/*
            AdoptNode() is not used because internal state is not reset
            (e.g. the past names map of a HTMLFormElement), this is safe
            in theory but we would rather not risk another attack vector.
            The state that is cloned by importNode() is explicitly defined
            by the specs.
          */

/*
       * Use the DOMParser API by default, fallback later if needs be
       * DOMParser not work for svg when has multiple root element.
       */

/*
     * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements.
     * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements)
     * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list)
     * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`.
     */

/* Add #text in case KEEP_CONTENT is set to true */

/* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */

/* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */

/* Allow valid data-* attributes: At least one character after "-"
          (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
          XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
          We don't need to check the value; it's always URI safe. */

/* Allowed attribute names */

/* Assign config vars */

/* Attributes safe for values like "javascript:" */

/* Check attributes, sanitize if necessary */

/* Check if dirty is correctly typed for IN_PLACE */

/* Check if element is clobbered or can clobber */

/* Check if we have a custom element to handle */

/* Check if we have attributes; if not we might have a text node */

/* Check value is safe. First, is attr inert? If so, is safe */

/* Check we have a DOM node from the data */

/* Check whether element has a valid namespace */

/* Clean up removed elements */

/* Create a HTML document */

/* Deep shadow DOM detected */

/* Detect mXSS attempts abusing namespace confusion */

/* Did the hooks approve of the attribute? */

/* Do some early pre-sanitization to avoid unsafe root nodes */

/* Document namespace */

/* Execute a hook if present */

/* Exit directly if we have nothing to do */

/* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */

/* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */

/* Full DOM Clobbering protection via namespace isolation,
         * Prefix id and name attributes with `user-content-`
         */

/* Get node iterator */

/* Get the element's text content */

/* Go backwards over all attributes; safely remove bad ones */

/* Handle attributes that require Trusted Types */

/* Handle invalid data-* attribute set by try-catching it */

/* Ideally, do not touch anything below this line */

/* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */

/* If a `Node` is passed to sanitize(), then performs sanitization in-place instead
     * of importing it into a new Document and returning a sanitized copy */

/* If dirty is a DOM element, append to an empty document to avoid
           elements being stripped by the parser */

/* If we sanitized `dirty` in-place, return it. */

/* Initialize shared config vars if necessary. */

/* Initialize the document to work on */

/* Is `value` valid for this attribute? */

/* Keep a reference to config to pass to hooks */

/* Keep content except for bad-listed elements */

/* Keep element content when removing element? */

/* Make sure attribute cannot clobber */

/* Make sure that older browsers don't get fallback-tag mXSS */

/* Make sure we have a string to sanitize.
        DO NOT return early, as this will return the wrong type if
        the user has requested a DOM object rather than a string */

/* Merge configuration parameters */

/* Node is already a body, use as is */

/* Now let's check the element's type and name */

/* Now start iterating over the created document */

/* Parse profile info */

/* Parsing of strict XHTML documents */

/* Remove any kind of possibly harmful comments */

/* Remove any occurrence of processing instructions */

/* Remove attribute */

/* Remove element if anything forbids its presence */

/* Remove first element node (ours) if FORCE_BODY is set */

/* Return dirty HTML if DOMPurify cannot run */

/* Return sanitized string or DOM */

/* Sanitize attribute content to be template-safe */

/* Sanitize element content to be template-safe */

/* Sanitize final string template-safe */

/* Sanitize tags and elements */

/* Serialize doctype if allowed */

/* Set configuration parameters */

/* Shadow DOM detected, sanitize it */

/* Shield configuration object from prototype pollution */

/* Shield configuration object from tampering */

/* Stringify, in case dirty is an object */

/* Tags that are safe for data: URIs */

/* Use createHTMLDocument in case DOMParser is not available */

/* Work around a security issue in jQuery 3.0 */

/* Work around a security issue with comments inside attributes */

/* Work on whole document or just its body */

/* ______________________________________________ */

/* allowed element names */

/*! @license DOMPurify 3.1.7 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.1.7/LICENSE */

/*#__PURE__*/

/**
     * AddHook
     * Public method to add DOMPurify hooks
     *
     * @param {String} entryPoint entry point for the hook to add
     * @param {Function} hookFunction function to execute
     */

/**
     * Array of elements that DOMPurify removed during sanitation.
     * Empty if nothing was removed.
     */

/**
     * Expose whether this browser supports running the full DOMPurify.
     */

/**
     * Public method to check if an attribute value is valid.
     * Uses last set config, if any. Otherwise, uses config defaults.
     * isValidAttribute
     *
     * @param  {String} tag Tag name of containing element.
     * @param  {String} attr Attribute name.
     * @param  {String} value Attribute value.
     * @return {Boolean} Returns true if `value` is valid. Otherwise, returns false.
     */

/**
     * Public method to remove the configuration
     * clearConfig
     *
     */

/**
     * Public method to set the configuration once
     * setConfig
     *
     * @param {Object} cfg configuration object
     */

/**
     * RemoveAllHooks
     * Public method to remove all DOMPurify hooks
     */

/**
     * RemoveHook
     * Public method to remove a DOMPurify hook at a given entryPoint
     * (pops it from the stack of hooks if more are present)
     *
     * @param {String} entryPoint entry point for the hook to remove
     * @return {Function} removed(popped) hook
     */

/**
     * RemoveHooks
     * Public method to remove all DOMPurify hooks at a given entryPoint
     *
     * @param  {String} entryPoint entry point for the hooks to remove
     */

/**
     * Sanitize
     * Public method providing core sanitation functionality
     *
     * @param {String|Node} dirty string or DOM node
     * @param {Object} cfg object
     */

/**
     * Version label, exposed for easier checks
     * if DOMPurify is up to date or not
     */

/**
     * We consider the elements and attributes below to be safe. Ideally
     * don't add any new ones but feel free to remove unwanted ones.
     */

/**
   * Add properties to a lookup table
   *
   * @param {Object} set - The set to which elements will be added.
   * @param {Array} array - The array containing elements to be added to the set.
   * @param {Function} transformCaseFunc - An optional function to transform the case of each element before adding to the set.
   * @returns {Object} The modified set with added elements.
   */

/**
   * Clean up an array to harden against CSPP
   *
   * @param {Array} array - The array to be cleaned.
   * @returns {Array} The cleaned version of the array
   */

/**
   * Creates a new function that calls the given function with a specified thisArg and arguments.
   *
   * @param {Function} func - The function to be wrapped and called.
   * @returns {Function} A new function that calls the given function with a specified thisArg and arguments.
   */

/**
   * Creates a new function that constructs an instance of the given constructor function with the provided arguments.
   *
   * @param {Function} func - The constructor function to be wrapped and called.
   * @returns {Function} A new function that constructs an instance of the given constructor function with the provided arguments.
   */

/**
   * Shallow clone an object
   *
   * @param {Object} object - The object to be cloned.
   * @returns {Object} A new object that copies the original.
   */

/**
   * This method automatically checks if the prop is function or getter and behaves accordingly.
   *
   * @param {Object} object - The object to look up the getter function in its prototype chain.
   * @param {String} prop - The property name for which to find the getter function.
   * @returns {Function} The getter function found in the prototype chain or a fallback function.
   */

/***/

// (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)

// <math> and HTML integration points

// Allow the callers to control the unique policy name

// Allows developers to see this is a property they can set

// Alternative, second condition checks if it's an `is`-attribute, AND

// As per issue #47, the web-components registry is inherited by a

// Config presets (e.g. tags.js, attrs.js) are immutable.

// Default false

// Default true

// Deprecated

// First condition does a very basic check if a) it's basically a valid custom element tagname AND

// HTML integration points, and from MathML to HTML

// HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.

// If creating the internal policy succeeded sign internal variables.

// In JSDOM, if we're inside shadow DOM, then parentNode

// Make 'in' and truthy checks like Boolean(set.constructor)

// Not available in IE8, Safari 5, etc.

// Not running in a browser, provide a factory function

// Overwrite existing TrustedTypes policy.

// Policy creation failed (most likely another DOMPurify script has

// Policy creation with duplicate names throws in Trusted Types.

// Prefix the value and later re-create the attribute with the sanitized value

// Prevent further manipulation of configuration.

// Prevent prototype setters from intercepting set as a this value.

// Remove the attribute with this value

// Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict)

// SVG

// Sign local variables required by `sanitize`.

// Syntax error if dirtyPayload is invalid xml

// The only way to switch from HTML namespace to MathML

// The only way to switch from HTML namespace to SVG

// The only way to switch from MathML to SVG is via`

// The only way to switch from SVG to HTML is via

// The only way to switch from SVG to MathML is via

// Uninitialized policy, attempt to initialize the internal dompurify policy.

// We void attribute values for unremovable "is"" attributes

// a new empty registry is used when creating a template contents owner

// already run). Skip creating the policy, as this will only cause errors

// and c) if the attribute name passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.attributeNameCheck

// b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck

// by adding a data-tt-policy-suffix to the script element with the DOMPurify.

// can be null. We just simulate parent in this case.

// document, so we use that as our parent document to ensure nothing

// eslint-disable-line import/no-mutable-exports

// eslint-disable-line indent

// eslint-disable-next-line complexity

// eslint-disable-next-line no-bitwise

// eslint-disable-next-line unicorn/prefer-dom-node-append

// eslint-disable-next-line unicorn/prefer-dom-node-remove

// eslint-disable-next-line unicorn/prefer-includes

// https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType

// if TT are enforced.

// independent of any properties defined on Object.prototype.

// is inherited.

// is via <math>. If it happens via any other tag, then

// is via <svg>. If it happens via any other tag, then

// is via MathML text integration points

// it should be killed.

// new document created via createHTMLDocument. As per the spec

// so that you can pass your own Window

// svg if parent is either <annotation-xml> or MathML

// text integration points.

// the value passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck

//# sourceMappingURL=purify.js.map
