SafeMethods.js 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158
  1. "use strict";
  2. var __values = (this && this.__values) || function(o) {
  3. var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
  4. if (m) return m.call(o);
  5. if (o && typeof o.length === "number") return {
  6. next: function () {
  7. if (o && i >= o.length) o = void 0;
  8. return { value: o && o[i++], done: !o };
  9. }
  10. };
  11. throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
  12. };
  13. var __read = (this && this.__read) || function (o, n) {
  14. var m = typeof Symbol === "function" && o[Symbol.iterator];
  15. if (!m) return o;
  16. var i = m.call(o), r, ar = [], e;
  17. try {
  18. while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
  19. }
  20. catch (error) { e = { error: error }; }
  21. finally {
  22. try {
  23. if (r && !r.done && (m = i["return"])) m.call(i);
  24. }
  25. finally { if (e) throw e.error; }
  26. }
  27. return ar;
  28. };
  29. Object.defineProperty(exports, "__esModule", { value: true });
  30. exports.SafeMethods = void 0;
  31. var lengths_js_1 = require("../../util/lengths.js");
  32. exports.SafeMethods = {
  33. filterURL: function (safe, url) {
  34. var protocol = (url.match(/^\s*([a-z]+):/i) || [null, ''])[1].toLowerCase();
  35. var allow = safe.allow.URLs;
  36. return (allow === 'all' || (allow === 'safe' &&
  37. (safe.options.safeProtocols[protocol] || !protocol))) ? url : null;
  38. },
  39. filterClassList: function (safe, list) {
  40. var _this = this;
  41. var classes = list.trim().replace(/\s\s+/g, ' ').split(/ /);
  42. return classes.map(function (name) { return _this.filterClass(safe, name) || ''; }).join(' ').trim().replace(/\s\s+/g, '');
  43. },
  44. filterClass: function (safe, CLASS) {
  45. var allow = safe.allow.classes;
  46. return (allow === 'all' || (allow === 'safe' && CLASS.match(safe.options.classPattern))) ? CLASS : null;
  47. },
  48. filterID: function (safe, id) {
  49. var allow = safe.allow.cssIDs;
  50. return (allow === 'all' || (allow === 'safe' && id.match(safe.options.idPattern))) ? id : null;
  51. },
  52. filterStyles: function (safe, styles) {
  53. var e_1, _a, e_2, _b;
  54. if (safe.allow.styles === 'all')
  55. return styles;
  56. if (safe.allow.styles !== 'safe')
  57. return null;
  58. var adaptor = safe.adaptor;
  59. var options = safe.options;
  60. try {
  61. var div1 = adaptor.node('div', { style: styles });
  62. var div2 = adaptor.node('div');
  63. try {
  64. for (var _c = __values(Object.keys(options.safeStyles)), _d = _c.next(); !_d.done; _d = _c.next()) {
  65. var style = _d.value;
  66. if (options.styleParts[style]) {
  67. try {
  68. for (var _e = (e_2 = void 0, __values(['Top', 'Right', 'Bottom', 'Left'])), _f = _e.next(); !_f.done; _f = _e.next()) {
  69. var sufix = _f.value;
  70. var name_1 = style + sufix;
  71. var value = this.filterStyle(safe, name_1, div1);
  72. if (value) {
  73. adaptor.setStyle(div2, name_1, value);
  74. }
  75. }
  76. }
  77. catch (e_2_1) { e_2 = { error: e_2_1 }; }
  78. finally {
  79. try {
  80. if (_f && !_f.done && (_b = _e.return)) _b.call(_e);
  81. }
  82. finally { if (e_2) throw e_2.error; }
  83. }
  84. }
  85. else {
  86. var value = this.filterStyle(safe, style, div1);
  87. if (value) {
  88. adaptor.setStyle(div2, style, value);
  89. }
  90. }
  91. }
  92. }
  93. catch (e_1_1) { e_1 = { error: e_1_1 }; }
  94. finally {
  95. try {
  96. if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
  97. }
  98. finally { if (e_1) throw e_1.error; }
  99. }
  100. styles = adaptor.allStyles(div2);
  101. }
  102. catch (err) {
  103. styles = '';
  104. }
  105. return styles;
  106. },
  107. filterStyle: function (safe, style, div) {
  108. var value = safe.adaptor.getStyle(div, style);
  109. if (typeof value !== 'string' || value === '' || value.match(/^\s*calc/) ||
  110. (value.match(/javascript:/) && !safe.options.safeProtocols.javascript) ||
  111. (value.match(/data:/) && !safe.options.safeProtocols.data)) {
  112. return null;
  113. }
  114. var name = style.replace(/Top|Right|Left|Bottom/, '');
  115. if (!safe.options.safeStyles[style] && !safe.options.safeStyles[name]) {
  116. return null;
  117. }
  118. return this.filterStyleValue(safe, style, value, div);
  119. },
  120. filterStyleValue: function (safe, style, value, div) {
  121. var name = safe.options.styleLengths[style];
  122. if (!name) {
  123. return value;
  124. }
  125. if (typeof name !== 'string') {
  126. return this.filterStyleLength(safe, style, value);
  127. }
  128. var length = this.filterStyleLength(safe, name, safe.adaptor.getStyle(div, name));
  129. if (!length) {
  130. return null;
  131. }
  132. safe.adaptor.setStyle(div, name, length);
  133. return safe.adaptor.getStyle(div, style);
  134. },
  135. filterStyleLength: function (safe, style, value) {
  136. if (!value.match(/^(.+)(em|ex|ch|rem|px|mm|cm|in|pt|pc|%)$/))
  137. return null;
  138. var em = (0, lengths_js_1.length2em)(value, 1);
  139. var lengths = safe.options.styleLengths[style];
  140. var _a = __read((Array.isArray(lengths) ? lengths : [-safe.options.lengthMax, safe.options.lengthMax]), 2), m = _a[0], M = _a[1];
  141. return (m <= em && em <= M ? value : (em < m ? m : M).toFixed(3).replace(/\.?0+$/, '') + 'em');
  142. },
  143. filterFontSize: function (safe, size) {
  144. return this.filterStyleLength(safe, 'fontSize', size);
  145. },
  146. filterSizeMultiplier: function (safe, size) {
  147. var _a = __read(safe.options.scriptsizemultiplierRange || [-Infinity, Infinity], 2), m = _a[0], M = _a[1];
  148. return Math.min(M, Math.max(m, parseFloat(size))).toString();
  149. },
  150. filterScriptLevel: function (safe, level) {
  151. var _a = __read(safe.options.scriptlevelRange || [-Infinity, Infinity], 2), m = _a[0], M = _a[1];
  152. return Math.min(M, Math.max(m, parseInt(level))).toString();
  153. },
  154. filterData: function (safe, value, id) {
  155. return (id.match(safe.options.dataPattern) ? value : null);
  156. }
  157. };
  158. //# sourceMappingURL=SafeMethods.js.map