智慧水务管理系统 - 精河县供水工程综合管理平台

purify.cjs.d.ts 16KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451
  1. /*! @license DOMPurify 3.4.10 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.10/LICENSE */
  2. import { TrustedTypePolicy, TrustedTypesWindow, TrustedHTML } from 'trusted-types/lib/index.js';
  3. /**
  4. * Configuration to control DOMPurify behavior.
  5. */
  6. interface Config {
  7. /**
  8. * Extend the existing array of allowed attributes.
  9. * Can be an array of attribute names, or a function that receives
  10. * the attribute name and tag name to determine if the attribute is allowed.
  11. */
  12. ADD_ATTR?: string[] | ((attributeName: string, tagName: string) => boolean) | undefined;
  13. /**
  14. * Extend the existing array of elements that can use Data URIs.
  15. */
  16. ADD_DATA_URI_TAGS?: string[] | undefined;
  17. /**
  18. * Extend the existing array of allowed tags.
  19. * Can be an array of tag names, or a function that receives
  20. * the tag name to determine if the tag is allowed.
  21. */
  22. ADD_TAGS?: string[] | ((tagName: string) => boolean) | undefined;
  23. /**
  24. * Extend the existing array of elements that are safe for URI-like values (be careful, XSS risk).
  25. */
  26. ADD_URI_SAFE_ATTR?: string[] | undefined;
  27. /**
  28. * Allow ARIA attributes, leave other safe HTML as is (default is true).
  29. */
  30. ALLOW_ARIA_ATTR?: boolean | undefined;
  31. /**
  32. * Allow HTML5 data attributes, leave other safe HTML as is (default is true).
  33. */
  34. ALLOW_DATA_ATTR?: boolean | undefined;
  35. /**
  36. * Allow external protocol handlers in URL attributes (default is false, be careful, XSS risk).
  37. * By default only `http`, `https`, `ftp`, `ftps`, `tel`, `mailto`, `callto`, `sms`, `cid` and `xmpp` are allowed.
  38. */
  39. ALLOW_UNKNOWN_PROTOCOLS?: boolean | undefined;
  40. /**
  41. * Decide if self-closing tags in attributes are allowed.
  42. * Usually removed due to a mXSS issue in jQuery 3.0.
  43. */
  44. ALLOW_SELF_CLOSE_IN_ATTR?: boolean | undefined;
  45. /**
  46. * Allow only specific attributes.
  47. */
  48. ALLOWED_ATTR?: string[] | undefined;
  49. /**
  50. * Allow only specific elements.
  51. */
  52. ALLOWED_TAGS?: string[] | undefined;
  53. /**
  54. * Allow only specific namespaces. Defaults to:
  55. * - `http://www.w3.org/1999/xhtml`
  56. * - `http://www.w3.org/2000/svg`
  57. * - `http://www.w3.org/1998/Math/MathML`
  58. */
  59. ALLOWED_NAMESPACES?: string[] | undefined;
  60. /**
  61. * Allow specific protocols handlers in URL attributes via regex (be careful, XSS risk).
  62. * Default RegExp:
  63. * ```
  64. * /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
  65. * ```
  66. */
  67. ALLOWED_URI_REGEXP?: RegExp | undefined;
  68. /**
  69. * Define how custom elements are handled.
  70. */
  71. CUSTOM_ELEMENT_HANDLING?: {
  72. /**
  73. * Regular expression or function to match to allowed elements.
  74. * Default is null (disallow any custom elements).
  75. */
  76. tagNameCheck?: RegExp | ((tagName: string) => boolean) | null | undefined;
  77. /**
  78. * Regular expression or function to match to allowed attributes.
  79. * Default is null (disallow any attributes not on the allow list).
  80. */
  81. attributeNameCheck?: RegExp | ((attributeName: string, tagName?: string) => boolean) | null | undefined;
  82. /**
  83. * Allow custom elements derived from built-ins if they pass `tagNameCheck`. Default is false.
  84. */
  85. allowCustomizedBuiltInElements?: boolean | undefined;
  86. };
  87. /**
  88. * Add attributes to block-list.
  89. */
  90. FORBID_ATTR?: string[] | undefined;
  91. /**
  92. * Add child elements to be removed when their parent is removed.
  93. */
  94. FORBID_CONTENTS?: string[] | undefined;
  95. /**
  96. * Extend the existing or default array of forbidden content elements.
  97. */
  98. ADD_FORBID_CONTENTS?: string[] | undefined;
  99. /**
  100. * Add elements to block-list.
  101. */
  102. FORBID_TAGS?: string[] | undefined;
  103. /**
  104. * Glue elements like style, script or others to `document.body` and prevent unintuitive browser behavior in several edge-cases (default is false).
  105. */
  106. FORCE_BODY?: boolean | undefined;
  107. /**
  108. * Map of non-standard HTML element names to support. Map to true to enable support. For example:
  109. *
  110. * ```
  111. * HTML_INTEGRATION_POINTS: { foreignobject: true }
  112. * ```
  113. */
  114. HTML_INTEGRATION_POINTS?: Record<string, boolean> | undefined;
  115. /**
  116. * Sanitize a node "in place", which is much faster depending on how you use DOMPurify.
  117. */
  118. IN_PLACE?: boolean | undefined;
  119. /**
  120. * Keep an element's content when the element is removed (default is true).
  121. */
  122. KEEP_CONTENT?: boolean | undefined;
  123. /**
  124. * Map of MathML element names to support. Map to true to enable support. For example:
  125. *
  126. * ```
  127. * MATHML_TEXT_INTEGRATION_POINTS: { mtext: true }
  128. * ```
  129. */
  130. MATHML_TEXT_INTEGRATION_POINTS?: Record<string, boolean> | undefined;
  131. /**
  132. * Change the default namespace from HTML to something different.
  133. */
  134. NAMESPACE?: string | undefined;
  135. /**
  136. * Change the parser type so sanitized data is treated as XML and not as HTML, which is the default.
  137. */
  138. PARSER_MEDIA_TYPE?: DOMParserSupportedType | undefined;
  139. /**
  140. * Return a DOM `DocumentFragment` instead of an HTML string (default is false).
  141. */
  142. RETURN_DOM_FRAGMENT?: boolean | undefined;
  143. /**
  144. * Return a DOM `HTMLBodyElement` instead of an HTML string (default is false).
  145. */
  146. RETURN_DOM?: boolean | undefined;
  147. /**
  148. * Return a TrustedHTML object instead of a string if possible.
  149. */
  150. RETURN_TRUSTED_TYPE?: boolean | undefined;
  151. /**
  152. * Strip `{{ ... }}`, `${ ... }` and `<% ... %>` to make output safe for template systems.
  153. * Be careful please, this mode is not recommended for production usage.
  154. * Allowing template parsing in user-controlled HTML is not advised at all.
  155. * Only use this mode if there is really no alternative.
  156. */
  157. SAFE_FOR_TEMPLATES?: boolean | undefined;
  158. /**
  159. * Change how e.g. comments containing risky HTML characters are treated.
  160. * Be very careful, this setting should only be set to `false` if you really only handle
  161. * HTML and nothing else, no SVG, MathML or the like.
  162. * Otherwise, changing from `true` to `false` will lead to XSS in this or some other way.
  163. */
  164. SAFE_FOR_XML?: boolean | undefined;
  165. /**
  166. * Use DOM Clobbering protection on output (default is true, handle with care, minor XSS risks here).
  167. */
  168. SANITIZE_DOM?: boolean | undefined;
  169. /**
  170. * Enforce strict DOM Clobbering protection via namespace isolation (default is false).
  171. * When enabled, isolates the namespace of named properties (i.e., `id` and `name` attributes)
  172. * from JS variables by prefixing them with the string `user-content-`
  173. */
  174. SANITIZE_NAMED_PROPS?: boolean | undefined;
  175. /**
  176. * Supplied policy must define `createHTML` and `createScriptURL`.
  177. */
  178. TRUSTED_TYPES_POLICY?: TrustedTypePolicy | null | undefined;
  179. /**
  180. * Controls categories of allowed elements.
  181. *
  182. * Note that the `USE_PROFILES` setting will override the `ALLOWED_TAGS` setting
  183. * so don't use them together.
  184. */
  185. USE_PROFILES?: false | UseProfilesConfig | undefined;
  186. /**
  187. * Return entire document including <html> tags (default is false).
  188. */
  189. WHOLE_DOCUMENT?: boolean | undefined;
  190. }
  191. /**
  192. * Defines categories of allowed elements.
  193. */
  194. interface UseProfilesConfig {
  195. /**
  196. * Allow all safe MathML elements.
  197. */
  198. mathMl?: boolean | undefined;
  199. /**
  200. * Allow all safe SVG elements.
  201. */
  202. svg?: boolean | undefined;
  203. /**
  204. * Allow all safe SVG Filters.
  205. */
  206. svgFilters?: boolean | undefined;
  207. /**
  208. * Allow all safe HTML elements.
  209. */
  210. html?: boolean | undefined;
  211. }
  212. interface DOMPurify {
  213. /**
  214. * Creates a DOMPurify instance using the given window-like object. Defaults to `window`.
  215. */
  216. (root?: WindowLike): DOMPurify;
  217. /**
  218. * Version label, exposed for easier checks
  219. * if DOMPurify is up to date or not
  220. */
  221. version: string;
  222. /**
  223. * Array of elements that DOMPurify removed during sanitation.
  224. * Empty if nothing was removed.
  225. */
  226. removed: Array<RemovedElement | RemovedAttribute>;
  227. /**
  228. * Expose whether this browser supports running the full DOMPurify.
  229. */
  230. isSupported: boolean;
  231. /**
  232. * Set the configuration once.
  233. *
  234. * @param cfg configuration object
  235. */
  236. setConfig(cfg?: Config): void;
  237. /**
  238. * Removes the configuration.
  239. */
  240. clearConfig(): void;
  241. /**
  242. * Provides core sanitation functionality.
  243. *
  244. * @param dirty string or DOM node
  245. * @param cfg object
  246. * @returns Sanitized TrustedHTML.
  247. */
  248. sanitize(dirty: string | Node, cfg: Config & {
  249. RETURN_TRUSTED_TYPE: true;
  250. }): TrustedHTML;
  251. /**
  252. * Provides core sanitation functionality.
  253. *
  254. * @param dirty DOM node
  255. * @param cfg object
  256. * @returns Sanitized DOM node.
  257. */
  258. sanitize(dirty: Node, cfg: Config & {
  259. IN_PLACE: true;
  260. }): Node;
  261. /**
  262. * Provides core sanitation functionality.
  263. *
  264. * @param dirty string or DOM node
  265. * @param cfg object
  266. * @returns Sanitized DOM node.
  267. */
  268. sanitize(dirty: string | Node, cfg: Config & {
  269. RETURN_DOM: true;
  270. }): Node;
  271. /**
  272. * Provides core sanitation functionality.
  273. *
  274. * @param dirty string or DOM node
  275. * @param cfg object
  276. * @returns Sanitized document fragment.
  277. */
  278. sanitize(dirty: string | Node, cfg: Config & {
  279. RETURN_DOM_FRAGMENT: true;
  280. }): DocumentFragment;
  281. /**
  282. * Provides core sanitation functionality.
  283. *
  284. * @param dirty string or DOM node
  285. * @param cfg object
  286. * @returns Sanitized string.
  287. */
  288. sanitize(dirty: string | Node, cfg?: Config): string;
  289. /**
  290. * Checks if an attribute value is valid.
  291. * Uses last set config, if any. Otherwise, uses config defaults.
  292. *
  293. * @param tag Tag name of containing element.
  294. * @param attr Attribute name.
  295. * @param value Attribute value.
  296. * @returns Returns true if `value` is valid. Otherwise, returns false.
  297. */
  298. isValidAttribute(tag: string, attr: string, value: string): boolean;
  299. /**
  300. * Adds a DOMPurify hook.
  301. *
  302. * @param entryPoint entry point for the hook to add
  303. * @param hookFunction function to execute
  304. */
  305. addHook(entryPoint: BasicHookName, hookFunction: NodeHook): void;
  306. /**
  307. * Adds a DOMPurify hook.
  308. *
  309. * @param entryPoint entry point for the hook to add
  310. * @param hookFunction function to execute
  311. */
  312. addHook(entryPoint: ElementHookName, hookFunction: ElementHook): void;
  313. /**
  314. * Adds a DOMPurify hook.
  315. *
  316. * @param entryPoint entry point for the hook to add
  317. * @param hookFunction function to execute
  318. */
  319. addHook(entryPoint: DocumentFragmentHookName, hookFunction: DocumentFragmentHook): void;
  320. /**
  321. * Adds a DOMPurify hook.
  322. *
  323. * @param entryPoint entry point for the hook to add
  324. * @param hookFunction function to execute
  325. */
  326. addHook(entryPoint: 'uponSanitizeElement', hookFunction: UponSanitizeElementHook): void;
  327. /**
  328. * Adds a DOMPurify hook.
  329. *
  330. * @param entryPoint entry point for the hook to add
  331. * @param hookFunction function to execute
  332. */
  333. addHook(entryPoint: 'uponSanitizeAttribute', hookFunction: UponSanitizeAttributeHook): void;
  334. /**
  335. * Remove a DOMPurify hook at a given entryPoint
  336. * (pops it from the stack of hooks if hook not specified)
  337. *
  338. * @param entryPoint entry point for the hook to remove
  339. * @param hookFunction optional specific hook to remove
  340. * @returns removed hook
  341. */
  342. removeHook(entryPoint: BasicHookName, hookFunction?: NodeHook): NodeHook | undefined;
  343. /**
  344. * Remove a DOMPurify hook at a given entryPoint
  345. * (pops it from the stack of hooks if hook not specified)
  346. *
  347. * @param entryPoint entry point for the hook to remove
  348. * @param hookFunction optional specific hook to remove
  349. * @returns removed hook
  350. */
  351. removeHook(entryPoint: ElementHookName, hookFunction?: ElementHook): ElementHook | undefined;
  352. /**
  353. * Remove a DOMPurify hook at a given entryPoint
  354. * (pops it from the stack of hooks if hook not specified)
  355. *
  356. * @param entryPoint entry point for the hook to remove
  357. * @param hookFunction optional specific hook to remove
  358. * @returns removed hook
  359. */
  360. removeHook(entryPoint: DocumentFragmentHookName, hookFunction?: DocumentFragmentHook): DocumentFragmentHook | undefined;
  361. /**
  362. * Remove a DOMPurify hook at a given entryPoint
  363. * (pops it from the stack of hooks if hook not specified)
  364. *
  365. * @param entryPoint entry point for the hook to remove
  366. * @param hookFunction optional specific hook to remove
  367. * @returns removed hook
  368. */
  369. removeHook(entryPoint: 'uponSanitizeElement', hookFunction?: UponSanitizeElementHook): UponSanitizeElementHook | undefined;
  370. /**
  371. * Remove a DOMPurify hook at a given entryPoint
  372. * (pops it from the stack of hooks if hook not specified)
  373. *
  374. * @param entryPoint entry point for the hook to remove
  375. * @param hookFunction optional specific hook to remove
  376. * @returns removed hook
  377. */
  378. removeHook(entryPoint: 'uponSanitizeAttribute', hookFunction?: UponSanitizeAttributeHook): UponSanitizeAttributeHook | undefined;
  379. /**
  380. * Removes all DOMPurify hooks at a given entryPoint
  381. *
  382. * @param entryPoint entry point for the hooks to remove
  383. */
  384. removeHooks(entryPoint: HookName): void;
  385. /**
  386. * Removes all DOMPurify hooks.
  387. */
  388. removeAllHooks(): void;
  389. }
  390. /**
  391. * An element removed by DOMPurify.
  392. */
  393. interface RemovedElement {
  394. /**
  395. * The element that was removed.
  396. */
  397. element: Node;
  398. }
  399. /**
  400. * An element removed by DOMPurify.
  401. */
  402. interface RemovedAttribute {
  403. /**
  404. * The attribute that was removed.
  405. */
  406. attribute: Attr | null;
  407. /**
  408. * The element that the attribute was removed.
  409. */
  410. from: Node;
  411. }
  412. type BasicHookName = 'beforeSanitizeElements' | 'afterSanitizeElements' | 'uponSanitizeShadowNode';
  413. type ElementHookName = 'beforeSanitizeAttributes' | 'afterSanitizeAttributes';
  414. type DocumentFragmentHookName = 'beforeSanitizeShadowDOM' | 'afterSanitizeShadowDOM';
  415. type UponSanitizeElementHookName = 'uponSanitizeElement';
  416. type UponSanitizeAttributeHookName = 'uponSanitizeAttribute';
  417. type HookName = BasicHookName | ElementHookName | DocumentFragmentHookName | UponSanitizeElementHookName | UponSanitizeAttributeHookName;
  418. type NodeHook = (this: DOMPurify, currentNode: Node, hookEvent: null, config: Config) => void;
  419. type ElementHook = (this: DOMPurify, currentNode: Element, hookEvent: null, config: Config) => void;
  420. type DocumentFragmentHook = (this: DOMPurify, currentNode: DocumentFragment, hookEvent: null, config: Config) => void;
  421. type UponSanitizeElementHook = (this: DOMPurify, currentNode: Node, hookEvent: UponSanitizeElementHookEvent, config: Config) => void;
  422. type UponSanitizeAttributeHook = (this: DOMPurify, currentNode: Element, hookEvent: UponSanitizeAttributeHookEvent, config: Config) => void;
  423. interface UponSanitizeElementHookEvent {
  424. tagName: string;
  425. allowedTags: Record<string, boolean>;
  426. }
  427. interface UponSanitizeAttributeHookEvent {
  428. attrName: string;
  429. attrValue: string;
  430. keepAttr: boolean;
  431. allowedAttributes: Record<string, boolean>;
  432. forceKeepAttr: boolean | undefined;
  433. }
  434. /**
  435. * A `Window`-like object containing the properties and types that DOMPurify requires.
  436. */
  437. type WindowLike = Pick<typeof globalThis, 'DocumentFragment' | 'HTMLTemplateElement' | 'Node' | 'Element' | 'NodeFilter' | 'NamedNodeMap' | 'HTMLFormElement' | 'DOMParser'> & {
  438. document?: Document;
  439. MozNamedAttrMap?: typeof window.NamedNodeMap;
  440. } & Pick<TrustedTypesWindow, 'trustedTypes'>;
  441. declare const _default: DOMPurify;
  442. export { _default as default };
  443. export type { Config, DOMPurify, DocumentFragmentHook, ElementHook, HookName, NodeHook, RemovedAttribute, RemovedElement, UponSanitizeAttributeHook, UponSanitizeAttributeHookEvent, UponSanitizeElementHook, UponSanitizeElementHookEvent, WindowLike };
  444. // @ts-ignore
  445. export = _default;