n.MozNamedAttrMap:p,h=n.HTMLFormElement,g=n.DOMParser,y=n.trustedTypes,_=s.prototype,Q=C(_,"cloneNode"),ee=C(_,"nextSibling"),te=C(_,"childNodes"),ne=C(_,"parentNode");if("function"==typeof c){var re=i.createElement("template");re.content&&re.content.ownerDocument&&(i=re.content.ownerDocument)}var oe=J(y,a),ae=oe?oe.createHTML(""):"",ie=i,le=ie.implementation,ce=ie.createNodeIterator,ue=ie.createDocumentFragment,se=ie.getElementsByTagName,me=a.importNode,fe={};try{fe=D(i).documentMode?i.documentMode:{}}catch(e){}var pe={};r.isSupported="function"==typeof ne&&le&&void 0!==le.createHTMLDocument&&9!==fe;var de,he,ge=G,ye=W,be=q,ve=Y,Te=V,Ne=$,Ee=K,Ae=null,we=O({},[].concat(o(M),o(R),o(L),o(F),o(U))),xe=null,ke=O({},[].concat(o(z),o(B),o(j),o(P))),Se=Object.seal(Object.create(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),_e=null,Oe=null,De=!0,Ce=!0,Me=!1,Re=!1,Le=!1,Ie=!1,Fe=!1,He=!1,Ue=!1,ze=!1,Be=!0,je=!0,Pe=!1,Ge={},We=null,qe=O({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","style","svg","template","thead","title","video","xmp"]),Ye=null,Ke=O({},["audio","video","img","source","image","track"]),Ve=null,$e=O({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),Xe="http://www.w3.org/1998/Math/MathML",Ze="http://www.w3.org/2000/svg",Je="http://www.w3.org/1999/xhtml",Qe=Je,et=!1,tt=["application/xhtml+xml","text/html"],nt="text/html",rt=null,ot=i.createElement("form"),at=function(e){return e instanceof RegExp||e instanceof Function},it=function(t){rt&&rt===t||(t&&"object"===e(t)||(t={}),t=D(t),Ae="ALLOWED_TAGS"in t?O({},t.ALLOWED_TAGS):we,xe="ALLOWED_ATTR"in t?O({},t.ALLOWED_ATTR):ke,Ve="ADD_URI_SAFE_ATTR"in t?O(D($e),t.ADD_URI_SAFE_ATTR):$e,Ye="ADD_DATA_URI_TAGS"in t?O(D(Ke),t.ADD_DATA_URI_TAGS):Ke,We="FORBID_CONTENTS"in t?O({},t.FORBID_CONTENTS):qe,_e="FORBID_TAGS"in t?O({},t.FORBID_TAGS):{},Oe="FORBID_ATTR"in t?O({},t.FORBID_ATTR):{},Ge="USE_PROFILES"in t&&t.USE_PROFILES,De=!1!==t.ALLOW_ARIA_ATTR,Ce=!1!==t.ALLOW_DATA_ATTR,Me=t.ALLOW_UNKNOWN_PROTOCOLS||!1,Re=t.SAFE_FOR_TEMPLATES||!1,Le=t.WHOLE_DOCUMENT||!1,He=t.RETURN_DOM||!1,Ue=t.RETURN_DOM_FRAGMENT||!1,ze=t.RETURN_TRUSTED_TYPE||!1,Fe=t.FORCE_BODY||!1,Be=!1!==t.SANITIZE_DOM,je=!1!==t.KEEP_CONTENT,Pe=t.IN_PLACE||!1,Ee=t.ALLOWED_URI_REGEXP||Ee,Qe=t.NAMESPACE||Je,t.CUSTOM_ELEMENT_HANDLING&&at(t.CUSTOM_ELEMENT_HANDLING.tagNameCheck)&&(Se.tagNameCheck=t.CUSTOM_ELEMENT_HANDLING.tagNameCheck),t.CUSTOM_ELEMENT_HANDLING&&at(t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(Se.attributeNameCheck=t.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),t.CUSTOM_ELEMENT_HANDLING&&"boolean"==typeof t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(Se.allowCustomizedBuiltInElements=t.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements),de=de=-1===tt.indexOf(t.PARSER_MEDIA_TYPE)?nt:t.PARSER_MEDIA_TYPE,he="application/xhtml+xml"===de?function(e){return e}:N,Re&&(Ce=!1),Ue&&(He=!0),Ge&&(Ae=O({},o(U)),xe=[],!0===Ge.html&&(O(Ae,M),O(xe,z)),!0===Ge.svg&&(O(Ae,R),O(xe,B),O(xe,P)),!0===Ge.svgFilters&&(O(Ae,L),O(xe,B),O(xe,P)),!0===Ge.mathMl&&(O(Ae,F),O(xe,j),O(xe,P))),t.ADD_TAGS&&(Ae===we&&(Ae=D(Ae)),O(Ae,t.ADD_TAGS)),t.ADD_ATTR&&(xe===ke&&(xe=D(xe)),O(xe,t.ADD_ATTR)),t.ADD_URI_SAFE_ATTR&&O(Ve,t.ADD_URI_SAFE_ATTR),t.FORBID_CONTENTS&&(We===qe&&(We=D(We)),O(We,t.FORBID_CONTENTS)),je&&(Ae["#text"]=!0),Le&&O(Ae,["html","head","body"]),Ae.table&&(O(Ae,["tbody"]),delete _e.tbody),m&&m(t),rt=t)},lt=O({},["mi","mo","mn","ms","mtext"]),ct=O({},["foreignobject","desc","title","annotation-xml"]),ut=O({},["title","style","font","a","script"]),st=O({},R);O(st,L),O(st,I);var mt=O({},F);O(mt,H);var ft=function(e){var t=ne(e);t&&t.tagName||(t={namespaceURI:Je,tagName:"template"});var n=N(e.tagName),r=N(t.tagName);return e.namespaceURI===Ze?t.namespaceURI===Je?"svg"===n:t.namespaceURI===Xe?"svg"===n&&("annotation-xml"===r||lt[r]):Boolean(st[n]):e.namespaceURI===Xe?t.namespaceURI===Je?"math"===n:t.namespaceURI===Ze?"math"===n&&ct[r]:Boolean(mt[n]):e.namespaceURI===Je&&(!(t.namespaceURI===Ze&&!ct[r])&&(!(t.namespaceURI===Xe&&!lt[r])&&(!mt[n]&&(ut[n]||!st[n]))))},pt=function(e){T(r.removed,{element:e});try{e.parentNode.removeChild(e)}catch(t){try{e.outerHTML=ae}catch(t){e.remove()}}},dt=function(e,t){try{T(r.removed,{attribute:t.getAttributeNode(e),from:t})}catch(e){T(r.removed,{attribute:null,from:t})}if(t.removeAttribute(e),"is"===e&&!xe[e])if(He||Ue)try{pt(t)}catch(e){}else try{t.setAttribute(e,"")}catch(e){}},ht=function(e){var t,n;if(Fe)e="<remove></remove>"+e;else{var r=E(e,/^[\r\n\t ]+/);n=r&&r[0]}"application/xhtml+xml"===de&&(e='<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>'+e+"</body></html>");var o=oe?oe.createHTML(e):e;if(Qe===Je)try{t=(new g).parseFromString(o,de)}catch(e){}if(!t||!t.documentElement){t=le.createDocument(Qe,"template",null);try{t.documentElement.innerHTML=et?"":o}catch(e){}}var a=t.body||t.documentElement;return e&&n&&a.insertBefore(i.createTextNode(n),a.childNodes[0]||null),Qe===Je?se.call(t,Le?"html":"body")[0]:Le?t.documentElement:a},gt=function(e){return ce.call(e.ownerDocument||e,e,f.SHOW_ELEMENT|f.SHOW_COMMENT|f.SHOW_TEXT,null,!1)},yt=function(e){return e instanceof h&&("string"!=typeof e.nodeName||"string"!=typeof e.textContent||"function"!=typeof e.removeChild||!(e.attributes instanceof d)||"function"!=typeof e.removeAttribute||"function"!=typeof e.setAttribute||"string"!=typeof e.namespaceURI||"function"!=typeof e.insertBefore)},bt=function(t){return"object"===e(u)?t instanceof u:t&&"object"===e(t)&&"number"==typeof t.nodeType&&"string"==typeof t.nodeName},vt=function(e,t,n){pe[e]&&b(pe[e],(function(e){e.call(r,t,n,rt)}))},Tt=function(e){var t;if(vt("beforeSanitizeElements",e,null),yt(e))return pt(e),!0;if(k(/[\u0080-\uFFFF]/,e.nodeName))return pt(e),!0;var n=he(e.nodeName);if(vt("uponSanitizeElement",e,{tagName:n,allowedTags:Ae}),e.hasChildNodes()&&!bt(e.firstElementChild)&&(!bt(e.content)||!bt(e.content.firstElementChild))&&k(/<[/\w]/g,e.innerHTML)&&k(/<[/\w]/g,e.textContent))return pt(e),!0;if("select"===n&&k(/<template/i,e.innerHTML))return pt(e),!0;if(!Ae[n]||_e[n]){if(!_e[n]&&Et(n)){if(Se.tagNameCheck instanceof RegExp&&k(Se.tagNameCheck,n))return!1;if(Se.tagNameCheck instanceof Function&&Se.tagNameCheck(n))return!1}if(je&&!We[n]){var o=ne(e)||e.parentNode,a=te(e)||e.childNodes;if(a&&o)for(var i=a.length-1;i>=0;--i)o.insertBefore(Q(a[i],!0),ee(e))}return pt(e),!0}return e instanceof s&&!ft(e)?(pt(e),!0):"noscript"!==n&&"noembed"!==n||!k(/<\/no(script|embed)/i,e.innerHTML)?(Re&&3===e.nodeType&&(t=e.textContent,t=A(t,ge," "),t=A(t,ye," "),e.textContent!==t&&(T(r.removed,{element:e.cloneNode()}),e.textContent=t)),vt("afterSanitizeElements",e,null),!1):(pt(e),!0)},Nt=function(e,t,n){if(Be&&("id"===t||"name"===t)&&(n in i||n in ot))return!1;if(Ce&&!Oe[t]&&k(be,t));else if(De&&k(ve,t));else if(!xe[t]||Oe[t]){if(!(Et(e)&&(Se.tagNameCheck instanceof RegExp&&k(Se.tagNameCheck,e)||Se.tagNameCheck instanceof Function&&Se.tagNameCheck(e))&&(Se.attributeNameCheck instanceof RegExp&&k(Se.attributeNameCheck,t)||Se.attributeNameCheck instanceof Function&&Se.attributeNameCheck(t))||"is"===t&&Se.allowCustomizedBuiltInElements&&(Se.tagNameCheck instanceof RegExp&&k(Se.tagNameCheck,n)||Se.tagNameCheck instanceof Function&&Se.tagNameCheck(n))))return!1}else if(Ve[t]);else if(k(Ee,A(n,Ne,"")));else if("src"!==t&&"xlink:href"!==t&&"href"!==t||"script"===e||0!==w(n,"data:")||!Ye[e]){if(Me&&!k(Te,A(n,Ne,"")));else if(n)return!1}else;return!0},Et=function(e){return e.indexOf("-")>0},At=function(e){var t,n,o,a;vt("beforeSanitizeAttributes",e,null);var i=e.attributes;if(i){var l={attrName:"",attrValue:"",keepAttr:!0,allowedAttributes:xe};for(a=i.length;a--;){var c=t=i[a],u=c.name,s=c.namespaceURI;if(n="value"===u?t.value:x(t.value),o=he(u),l.attrName=o,l.attrValue=n,l.keepAttr=!0,l.forceKeepAttr=void 0,vt("uponSanitizeAttribute",e,l),n=l.attrValue,!l.forceKeepAttr&&(dt(u,e),l.keepAttr))if(k(/\/>/i,n))dt(u,e);else{Re&&(n=A(n,ge," "),n=A(n,ye," "));var m=he(e.nodeName);if(Nt(m,o,n))try{s?e.setAttributeNS(s,u,n):e.setAttribute(u,n),v(r.removed)}catch(e){}}}vt("afterSanitizeAttributes",e,null)}},wt=function e(t){var n,r=gt(t);for(vt("beforeSanitizeShadowDOM",t,null);n=r.nextNode();)vt("uponSanitizeShadowNode",n,null),Tt(n)||(n.content instanceof l&&e(n.content),At(n));vt("afterSanitizeShadowDOM",t,null)};return r.sanitize=function(t,o){var i,c,s,m,f;if((et=!t)&&(t="\x3c!--\x3e"),"string"!=typeof t&&!bt(t)){if("function"!=typeof t.toString)throw S("toString is not a function");if("string"!=typeof(t=t.toString()))throw S("dirty is not a string, aborting")}if(!r.isSupported){if("object"===e(n.toStaticHTML)||"function"==typeof n.toStaticHTML){if("string"==typeof t)return n.toStaticHTML(t);if(bt(t))return n.toStaticHTML(t.outerHTML)}return t}if(Ie||it(o),r.removed=[],"string"==typeof t&&(Pe=!1),Pe){if(t.nodeName){var p=he(t.nodeName);if(!Ae[p]||_e[p])throw S("root node is forbidden and cannot be sanitized in-place")}}else if(t instanceof u)1===(c=(i=ht("\x3c!----\x3e")).ownerDocument.importNode(t,!0)).nodeType&&"BODY"===c.nodeName||"HTML"===c.nodeName?i=c:i.appendChild(c);else{if(!He&&!Re&&!Le&&-1===t.indexOf("<"))return oe&&ze?oe.createHTML(t):t;if(!(i=ht(t)))return He?null:ze?ae:""}i&&Fe&&pt(i.firstChild);for(var d=gt(Pe?t:i);s=d.nextNode();)3===s.nodeType&&s===m||Tt(s)||(s.content instanceof l&&wt(s.content),At(s),m=s);if(m=null,Pe)return t;if(He){if(Ue)for(f=ue.call(i.ownerDocument);i.firstChild;)f.appendChild(i.firstChild);else f=i;return xe.shadowroot&&(f=me.call(a,f,!0)),f}var h=Le?i.outerHTML:i.innerHTML;return Le&&Ae["!doctype"]&&i.ownerDocument&&i.ownerDocument.doctype&&i.ownerDocument.doctype.name&&k(X,i.ownerDocument.doctype.name)&&(h="<!DOCTYPE "+i.ownerDocument.doctype.name+">\n"+h),Re&&(h=A(h,ge," "),h=A(h,ye," ")),oe&&ze?oe.createHTML(h):h},r.setConfig=function(e){it(e),Ie=!0},r.clearConfig=function(){rt=null,Ie=!1},r.isValidAttribute=function(e,t,n){rt||it({});var r=he(e),o=he(t);return Nt(r,o,n)},r.addHook=function(e,t){"function"==typeof t&&(pe[e]=pe[e]||[],T(pe[e],t))},r.removeHook=function(e){if(pe[e])return v(pe[e])},r.removeHooks=function(e){pe[e]&&(pe[e]=[])},r.removeAllHooks=function(){pe={}},r}()}));
vendor/composer/platform_check.php CHANGED
@@ -4,8 +4,8 @@
4
 
5
  $issues = array();
6
 
7
- if (!(PHP_VERSION_ID >= 70000)) {
8
- $issues[] = 'Your Composer dependencies require a PHP version ">= 7.0.0". You are running ' . PHP_VERSION . '.';
9
  }
10
 
11
  if ($issues) {
4
 
5
  $issues = array();
6
 
7
+ if (!(PHP_VERSION_ID >= 50600)) {
8
+ $issues[] = 'Your Composer dependencies require a PHP version ">= 5.6.0". You are running ' . PHP_VERSION . '.';
9
  }
10
 
11
  if ($issues) {