UNPKG

next-csrf

Version:

CSRF mitigation library for Next.js

209 lines (159 loc) 6.46 kB
'use strict'; Object.defineProperty(exports, "__esModule", { value: true }); var _focusRelevant = require('./focus-relevant'); var _focusRelevant2 = _interopRequireDefault(_focusRelevant); var _validArea = require('./valid-area'); var _validArea2 = _interopRequireDefault(_validArea); var _visible = require('./visible'); var _visible2 = _interopRequireDefault(_visible); var _disabled = require('./disabled'); var _disabled2 = _interopRequireDefault(_disabled); var _onlyTabbable = require('./only-tabbable'); var _onlyTabbable2 = _interopRequireDefault(_onlyTabbable); var _contextToElement = require('../util/context-to-element'); var _contextToElement2 = _interopRequireDefault(_contextToElement); var _getFrameElement = require('../util/get-frame-element'); var _getFrameElement2 = _interopRequireDefault(_getFrameElement); var _tabindexValue = require('../util/tabindex-value'); var _tabindexValue2 = _interopRequireDefault(_tabindexValue); var _supports2 = require('../supports/supports'); var _supports3 = _interopRequireDefault(_supports2); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } var supports = void 0; // determine if an element can be focused // https://www.w3.org/TR/html5/editing.html#focus-management // NOTE: The following known issues exist: // Gecko: `svg a[xlink|href]` is not identified as focusable (because SVGElement.prototype.focus is missing) // Blink, WebKit: SVGElements that have been made focusable by adding a focus event listener are not identified as focusable function isOnlyFocusRelevant(element) { var nodeName = element.nodeName.toLowerCase(); if (nodeName === 'embed' || nodeName === 'keygen') { // embed is considered focus-relevant but not focusable // see https://github.com/medialize/ally.js/issues/82 return true; } var _tabindex = (0, _tabindexValue2.default)(element); if (element.shadowRoot && _tabindex === null) { // ShadowDOM host elements *may* receive focus // even though they are not considered focuable return true; } if (nodeName === 'label') { // <label tabindex="0"> is only tabbable in Firefox, not script-focusable // there's no way to make an element focusable other than by adding a tabindex, // and focus behavior of the label element seems hard-wired to ignore tabindex // in some browsers (like Gecko, Blink and WebKit) return !supports.focusLabelTabindex || _tabindex === null; } if (nodeName === 'legend') { return _tabindex === null; } if (supports.focusSvgFocusableAttribute && (element.ownerSVGElement || nodeName === 'svg')) { // Internet Explorer understands the focusable attribute introduced in SVG Tiny 1.2 var focusableAttribute = element.getAttribute('focusable'); return focusableAttribute && focusableAttribute === 'false'; } if (nodeName === 'img' && element.hasAttribute('usemap')) { // Gecko, Trident and Edge do not allow an image with an image map and tabindex to be focused, // it appears the tabindex is overruled so focus is still forwarded to the <map> return _tabindex === null || !supports.focusImgUsemapTabindex; } if (nodeName === 'area') { // all <area>s are considered relevant, // but only the valid <area>s are focusable return !(0, _validArea2.default)(element); } return false; } function isFocusableRules() { var _ref = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {}, context = _ref.context, _ref$except = _ref.except, except = _ref$except === undefined ? { disabled: false, visible: false, onlyTabbable: false } : _ref$except; if (!supports) { supports = (0, _supports3.default)(); } var _isOnlyTabbable = _onlyTabbable2.default.rules.except({ onlyFocusableBrowsingContext: true, visible: except.visible }); var element = (0, _contextToElement2.default)({ label: 'is/focusable', resolveDocument: true, context: context }); var focusRelevant = _focusRelevant2.default.rules({ context: element, except: except }); if (!focusRelevant || isOnlyFocusRelevant(element)) { return false; } if (!except.disabled && (0, _disabled2.default)(element)) { return false; } if (!except.onlyTabbable && _isOnlyTabbable(element)) { // some elements may be keyboard focusable, but not script focusable return false; } // elements that are not rendered, cannot be focused if (!except.visible) { var visibilityOptions = { context: element, except: {} }; if (supports.focusInHiddenIframe) { // WebKit and Blink can focus content in hidden <iframe> and <object> visibilityOptions.except.browsingContext = true; } if (supports.focusObjectSvgHidden) { // Blink allows focusing the object element, even if it has visibility: hidden; // @browser-issue Blink https://code.google.com/p/chromium/issues/detail?id=586191 var _nodeName2 = element.nodeName.toLowerCase(); if (_nodeName2 === 'object') { visibilityOptions.except.cssVisibility = true; } } if (!_visible2.default.rules(visibilityOptions)) { return false; } } var frameElement = (0, _getFrameElement2.default)(element); if (frameElement) { var _nodeName = frameElement.nodeName.toLowerCase(); if (_nodeName === 'object' && !supports.focusInZeroDimensionObject) { if (!frameElement.offsetWidth || !frameElement.offsetHeight) { // WebKit can not focus content in <object> if it doesn't have dimensions return false; } } } var nodeName = element.nodeName.toLowerCase(); if (nodeName === 'svg' && supports.focusSvgInIframe && !frameElement && element.getAttribute('tabindex') === null) { return false; } return true; } // bind exceptions to an iterator callback isFocusableRules.except = function () { var except = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {}; var isFocusable = function isFocusable(context) { return isFocusableRules({ context: context, except: except }); }; isFocusable.rules = isFocusableRules; return isFocusable; }; // provide isFocusRelevant(context) as default iterator callback var isFocusable = isFocusableRules.except({}); exports.default = isFocusable; module.exports = exports['default']; //# sourceMappingURL=focusable.js.map