config-f6225ae7.js 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201
  1. /*!
  2. * (C) Ionic http://ionicframework.com - MIT License
  3. */
  4. 'use strict';
  5. const index = require('./index-cc858e97.js');
  6. /**
  7. * Does a simple sanitization of all elements
  8. * in an untrusted string
  9. */
  10. const sanitizeDOMString = (untrustedString) => {
  11. try {
  12. if (untrustedString instanceof IonicSafeString) {
  13. return untrustedString.value;
  14. }
  15. if (!isSanitizerEnabled() || typeof untrustedString !== 'string' || untrustedString === '') {
  16. return untrustedString;
  17. }
  18. /**
  19. * onload is fired when appending to a document
  20. * fragment in Chrome. If a string
  21. * contains onload then we should not
  22. * attempt to add this to the fragment.
  23. */
  24. if (untrustedString.includes('onload=')) {
  25. return '';
  26. }
  27. /**
  28. * Create a document fragment
  29. * separate from the main DOM,
  30. * create a div to do our work in
  31. */
  32. const documentFragment = document.createDocumentFragment();
  33. const workingDiv = document.createElement('div');
  34. documentFragment.appendChild(workingDiv);
  35. workingDiv.innerHTML = untrustedString;
  36. /**
  37. * Remove any elements
  38. * that are blocked
  39. */
  40. blockedTags.forEach((blockedTag) => {
  41. const getElementsToRemove = documentFragment.querySelectorAll(blockedTag);
  42. for (let elementIndex = getElementsToRemove.length - 1; elementIndex >= 0; elementIndex--) {
  43. const element = getElementsToRemove[elementIndex];
  44. if (element.parentNode) {
  45. element.parentNode.removeChild(element);
  46. }
  47. else {
  48. documentFragment.removeChild(element);
  49. }
  50. /**
  51. * We still need to sanitize
  52. * the children of this element
  53. * as they are left behind
  54. */
  55. const childElements = getElementChildren(element);
  56. /* eslint-disable-next-line */
  57. for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
  58. sanitizeElement(childElements[childIndex]);
  59. }
  60. }
  61. });
  62. /**
  63. * Go through remaining elements and remove
  64. * non-allowed attribs
  65. */
  66. // IE does not support .children on document fragments, only .childNodes
  67. const dfChildren = getElementChildren(documentFragment);
  68. /* eslint-disable-next-line */
  69. for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
  70. sanitizeElement(dfChildren[childIndex]);
  71. }
  72. // Append document fragment to div
  73. const fragmentDiv = document.createElement('div');
  74. fragmentDiv.appendChild(documentFragment);
  75. // First child is always the div we did our work in
  76. const getInnerDiv = fragmentDiv.querySelector('div');
  77. return getInnerDiv !== null ? getInnerDiv.innerHTML : fragmentDiv.innerHTML;
  78. }
  79. catch (err) {
  80. index.printIonError('sanitizeDOMString', err);
  81. return '';
  82. }
  83. };
  84. /**
  85. * Clean up current element based on allowed attributes
  86. * and then recursively dig down into any child elements to
  87. * clean those up as well
  88. */
  89. // TODO(FW-2832): type (using Element triggers other type errors as well)
  90. const sanitizeElement = (element) => {
  91. // IE uses childNodes, so ignore nodes that are not elements
  92. if (element.nodeType && element.nodeType !== 1) {
  93. return;
  94. }
  95. /**
  96. * If attributes is not a NamedNodeMap
  97. * then we should remove the element entirely.
  98. * This helps avoid DOM Clobbering attacks where
  99. * attributes is overridden.
  100. */
  101. if (typeof NamedNodeMap !== 'undefined' && !(element.attributes instanceof NamedNodeMap)) {
  102. element.remove();
  103. return;
  104. }
  105. for (let i = element.attributes.length - 1; i >= 0; i--) {
  106. const attribute = element.attributes.item(i);
  107. const attributeName = attribute.name;
  108. // remove non-allowed attribs
  109. if (!allowedAttributes.includes(attributeName.toLowerCase())) {
  110. element.removeAttribute(attributeName);
  111. continue;
  112. }
  113. // clean up any allowed attribs
  114. // that attempt to do any JS funny-business
  115. const attributeValue = attribute.value;
  116. /**
  117. * We also need to check the property value
  118. * as javascript: can allow special characters
  119. * such as &Tab; and still be valid (i.e. java&Tab;script)
  120. */
  121. const propertyValue = element[attributeName];
  122. /* eslint-disable */
  123. if ((attributeValue != null && attributeValue.toLowerCase().includes('javascript:')) ||
  124. (propertyValue != null && propertyValue.toLowerCase().includes('javascript:'))) {
  125. element.removeAttribute(attributeName);
  126. }
  127. /* eslint-enable */
  128. }
  129. /**
  130. * Sanitize any nested children
  131. */
  132. const childElements = getElementChildren(element);
  133. /* eslint-disable-next-line */
  134. for (let i = 0; i < childElements.length; i++) {
  135. sanitizeElement(childElements[i]);
  136. }
  137. };
  138. /**
  139. * IE doesn't always support .children
  140. * so we revert to .childNodes instead
  141. */
  142. // TODO(FW-2832): type
  143. const getElementChildren = (el) => {
  144. return el.children != null ? el.children : el.childNodes;
  145. };
  146. const isSanitizerEnabled = () => {
  147. var _a;
  148. const win = window;
  149. const config = (_a = win === null || win === void 0 ? void 0 : win.Ionic) === null || _a === void 0 ? void 0 : _a.config;
  150. if (config) {
  151. if (config.get) {
  152. return config.get('sanitizerEnabled', true);
  153. }
  154. else {
  155. return config.sanitizerEnabled === true || config.sanitizerEnabled === undefined;
  156. }
  157. }
  158. return true;
  159. };
  160. const allowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
  161. const blockedTags = ['script', 'style', 'iframe', 'meta', 'link', 'object', 'embed'];
  162. class IonicSafeString {
  163. constructor(value) {
  164. this.value = value;
  165. }
  166. }
  167. const setupConfig = (config) => {
  168. const win = window;
  169. const Ionic = win.Ionic;
  170. // eslint-disable-next-line @typescript-eslint/prefer-optional-chain
  171. if (Ionic && Ionic.config && Ionic.config.constructor.name !== 'Object') {
  172. return;
  173. }
  174. win.Ionic = win.Ionic || {};
  175. win.Ionic.config = Object.assign(Object.assign({}, win.Ionic.config), config);
  176. return win.Ionic.config;
  177. };
  178. const getMode = () => {
  179. var _a;
  180. const win = window;
  181. const config = (_a = win === null || win === void 0 ? void 0 : win.Ionic) === null || _a === void 0 ? void 0 : _a.config;
  182. if (config) {
  183. if (config.mode) {
  184. return config.mode;
  185. }
  186. else {
  187. return config.get('mode');
  188. }
  189. }
  190. return 'md';
  191. };
  192. const ENABLE_HTML_CONTENT_DEFAULT = false;
  193. exports.ENABLE_HTML_CONTENT_DEFAULT = ENABLE_HTML_CONTENT_DEFAULT;
  194. exports.IonicSafeString = IonicSafeString;
  195. exports.getMode = getMode;
  196. exports.sanitizeDOMString = sanitizeDOMString;
  197. exports.setupConfig = setupConfig;