yangzhengze
7 years ago
committed by
Limy
parent
a70264d12b
commit
cf63757bae
@ -0,0 +1,554 @@
|
||||
/*!
|
||||
* bootstrap-fileinput v4.4.9
|
||||
* http://plugins.krajee.com/file-input
|
||||
*
|
||||
* Krajee default styling for bootstrap-fileinput.
|
||||
*
|
||||
* Author: Kartik Visweswaran
|
||||
* Copyright: 2014 - 2018, Kartik Visweswaran, Krajee.com
|
||||
*
|
||||
* Licensed under the BSD 3-Clause
|
||||
* https://github.com/kartik-v/bootstrap-fileinput/blob/master/LICENSE.md
|
||||
*/
|
||||
.file-loading input[type=file], input[type=file].file-loading {
|
||||
width: 0;
|
||||
height: 0;
|
||||
}
|
||||
|
||||
.file-no-browse {
|
||||
position: absolute;
|
||||
left: 50%;
|
||||
bottom: 20%;
|
||||
width: 1px;
|
||||
height: 1px;
|
||||
font-size: 0;
|
||||
opacity: 0;
|
||||
border: none;
|
||||
background: none;
|
||||
outline: none;
|
||||
box-shadow: none;
|
||||
}
|
||||
|
||||
.kv-hidden, .file-caption-icon, .file-zoom-dialog .modal-header:before, .file-zoom-dialog .modal-header:after, .file-input-new .file-preview, .file-input-new .close, .file-input-new .glyphicon-file, .file-input-new .fileinput-remove-button, .file-input-new .fileinput-upload-button, .file-input-new .no-browse .input-group-btn, .file-input-ajax-new .fileinput-remove-button, .file-input-ajax-new .fileinput-upload-button, .file-input-ajax-new .no-browse .input-group-btn, .hide-content .kv-file-content {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.btn-file input[type=file], .file-caption-icon, .file-preview .fileinput-remove, .krajee-default .file-thumb-progress, .file-zoom-dialog .btn-navigate, .file-zoom-dialog .floating-buttons {
|
||||
position: absolute;
|
||||
}
|
||||
|
||||
.file-input, .file-loading:before, .btn-file, .file-caption, .file-preview, .krajee-default.file-preview-frame, .krajee-default .file-thumbnail-footer, .file-zoom-dialog .modal-dialog {
|
||||
position: relative;
|
||||
}
|
||||
|
||||
.file-error-message pre, .file-error-message ul, .krajee-default .file-actions, .krajee-default .file-other-error {
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.file-error-message pre, .file-error-message ul {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.krajee-default .file-drag-handle, .krajee-default .file-upload-indicator {
|
||||
float: left;
|
||||
margin: 5px 0 -5px;
|
||||
width: 16px;
|
||||
height: 16px;
|
||||
}
|
||||
|
||||
.krajee-default .file-thumb-progress .progress, .krajee-default .file-thumb-progress .progress-bar {
|
||||
height: 11px;
|
||||
font-size: 9px;
|
||||
line-height: 10px;
|
||||
}
|
||||
|
||||
.krajee-default .file-caption-info, .krajee-default .file-size-info {
|
||||
display: block;
|
||||
white-space: nowrap;
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
width: 160px;
|
||||
height: 15px;
|
||||
margin: auto;
|
||||
}
|
||||
|
||||
.file-zoom-content > .file-object.type-video, .file-zoom-content > .file-object.type-flash, .file-zoom-content > .file-object.type-image {
|
||||
max-width: 100%;
|
||||
max-height: 100%;
|
||||
width: auto;
|
||||
}
|
||||
|
||||
.file-zoom-content > .file-object.type-video, .file-zoom-content > .file-object.type-flash {
|
||||
height: 100%;
|
||||
}
|
||||
|
||||
.file-zoom-content > .file-object.type-pdf, .file-zoom-content > .file-object.type-html, .file-zoom-content > .file-object.type-text, .file-zoom-content > .file-object.type-default {
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
.rotate-2 {
|
||||
transform: rotateY(180deg);
|
||||
}
|
||||
|
||||
.rotate-3 {
|
||||
transform: rotate(180deg);
|
||||
}
|
||||
|
||||
.rotate-4 {
|
||||
transform: rotate(180deg) rotateY(180deg);
|
||||
}
|
||||
|
||||
.rotate-5 {
|
||||
transform: rotate(270deg) rotateY(180deg);
|
||||
}
|
||||
|
||||
.rotate-6 {
|
||||
transform: rotate(90deg);
|
||||
}
|
||||
|
||||
.rotate-7 {
|
||||
transform: rotate(90deg) rotateY(180deg);
|
||||
}
|
||||
|
||||
.rotate-8 {
|
||||
transform: rotate(270deg);
|
||||
}
|
||||
|
||||
.file-loading:before {
|
||||
content: " Loading...";
|
||||
display: inline-block;
|
||||
padding-left: 20px;
|
||||
line-height: 16px;
|
||||
font-size: 13px;
|
||||
font-variant: small-caps;
|
||||
color: #999;
|
||||
background: transparent url(../img/loading.gif) top left no-repeat;
|
||||
}
|
||||
|
||||
.file-object {
|
||||
margin: 0 0 -5px 0;
|
||||
padding: 0;
|
||||
}
|
||||
|
||||
.btn-file {
|
||||
overflow: hidden;
|
||||
}
|
||||
|
||||
.btn-file input[type=file] {
|
||||
top: 0;
|
||||
left: 0;
|
||||
min-width: 100%;
|
||||
min-height: 100%;
|
||||
text-align: right;
|
||||
opacity: 0;
|
||||
background: none repeat scroll 0 0 transparent;
|
||||
cursor: inherit;
|
||||
display: block;
|
||||
}
|
||||
|
||||
.btn-file ::-ms-browse {
|
||||
font-size: 10000px;
|
||||
width: 100%;
|
||||
height: 100%;
|
||||
}
|
||||
|
||||
.file-caption .file-caption-name {
|
||||
width: 100%;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
box-shadow: none;
|
||||
border: none;
|
||||
background: none;
|
||||
outline: none;
|
||||
}
|
||||
|
||||
.file-caption.icon-visible .file-caption-icon {
|
||||
display: inline-block;
|
||||
}
|
||||
|
||||
.file-caption.icon-visible .file-caption-name {
|
||||
padding-left: 15px;
|
||||
}
|
||||
|
||||
.file-caption-icon {
|
||||
left: 8px;
|
||||
}
|
||||
|
||||
.file-error-message {
|
||||
color: #a94442;
|
||||
background-color: #f2dede;
|
||||
margin: 5px;
|
||||
border: 1px solid #ebccd1;
|
||||
border-radius: 4px;
|
||||
padding: 15px;
|
||||
}
|
||||
|
||||
.file-error-message pre {
|
||||
margin: 5px 0;
|
||||
}
|
||||
|
||||
.file-caption-disabled {
|
||||
background-color: #eee;
|
||||
cursor: not-allowed;
|
||||
opacity: 1;
|
||||
}
|
||||
|
||||
.file-preview {
|
||||
border-radius: 5px;
|
||||
border: 1px solid #ddd;
|
||||
padding: 8px;
|
||||
width: 100%;
|
||||
margin-bottom: 5px;
|
||||
}
|
||||
|
||||
.file-preview .btn-xs {
|
||||
padding: 1px 5px;
|
||||
font-size: 12px;
|
||||
line-height: 1.5;
|
||||
border-radius: 3px;
|
||||
}
|
||||
|
||||
.file-preview .fileinput-remove {
|
||||
top: 1px;
|
||||
right: 1px;
|
||||
line-height: 10px;
|
||||
}
|
||||
|
||||
.file-preview .clickable {
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.file-preview-image {
|
||||
font: 40px Impact, Charcoal, sans-serif;
|
||||
color: #008000;
|
||||
}
|
||||
|
||||
.krajee-default.file-preview-frame {
|
||||
margin: 8px;
|
||||
border: 1px solid #ddd;
|
||||
box-shadow: 1px 1px 5px 0 #a2958a;
|
||||
padding: 6px;
|
||||
float: left;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.krajee-default.file-preview-frame .kv-file-content {
|
||||
width: 213px;
|
||||
height: 160px;
|
||||
}
|
||||
|
||||
.krajee-default.file-preview-frame .file-thumbnail-footer {
|
||||
height: 70px;
|
||||
}
|
||||
|
||||
.krajee-default.file-preview-frame:not(.file-preview-error):hover {
|
||||
box-shadow: 3px 3px 5px 0 #333;
|
||||
}
|
||||
|
||||
.krajee-default .file-preview-text {
|
||||
display: block;
|
||||
color: #428bca;
|
||||
border: 1px solid #ddd;
|
||||
font-family: Menlo, Monaco, Consolas, "Courier New", monospace;
|
||||
outline: none;
|
||||
padding: 8px;
|
||||
resize: none;
|
||||
}
|
||||
|
||||
.krajee-default .file-preview-html {
|
||||
border: 1px solid #ddd;
|
||||
padding: 8px;
|
||||
overflow: auto;
|
||||
}
|
||||
|
||||
.krajee-default .file-other-icon {
|
||||
font-size: 6em;
|
||||
}
|
||||
|
||||
.krajee-default .file-footer-buttons {
|
||||
float: right;
|
||||
}
|
||||
|
||||
.krajee-default .file-footer-caption {
|
||||
display: block;
|
||||
text-align: center;
|
||||
padding-top: 4px;
|
||||
font-size: 11px;
|
||||
color: #777;
|
||||
margin-bottom: 15px;
|
||||
}
|
||||
|
||||
.krajee-default .file-preview-error {
|
||||
opacity: 0.65;
|
||||
box-shadow: none;
|
||||
}
|
||||
|
||||
.krajee-default .file-thumb-progress {
|
||||
height: 11px;
|
||||
top: 37px;
|
||||
left: 0;
|
||||
right: 0;
|
||||
}
|
||||
|
||||
.krajee-default.kvsortable-ghost {
|
||||
background: #e1edf7;
|
||||
border: 2px solid #a1abff;
|
||||
}
|
||||
|
||||
.krajee-default .file-preview-other:hover {
|
||||
opacity: 0.8;
|
||||
}
|
||||
|
||||
.krajee-default .file-preview-frame:not(.file-preview-error) .file-footer-caption:hover {
|
||||
color: #000;
|
||||
}
|
||||
|
||||
.kv-upload-progress .progress {
|
||||
height: 20px;
|
||||
line-height: 20px;
|
||||
margin: 10px 0;
|
||||
overflow: hidden;
|
||||
}
|
||||
|
||||
.kv-upload-progress .progress-bar {
|
||||
height: 20px;
|
||||
line-height: 20px;
|
||||
}
|
||||
|
||||
/*noinspection CssOverwrittenProperties*/
|
||||
.file-zoom-dialog .file-other-icon {
|
||||
font-size: 22em;
|
||||
font-size: 50vmin;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .modal-dialog {
|
||||
width: auto;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .modal-header {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .btn-navigate {
|
||||
padding: 0;
|
||||
margin: 0;
|
||||
background: transparent;
|
||||
text-decoration: none;
|
||||
outline: none;
|
||||
opacity: 0.7;
|
||||
top: 45%;
|
||||
font-size: 4em;
|
||||
color: #1c94c4;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .btn-navigate:not([disabled]):hover {
|
||||
outline: none;
|
||||
box-shadow: none;
|
||||
opacity: 0.6;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .floating-buttons {
|
||||
top: 5px;
|
||||
right: 10px;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .btn-navigate[disabled] {
|
||||
opacity: 0.3;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .btn-prev {
|
||||
left: 1px;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .btn-next {
|
||||
right: 1px;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .kv-zoom-title {
|
||||
font-weight: 300;
|
||||
color: #999;
|
||||
max-width: 50%;
|
||||
overflow: hidden;
|
||||
white-space: nowrap;
|
||||
text-overflow: ellipsis;
|
||||
}
|
||||
|
||||
.file-input-new .no-browse .form-control {
|
||||
border-top-right-radius: 4px;
|
||||
border-bottom-right-radius: 4px;
|
||||
}
|
||||
|
||||
.file-input-ajax-new .no-browse .form-control {
|
||||
border-top-right-radius: 4px;
|
||||
border-bottom-right-radius: 4px;
|
||||
}
|
||||
|
||||
.file-caption-main {
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
.file-thumb-loading {
|
||||
background: transparent url(../img/loading.gif) no-repeat scroll center center content-box !important;
|
||||
}
|
||||
|
||||
.file-drop-zone {
|
||||
border: 1px dashed #aaa;
|
||||
border-radius: 4px;
|
||||
height: 100%;
|
||||
text-align: center;
|
||||
vertical-align: middle;
|
||||
margin: 12px 15px 12px 12px;
|
||||
padding: 5px;
|
||||
}
|
||||
|
||||
.file-drop-zone.clickable:hover {
|
||||
border: 2px dashed #999;
|
||||
}
|
||||
|
||||
.file-drop-zone.clickable:focus {
|
||||
border: 2px solid #5acde2;
|
||||
}
|
||||
|
||||
.file-drop-zone .file-preview-thumbnails {
|
||||
cursor: default;
|
||||
}
|
||||
|
||||
.file-drop-zone-title {
|
||||
color: #aaa;
|
||||
font-size: 1.6em;
|
||||
padding: 85px 10px;
|
||||
cursor: default;
|
||||
}
|
||||
|
||||
.file-highlighted {
|
||||
border: 2px dashed #999 !important;
|
||||
background-color: #eee;
|
||||
}
|
||||
|
||||
.file-uploading {
|
||||
background: url(../img/loading-sm.gif) no-repeat center bottom 10px;
|
||||
opacity: 0.65;
|
||||
}
|
||||
|
||||
@media (min-width: 576px) {
|
||||
.file-zoom-dialog .modal-dialog {
|
||||
max-width: 500px;
|
||||
}
|
||||
}
|
||||
|
||||
@media (min-width: 992px) {
|
||||
.file-zoom-dialog .modal-lg {
|
||||
max-width: 800px;
|
||||
}
|
||||
}
|
||||
|
||||
.file-zoom-fullscreen.modal {
|
||||
position: fixed;
|
||||
top: 0;
|
||||
right: 0;
|
||||
bottom: 0;
|
||||
left: 0;
|
||||
}
|
||||
|
||||
.file-zoom-fullscreen .modal-dialog {
|
||||
position: fixed;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
width: 100%;
|
||||
height: 100%;
|
||||
max-width: 100%;
|
||||
max-height: 100%;
|
||||
}
|
||||
|
||||
.file-zoom-fullscreen .modal-content {
|
||||
border-radius: 0;
|
||||
box-shadow: none;
|
||||
}
|
||||
|
||||
.file-zoom-fullscreen .modal-body {
|
||||
overflow-y: auto;
|
||||
}
|
||||
|
||||
.floating-buttons {
|
||||
z-index: 3000;
|
||||
}
|
||||
|
||||
.floating-buttons .btn-kv {
|
||||
margin-left: 3px;
|
||||
z-index: 3000;
|
||||
}
|
||||
|
||||
.file-zoom-content {
|
||||
height: 480px;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.file-zoom-content .file-preview-image {
|
||||
max-height: 100%;
|
||||
}
|
||||
|
||||
.file-zoom-content .file-preview-video {
|
||||
max-height: 100%;
|
||||
}
|
||||
|
||||
.file-zoom-content .is-portrait-gt4 {
|
||||
margin-top: 60px;
|
||||
}
|
||||
|
||||
.file-zoom-content > .file-object.type-image {
|
||||
height: auto;
|
||||
min-height: inherit;
|
||||
}
|
||||
|
||||
.file-zoom-content > .file-object.type-audio {
|
||||
width: auto;
|
||||
height: 30px;
|
||||
}
|
||||
|
||||
@media screen and (max-width: 767px) {
|
||||
.file-preview-thumbnails {
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
flex-direction: column;
|
||||
}
|
||||
|
||||
.file-zoom-dialog .modal-header {
|
||||
flex-direction: column;
|
||||
}
|
||||
}
|
||||
|
||||
@media screen and (max-width: 350px) {
|
||||
.krajee-default.file-preview-frame .kv-file-content {
|
||||
width: 160px;
|
||||
}
|
||||
}
|
||||
|
||||
.file-loading[dir=rtl]:before {
|
||||
background: transparent url(../img/loading.gif) top right no-repeat;
|
||||
padding-left: 0;
|
||||
padding-right: 20px;
|
||||
}
|
||||
|
||||
.file-sortable .file-drag-handle {
|
||||
cursor: move;
|
||||
opacity: 1;
|
||||
}
|
||||
|
||||
.file-sortable .file-drag-handle:hover {
|
||||
opacity: 0.7;
|
||||
}
|
||||
|
||||
.clickable .file-drop-zone-title {
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.kv-zoom-actions .btn-kv {
|
||||
margin-left: 3px;
|
||||
}
|
||||
|
||||
.file-preview-initial.sortable-chosen {
|
||||
background-color: #d9edf7;
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
@ -0,0 +1,100 @@
|
||||
/*!
|
||||
* FileInput Chinese Translations
|
||||
*
|
||||
* This file must be loaded after 'fileinput.js'. Patterns in braces '{}', or
|
||||
* any HTML markup tags in the messages must not be converted or translated.
|
||||
*
|
||||
* @see http://github.com/kartik-v/bootstrap-fileinput
|
||||
* @author kangqf <kangqingfei@gmail.com>
|
||||
*
|
||||
* NOTE: this file must be saved in UTF-8 encoding.
|
||||
*/
|
||||
(function ($) {
|
||||
"use strict";
|
||||
|
||||
$.fn.fileinputLocales['zh'] = {
|
||||
fileSingle: '文件',
|
||||
filePlural: '个文件',
|
||||
browseLabel: '选择 …',
|
||||
removeLabel: '移除',
|
||||
removeTitle: '清除选中文件',
|
||||
cancelLabel: '取消',
|
||||
cancelTitle: '取消进行中的上传',
|
||||
uploadLabel: '上传',
|
||||
uploadTitle: '上传选中文件',
|
||||
msgNo: '没有',
|
||||
msgNoFilesSelected: '未选择文件',
|
||||
msgCancelled: '取消',
|
||||
msgPlaceholder: '选择 {files}...',
|
||||
msgZoomModalHeading: '详细预览',
|
||||
msgFileRequired: '必须选择一个文件上传.',
|
||||
msgSizeTooSmall: '文件 "{name}" (<b>{size} KB</b>) 必须大于限定大小 <b>{minSize} KB</b>.',
|
||||
msgSizeTooLarge: '文件 "{name}" (<b>{size} KB</b>) 超过了允许大小 <b>{maxSize} KB</b>.',
|
||||
msgFilesTooLess: '你必须选择最少 <b>{n}</b> {files} 来上传. ',
|
||||
msgFilesTooMany: '选择的上传文件个数 <b>({n})</b> 超出最大文件的限制个数 <b>{m}</b>.',
|
||||
msgFileNotFound: '文件 "{name}" 未找到!',
|
||||
msgFileSecured: '安全限制，为了防止读取文件 "{name}".',
|
||||
msgFileNotReadable: '文件 "{name}" 不可读.',
|
||||
msgFilePreviewAborted: '取消 "{name}" 的预览.',
|
||||
msgFilePreviewError: '读取 "{name}" 时出现了一个错误.',
|
||||
msgInvalidFileName: '文件名 "{name}" 包含非法字符.',
|
||||
msgInvalidFileType: '不正确的类型 "{name}". 只支持 "{types}" 类型的文件.',
|
||||
msgInvalidFileExtension: '不正确的文件扩展名 "{name}". 只支持 "{extensions}" 的文件扩展名.',
|
||||
msgFileTypes: {
|
||||
'image': 'image',
|
||||
'html': 'HTML',
|
||||
'text': 'text',
|
||||
'video': 'video',
|
||||
'audio': 'audio',
|
||||
'flash': 'flash',
|
||||
'pdf': 'PDF',
|
||||
'object': 'object'
|
||||
},
|
||||
msgUploadAborted: '该文件上传被中止',
|
||||
msgUploadThreshold: '处理中...',
|
||||
msgUploadBegin: '正在初始化...',
|
||||
msgUploadEnd: '完成',
|
||||
msgUploadEmpty: '无效的文件上传.',
|
||||
msgUploadError: '上传出错',
|
||||
msgValidationError: '验证错误',
|
||||
msgLoading: '加载第 {index} 文件 共 {files} …',
|
||||
msgProgress: '加载第 {index} 文件 共 {files} - {name} - {percent}% 完成.',
|
||||
msgSelected: '{n} {files} 选中',
|
||||
msgFoldersNotAllowed: '只支持拖拽文件! 跳过 {n} 拖拽的文件夹.',
|
||||
msgImageWidthSmall: '图像文件的"{name}"的宽度必须是至少{size}像素.',
|
||||
msgImageHeightSmall: '图像文件的"{name}"的高度必须至少为{size}像素.',
|
||||
msgImageWidthLarge: '图像文件"{name}"的宽度不能超过{size}像素.',
|
||||
msgImageHeightLarge: '图像文件"{name}"的高度不能超过{size}像素.',
|
||||
msgImageResizeError: '无法获取的图像尺寸调整。',
|
||||
msgImageResizeException: '调整图像大小时发生错误。<pre>{errors}</pre>',
|
||||
msgAjaxError: '{operation} 发生错误. 请重试!',
|
||||
msgAjaxProgressError: '{operation} 失败',
|
||||
ajaxOperations: {
|
||||
deleteThumb: '删除文件',
|
||||
uploadThumb: '上传文件',
|
||||
uploadBatch: '批量上传',
|
||||
uploadExtra: '表单数据上传'
|
||||
},
|
||||
dropZoneTitle: '拖拽文件到这里 …<br>支持多文件同时上传',
|
||||
dropZoneClickTitle: '<br>(或点击{files}按钮选择文件)',
|
||||
fileActionSettings: {
|
||||
removeTitle: '删除文件',
|
||||
uploadTitle: '上传文件',
|
||||
uploadRetryTitle: '重试',
|
||||
zoomTitle: '查看详情',
|
||||
dragTitle: '移动 / 重置',
|
||||
indicatorNewTitle: '没有上传',
|
||||
indicatorSuccessTitle: '上传',
|
||||
indicatorErrorTitle: '上传错误',
|
||||
indicatorLoadingTitle: '上传 ...'
|
||||
},
|
||||
previewZoomButtonTitles: {
|
||||
prev: '预览上一个文件',
|
||||
next: '预览下一个文件',
|
||||
toggleheader: '缩放',
|
||||
fullscreen: '全屏',
|
||||
borderless: '无边界模式',
|
||||
close: '关闭当前预览'
|
||||
}
|
||||
};
|
||||
})(window.jQuery);
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
@ -0,0 +1,812 @@
|
||||
;(function(factory) {
|
||||
'use strict';
|
||||
/* global window: false, define: false, module: false */
|
||||
var root = typeof window === 'undefined' ? null : window;
|
||||
|
||||
if (typeof define === 'function' && define.amd) {
|
||||
define(function(){ return factory(root); });
|
||||
} else if (typeof module !== 'undefined') {
|
||||
module.exports = factory(root);
|
||||
} else {
|
||||
root.DOMPurify = factory(root);
|
||||
}
|
||||
}(function factory(window) {
|
||||
'use strict';
|
||||
|
||||
var DOMPurify = function(window) {
|
||||
return factory(window);
|
||||
};
|
||||
|
||||
/**
|
||||
* Version label, exposed for easier checks
|
||||
* if DOMPurify is up to date or not
|
||||
*/
|
||||
DOMPurify.version = '0.7.4';
|
||||
|
||||
if (!window || !window.document || window.document.nodeType !== 9) {
|
||||
// not running in a browser, provide a factory function
|
||||
// so that you can pass your own Window
|
||||
DOMPurify.isSupported = false;
|
||||
return DOMPurify;
|
||||
}
|
||||
|
||||
var document = window.document;
|
||||
var originalDocument = document;
|
||||
var DocumentFragment = window.DocumentFragment;
|
||||
var HTMLTemplateElement = window.HTMLTemplateElement;
|
||||
var NodeFilter = window.NodeFilter;
|
||||
var NamedNodeMap = window.NamedNodeMap || window.MozNamedAttrMap;
|
||||
var Text = window.Text;
|
||||
var Comment = window.Comment;
|
||||
var DOMParser = window.DOMParser;
|
||||
|
||||
// As per issue #47, the web-components registry is inherited by a
|
||||
// new document created via createHTMLDocument. As per the spec
|
||||
// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
|
||||
// a new empty registry is used when creating a template contents owner
|
||||
// document, so we use that as our parent document to ensure nothing
|
||||
// is inherited.
|
||||
if (typeof HTMLTemplateElement === 'function') {
|
||||
var template = document.createElement('template');
|
||||
if (template.content && template.content.ownerDocument) {
|
||||
document = template.content.ownerDocument;
|
||||
}
|
||||
}
|
||||
var implementation = document.implementation;
|
||||
var createNodeIterator = document.createNodeIterator;
|
||||
var getElementsByTagName = document.getElementsByTagName;
|
||||
var createDocumentFragment = document.createDocumentFragment;
|
||||
var importNode = originalDocument.importNode;
|
||||
|
||||
var hooks = {};
|
||||
|
||||
/**
|
||||
* Expose whether this browser supports running the full DOMPurify.
|
||||
*/
|
||||
DOMPurify.isSupported =
|
||||
typeof implementation.createHTMLDocument !== 'undefined' &&
|
||||
document.documentMode !== 9;
|
||||
|
||||
/* Add properties to a lookup table */
|
||||
var _addToSet = function(set, array) {
|
||||
var l = array.length;
|
||||
while (l--) {
|
||||
if (typeof array[l] === 'string') {
|
||||
array[l] = array[l].toLowerCase();
|
||||
}
|
||||
set[array[l]] = true;
|
||||
}
|
||||
return set;
|
||||
};
|
||||
|
||||
/* Shallow clone an object */
|
||||
var _cloneObj = function(object) {
|
||||
var newObject = {};
|
||||
var property;
|
||||
for (property in object) {
|
||||
if (object.hasOwnProperty(property)) {
|
||||
newObject[property] = object[property];
|
||||
}
|
||||
}
|
||||
return newObject;
|
||||
};
|
||||
|
||||
/**
|
||||
* We consider the elements and attributes below to be safe. Ideally
|
||||
* don't add any new ones but feel free to remove unwanted ones.
|
||||
*/
|
||||
|
||||
/* allowed element names */
|
||||
var ALLOWED_TAGS = null;
|
||||
var DEFAULT_ALLOWED_TAGS = _addToSet({}, [
|
||||
|
||||
// HTML
|
||||
'a','abbr','acronym','address','area','article','aside','audio','b',
|
||||
'bdi','bdo','big','blink','blockquote','body','br','button','canvas',
|
||||
'caption','center','cite','code','col','colgroup','content','data',
|
||||
'datalist','dd','decorator','del','details','dfn','dir','div','dl','dt',
|
||||
'element','em','fieldset','figcaption','figure','font','footer','form',
|
||||
'h1','h2','h3','h4','h5','h6','head','header','hgroup','hr','html','i',
|
||||
'img','input','ins','kbd','label','legend','li','main','map','mark',
|
||||
'marquee','menu','menuitem','meter','nav','nobr','ol','optgroup',
|
||||
'option','output','p','pre','progress','q','rp','rt','ruby','s','samp',
|
||||
'section','select','shadow','small','source','spacer','span','strike',
|
||||
'strong','style','sub','summary','sup','table','tbody','td','template',
|
||||
'textarea','tfoot','th','thead','time','tr','track','tt','u','ul','var',
|
||||
'video','wbr',
|
||||
|
||||
// SVG
|
||||
'svg','altglyph','altglyphdef','altglyphitem','animatecolor',
|
||||
'animatemotion','animatetransform','circle','clippath','defs','desc',
|
||||
'ellipse','filter','font','g','glyph','glyphref','hkern','image','line',
|
||||
'lineargradient','marker','mask','metadata','mpath','path','pattern',
|
||||
'polygon','polyline','radialgradient','rect','stop','switch','symbol',
|
||||
'text','textpath','title','tref','tspan','view','vkern',
|
||||
|
||||
// SVG Filters
|
||||
'feBlend','feColorMatrix','feComponentTransfer','feComposite',
|
||||
'feConvolveMatrix','feDiffuseLighting','feDisplacementMap',
|
||||
'feFlood','feFuncA','feFuncB','feFuncG','feFuncR','feGaussianBlur',
|
||||
'feMerge','feMergeNode','feMorphology','feOffset',
|
||||
'feSpecularLighting','feTile','feTurbulence',
|
||||
|
||||
//MathML
|
||||
'math','menclose','merror','mfenced','mfrac','mglyph','mi','mlabeledtr',
|
||||
'mmuliscripts','mn','mo','mover','mpadded','mphantom','mroot','mrow',
|
||||
'ms','mpspace','msqrt','mystyle','msub','msup','msubsup','mtable','mtd',
|
||||
'mtext','mtr','munder','munderover',
|
||||
|
||||
//Text
|
||||
'#text'
|
||||
]);
|
||||
|
||||
/* Allowed attribute names */
|
||||
var ALLOWED_ATTR = null;
|
||||
var DEFAULT_ALLOWED_ATTR = _addToSet({}, [
|
||||
|
||||
// HTML
|
||||
'accept','action','align','alt','autocomplete','background','bgcolor',
|
||||
'border','cellpadding','cellspacing','checked','cite','class','clear','color',
|
||||
'cols','colspan','coords','datetime','default','dir','disabled',
|
||||
'download','enctype','face','for','headers','height','hidden','high','href',
|
||||
'hreflang','id','ismap','label','lang','list','loop', 'low','max',
|
||||
'maxlength','media','method','min','multiple','name','noshade','novalidate',
|
||||
'nowrap','open','optimum','pattern','placeholder','poster','preload','pubdate',
|
||||
'radiogroup','readonly','rel','required','rev','reversed','rows',
|
||||
'rowspan','spellcheck','scope','selected','shape','size','span',
|
||||
'srclang','start','src','step','style','summary','tabindex','title',
|
||||
'type','usemap','valign','value','width','xmlns',
|
||||
|
||||
// SVG
|
||||
'accent-height','accumulate','additivive','alignment-baseline',
|
||||
'ascent','attributename','attributetype','azimuth','basefrequency',
|
||||
'baseline-shift','begin','bias','by','clip','clip-path','clip-rule',
|
||||
'color','color-interpolation','color-interpolation-filters','color-profile',
|
||||
'color-rendering','cx','cy','d','dx','dy','diffuseconstant','direction',
|
||||
'display','divisor','dur','edgemode','elevation','end','fill','fill-opacity',
|
||||
'fill-rule','filter','flood-color','flood-opacity','font-family','font-size',
|
||||
'font-size-adjust','font-stretch','font-style','font-variant','font-weight',
|
||||
'fx', 'fy','g1','g2','glyph-name','glyphref','gradientunits','gradienttransform',
|
||||
'image-rendering','in','in2','k','k1','k2','k3','k4','kerning','keypoints',
|
||||
'keysplines','keytimes','lengthadjust','letter-spacing','kernelmatrix',
|
||||
'kernelunitlength','lighting-color','local','marker-end','marker-mid',
|
||||
'marker-start','markerheight','markerunits','markerwidth','maskcontentunits',
|
||||
'maskunits','max','mask','mode','min','numoctaves','offset','operator',
|
||||
'opacity','order','orient','orientation','origin','overflow','paint-order',
|
||||
'path','pathlength','patterncontentunits','patterntransform','patternunits',
|
||||
'points','preservealpha','r','rx','ry','radius','refx','refy','repeatcount',
|
||||
'repeatdur','restart','result','rotate','scale','seed','shape-rendering',
|
||||
'specularconstant','specularexponent','spreadmethod','stddeviation','stitchtiles',
|
||||
'stop-color','stop-opacity','stroke-dasharray','stroke-dashoffset','stroke-linecap',
|
||||
'stroke-linejoin','stroke-miterlimit','stroke-opacity','stroke','stroke-width',
|
||||
'surfacescale','targetx','targety','transform','text-anchor','text-decoration',
|
||||
'text-rendering','textlength','u1','u2','unicode','values','viewbox',
|
||||
'visibility','vert-adv-y','vert-origin-x','vert-origin-y','word-spacing',
|
||||
'wrap','writing-mode','xchannelselector','ychannelselector','x','x1','x2',
|
||||
'y','y1','y2','z','zoomandpan',
|
||||
|
||||
// MathML
|
||||
'accent','accentunder','bevelled','close','columnsalign','columnlines',
|
||||
'columnspan','denomalign','depth','display','displaystyle','fence',
|
||||
'frame','largeop','length','linethickness','lspace','lquote',
|
||||
'mathbackground','mathcolor','mathsize','mathvariant','maxsize',
|
||||
'minsize','movablelimits','notation','numalign','open','rowalign',
|
||||
'rowlines','rowspacing','rowspan','rspace','rquote','scriptlevel',
|
||||
'scriptminsize','scriptsizemultiplier','selection','separator',
|
||||
'separators','stretchy','subscriptshift','supscriptshift','symmetric',
|
||||
'voffset',
|
||||
|
||||
// XML
|
||||
'xlink:href','xml:id','xlink:title','xml:space','xmlns:xlink'
|
||||
]);
|
||||
|
||||
/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */
|
||||
var FORBID_TAGS = null;
|
||||
|
||||
/* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */
|
||||
var FORBID_ATTR = null;
|
||||
|
||||
/* Decide if custom data attributes are okay */
|
||||
var ALLOW_DATA_ATTR = true;
|
||||
|
||||
/* Decide if unknown protocols are okay */
|
||||
var ALLOW_UNKNOWN_PROTOCOLS = false;
|
||||
|
||||
/* Output should be safe for jQuery's $() factory? */
|
||||
var SAFE_FOR_JQUERY = false;
|
||||
|
||||
/* Output should be safe for common template engines.
|
||||
* This means, DOMPurify removes data attributes, mustaches and ERB
|
||||
*/
|
||||
var SAFE_FOR_TEMPLATES = false;
|
||||
|
||||
/* Specify template detection regex for SAFE_FOR_TEMPLATES mode */
|
||||
var MUSTACHE_EXPR = /\{\{[\s\S]*|[\s\S]*\}\}/gm;
|
||||
var ERB_EXPR = /<%[\s\S]*|[\s\S]*%>/gm;
|
||||
|
||||
/* Decide if document with <html>... should be returned */
|
||||
var WHOLE_DOCUMENT = false;
|
||||
|
||||
/* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html string.
|
||||
* If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead
|
||||
*/
|
||||
var RETURN_DOM = false;
|
||||
|
||||
/* Decide if a DOM `DocumentFragment` should be returned, instead of a html string */
|
||||
var RETURN_DOM_FRAGMENT = false;
|
||||
|
||||
/* If `RETURN_DOM` or `RETURN_DOM_FRAGMENT` is enabled, decide if the returned DOM
|
||||
* `Node` is imported into the current `Document`. If this flag is not enabled the
|
||||
* `Node` will belong (its ownerDocument) to a fresh `HTMLDocument`, created by
|
||||
* DOMPurify. */
|
||||
var RETURN_DOM_IMPORT = false;
|
||||
|
||||
/* Output should be free from DOM clobbering attacks? */
|
||||
var SANITIZE_DOM = true;
|
||||
|
||||
/* Keep element content when removing element? */
|
||||
var KEEP_CONTENT = true;
|
||||
|
||||
/* Tags to ignore content of when KEEP_CONTENT is true */
|
||||
var FORBID_CONTENTS = _addToSet({}, [
|
||||
'audio', 'head', 'math', 'script', 'style', 'svg', 'video'
|
||||
]);
|
||||
|
||||
/* Tags that are safe for data: URIs */
|
||||
var DATA_URI_TAGS = _addToSet({}, [
|
||||
'audio', 'video', 'img', 'source'
|
||||
]);
|
||||
|
||||
/* Attributes safe for values like "javascript:" */
|
||||
var URI_SAFE_ATTRIBUTES = _addToSet({}, [
|
||||
'alt','class','for','id','label','name','pattern','placeholder',
|
||||
'summary','title','value','style','xmlns'
|
||||
]);
|
||||
|
||||
/* Keep a reference to config to pass to hooks */
|
||||
var CONFIG = null;
|
||||
|
||||
/* Ideally, do not touch anything below this line */
|
||||
/* ______________________________________________ */
|
||||
|
||||
var formElement = document.createElement('form');
|
||||
|
||||
/**
|
||||
* _parseConfig
|
||||
*
|
||||
* @param optional config literal
|
||||
*/
|
||||
var _parseConfig = function(cfg) {
|
||||
/* Shield configuration object from tampering */
|
||||
if (typeof cfg !== 'object') {
|
||||
cfg = {};
|
||||
}
|
||||
|
||||
/* Set configuration parameters */
|
||||
ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ?
|
||||
_addToSet({}, cfg.ALLOWED_TAGS) : DEFAULT_ALLOWED_TAGS;
|
||||
ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ?
|
||||
_addToSet({}, cfg.ALLOWED_ATTR) : DEFAULT_ALLOWED_ATTR;
|
||||
FORBID_TAGS = 'FORBID_TAGS' in cfg ?
|
||||
_addToSet({}, cfg.FORBID_TAGS) : {};
|
||||
FORBID_ATTR = 'FORBID_ATTR' in cfg ?
|
||||
_addToSet({}, cfg.FORBID_ATTR) : {};
|
||||
ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true
|
||||
ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false
|
||||
SAFE_FOR_JQUERY = cfg.SAFE_FOR_JQUERY || false; // Default false
|
||||
SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false
|
||||
WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false
|
||||
RETURN_DOM = cfg.RETURN_DOM || false; // Default false
|
||||
RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false
|
||||
RETURN_DOM_IMPORT = cfg.RETURN_DOM_IMPORT || false; // Default false
|
||||
SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true
|
||||
KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
|
||||
|
||||
if (SAFE_FOR_TEMPLATES) {
|
||||
ALLOW_DATA_ATTR = false;
|
||||
}
|
||||
|
||||
if (RETURN_DOM_FRAGMENT) {
|
||||
RETURN_DOM = true;
|
||||
}
|
||||
|
||||
/* Merge configuration parameters */
|
||||
if (cfg.ADD_TAGS) {
|
||||
if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
|
||||
ALLOWED_TAGS = _cloneObj(ALLOWED_TAGS);
|
||||
}
|
||||
_addToSet(ALLOWED_TAGS, cfg.ADD_TAGS);
|
||||
}
|
||||
if (cfg.ADD_ATTR) {
|
||||
if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) {
|
||||
ALLOWED_ATTR = _cloneObj(ALLOWED_ATTR);
|
||||
}
|
||||
_addToSet(ALLOWED_ATTR, cfg.ADD_ATTR);
|
||||
}
|
||||
|
||||
/* Add #text in case KEEP_CONTENT is set to true */
|
||||
if (KEEP_CONTENT) { ALLOWED_TAGS['#text'] = true; }
|
||||
|
||||
// Prevent further manipulation of configuration.
|
||||
// Not available in IE8, Safari 5, etc.
|
||||
if (Object && 'freeze' in Object) { Object.freeze(cfg); }
|
||||
|
||||
CONFIG = cfg;
|
||||
};
|
||||
|
||||
/**
|
||||
* _forceRemove
|
||||
*
|
||||
* @param a DOM node
|
||||
*/
|
||||
var _forceRemove = function(node) {
|
||||
try {
|
||||
node.parentNode.removeChild(node);
|
||||
} catch (e) {
|
||||
node.outerHTML = '';
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* _initDocument
|
||||
*
|
||||
* @param a string of dirty markup
|
||||
* @return a DOM, filled with the dirty markup
|
||||
*/
|
||||
var _initDocument = function(dirty) {
|
||||
/* Create a HTML document using DOMParser */
|
||||
var doc, body;
|
||||
try {
|
||||
doc = new DOMParser().parseFromString(dirty, 'text/html');
|
||||
} catch (e) {}
|
||||
|
||||
/* Some browsers throw, some browsers return null for the code above
|
||||
DOMParser with text/html support is only in very recent browsers. */
|
||||
if (!doc) {
|
||||
doc = implementation.createHTMLDocument('');
|
||||
body = doc.body;
|
||||
body.parentNode.removeChild(body.parentNode.firstElementChild);
|
||||
body.outerHTML = dirty;
|
||||
}
|
||||
|
||||
/* Work on whole document or just its body */
|
||||
if (typeof doc.getElementsByTagName === 'function') {
|
||||
return doc.getElementsByTagName(
|
||||
WHOLE_DOCUMENT ? 'html' : 'body')[0];
|
||||
}
|
||||
return getElementsByTagName.call(doc,
|
||||
WHOLE_DOCUMENT ? 'html' : 'body')[0];
|
||||
};
|
||||
|
||||
/**
|
||||
* _createIterator
|
||||
*
|
||||
* @param document/fragment to create iterator for
|
||||
* @return iterator instance
|
||||
*/
|
||||
var _createIterator = function(root) {
|
||||
return createNodeIterator.call(root.ownerDocument || root,
|
||||
root,
|
||||
NodeFilter.SHOW_ELEMENT
|
||||
| NodeFilter.SHOW_COMMENT
|
||||
| NodeFilter.SHOW_TEXT,
|
||||
function() { return NodeFilter.FILTER_ACCEPT; },
|
||||
false
|
||||
);
|
||||
};
|
||||
|
||||
/**
|
||||
* _isClobbered
|
||||
*
|
||||
* @param element to check for clobbering attacks
|
||||
* @return true if clobbered, false if safe
|
||||
*/
|
||||
var _isClobbered = function(elm) {
|
||||
if (elm instanceof Text || elm instanceof Comment) {
|
||||
return false;
|
||||
}
|
||||
if ( typeof elm.nodeName !== 'string'
|
||||
|| typeof elm.textContent !== 'string'
|
||||
|| typeof elm.removeChild !== 'function'
|
||||
|| !(elm.attributes instanceof NamedNodeMap)
|
||||
|| typeof elm.removeAttribute !== 'function'
|
||||
|| typeof elm.setAttribute !== 'function'
|
||||
) {
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
};
|
||||
|
||||
/**
|
||||
* _sanitizeElements
|
||||
*
|
||||
* @protect nodeName
|
||||
* @protect textContent
|
||||
* @protect removeChild
|
||||
*
|
||||
* @param node to check for permission to exist
|
||||
* @return true if node was killed, false if left alive
|
||||
*/
|
||||
var _sanitizeElements = function(currentNode) {
|
||||
var tagName, content;
|
||||
/* Execute a hook if present */
|
||||
_executeHook('beforeSanitizeElements', currentNode, null);
|
||||
|
||||
/* Check if element is clobbered or can clobber */
|
||||
if (_isClobbered(currentNode)) {
|
||||
_forceRemove(currentNode);
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Now let's check the element's type and name */
|
||||
tagName = currentNode.nodeName.toLowerCase();
|
||||
|
||||
/* Execute a hook if present */
|
||||
_executeHook('uponSanitizeElement', currentNode, {
|
||||
tagName: tagName
|
||||
});
|
||||
|
||||
/* Remove element if anything forbids its presence */
|
||||
if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
|
||||
/* Keep content except for black-listed elements */
|
||||
if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]
|
||||
&& typeof currentNode.insertAdjacentHTML === 'function') {
|
||||
try {
|
||||
currentNode.insertAdjacentHTML('AfterEnd', currentNode.innerHTML);
|
||||
} catch (e) {}
|
||||
}
|
||||
_forceRemove(currentNode);
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Convert markup to cover jQuery behavior */
|
||||
if (SAFE_FOR_JQUERY && !currentNode.firstElementChild &&
|
||||
(!currentNode.content || !currentNode.content.firstElementChild)) {
|
||||
currentNode.innerHTML = currentNode.textContent.replace(/</g, '<');
|
||||
}
|
||||
|
||||
/* Sanitize element content to be template-safe */
|
||||
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === 3) {
|
||||
/* Get the element's text content */
|
||||
content = currentNode.textContent;
|
||||
content = content.replace(MUSTACHE_EXPR, ' ');
|
||||
content = content.replace(ERB_EXPR, ' ');
|
||||
currentNode.textContent = content;
|
||||
}
|
||||
|
||||
/* Execute a hook if present */
|
||||
_executeHook('afterSanitizeElements', currentNode, null);
|
||||
|
||||
return false;
|
||||
};
|
||||
|
||||
var DATA_ATTR = /^data-[\w.\u00B7-\uFFFF-]/;
|
||||
var IS_ALLOWED_URI = /^(?:(?:(?:f|ht)tps?|mailto|tel):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
|
||||
var IS_SCRIPT_OR_DATA = /^(?:\w+script|data):/i;
|
||||
/* This needs to be extensive thanks to Webkit/Blink's behavior */
|
||||
var ATTR_WHITESPACE = /[\x00-\x20\xA0\u1680\u180E\u2000-\u2029\u205f\u3000]/g;
|
||||
|
||||
/**
|
||||
* _sanitizeAttributes
|
||||
*
|
||||
* @protect attributes
|
||||
* @protect nodeName
|
||||
* @protect removeAttribute
|
||||
* @protect setAttribute
|
||||
*
|
||||
* @param node to sanitize
|
||||
* @return void
|
||||
*/
|
||||
var _sanitizeAttributes = function(currentNode) {
|
||||
var attr, name, value, lcName, idAttr, attributes, hookEvent, l;
|
||||
/* Execute a hook if present */
|
||||
_executeHook('beforeSanitizeAttributes', currentNode, null);
|
||||
|
||||
attributes = currentNode.attributes;
|
||||
|
||||
/* Check if we have attributes; if not we might have a text node */
|
||||
if (!attributes) { return; }
|
||||
|
||||
hookEvent = {
|
||||
attrName: '',
|
||||
attrValue: '',
|
||||
keepAttr: true
|
||||
};
|
||||
l = attributes.length;
|
||||
|
||||
/* Go backwards over all attributes; safely remove bad ones */
|
||||
while (l--) {
|
||||
attr = attributes[l];
|
||||
name = attr.name;
|
||||
value = attr.value;
|
||||
lcName = name.toLowerCase();
|
||||
|
||||
/* Execute a hook if present */
|
||||
hookEvent.attrName = lcName;
|
||||
hookEvent.attrValue = value;
|
||||
hookEvent.keepAttr = true;
|
||||
_executeHook('uponSanitizeAttribute', currentNode, hookEvent );
|
||||
value = hookEvent.attrValue;
|
||||
|
||||
/* Remove attribute */
|
||||
// Safari (iOS + Mac), last tested v8.0.5, crashes if you try to
|
||||
// remove a "name" attribute from an <img> tag that has an "id"
|
||||
// attribute at the time.
|
||||
if (lcName === 'name' &&
|
||||
currentNode.nodeName === 'IMG' && attributes.id) {
|
||||
idAttr = attributes.id;
|
||||
attributes = Array.prototype.slice.apply(attributes);
|
||||
currentNode.removeAttribute('id');
|
||||
currentNode.removeAttribute(name);
|
||||
if (attributes.indexOf(idAttr) > l) {
|
||||
currentNode.setAttribute('id', idAttr.value);
|
||||
}
|
||||
} else {
|
||||
// This avoids a crash in Safari v9.0 with double-ids.
|
||||
// The trick is to first set the id to be empty and then to
|
||||
// remove the attriubute
|
||||
if (name === 'id') {
|
||||
currentNode.setAttribute(name, '');
|
||||
}
|
||||
currentNode.removeAttribute(name);
|
||||
}
|
||||
|
||||
/* Did the hooks approve of the attribute? */
|
||||
if (!hookEvent.keepAttr) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Make sure attribute cannot clobber */
|
||||
if (SANITIZE_DOM &&
|
||||
(lcName === 'id' || lcName === 'name') &&
|
||||
(value in window || value in document || value in formElement)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Sanitize attribute content to be template-safe */
|
||||
if (SAFE_FOR_TEMPLATES) {
|
||||
value = value.replace(MUSTACHE_EXPR, ' ');
|
||||
value = value.replace(ERB_EXPR, ' ');
|
||||
}
|
||||
|
||||
if (
|
||||
/* Check the name is permitted */
|
||||
(ALLOWED_ATTR[lcName] && !FORBID_ATTR[lcName] && (
|
||||
/* Check no script, data or unknown possibly unsafe URI
|
||||
unless we know URI values are safe for that attribute */
|
||||
URI_SAFE_ATTRIBUTES[lcName] ||
|
||||
IS_ALLOWED_URI.test(value.replace(ATTR_WHITESPACE,'')) ||
|
||||
/* Keep image data URIs alive if src is allowed */
|
||||
(lcName === 'src' && value.indexOf('data:') === 0 &&
|
||||
DATA_URI_TAGS[currentNode.nodeName.toLowerCase()])
|
||||
)) ||
|
||||
/* Allow potentially valid data-* attributes:
|
||||
* At least one character after "-" (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
|
||||
* XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
|
||||
* We don't need to check the value; it's always URI safe.
|
||||
*/
|
||||
(ALLOW_DATA_ATTR && DATA_ATTR.test(lcName)) ||
|
||||
/* Allow unknown protocols:
|
||||
* This provides support for links that are handled by protocol handlers which may be unknown
|
||||
* ahead of time, e.g. fb:, spotify:
|
||||
*/
|
||||
(ALLOW_UNKNOWN_PROTOCOLS && !IS_SCRIPT_OR_DATA.test(value.replace(ATTR_WHITESPACE,'')))
|
||||
) {
|
||||
/* Handle invalid data-* attribute set by try-catching it */
|
||||
try {
|
||||
currentNode.setAttribute(name, value);
|
||||
} catch (e) {}
|
||||
}
|
||||
}
|
||||
|
||||
/* Execute a hook if present */
|
||||
_executeHook('afterSanitizeAttributes', currentNode, null);
|
||||
};
|
||||
|
||||
/**
|
||||
* _sanitizeShadowDOM
|
||||
*
|
||||
* @param fragment to iterate over recursively
|
||||
* @return void
|
||||
*/
|
||||
var _sanitizeShadowDOM = function(fragment) {
|
||||
var shadowNode;
|
||||
var shadowIterator = _createIterator(fragment);
|
||||
|
||||
/* Execute a hook if present */
|
||||
_executeHook('beforeSanitizeShadowDOM', fragment, null);
|
||||
|
||||
while ( (shadowNode = shadowIterator.nextNode()) ) {
|
||||
/* Execute a hook if present */
|
||||
_executeHook('uponSanitizeShadowNode', shadowNode, null);
|
||||
|
||||
/* Sanitize tags and elements */
|
||||
if (_sanitizeElements(shadowNode)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Deep shadow DOM detected */
|
||||
if (shadowNode.content instanceof DocumentFragment) {
|
||||
_sanitizeShadowDOM(shadowNode.content);
|
||||
}
|
||||
|
||||
/* Check attributes, sanitize if necessary */
|
||||
_sanitizeAttributes(shadowNode);
|
||||
}
|
||||
|
||||
/* Execute a hook if present */
|
||||
_executeHook('afterSanitizeShadowDOM', fragment, null);
|
||||
};
|
||||
|
||||
/**
|
||||
* _executeHook
|
||||
* Execute user configurable hooks
|
||||
*
|
||||
* @param {String} entryPoint Name of the hook's entry point
|
||||
* @param {Node} currentNode
|
||||
*/
|
||||
var _executeHook = function(entryPoint, currentNode, data) {
|
||||
if (!hooks[entryPoint]) { return; }
|
||||
|
||||
hooks[entryPoint].forEach(function(hook) {
|
||||
hook.call(DOMPurify, currentNode, data, CONFIG);
|
||||
});
|
||||
};
|
||||
|
||||
/**
|
||||
* sanitize
|
||||
* Public method providing core sanitation functionality
|
||||
*
|
||||
* @param {String} dirty string
|
||||
* @param {Object} configuration object
|
||||
*/
|
||||
DOMPurify.sanitize = function(dirty, cfg) {
|
||||
var body, currentNode, oldNode, nodeIterator, returnNode;
|
||||
/* Make sure we have a string to sanitize.
|
||||
DO NOT return early, as this will return the wrong type if
|
||||
the user has requested a DOM object rather than a string */
|
||||
if (!dirty) {
|
||||
dirty = '';
|
||||
}
|
||||
|
||||
/* Stringify, in case dirty is an object */
|
||||
if (typeof dirty !== 'string') {
|
||||
if (typeof dirty.toString !== 'function') {
|
||||
throw new TypeError('toString is not a function');
|
||||
} else {
|
||||
dirty = dirty.toString();
|
||||
}
|
||||
}
|
||||
|
||||
/* Check we can run. Otherwise fall back or ignore */
|
||||
if (!DOMPurify.isSupported) {
|
||||
if (typeof window.toStaticHTML === 'object'
|
||||
|| typeof window.toStaticHTML === 'function') {
|
||||
return window.toStaticHTML(dirty);
|
||||
}
|
||||
return dirty;
|
||||
}
|
||||
|
||||
/* Assign config vars */
|
||||
_parseConfig(cfg);
|
||||
|
||||
/* Exit directly if we have nothing to do */
|
||||
if (!RETURN_DOM && !WHOLE_DOCUMENT && dirty.indexOf('<') === -1) {
|
||||
return dirty;
|
||||
}
|
||||
|
||||
/* Initialize the document to work on */
|
||||
body = _initDocument(dirty);
|
||||
|
||||
/* Check we have a DOM node from the data */
|
||||
if (!body) {
|
||||
return RETURN_DOM ? null : '';
|
||||
}
|
||||
|
||||
/* Get node iterator */
|
||||
nodeIterator = _createIterator(body);
|
||||
|
||||
/* Now start iterating over the created document */
|
||||
while ( (currentNode = nodeIterator.nextNode()) ) {
|
||||
|
||||
/* Fix IE's strange behavior with manipulated textNodes #89 */
|
||||
if (currentNode.nodeType === 3 && currentNode === oldNode) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Sanitize tags and elements */
|
||||
if (_sanitizeElements(currentNode)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Shadow DOM detected, sanitize it */
|
||||
if (currentNode.content instanceof DocumentFragment) {
|
||||
_sanitizeShadowDOM(currentNode.content);
|
||||
}
|
||||
|
||||
/* Check attributes, sanitize if necessary */
|
||||
_sanitizeAttributes(currentNode);
|
||||
|
||||
oldNode = currentNode;
|
||||
}
|
||||
|
||||
/* Return sanitized string or DOM */
|
||||
if (RETURN_DOM) {
|
||||
|
||||
if (RETURN_DOM_FRAGMENT) {
|
||||
returnNode = createDocumentFragment.call(body.ownerDocument);
|
||||
|
||||
while (body.firstChild) {
|
||||
returnNode.appendChild(body.firstChild);
|
||||
}
|
||||
} else {
|
||||
returnNode = body;
|
||||
}
|
||||
|
||||
if (RETURN_DOM_IMPORT) {
|
||||
/* adoptNode() is not used because internal state is not reset
|
||||
(e.g. the past names map of a HTMLFormElement), this is safe
|
||||
in theory but we would rather not risk another attack vector.
|
||||
The state that is cloned by importNode() is explicitly defined
|
||||
by the specs. */
|
||||
returnNode = importNode.call(originalDocument, returnNode, true);
|
||||
}
|
||||
|
||||
return returnNode;
|
||||
}
|
||||
|
||||
return WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
|
||||
};
|
||||
|
||||
/**
|
||||
* addHook
|
||||
* Public method to add DOMPurify hooks
|
||||
*
|
||||
* @param {String} entryPoint
|
||||
* @param {Function} hookFunction
|
||||
*/
|
||||
DOMPurify.addHook = function(entryPoint, hookFunction) {
|
||||
if (typeof hookFunction !== 'function') { return; }
|
||||
hooks[entryPoint] = hooks[entryPoint] || [];
|
||||
hooks[entryPoint].push(hookFunction);
|
||||
};
|
||||
|
||||
/**
|
||||
* removeHook
|
||||
* Public method to remove a DOMPurify hook at a given entryPoint
|
||||
* (pops it from the stack of hooks if more are present)
|
||||
*
|
||||
* @param {String} entryPoint
|
||||
* @return void
|
||||
*/
|
||||
DOMPurify.removeHook = function(entryPoint) {
|
||||
if (hooks[entryPoint]) {
|
||||
hooks[entryPoint].pop();
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* removeHooks
|
||||
* Public method to remove all DOMPurify hooks at a given entryPoint
|
||||
*
|
||||
* @param {String} entryPoint
|
||||
* @return void
|
||||
*/
|
||||
DOMPurify.removeHooks = function(entryPoint) {
|
||||
if (hooks[entryPoint]) {
|
||||
hooks[entryPoint] = [];
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* removeAllHooks
|
||||
* Public method to remove all DOMPurify hooks
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
DOMPurify.removeAllHooks = function() {
|
||||
hooks = [];
|
||||
};
|
||||
|
||||
return DOMPurify;
|
||||
}));
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
Binary file not shown.
Loading…
Reference in New Issue