test-isc
Version:
An Ionic component similar to Ionic Select, that allows to search items, including async search, group, add, edit, delete items, and much more.
134 lines (133 loc) • 4.93 kB
JavaScript
/**
* Does a simple sanitization of all elements
* in an untrusted string
*/
var sanitizeDOMString = function (untrustedString) {
try {
if (untrustedString instanceof IonicSafeString) {
return untrustedString.value;
}
if (!isSanitizerEnabled() || typeof untrustedString !== 'string' || untrustedString === '') {
return untrustedString;
}
/**
* Create a document fragment
* separate from the main DOM,
* create a div to do our work in
*/
var documentFragment_1 = document.createDocumentFragment();
var workingDiv = document.createElement('div');
documentFragment_1.appendChild(workingDiv);
workingDiv.innerHTML = untrustedString;
/**
* Remove any elements
* that are blocked
*/
blockedTags.forEach(function (blockedTag) {
var getElementsToRemove = documentFragment_1.querySelectorAll(blockedTag);
for (var elementIndex = getElementsToRemove.length - 1; elementIndex >= 0; elementIndex--) {
var element = getElementsToRemove[elementIndex];
if (element.parentNode) {
element.parentNode.removeChild(element);
}
else {
documentFragment_1.removeChild(element);
}
/**
* We still need to sanitize
* the children of this element
* as they are left behind
*/
var childElements = getElementChildren(element);
/* tslint:disable-next-line */
for (var childIndex = 0; childIndex < childElements.length; childIndex++) {
sanitizeElement(childElements[childIndex]);
}
}
});
/**
* Go through remaining elements and remove
* non-allowed attribs
*/
// IE does not support .children on document fragments, only .childNodes
var dfChildren = getElementChildren(documentFragment_1);
/* tslint:disable-next-line */
for (var childIndex = 0; childIndex < dfChildren.length; childIndex++) {
sanitizeElement(dfChildren[childIndex]);
}
// Append document fragment to div
var fragmentDiv = document.createElement('div');
fragmentDiv.appendChild(documentFragment_1);
// First child is always the div we did our work in
var getInnerDiv = fragmentDiv.querySelector('div');
return (getInnerDiv !== null) ? getInnerDiv.innerHTML : fragmentDiv.innerHTML;
}
catch (err) {
console.error(err);
return '';
}
};
/**
* Clean up current element based on allowed attributes
* and then recursively dig down into any child elements to
* clean those up as well
*/
var sanitizeElement = function (element) {
// IE uses childNodes, so ignore nodes that are not elements
if (element.nodeType && element.nodeType !== 1) {
return;
}
for (var i = element.attributes.length - 1; i >= 0; i--) {
var attribute = element.attributes.item(i);
var attributeName = attribute.name;
// remove non-allowed attribs
if (!allowedAttributes.includes(attributeName.toLowerCase())) {
element.removeAttribute(attributeName);
continue;
}
// clean up any allowed attribs
// that attempt to do any JS funny-business
var attributeValue = attribute.value;
/* tslint:disable-next-line */
if (attributeValue != null && attributeValue.toLowerCase().includes('javascript:')) {
element.removeAttribute(attributeName);
}
}
/**
* Sanitize any nested children
*/
var childElements = getElementChildren(element);
/* tslint:disable-next-line */
for (var i = 0; i < childElements.length; i++) {
sanitizeElement(childElements[i]);
}
};
/**
* IE doesn't always support .children
* so we revert to .childNodes instead
*/
var getElementChildren = function (el) {
return (el.children != null) ? el.children : el.childNodes;
};
var isSanitizerEnabled = function () {
var win = window;
var config = win && win.Ionic && win.Ionic.config;
if (config) {
if (config.get) {
return config.get('sanitizerEnabled', true);
}
else {
return config.sanitizerEnabled === true || config.sanitizerEnabled === undefined;
}
}
return true;
};
var allowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
var blockedTags = ['script', 'style', 'iframe', 'meta', 'link', 'object', 'embed'];
var IonicSafeString = /** @class */ (function () {
function IonicSafeString(value) {
this.value = value;
}
return IonicSafeString;
}());
export { sanitizeDOMString as s };