diff --git a/package-lock.json b/package-lock.json index 46edc1e9a..d30cd4e2a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,47 +9,44 @@ "version": "1.7.1", "license": "MIT", "dependencies": { + "ace-builds": "^1.4.14", + "coordinate-parser": "^1.0.7", + "dompurify": "3.4.11", + "email-addresses": "^5.0.0", "font-awesome": "^4.7.0", + "formatcoords": "^1.1.3", + "load-google-maps-api": "^1.3.3", + "marked": "^18.0.5", + "moment": "^2.29.1", "moment-timezone": "^0.5.33" }, "devDependencies": { - "ace-builds": "^1.4.14", "autoprefixer": "^10.4.21", "babel-jest": "^21.2.0", - "base64-inline-loader": "^2.0.1", "cheerio": "^1.0.0", "chokidar": "^4.0.3", "clean-webpack-plugin": "^4.0.0", "codo": "^2.1.2", "coffee-loader": "0.9.0", "coffeescript": "^1.12.7", - "coordinate-parser": "^1.0.7", "css-loader": "^7.1.2", "cssnano": "^7.0.7", - "email-addresses": "^5.0.0", - "file-loader": "^5.1.0", - "formatcoords": "^1.1.3", "gulp": "^5.0.0", "gulp-copy": "^5.0.0", "gulp-rename": "^1.4.0", "gulp-svgmin": "^4.1.0", "gulp-svgstore": "^9.0.0", - "hard-source-webpack-plugin": "^0.13.1", "html-loader": "^0.5.1", "jest": "^21.2.1", "leaflet": "^1.7.1", "leaflet-defaulticon-compatibility": "^0.1.2", - "load-google-maps-api": "^1.3.3", - "marked": "^0.7.0", "mini-css-extract-plugin": "^2.7.5", - "moment": "^2.29.1", "postcss-loader": "^8.1.1", "raw-loader": "^4.0.2", "resolve-url-loader": "^5.0.0", "rimraf": "^3.0.2", "sass": "^1.86.0", "sass-loader": "^16.0.5", - "style-loader": "^1.1.3", "stylelint": "^16.19.1", "stylelint-config-standard-scss": "^15.0.0", "stylelint-webpack-plugin": "^5.0.1", @@ -781,6 +778,13 @@ "undici-types": "~6.19.2" } }, + "node_modules/@types/trusted-types": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz", + "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==", + "license": "MIT", + "optional": true + }, "node_modules/@types/yargs": { "version": "17.0.33", "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.33.tgz", @@ -1008,8 +1012,7 @@ "node_modules/ace-builds": { "version": "1.36.2", "resolved": "https://registry.npmjs.org/ace-builds/-/ace-builds-1.36.2.tgz", - "integrity": "sha512-eqqfbGwx/GKjM/EnFu4QtQ+d2NNBu84MGgxoG8R5iyFpcVeQ4p9YlTL+ZzdEJqhdkASqoqOxCSNNGyB6lvMm+A==", - "dev": true + "integrity": "sha512-eqqfbGwx/GKjM/EnFu4QtQ+d2NNBu84MGgxoG8R5iyFpcVeQ4p9YlTL+ZzdEJqhdkASqoqOxCSNNGyB6lvMm+A==" }, "node_modules/acorn": { "version": "4.0.13", @@ -1854,20 +1857,6 @@ "node": ">=0.10.0" } }, - "node_modules/base64-inline-loader": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/base64-inline-loader/-/base64-inline-loader-2.0.1.tgz", - "integrity": "sha512-PW2f2Xl2PDB+0ny7H81Ucxh3L0IcZVqbWdKrCf52OJhphy4lgv4G1KOLmhxRGwK9qVtPqqcEwvnemqOOFRSjOw==", - "dev": true, - "dependencies": { - "loader-utils": "^2.0.0", - "mime-types": "^2.1.32" - }, - "engines": { - "node": ">=6.2", - "npm": ">=3.8" - } - }, "node_modules/base64-js": { "version": "1.5.1", "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz", @@ -2723,12 +2712,6 @@ "node": ">=14" } }, - "node_modules/commondir": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz", - "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==", - "dev": true - }, "node_modules/component-emitter": { "version": "1.3.1", "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.1.tgz", @@ -2784,8 +2767,7 @@ "node_modules/coordinate-parser": { "version": "1.0.7", "resolved": "https://registry.npmjs.org/coordinate-parser/-/coordinate-parser-1.0.7.tgz", - "integrity": "sha512-pkcjigkAEjU5JsTYnuXLkRgR6T5fF/7GXR4p9vWJesy8fKwsheN8zC5d3sSvdMmWihHB4u48xWZ5mUCcgBIEpw==", - "dev": true + "integrity": "sha512-pkcjigkAEjU5JsTYnuXLkRgR6T5fF/7GXR4p9vWJesy8fKwsheN8zC5d3sSvdMmWihHB4u48xWZ5mUCcgBIEpw==" }, "node_modules/copy-descriptor": { "version": "0.1.1", @@ -3380,6 +3362,15 @@ "url": "https://github.com/fb55/domhandler?sponsor=1" } }, + "node_modules/dompurify": { + "version": "3.4.11", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz", + "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==", + "license": "(MPL-2.0 OR Apache-2.0)", + "optionalDependencies": { + "@types/trusted-types": "^2.0.7" + } + }, "node_modules/domutils": { "version": "3.2.2", "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz", @@ -3446,8 +3437,7 @@ "node_modules/email-addresses": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/email-addresses/-/email-addresses-5.0.0.tgz", - "integrity": "sha512-4OIPYlA6JXqtVn8zpHpGiI7vE6EQOAg16aGnDMIAlZVinnoZ8208tW1hAbjWydgN/4PLTT9q+O1K6AH/vALJGw==", - "dev": true + "integrity": "sha512-4OIPYlA6JXqtVn8zpHpGiI7vE6EQOAg16aGnDMIAlZVinnoZ8208tW1hAbjWydgN/4PLTT9q+O1K6AH/vALJGw==" }, "node_modules/emoji-regex": { "version": "8.0.0", @@ -4116,40 +4106,6 @@ "flat-cache": "^6.1.9" } }, - "node_modules/file-loader": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/file-loader/-/file-loader-5.1.0.tgz", - "integrity": "sha512-u/VkLGskw3Ue59nyOwUwXI/6nuBCo7KBkniB/l7ICwr/7cPNGsL1WCXUp3GB0qgOOKU1TiP49bv4DZF/LJqprg==", - "dev": true, - "dependencies": { - "loader-utils": "^1.4.0", - "schema-utils": "^2.5.0" - }, - "engines": { - "node": ">= 10.13.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/webpack" - }, - "peerDependencies": { - "webpack": "^4.0.0 || ^5.0.0" - } - }, - "node_modules/file-loader/node_modules/loader-utils": { - "version": "1.4.2", - "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.2.tgz", - "integrity": "sha512-I5d00Pd/jwMD2QCduo657+YM/6L3KZu++pmX9VFncxaxvHcru9jx1lBaFft+r4Mt2jK0Yhp41XlRAihzPxHNCg==", - "dev": true, - "dependencies": { - "big.js": "^5.2.2", - "emojis-list": "^3.0.0", - "json5": "^1.0.1" - }, - "engines": { - "node": ">=4.0.0" - } - }, "node_modules/file-uri-to-path": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz", @@ -4228,20 +4184,6 @@ "node": ">= 0.8" } }, - "node_modules/find-cache-dir": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-2.1.0.tgz", - "integrity": "sha512-Tq6PixE0w/VMFfCgbONnkiQIVol/JJL7nRMi20fqzA4NRs9AfeqMGeRdPi3wIhYkxjeBaWh2rxwapn5Tu3IqOQ==", - "dev": true, - "dependencies": { - "commondir": "^1.0.1", - "make-dir": "^2.0.0", - "pkg-dir": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, "node_modules/find-up": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", @@ -4443,8 +4385,7 @@ "node_modules/formatcoords": { "version": "1.1.3", "resolved": "https://registry.npmjs.org/formatcoords/-/formatcoords-1.1.3.tgz", - "integrity": "sha512-Ittg5/AsYFCOtcFGPLSmVpP56a8Ionmv4Ys69UmCAdvBnqVzvVVbkZMnjWEmXrZvnmoGQE8YI3RhnxbMQFdYSw==", - "dev": true + "integrity": "sha512-Ittg5/AsYFCOtcFGPLSmVpP56a8Ionmv4Ys69UmCAdvBnqVzvVVbkZMnjWEmXrZvnmoGQE8YI3RhnxbMQFdYSw==" }, "node_modules/fraction.js": { "version": "4.3.7", @@ -5236,93 +5177,6 @@ "node": ">=6" } }, - "node_modules/hard-source-webpack-plugin": { - "version": "0.13.1", - "resolved": "https://registry.npmjs.org/hard-source-webpack-plugin/-/hard-source-webpack-plugin-0.13.1.tgz", - "integrity": "sha512-r9zf5Wq7IqJHdVAQsZ4OP+dcUSvoHqDMxJlIzaE2J0TZWn3UjMMrHqwDHR8Jr/pzPfG7XxSe36E7Y8QGNdtuAw==", - "dev": true, - "dependencies": { - "chalk": "^2.4.1", - "find-cache-dir": "^2.0.0", - "graceful-fs": "^4.1.11", - "lodash": "^4.15.0", - "mkdirp": "^0.5.1", - "node-object-hash": "^1.2.0", - "parse-json": "^4.0.0", - "pkg-dir": "^3.0.0", - "rimraf": "^2.6.2", - "semver": "^5.6.0", - "tapable": "^1.0.0-beta.5", - "webpack-sources": "^1.0.1", - "write-json-file": "^2.3.0" - }, - "engines": { - "node": ">=8.0.0" - }, - "peerDependencies": { - "webpack": "*" - } - }, - "node_modules/hard-source-webpack-plugin/node_modules/ansi-styles": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz", - "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==", - "dev": true, - "dependencies": { - "color-convert": "^1.9.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/hard-source-webpack-plugin/node_modules/chalk": { - "version": "2.4.2", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz", - "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==", - "dev": true, - "dependencies": { - "ansi-styles": "^3.2.1", - "escape-string-regexp": "^1.0.5", - "supports-color": "^5.3.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/hard-source-webpack-plugin/node_modules/rimraf": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz", - "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==", - "deprecated": "Rimraf versions prior to v4 are no longer supported", - "dev": true, - "dependencies": { - "glob": "^7.1.3" - }, - "bin": { - "rimraf": "bin.js" - } - }, - "node_modules/hard-source-webpack-plugin/node_modules/semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", - "dev": true, - "bin": { - "semver": "bin/semver" - } - }, - "node_modules/hard-source-webpack-plugin/node_modules/supports-color": { - "version": "5.5.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz", - "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==", - "dev": true, - "dependencies": { - "has-flag": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/has-ansi": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/has-ansi/-/has-ansi-2.0.0.tgz", @@ -6092,15 +5946,6 @@ "node": ">=6" } }, - "node_modules/is-plain-obj": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-1.1.0.tgz", - "integrity": "sha512-yvkRyxmFKEOQ4pNXCmJG5AEQNlXJS5LaONXo5/cLdTZdWvsZ1ioJEonLGAosKlMWE8lwUy/bJzMjcw8az73+Fg==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/is-plain-object": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz", @@ -8118,12 +7963,6 @@ "jsesc": "bin/jsesc" } }, - "node_modules/json-parse-better-errors": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz", - "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==", - "dev": true - }, "node_modules/json-parse-even-better-errors": { "version": "2.3.1", "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz", @@ -8336,8 +8175,7 @@ "node_modules/load-google-maps-api": { "version": "1.3.3", "resolved": "https://registry.npmjs.org/load-google-maps-api/-/load-google-maps-api-1.3.3.tgz", - "integrity": "sha512-THOSdgymg98eQz8KcZZ2BGjVQIcpMBMUxjKb+0vkgXPQauK238zMNBgUoQBb9JzoP73J9Qgq9dvyHGu3oYvBMQ==", - "dev": true + "integrity": "sha512-THOSdgymg98eQz8KcZZ2BGjVQIcpMBMUxjKb+0vkgXPQauK238zMNBgUoQBb9JzoP73J9Qgq9dvyHGu3oYvBMQ==" }, "node_modules/load-json-file": { "version": "1.1.0", @@ -8481,28 +8319,6 @@ "yallist": "^2.1.2" } }, - "node_modules/make-dir": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-2.1.0.tgz", - "integrity": "sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==", - "dev": true, - "dependencies": { - "pify": "^4.0.1", - "semver": "^5.6.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/make-dir/node_modules/semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", - "dev": true, - "bin": { - "semver": "bin/semver" - } - }, "node_modules/makeerror": { "version": "1.0.12", "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz", @@ -8534,15 +8350,15 @@ } }, "node_modules/marked": { - "version": "0.7.0", - "resolved": "https://registry.npmjs.org/marked/-/marked-0.7.0.tgz", - "integrity": "sha512-c+yYdCZJQrsRjTPhUx7VKkApw9bwDkNbHUKo1ovgcfDjb2kc8rLuRbIFyXL5WOEUwzSSKo3IXpph2K6DqB/KZg==", - "dev": true, + "version": "18.0.5", + "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.5.tgz", + "integrity": "sha512-S6GcvALHg6K4ohtu4E7x0a1AqhAjp6cV8KhLSyN9qVapnzJkusVBxZRcIU9AeYsbe6P1hKDusSbEOzGyyuce6w==", + "license": "MIT", "bin": { - "marked": "bin/marked" + "marked": "bin/marked.js" }, "engines": { - "node": ">=0.10.0" + "node": ">= 20" } }, "node_modules/math-intrinsics": { @@ -9182,15 +8998,6 @@ "semver": "bin/semver" } }, - "node_modules/node-object-hash": { - "version": "1.4.2", - "resolved": "https://registry.npmjs.org/node-object-hash/-/node-object-hash-1.4.2.tgz", - "integrity": "sha512-UdS4swXs85fCGWWf6t6DMGgpN/vnlKeSGEQ7hJcrs7PBFoxoKLmibc3QRb7fwiYsjdL7PX8iI/TMSlZ90dgHhQ==", - "dev": true, - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/node-releases": { "version": "2.0.19", "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.19.tgz", @@ -9683,19 +9490,6 @@ "node": ">=0.10.0" } }, - "node_modules/parse-json": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz", - "integrity": "sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw==", - "dev": true, - "dependencies": { - "error-ex": "^1.3.1", - "json-parse-better-errors": "^1.0.1" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/parse-node-version": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/parse-node-version/-/parse-node-version-1.0.1.tgz", @@ -9904,70 +9698,6 @@ "node": ">=0.10.0" } }, - "node_modules/pkg-dir": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-3.0.0.tgz", - "integrity": "sha512-/E57AYkoeQ25qkxMj5PBOVgF8Kiu/h7cYS30Z5+R7WaiCCBfLq58ZI/dSeaEKb9WVJV5n/03QwrN3IeWIFllvw==", - "dev": true, - "dependencies": { - "find-up": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/pkg-dir/node_modules/find-up": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/find-up/-/find-up-3.0.0.tgz", - "integrity": "sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==", - "dev": true, - "dependencies": { - "locate-path": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/pkg-dir/node_modules/locate-path": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-3.0.0.tgz", - "integrity": "sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==", - "dev": true, - "dependencies": { - "p-locate": "^3.0.0", - "path-exists": "^3.0.0" - }, - "engines": { - "node": ">=6" - } - }, - "node_modules/pkg-dir/node_modules/p-limit": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", - "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", - "dev": true, - "dependencies": { - "p-try": "^2.0.0" - }, - "engines": { - "node": ">=6" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/pkg-dir/node_modules/p-locate": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-3.0.0.tgz", - "integrity": "sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==", - "dev": true, - "dependencies": { - "p-limit": "^2.0.0" - }, - "engines": { - "node": ">=6" - } - }, "node_modules/pkginfo": { "version": "0.3.1", "resolved": "https://registry.npmjs.org/pkginfo/-/pkginfo-0.3.1.tgz", @@ -11732,24 +11462,6 @@ "integrity": "sha512-+aWOz7yVScEGoKNd4PA10LZ8sk0A/z5+nXQG5giUO5rprX9jgYsTdov9qCchZiPIZezbZH+jRut8nPodFAX4Jg==", "dev": true }, - "node_modules/schema-utils": { - "version": "2.7.1", - "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz", - "integrity": "sha512-SHiNtMOUGWBQJwzISiVYKu82GiV4QYGePp3odlY1tuKO7gPtphAT5R/py0fA6xtbgLL/RvtJZnU9b8s0F1q0Xg==", - "dev": true, - "dependencies": { - "@types/json-schema": "^7.0.5", - "ajv": "^6.12.4", - "ajv-keywords": "^3.5.2" - }, - "engines": { - "node": ">= 8.9.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/webpack" - } - }, "node_modules/semver": { "version": "6.3.1", "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", @@ -12058,24 +11770,6 @@ "node": ">=0.8.0" } }, - "node_modules/sort-keys": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/sort-keys/-/sort-keys-2.0.0.tgz", - "integrity": "sha512-/dPCrG1s3ePpWm6yBbxZq5Be1dXGLyLn9Z791chDC3NFrpkVbWGzkBwPN1knaciexFXgRJ7hzdnwZ4stHSDmjg==", - "dev": true, - "dependencies": { - "is-plain-obj": "^1.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/source-list-map": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/source-list-map/-/source-list-map-2.0.1.tgz", - "integrity": "sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==", - "dev": true - }, "node_modules/source-map": { "version": "0.6.1", "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz", @@ -12416,26 +12110,6 @@ "node": ">=0.10.0" } }, - "node_modules/style-loader": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/style-loader/-/style-loader-1.3.0.tgz", - "integrity": "sha512-V7TCORko8rs9rIqkSrlMfkqA63DfoGBBJmK1kKGCcSi+BWb4cqz0SRsnp4l6rU5iwOEd0/2ePv68SV22VXon4Q==", - "dev": true, - "dependencies": { - "loader-utils": "^2.0.0", - "schema-utils": "^2.7.0" - }, - "engines": { - "node": ">= 8.9.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/webpack" - }, - "peerDependencies": { - "webpack": "^4.0.0 || ^5.0.0" - } - }, "node_modules/stylehacks": { "version": "7.0.5", "resolved": "https://registry.npmjs.org/stylehacks/-/stylehacks-7.0.5.tgz", @@ -13337,15 +13011,6 @@ "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", "dev": true }, - "node_modules/tapable": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/tapable/-/tapable-1.1.3.tgz", - "integrity": "sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA==", - "dev": true, - "engines": { - "node": ">=6" - } - }, "node_modules/teex": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz", @@ -14265,16 +13930,6 @@ "node": ">=10.0.0" } }, - "node_modules/webpack-sources": { - "version": "1.4.3", - "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-1.4.3.tgz", - "integrity": "sha512-lgTS3Xhv1lCOKo7SA5TjKXMjpSM4sBjNV5+q2bqesbSPs5FjGmU6jjtBSkX9b4qW87vDIsCIlUPOEhbZrMdjeQ==", - "dev": true, - "dependencies": { - "source-list-map": "^2.0.0", - "source-map": "~0.6.1" - } - }, "node_modules/webpack/node_modules/acorn": { "version": "8.12.1", "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.12.1.tgz", @@ -14587,53 +14242,6 @@ "signal-exit": "^3.0.2" } }, - "node_modules/write-json-file": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/write-json-file/-/write-json-file-2.3.0.tgz", - "integrity": "sha512-84+F0igFp2dPD6UpAQjOUX3CdKUOqUzn6oE9sDBNzUXINR5VceJ1rauZltqQB/bcYsx3EpKys4C7/PivKUAiWQ==", - "dev": true, - "dependencies": { - "detect-indent": "^5.0.0", - "graceful-fs": "^4.1.2", - "make-dir": "^1.0.0", - "pify": "^3.0.0", - "sort-keys": "^2.0.0", - "write-file-atomic": "^2.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/write-json-file/node_modules/detect-indent": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/detect-indent/-/detect-indent-5.0.0.tgz", - "integrity": "sha512-rlpvsxUtM0PQvy9iZe640/IWwWYyBsTApREbA1pHOpmOUIl9MkP/U4z7vTtg4Oaojvqhxt7sdufnT0EzGaR31g==", - "dev": true, - "engines": { - "node": ">=4" - } - }, - "node_modules/write-json-file/node_modules/make-dir": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-1.3.0.tgz", - "integrity": "sha512-2w31R7SJtieJJnQtGc7RVL2StM2vGYVfqUOvUDxH6bC6aJTxPxTF0GnIgCyu7tjockiUWAYQRbxa7vKn34s5sQ==", - "dev": true, - "dependencies": { - "pify": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, - "node_modules/write-json-file/node_modules/pify": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz", - "integrity": "sha512-C3FsVNH1udSEX48gGX1xfvwTWfsYWj5U+8/uK15BGzIGrKoUpghX8hWZwa/OFnakBiiVNmBvemTJR5mcy7iPcg==", - "dev": true, - "engines": { - "node": ">=4" - } - }, "node_modules/xml-name-validator": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-2.0.1.tgz", diff --git a/package.json b/package.json index 7c660b7c8..ce71d2891 100644 --- a/package.json +++ b/package.json @@ -33,44 +33,45 @@ "url": "https://github.com/programmfabrik/coffeescript-ui/issues" }, "homepage": "https://github.com/programmfabrik/coffeescript-ui#readme", - "devDependencies": { + "dependencies": { "ace-builds": "^1.4.14", + "coordinate-parser": "^1.0.7", + "formatcoords": "^1.1.3", + "font-awesome": "^4.7.0", + "email-addresses": "^5.0.0", + "load-google-maps-api": "^1.3.3", + "moment": "^2.29.1", + "moment-timezone": "^0.5.33", + "marked": "^18.0.5", + "dompurify": "3.4.11" + }, + "devDependencies": { "autoprefixer": "^10.4.21", "babel-jest": "^21.2.0", - "base64-inline-loader": "^2.0.1", "cheerio": "^1.0.0", "chokidar": "^4.0.3", "clean-webpack-plugin": "^4.0.0", "codo": "^2.1.2", "coffee-loader": "0.9.0", "coffeescript": "^1.12.7", - "coordinate-parser": "^1.0.7", "css-loader": "^7.1.2", "cssnano": "^7.0.7", - "email-addresses": "^5.0.0", - "file-loader": "^5.1.0", - "formatcoords": "^1.1.3", "gulp": "^5.0.0", "gulp-copy": "^5.0.0", "gulp-rename": "^1.4.0", "gulp-svgmin": "^4.1.0", "gulp-svgstore": "^9.0.0", - "hard-source-webpack-plugin": "^0.13.1", "html-loader": "^0.5.1", "jest": "^21.2.1", "leaflet": "^1.7.1", "leaflet-defaulticon-compatibility": "^0.1.2", - "load-google-maps-api": "^1.3.3", - "marked": "^0.7.0", "mini-css-extract-plugin": "^2.7.5", - "moment": "^2.29.1", "postcss-loader": "^8.1.1", "raw-loader": "^4.0.2", "resolve-url-loader": "^5.0.0", "rimraf": "^3.0.2", "sass": "^1.86.0", "sass-loader": "^16.0.5", - "style-loader": "^1.1.3", "stylelint": "^16.19.1", "stylelint-config-standard-scss": "^15.0.0", "stylelint-webpack-plugin": "^5.0.1", @@ -79,9 +80,5 @@ "vinyl": "^3.0.0", "webpack": "^5.76.3", "webpack-cli": "^5.0.1" - }, - "dependencies": { - "font-awesome": "^4.7.0", - "moment-timezone": "^0.5.33" } } diff --git a/public/cui.js b/public/cui.js index 2161c1cf2..7808141d2 100644 --- a/public/cui.js +++ b/public/cui.js @@ -22066,9 +22066,9 @@ CUI.CSVData = (function(superClass) { * MIT Licence * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org */ -var CUI, marked; +var CUI, Renderer, marked, ref; -marked = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.js"); +ref = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.esm.js"), marked = ref.marked, Renderer = ref.Renderer; CUI = (function() { function CUI() {} @@ -22137,17 +22137,17 @@ CUI = (function() { type: "keydown", node: window, call: function(ev) { - var j, len1, node, ref, ref1; + var j, len1, node, ref1, ref2; if (ev.getKeyboard() === "c+") { CUI.toaster({ text: "CUI!" }); } if (ev.keyCode() === 8) { - ref = CUI.dom.elementsUntil(ev.getTarget(), null, document.documentElement); - for (j = 0, len1 = ref.length; j < len1; j++) { - node = ref[j]; - if ((ref1 = node.tagName) === "INPUT" || ref1 === "TEXTAREA") { + ref1 = CUI.dom.elementsUntil(ev.getTarget(), null, document.documentElement); + for (j = 0, len1 = ref1.length; j < len1; j++) { + node = ref1[j]; + if ((ref2 = node.tagName) === "INPUT" || ref2 === "TEXTAREA") { return; } if (node.getAttribute("contenteditable") === "true") { @@ -22429,11 +22429,11 @@ CUI = (function() { CUI.__timeoutCallbacks = []; CUI.__callTimeoutChangeCallbacks = function() { - var cb, j, len1, ref, tracked; + var cb, j, len1, ref1, tracked; tracked = this.countTimeouts(); - ref = this.__timeoutCallbacks; - for (j = 0, len1 = ref.length; j < len1; j++) { - cb = ref[j]; + ref1 = this.__timeoutCallbacks; + for (j = 0, len1 = ref1.length; j < len1; j++) { + cb = ref1[j]; cb(tracked); } }; @@ -22447,13 +22447,13 @@ CUI = (function() { }; CUI.__getTimeoutById = function(timeoutID, ignoreNotFound) { - var j, len1, ref, timeout; + var j, len1, ref1, timeout; if (ignoreNotFound == null) { ignoreNotFound = false; } - ref = this.__timeouts; - for (j = 0, len1 = ref.length; j < len1; j++) { - timeout = ref[j]; + ref1 = this.__timeouts; + for (j = 0, len1 = ref1.length; j < len1; j++) { + timeout = ref1[j]; if (timeout.id === timeoutID) { return timeout; } @@ -22649,11 +22649,11 @@ CUI = (function() { }; CUI.countTimeouts = function() { - var j, len1, ref, timeout, tracked; + var j, len1, ref1, timeout, tracked; tracked = 0; - ref = this.__timeouts; - for (j = 0, len1 = ref.length; j < len1; j++) { - timeout = ref[j]; + ref1 = this.__timeouts; + for (j = 0, len1 = ref1.length; j < len1; j++) { + timeout = ref1[j]; if (timeout.track) { tracked++; } @@ -22841,20 +22841,20 @@ CUI = (function() { }; CUI.encodeURIComponentNicely = function(str) { - var idx, idx2, j, l, len1, len2, ref, ref1, s, v, v2; + var idx, idx2, j, l, len1, len2, ref1, ref2, s, v, v2; if (str == null) { str = ""; } s = []; - ref = (str + "").split(","); - for (idx = j = 0, len1 = ref.length; j < len1; idx = ++j) { - v = ref[idx]; + ref1 = (str + "").split(","); + for (idx = j = 0, len1 = ref1.length; j < len1; idx = ++j) { + v = ref1[idx]; if (idx > 0) { s.push(","); } - ref1 = v.split(":"); - for (idx2 = l = 0, len2 = ref1.length; l < len2; idx2 = ++l) { - v2 = ref1[idx2]; + ref2 = v.split(":"); + for (idx2 = l = 0, len2 = ref2.length; l < len2; idx2 = ++l) { + v2 = ref2[idx2]; if (idx2 > 0) { s.push(":"); } @@ -22869,7 +22869,7 @@ CUI = (function() { }; CUI.decodeUrlData = function(url, replacer, connect, connect_pair, use_array) { - var decode_func, j, key, len1, pair, params, part, ref, value; + var decode_func, j, key, len1, pair, params, part, ref1, value; if (replacer == null) { replacer = null; } @@ -22896,9 +22896,9 @@ CUI = (function() { return decodeURIComponent(v); }; } - ref = url.split(connect); - for (j = 0, len1 = ref.length; j < len1; j++) { - part = ref[j]; + ref1 = url.split(connect); + for (j = 0, len1 = ref1.length; j < len1; j++) { + part = ref1[j]; if (part.length === 0) { continue; } @@ -23056,14 +23056,14 @@ CUI = (function() { }; CUI.parseLocation = function(url) { - var _match, match, p, pUrl, ref; + var _match, match, p, pUrl, ref1; if (!CUI.util.isFunction(url != null ? url.match : void 0) || url.length === 0) { return null; } try { pUrl = new URL(url); p = { - protocol: ((ref = pUrl.protocol) != null ? ref.replaceAll(':', '') : void 0) || "", + protocol: ((ref1 = pUrl.protocol) != null ? ref1.replaceAll(':', '') : void 0) || "", user: pUrl.username, password: pUrl.password, hostname: pUrl.hostname, @@ -23198,14 +23198,14 @@ CUI = (function() { })(); CUI.__toggleUIElements = function(showAll) { - var div, elementTopContainer, fn, highlightDiv, j, l, len1, len2, len3, n, ref, ref1, ref2, ref3, ref4, topContainer, topElement, uiElement, uiElementRect, uiElements, x, y; + var div, elementTopContainer, fn, highlightDiv, j, l, len1, len2, len3, n, ref1, ref2, ref3, ref4, ref5, topContainer, topElement, uiElement, uiElementRect, uiElements, x, y; if (showAll == null) { showAll = false; } - if (((ref = this.__uiHighlightDivs) != null ? ref.length : void 0) > 0) { - ref1 = this.__uiHighlightDivs; - for (j = 0, len1 = ref1.length; j < len1; j++) { - highlightDiv = ref1[j]; + if (((ref1 = this.__uiHighlightDivs) != null ? ref1.length : void 0) > 0) { + ref2 = this.__uiHighlightDivs; + for (j = 0, len1 = ref2.length; j < len1; j++) { + highlightDiv = ref2[j]; CUI.dom.remove(highlightDiv); } delete this.__uiHighlightDivs; @@ -23234,10 +23234,10 @@ CUI = (function() { CUI.dom.append(document.body, div); borderStyle = CUI.dom.getStyle(uiElement).border; div.addEventListener('mouseenter', function() { - var len3, n, otherHighlightDiv, ref2; - ref2 = _this.__uiHighlightDivs; - for (n = 0, len3 = ref2.length; n < len3; n++) { - otherHighlightDiv = ref2[n]; + var len3, n, otherHighlightDiv, ref3; + ref3 = _this.__uiHighlightDivs; + for (n = 0, len3 = ref3.length; n < len3; n++) { + otherHighlightDiv = ref3[n]; CUI.dom.hideElement(otherHighlightDiv); } CUI.dom.showElement(div); @@ -23246,10 +23246,10 @@ CUI = (function() { }); }); div.addEventListener('mouseleave', function() { - var len3, n, otherHighlightDiv, ref2; - ref2 = _this.__uiHighlightDivs; - for (n = 0, len3 = ref2.length; n < len3; n++) { - otherHighlightDiv = ref2[n]; + var len3, n, otherHighlightDiv, ref3; + ref3 = _this.__uiHighlightDivs; + for (n = 0, len3 = ref3.length; n < len3; n++) { + otherHighlightDiv = ref3[n]; CUI.dom.showElement(otherHighlightDiv); } return CUI.dom.setStyle(uiElement, { @@ -23260,15 +23260,15 @@ CUI = (function() { return navigator.clipboard.writeText(uiElement.getAttribute("ui")); }); span.addEventListener('click', function() { - var len3, n, otherHighlightDiv, ref2; + var len3, n, otherHighlightDiv, ref3; CUI.dom.remove(div); CUI.util.removeFromArray(div, _this.__uiHighlightDivs); CUI.dom.setStyle(uiElement, { border: borderStyle }); - ref2 = _this.__uiHighlightDivs; - for (n = 0, len3 = ref2.length; n < len3; n++) { - otherHighlightDiv = ref2[n]; + ref3 = _this.__uiHighlightDivs; + for (n = 0, len3 = ref3.length; n < len3; n++) { + otherHighlightDiv = ref3[n]; CUI.dom.showElement(otherHighlightDiv); } }); @@ -23303,8 +23303,8 @@ CUI = (function() { y = uiElementRect.top; topElement = document.elementFromPoint(x, y); if (topElement) { - elementTopContainer = (ref2 = CUI.dom.parents(uiElement, "body > div")) != null ? ref2[0] : void 0; - topContainer = (ref3 = CUI.dom.parents(topElement, "body > div")) != null ? ref3[0] : void 0; + elementTopContainer = (ref3 = CUI.dom.parents(uiElement, "body > div")) != null ? ref3[0] : void 0; + topContainer = (ref4 = CUI.dom.parents(topElement, "body > div")) != null ? ref4[0] : void 0; if (elementTopContainer !== topContainer) { continue; } @@ -23314,9 +23314,9 @@ CUI = (function() { this.__uiHighlightDivs.push(div); fn(div, uiElement); } - ref4 = this.__uiHighlightDivs; - for (n = 0, len3 = ref4.length; n < len3; n++) { - div = ref4[n]; + ref5 = this.__uiHighlightDivs; + for (n = 0, len3 = ref5.length; n < len3; n++) { + div = ref5[n]; CUI.dom.showElement(div); } }; @@ -23334,13 +23334,8 @@ CUI.ready((function(_this) { } } CUI.defaults.marked_opts = { - renderer: new marked.Renderer(), gfm: true, - tables: true, - breaks: false, - pedantic: false, - smartLists: true, - smartypants: false + renderer: new Renderer() }; marked.setOptions(CUI.defaults.marked_opts); nodes = CUI.dom.htmlToNodes(""); @@ -35067,7 +35062,7 @@ CoordinatesParser = __webpack_require__(/*! coordinate-parser */ "../node_module CoordinatesFormat = __webpack_require__(/*! formatcoords */ "../node_modules/formatcoords/index.js"); -marked = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.js"); +marked = (__webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.esm.js").marked); moment = __webpack_require__(/*! moment */ "../node_modules/moment/moment.js"); @@ -35916,18 +35911,10 @@ CUI.util.moment = moment; CUI.util.marked = marked; -String.prototype.startsWith = function(s) { - return this.substr(0, s.length) === s; -}; - String.prototype.startsWithIgnoreCase = function(s) { return this.toUpperCase().startsWith(s.toUpperCase()); }; -String.prototype.endsWith = function(s) { - return this.substr(this.length - s.length) === s; -}; - RegExp.escape = function(s) { return s.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&'); }; @@ -43872,11 +43859,13 @@ CUI.DigiDisplay = (function(superClass) { * MIT Licence * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org */ -var marked, +var DOMPurify, Renderer, marked, ref, extend = function(child, parent) { for (var key in parent) { if (hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; }, hasProp = {}.hasOwnProperty; -marked = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.js"); +ref = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.esm.js"), marked = ref.marked, Renderer = ref.Renderer; + +DOMPurify = __webpack_require__(/*! dompurify */ "../node_modules/dompurify/dist/purify.cjs.js"); CUI.DocumentBrowser = (function(superClass) { extend(DocumentBrowser, superClass); @@ -43940,16 +43929,20 @@ CUI.DocumentBrowser = (function(superClass) { DocumentBrowser.__super__.readOpts.call(this); this.__marked_opts = CUI.util.copyObject(this._marked_opts); if (!this.__marked_opts.renderer) { - this.__marked_opts.renderer = new marked.Renderer(); + this.__marked_opts.renderer = new Renderer(); } renderer = this.__marked_opts.renderer; renderer.image = (function(_this) { - return function(href, title, text) { + return function(arg) { + var href, text, title; + href = arg.href, title = arg.title, text = arg.text; return _this.__node.rendererImage(href, title, text); }; })(this); renderer.link = (function(_this) { - return function(href, title, text) { + return function(arg) { + var href, text, title; + href = arg.href, title = arg.title, text = arg.text; return _this.__node.rendererLink(href, title, text); }; })(this); @@ -43966,7 +43959,7 @@ CUI.DocumentBrowser = (function(superClass) { dfr = new CUI.Deferred(); mark = (function(_this) { return function(markdown) { - return dfr.resolve(marked(markdown, _this.__marked_opts)); + return dfr.resolve(DOMPurify.sanitize(marked(markdown, _this.__marked_opts))); }; })(this); ret = this._getMarkdown(markdown); @@ -44098,13 +44091,13 @@ CUI.DocumentBrowser = (function(superClass) { }; DocumentBrowser.prototype.addWords = function(texts) { - var _word, i, j, len, len1, ref, text, word; + var _word, i, j, len, len1, ref1, text, word; return; for (i = 0, len = texts.length; i < len; i++) { text = texts[i]; - ref = text.split(/(\s+)/); - for (j = 0, len1 = ref.length; j < len1; j++) { - _word = ref[j]; + ref1 = text.split(/(\s+)/); + for (j = 0, len1 = ref1.length; j < len1; j++) { + _word = ref1[j]; word = _word.replace(/[\^\$\"\.,\-\(\)\s\t]/g, ""); if (word.length === 0) { continue; @@ -44219,11 +44212,11 @@ CUI.DocumentBrowser = (function(superClass) { DocumentBrowser.prototype.load = function() { return this.__tree.root.open().done((function(_this) { return function() { - var count, ref, word; + var count, ref1, word; _this.__all_words = []; - ref = _this.__words; - for (word in ref) { - count = ref[word]; + ref1 = _this.__words; + for (word in ref1) { + count = ref1[word]; _this.__all_words.push({ word: word, count: count, @@ -51404,11 +51397,13 @@ CUI.EmptyLabel = (function(superClass) { * MIT Licence * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org */ -var marked, +var DOMPurify, marked, extend = function(child, parent) { for (var key in parent) { if (hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; }, hasProp = {}.hasOwnProperty; -marked = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.js"); +marked = (__webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.esm.js").marked); + +DOMPurify = __webpack_require__(/*! dompurify */ "../node_modules/dompurify/dist/purify.cjs.js"); CUI.Template.loadTemplateText(__webpack_require__(/*! ./Label.html */ "./elements/Label/Label.html")); @@ -51568,6 +51563,10 @@ CUI.Label = (function(superClass) { markdown_opts: { check: "PlainObject" }, + sanitizeMarkdown: { + check: Boolean, + "default": true + }, tooltip: { check: "PlainObject" }, @@ -51640,6 +51639,7 @@ CUI.Label = (function(superClass) { }; Label.prototype.setText = function(__currentText, markdown) { + var htmlValue, renderedMarkdown; this.__currentText = __currentText; if (markdown == null) { markdown = this.__markdown; @@ -51647,7 +51647,9 @@ CUI.Label = (function(superClass) { if (CUI.util.isEmpty(this.__currentText)) { this.empty("content"); } else if (markdown) { - this.setContent(CUI.dom.htmlToNodes(marked(this.__currentText, this.__markdown_opts))); + renderedMarkdown = marked(this.__currentText, this.__markdown_opts); + htmlValue = this._sanitizeMarkdown ? DOMPurify.sanitize(renderedMarkdown) : renderedMarkdown; + this.setContent(CUI.dom.htmlToNodes(htmlValue)); this.addClass("cui-label-markdown"); } else if (this._text_node_func) { this.setContent(this._text_node_func(this.__currentText)); @@ -57836,11 +57838,13 @@ CUI.MapInput = (function(superClass) { * MIT Licence * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org */ -var marked, +var DOMPurify, marked, extend = function(child, parent) { for (var key in parent) { if (hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; }, hasProp = {}.hasOwnProperty; -marked = __webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.js"); +marked = (__webpack_require__(/*! marked */ "../node_modules/marked/lib/marked.esm.js").marked); + +DOMPurify = __webpack_require__(/*! dompurify */ "../node_modules/dompurify/dist/purify.cjs.js"); CUI.MarkdownInput = (function(superClass) { extend(MarkdownInput, superClass); @@ -58108,7 +58112,7 @@ CUI.MarkdownInput = (function(superClass) { }; MarkdownInput.prototype.renderHTML = function() { - return this._renderFunction(this.getElement().value); + return DOMPurify.sanitize(this._renderFunction(this.getElement().value)); }; MarkdownInput.__escape_regexp = new RegExp('[\\' + ('*-_\\![]()'.split("").join("\\")) + ']', 'g'); @@ -65061,6 +65065,2268 @@ Validator = class Validator { module.exports = Validator; +/***/ }), + +/***/ "../node_modules/dompurify/dist/purify.cjs.js": +/*!****************************************************!*\ + !*** ../node_modules/dompurify/dist/purify.cjs.js ***! + \****************************************************/ +/***/ ((module) => { + +"use strict"; +/*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE */ + + + +function _arrayLikeToArray(r, a) { + (null == a || a > r.length) && (a = r.length); + for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; + return n; +} +function _arrayWithHoles(r) { + if (Array.isArray(r)) return r; +} +function _iterableToArrayLimit(r, l) { + var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; + if (null != t) { + var e, + n, + i, + u, + a = [], + f = true, + o = false; + try { + if (i = (t = t.call(r)).next, 0 === l) ; else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0); + } catch (r) { + o = true, n = r; + } finally { + try { + if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return; + } finally { + if (o) throw n; + } + } + return a; + } +} +function _nonIterableRest() { + throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); +} +function _slicedToArray(r, e) { + return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest(); +} +function _unsupportedIterableToArray(r, a) { + if (r) { + if ("string" == typeof r) return _arrayLikeToArray(r, a); + var t = {}.toString.call(r).slice(8, -1); + return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; + } +} + +const entries = Object.entries, + setPrototypeOf = Object.setPrototypeOf, + isFrozen = Object.isFrozen, + getPrototypeOf = Object.getPrototypeOf, + getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor; +let freeze = Object.freeze, + seal = Object.seal, + create = Object.create; // eslint-disable-line import/no-mutable-exports +let _ref = typeof Reflect !== 'undefined' && Reflect, + apply = _ref.apply, + construct = _ref.construct; +if (!freeze) { + freeze = function freeze(x) { + return x; + }; +} +if (!seal) { + seal = function seal(x) { + return x; + }; +} +if (!apply) { + apply = function apply(func, thisArg) { + for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) { + args[_key - 2] = arguments[_key]; + } + return func.apply(thisArg, args); + }; +} +if (!construct) { + construct = function construct(Func) { + for (var _len2 = arguments.length, args = new Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) { + args[_key2 - 1] = arguments[_key2]; + } + return new Func(...args); + }; +} +const arrayForEach = unapply(Array.prototype.forEach); +const arrayLastIndexOf = unapply(Array.prototype.lastIndexOf); +const arrayPop = unapply(Array.prototype.pop); +const arrayPush = unapply(Array.prototype.push); +const arraySplice = unapply(Array.prototype.splice); +const arrayIsArray = Array.isArray; +const stringToLowerCase = unapply(String.prototype.toLowerCase); +const stringToString = unapply(String.prototype.toString); +const stringMatch = unapply(String.prototype.match); +const stringReplace = unapply(String.prototype.replace); +const stringIndexOf = unapply(String.prototype.indexOf); +const stringTrim = unapply(String.prototype.trim); +const numberToString = unapply(Number.prototype.toString); +const booleanToString = unapply(Boolean.prototype.toString); +const bigintToString = typeof BigInt === 'undefined' ? null : unapply(BigInt.prototype.toString); +const symbolToString = typeof Symbol === 'undefined' ? null : unapply(Symbol.prototype.toString); +const objectHasOwnProperty = unapply(Object.prototype.hasOwnProperty); +const objectToString = unapply(Object.prototype.toString); +const regExpTest = unapply(RegExp.prototype.test); +const typeErrorCreate = unconstruct(TypeError); +/** + * Creates a new function that calls the given function with a specified thisArg and arguments. + * + * @param func - The function to be wrapped and called. + * @returns A new function that calls the given function with a specified thisArg and arguments. + */ +function unapply(func) { + return function (thisArg) { + if (thisArg instanceof RegExp) { + thisArg.lastIndex = 0; + } + for (var _len3 = arguments.length, args = new Array(_len3 > 1 ? _len3 - 1 : 0), _key3 = 1; _key3 < _len3; _key3++) { + args[_key3 - 1] = arguments[_key3]; + } + return apply(func, thisArg, args); + }; +} +/** + * Creates a new function that constructs an instance of the given constructor function with the provided arguments. + * + * @param func - The constructor function to be wrapped and called. + * @returns A new function that constructs an instance of the given constructor function with the provided arguments. + */ +function unconstruct(Func) { + return function () { + for (var _len4 = arguments.length, args = new Array(_len4), _key4 = 0; _key4 < _len4; _key4++) { + args[_key4] = arguments[_key4]; + } + return construct(Func, args); + }; +} +/** + * Add properties to a lookup table + * + * @param set - The set to which elements will be added. + * @param array - The array containing elements to be added to the set. + * @param transformCaseFunc - An optional function to transform the case of each element before adding to the set. + * @returns The modified set with added elements. + */ +function addToSet(set, array) { + let transformCaseFunc = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : stringToLowerCase; + if (setPrototypeOf) { + // Make 'in' and truthy checks like Boolean(set.constructor) + // independent of any properties defined on Object.prototype. + // Prevent prototype setters from intercepting set as a this value. + setPrototypeOf(set, null); + } + if (!arrayIsArray(array)) { + return set; + } + let l = array.length; + while (l--) { + let element = array[l]; + if (typeof element === 'string') { + const lcElement = transformCaseFunc(element); + if (lcElement !== element) { + // Config presets (e.g. tags.js, attrs.js) are immutable. + if (!isFrozen(array)) { + array[l] = lcElement; + } + element = lcElement; + } + } + set[element] = true; + } + return set; +} +/** + * Clean up an array to harden against CSPP + * + * @param array - The array to be cleaned. + * @returns The cleaned version of the array + */ +function cleanArray(array) { + for (let index = 0; index < array.length; index++) { + const isPropertyExist = objectHasOwnProperty(array, index); + if (!isPropertyExist) { + array[index] = null; + } + } + return array; +} +/** + * Shallow clone an object + * + * @param object - The object to be cloned. + * @returns A new object that copies the original. + */ +function clone(object) { + const newObject = create(null); + for (const _ref2 of entries(object)) { + var _ref3 = _slicedToArray(_ref2, 2); + const property = _ref3[0]; + const value = _ref3[1]; + const isPropertyExist = objectHasOwnProperty(object, property); + if (isPropertyExist) { + if (arrayIsArray(value)) { + newObject[property] = cleanArray(value); + } else if (value && typeof value === 'object' && value.constructor === Object) { + newObject[property] = clone(value); + } else { + newObject[property] = value; + } + } + } + return newObject; +} +/** + * Convert non-node values into strings without depending on direct property access. + * + * @param value - The value to stringify. + * @returns A string representation of the provided value. + */ +function stringifyValue(value) { + switch (typeof value) { + case 'string': + { + return value; + } + case 'number': + { + return numberToString(value); + } + case 'boolean': + { + return booleanToString(value); + } + case 'bigint': + { + return bigintToString ? bigintToString(value) : '0'; + } + case 'symbol': + { + return symbolToString ? symbolToString(value) : 'Symbol()'; + } + case 'undefined': + { + return objectToString(value); + } + case 'function': + case 'object': + { + if (value === null) { + return objectToString(value); + } + const valueAsRecord = value; + const valueToString = lookupGetter(valueAsRecord, 'toString'); + if (typeof valueToString === 'function') { + const stringified = valueToString(valueAsRecord); + return typeof stringified === 'string' ? stringified : objectToString(stringified); + } + return objectToString(value); + } + default: + { + return objectToString(value); + } + } +} +/** + * This method automatically checks if the prop is function or getter and behaves accordingly. + * + * @param object - The object to look up the getter function in its prototype chain. + * @param prop - The property name for which to find the getter function. + * @returns The getter function found in the prototype chain or a fallback function. + */ +function lookupGetter(object, prop) { + while (object !== null) { + const desc = getOwnPropertyDescriptor(object, prop); + if (desc) { + if (desc.get) { + return unapply(desc.get); + } + if (typeof desc.value === 'function') { + return unapply(desc.value); + } + } + object = getPrototypeOf(object); + } + function fallbackValue() { + return null; + } + return fallbackValue; +} +function isRegex(value) { + try { + regExpTest(value, ''); + return true; + } catch (_unused) { + return false; + } +} + +const html$1 = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'search', 'section', 'select', 'shadow', 'slot', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); +const svg$1 = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'enterkeyhint', 'exportparts', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'inputmode', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'part', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']); +const svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feDropShadow', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); +// List of SVG elements that are disallowed by default. +// We still need to know them so that we can do namespace +// checks properly in case one wants to add them to +// allow-list. +const svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']); +const mathMl$1 = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover', 'mprescripts']); +// Similarly to SVG, we want to know all MathML elements, +// even those that we disallow by default. +const mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']); +const text = freeze(['#text']); + +const html = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'command', 'commandfor', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'exportparts', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inert', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'part', 'pattern', 'placeholder', 'playsinline', 'popover', 'popovertarget', 'popovertargetaction', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'slot', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'wrap', 'xmlns']); +const svg = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'amplitude', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'exponent', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'intercept', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'mask-type', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'slope', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'tablevalues', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']); +const mathMl = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnalign', 'columnlines', 'columnspacing', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lquote', 'lspace', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']); +const xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']); + +const MUSTACHE_EXPR = seal(/{{[\w\W]*|^[\w\W]*}}/g); +const ERB_EXPR = seal(/<%[\w\W]*|^[\w\W]*%>/g); +const TMPLIT_EXPR = seal(/\${[\w\W]*/g); +const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape +const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape +const IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape +); +const IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i); +const ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex +); +const DOCTYPE_NAME = seal(/^html$/i); +const CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i); +// Markup-significant character probes used by _sanitizeElements. +// Shared module-level instances are safe despite the sticky /g flags: +// unapply() resets lastIndex for RegExp receivers before every call. +const ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g); +const COMMENT_MARKUP_PROBE = seal(/<[/\w]/g); +const FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i); +const SELF_CLOSING_TAG = seal(/\/>/i); + +// https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType +const NODE_TYPE = { + element: 1, + attribute: 2, + text: 3, + cdataSection: 4, + entityReference: 5, + // Deprecated + entityNode: 6, + // Deprecated + processingInstruction: 7, + comment: 8, + document: 9, + documentType: 10, + documentFragment: 11, + notation: 12 // Deprecated +}; +const getGlobal = function getGlobal() { + return typeof window === 'undefined' ? null : window; +}; +/** + * Creates a no-op policy for internal use only. + * Don't export this function outside this module! + * @param trustedTypes The policy factory. + * @param purifyHostElement The Script element used to load DOMPurify (to determine policy name suffix). + * @return The policy created (or null, if Trusted Types + * are not supported or creating the policy failed). + */ +const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) { + if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') { + return null; + } + // Allow the callers to control the unique policy name + // by adding a data-tt-policy-suffix to the script element with the DOMPurify. + // Policy creation with duplicate names throws in Trusted Types. + let suffix = null; + const ATTR_NAME = 'data-tt-policy-suffix'; + if (purifyHostElement && purifyHostElement.hasAttribute(ATTR_NAME)) { + suffix = purifyHostElement.getAttribute(ATTR_NAME); + } + const policyName = 'dompurify' + (suffix ? '#' + suffix : ''); + try { + return trustedTypes.createPolicy(policyName, { + createHTML(html) { + return html; + }, + createScriptURL(scriptUrl) { + return scriptUrl; + } + }); + } catch (_) { + // Policy creation failed (most likely another DOMPurify script has + // already run). Skip creating the policy, as this will only cause errors + // if TT are enforced. + console.warn('TrustedTypes policy ' + policyName + ' could not be created.'); + return null; + } +}; +const _createHooksMap = function _createHooksMap() { + return { + afterSanitizeAttributes: [], + afterSanitizeElements: [], + afterSanitizeShadowDOM: [], + beforeSanitizeAttributes: [], + beforeSanitizeElements: [], + beforeSanitizeShadowDOM: [], + uponSanitizeAttribute: [], + uponSanitizeElement: [], + uponSanitizeShadowNode: [] + }; +}; +/** + * Resolve a set-valued configuration option: a fresh set built from + * cfg[key] when it is an own array property (seeded with a clone of + * options.base when given, case-normalized via options.transform), + * the fallback set otherwise. + * + * @param cfg the cloned, prototype-free configuration object + * @param key the configuration property to read + * @param fallback the set to use when the option is absent or not an array + * @param options transform and optional base set to merge into + * @returns the resolved set + */ +const _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options) { + return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback; +}; +function createDOMPurify() { + let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal(); + const DOMPurify = root => createDOMPurify(root); + DOMPurify.version = '3.4.11'; + DOMPurify.removed = []; + if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) { + // Not running in a browser, provide a factory function + // so that you can pass your own Window + DOMPurify.isSupported = false; + return DOMPurify; + } + let document = window.document; + const originalDocument = document; + const currentScript = originalDocument.currentScript; + window.DocumentFragment; + const HTMLTemplateElement = window.HTMLTemplateElement, + Node = window.Node, + Element = window.Element, + NodeFilter = window.NodeFilter, + _window$NamedNodeMap = window.NamedNodeMap; + _window$NamedNodeMap === void 0 ? window.NamedNodeMap || window.MozNamedAttrMap : _window$NamedNodeMap; + window.HTMLFormElement; + const DOMParser = window.DOMParser, + trustedTypes = window.trustedTypes; + const ElementPrototype = Element.prototype; + const cloneNode = lookupGetter(ElementPrototype, 'cloneNode'); + const remove = lookupGetter(ElementPrototype, 'remove'); + const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling'); + const getChildNodes = lookupGetter(ElementPrototype, 'childNodes'); + const getParentNode = lookupGetter(ElementPrototype, 'parentNode'); + const getShadowRoot = lookupGetter(ElementPrototype, 'shadowRoot'); + const getAttributes = lookupGetter(ElementPrototype, 'attributes'); + const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeType') : null; + const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, 'nodeName') : null; + // As per issue #47, the web-components registry is inherited by a + // new document created via createHTMLDocument. As per the spec + // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries) + // a new empty registry is used when creating a template contents owner + // document, so we use that as our parent document to ensure nothing + // is inherited. + if (typeof HTMLTemplateElement === 'function') { + const template = document.createElement('template'); + if (template.content && template.content.ownerDocument) { + document = template.content.ownerDocument; + } + } + let trustedTypesPolicy; + let emptyHTML = ''; + // The instance's own internal Trusted Types policy. Unlike a caller-supplied + // `TRUSTED_TYPES_POLICY`, this is created at most once — Trusted Types throws + // on duplicate policy names — and is the only policy allowed to persist + // across configurations and survive `clearConfig()`. + let defaultTrustedTypesPolicy; + let defaultTrustedTypesPolicyResolved = false; + // Tracks whether we are already inside a call to the configured Trusted Types + // policy (`createHTML` or `createScriptURL`). If a supplied policy callback + // itself calls `DOMPurify.sanitize` (the cause of #1422), `sanitize` would + // re-enter the policy and recurse until the stack overflows. We detect that + // re-entry and throw a clear, actionable error instead. The guard is shared + // across both callbacks, because either one re-entering `sanitize` triggers + // the same unbounded recursion. + let IN_TRUSTED_TYPES_POLICY = 0; + const _assertNotInTrustedTypesPolicy = function _assertNotInTrustedTypesPolicy() { + if (IN_TRUSTED_TYPES_POLICY > 0) { + throw typeErrorCreate('A configured TRUSTED_TYPES_POLICY callback (createHTML or ' + 'createScriptURL) must not call DOMPurify.sanitize, as that causes ' + 'infinite recursion. Do not pass a policy whose callbacks wrap ' + 'DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted ' + 'Types" section of the README.'); + } + }; + const _createTrustedHTML = function _createTrustedHTML(html) { + _assertNotInTrustedTypesPolicy(); + IN_TRUSTED_TYPES_POLICY++; + try { + return trustedTypesPolicy.createHTML(html); + } finally { + IN_TRUSTED_TYPES_POLICY--; + } + }; + const _createTrustedScriptURL = function _createTrustedScriptURL(scriptUrl) { + _assertNotInTrustedTypesPolicy(); + IN_TRUSTED_TYPES_POLICY++; + try { + return trustedTypesPolicy.createScriptURL(scriptUrl); + } finally { + IN_TRUSTED_TYPES_POLICY--; + } + }; + // Lazily resolve (and cache) the instance's internal default policy. + // Resolution is attempted at most once: a successful `createPolicy` cannot be + // repeated (Trusted Types throws on duplicate names), and a failed or + // unsupported attempt must not be retried on every parse. + const _getDefaultTrustedTypesPolicy = function _getDefaultTrustedTypesPolicy() { + if (!defaultTrustedTypesPolicyResolved) { + defaultTrustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript); + defaultTrustedTypesPolicyResolved = true; + } + return defaultTrustedTypesPolicy; + }; + const _document = document, + implementation = _document.implementation, + createNodeIterator = _document.createNodeIterator, + createDocumentFragment = _document.createDocumentFragment, + getElementsByTagName = _document.getElementsByTagName; + const importNode = originalDocument.importNode; + let hooks = _createHooksMap(); + /** + * Expose whether this browser supports running the full DOMPurify. + */ + DOMPurify.isSupported = typeof entries === 'function' && typeof getParentNode === 'function' && implementation && implementation.createHTMLDocument !== undefined; + const MUSTACHE_EXPR$1 = MUSTACHE_EXPR, + ERB_EXPR$1 = ERB_EXPR, + TMPLIT_EXPR$1 = TMPLIT_EXPR, + DATA_ATTR$1 = DATA_ATTR, + ARIA_ATTR$1 = ARIA_ATTR, + IS_SCRIPT_OR_DATA$1 = IS_SCRIPT_OR_DATA, + ATTR_WHITESPACE$1 = ATTR_WHITESPACE, + CUSTOM_ELEMENT$1 = CUSTOM_ELEMENT; + let IS_ALLOWED_URI$1 = IS_ALLOWED_URI; + /** + * We consider the elements and attributes below to be safe. Ideally + * don't add any new ones but feel free to remove unwanted ones. + */ + /* allowed element names */ + let ALLOWED_TAGS = null; + const DEFAULT_ALLOWED_TAGS = addToSet({}, [...html$1, ...svg$1, ...svgFilters, ...mathMl$1, ...text]); + /* Allowed attribute names */ + let ALLOWED_ATTR = null; + const DEFAULT_ALLOWED_ATTR = addToSet({}, [...html, ...svg, ...mathMl, ...xml]); + /* + * Configure how DOMPurify should handle custom elements and their attributes as well as customized built-in elements. + * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements) + * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list) + * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`. + */ + let CUSTOM_ELEMENT_HANDLING = Object.seal(create(null, { + tagNameCheck: { + writable: true, + configurable: false, + enumerable: true, + value: null + }, + attributeNameCheck: { + writable: true, + configurable: false, + enumerable: true, + value: null + }, + allowCustomizedBuiltInElements: { + writable: true, + configurable: false, + enumerable: true, + value: false + } + })); + /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */ + let FORBID_TAGS = null; + /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */ + let FORBID_ATTR = null; + /* Config object to store ADD_TAGS/ADD_ATTR functions (when used as functions) */ + const EXTRA_ELEMENT_HANDLING = Object.seal(create(null, { + tagCheck: { + writable: true, + configurable: false, + enumerable: true, + value: null + }, + attributeCheck: { + writable: true, + configurable: false, + enumerable: true, + value: null + } + })); + /* Decide if ARIA attributes are okay */ + let ALLOW_ARIA_ATTR = true; + /* Decide if custom data attributes are okay */ + let ALLOW_DATA_ATTR = true; + /* Decide if unknown protocols are okay */ + let ALLOW_UNKNOWN_PROTOCOLS = false; + /* Decide if self-closing tags in attributes are allowed. + * Usually removed due to a mXSS issue in jQuery 3.0 */ + let ALLOW_SELF_CLOSE_IN_ATTR = true; + /* Output should be safe for common template engines. + * This means, DOMPurify removes data attributes, mustaches and ERB + */ + let SAFE_FOR_TEMPLATES = false; + /* Output should be safe even for XML used within HTML and alike. + * This means, DOMPurify removes comments when containing risky content. + */ + let SAFE_FOR_XML = true; + /* Decide if document with ... should be returned */ + let WHOLE_DOCUMENT = false; + /* Track whether config is already set on this instance of DOMPurify. */ + let SET_CONFIG = false; + /* Pristine allowlist bindings captured at setConfig() time. On the + * persistent-config path sanitize() restores the sets from these before + * the per-walk hook clone-guard, so a hook's in-call widening cannot + * carry across calls. Null until setConfig() is called; reset by + * clearConfig(). */ + let SET_CONFIG_ALLOWED_TAGS = null; + let SET_CONFIG_ALLOWED_ATTR = null; + /* Decide if all elements (e.g. style, script) must be children of + * document.body. By default, browsers might move them to document.head */ + let FORCE_BODY = false; + /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html + * string (or a TrustedHTML object if Trusted Types are supported). + * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead + */ + let RETURN_DOM = false; + /* Decide if a DOM `DocumentFragment` should be returned, instead of a html + * string (or a TrustedHTML object if Trusted Types are supported) */ + let RETURN_DOM_FRAGMENT = false; + /* Try to return a Trusted Type object instead of a string, return a string in + * case Trusted Types are not supported */ + let RETURN_TRUSTED_TYPE = false; + /* Output should be free from DOM clobbering attacks? + * This sanitizes markups named with colliding, clobberable built-in DOM APIs. + */ + let SANITIZE_DOM = true; + /* Achieve full DOM Clobbering protection by isolating the namespace of named + * properties and JS variables, mitigating attacks that abuse the HTML/DOM spec rules. + * + * HTML/DOM spec rules that enable DOM Clobbering: + * - Named Access on Window (§7.3.3) + * - DOM Tree Accessors (§3.1.5) + * - Form Element Parent-Child Relations (§4.10.3) + * - Iframe srcdoc / Nested WindowProxies (§4.8.5) + * - HTMLCollection (§4.2.10.2) + * + * Namespace isolation is implemented by prefixing `id` and `name` attributes + * with a constant string, i.e., `user-content-` + */ + let SANITIZE_NAMED_PROPS = false; + const SANITIZE_NAMED_PROPS_PREFIX = 'user-content-'; + /* Keep element content when removing element? */ + let KEEP_CONTENT = true; + /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead + * of importing it into a new Document and returning a sanitized copy */ + let IN_PLACE = false; + /* Allow usage of profiles like html, svg and mathMl */ + let USE_PROFILES = {}; + /* Tags to ignore content of when KEEP_CONTENT is true */ + let FORBID_CONTENTS = null; + const DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', + // mirrors the selected