diff --git a/CHANGELOG.md b/CHANGELOG.md index c6604fda0..0432ab1ae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,25 +1,55 @@ # Change Log +## [v11.33.0](https://github.com/auth0/lock/tree/v11.33.0) (2022-05-05) + +[Full Changelog](https://github.com/auth0/lock/compare/v11.32.2...v11.33.0) + +**Important** + +This release contains a change to how [custom signup fields](https://github.com/auth0/lock/#additional-sign-up-fields) are processed. From this release, all HTML tags are stripped from user input into any custom signup field before being sent to Auth0 to register the user. This is a security measure to help mitigate from potential XSS attacks in signup verification emails. + +If you would be affected by this change and require HTML to be specified in a custom signup field, please leave us some feedback in our [issue tracker](https://github.com/auth0/lock/issues). + +**Changed** + +- ui box - div replaced by main [\#2114](https://github.com/auth0/lock/pull/2114) ([piwysocki](https://github.com/piwysocki)) +- More complete support for custom passwordless connections [\#2105](https://github.com/auth0/lock/pull/2105) ([peter-isgfunds](https://github.com/peter-isgfunds)) + +**Fixed** + +- fix: initialize reset password inside componentDidMount [\#2111](https://github.com/auth0/lock/pull/2111) ([stevehobbsdev](https://github.com/stevehobbsdev)) + +**Security** + +- [Snyk] Upgrade dompurify from 2.3.4 to 2.3.5 [\#2101](https://github.com/auth0/lock/pull/2101) ([snyk-bot](https://github.com/snyk-bot)) + ## [v11.32.2](https://github.com/auth0/lock/tree/v11.32.2) (2022-02-08) + [Full Changelog](https://github.com/auth0/lock/compare/v11.32.1...v11.32.2) **Changed** + - align german loginWithLabel translation with Apple Guidelines [\#2097](https://github.com/auth0/lock/pull/2097) ([Steffen911](https://github.com/Steffen911)) **Fixed** + - [SDK-3087] Captcha for single enterprise AD connections [\#2096](https://github.com/auth0/lock/pull/2096) ([stevehobbsdev](https://github.com/stevehobbsdev)) **Security** + - [Snyk] Upgrade qs from 6.10.2 to 6.10.3 [\#2095](https://github.com/auth0/lock/pull/2095) ([snyk-bot](https://github.com/snyk-bot)) - Bump cached-path-relative from 1.0.2 to 1.1.0 [\#2091](https://github.com/auth0/lock/pull/2091) ([dependabot[bot]](https://github.com/apps/dependabot)) ## [v11.32.1](https://github.com/auth0/lock/tree/v11.32.1) (2022-01-27) + [Full Changelog](https://github.com/auth0/lock/compare/v11.32.0...v11.32.1) **Changed** + - Update auth0-js and support legacySameSiteCookie option [\#2089](https://github.com/auth0/lock/pull/2089) ([stevehobbsdev](https://github.com/stevehobbsdev)) **Security** + - Bump log4js from 6.3.0 to 6.4.0 [\#2087](https://github.com/auth0/lock/pull/2087) ([dependabot[bot]](https://github.com/apps/dependabot)) - Security upgrade node-fetch to 2.6.7 [\#2085](https://github.com/auth0/lock/pull/2085) ([evansims](https://github.com/evansims)) - [Snyk] Upgrade prop-types from 15.7.2 to 15.8.0 [\#2083](https://github.com/auth0/lock/pull/2083) ([snyk-bot](https://github.com/snyk-bot)) @@ -27,9 +57,11 @@ - Bump follow-redirects from 1.14.4 to 1.14.7 [\#2081](https://github.com/auth0/lock/pull/2081) ([dependabot[bot]](https://github.com/apps/dependabot)) ## [v11.32.0](https://github.com/auth0/lock/tree/v11.32.0) (2022-01-07) + [Full Changelog](https://github.com/auth0/lock/compare/v11.31.1...v11.32.0) **Fixed** + - [SDK-2970] Remove captcha for enterprise SSO connections [\#2071](https://github.com/auth0/lock/pull/2071) ([stevehobbsdev](https://github.com/stevehobbsdev)) - Add ID attributes to password field + submit button [\#2072](https://github.com/auth0/lock/pull/2072) ([stevehobbsdev](https://github.com/stevehobbsdev)) diff --git a/README.md b/README.md index 605d62ce2..f5651d34d 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ From CDN ```html - + ``` From [npm](https://npmjs.org) @@ -490,6 +490,8 @@ Extra input fields can be added to the sign up screen with the `additionalSignUp Additional sign up fields are rendered below the default fields in the order they are provided. +:warning: **Note**: From `11.33.0` onwards, all HTML tags are stripped from user input into custom signup fields. + ##### Text field A `validator` function can also be provided. diff --git a/bower.json b/bower.json index 5069aaea3..e645e2579 100644 --- a/bower.json +++ b/bower.json @@ -1,6 +1,6 @@ { "name": "auth0-lock", - "version": "11.32.2", + "version": "11.33.0", "main": "build/lock.js", "ignore": [ "lib-cov", diff --git a/build/lock.js b/build/lock.js index 7a194875b..8dbca4730 100644 --- a/build/lock.js +++ b/build/lock.js @@ -1,8 +1,8 @@ /*! - * lock v11.32.2 + * lock v11.33.0 * * Author: Auth0 (http://auth0.com) - * Date: 08/02/2022, 15:03:19 + * Date: 05/05/2022, 11:36:29 * License: MIT * *//******/ (function(modules) { // webpackBootstrap @@ -1852,7 +1852,7 @@ module.exports = ReactDOMComponentTree; /* harmony import */ var __WEBPACK_IMPORTED_MODULE_4__sync__ = __webpack_require__(28); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_5_trim__ = __webpack_require__(31); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_5_trim___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_5_trim__); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__core_tenant__ = __webpack_require__(67); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__core_tenant__ = __webpack_require__(68); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__connection_enterprise__ = __webpack_require__(13); @@ -7349,14 +7349,14 @@ Object.defineProperty(__webpack_exports__, "__esModule", { value: true }); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_1_immutable__ = __webpack_require__(11); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_1_immutable___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_1_immutable__); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__utils_format__ = __webpack_require__(120); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_3_dompurify__ = __webpack_require__(77); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_3_dompurify__ = __webpack_require__(58); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_3_dompurify___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_3_dompurify__); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_4__sync__ = __webpack_require__(28); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_5__core_index__ = __webpack_require__(1); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__utils_data_utils__ = __webpack_require__(20); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__i18n_en__ = __webpack_require__(200); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__i18n_en___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_7__i18n_en__); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_8__utils_cdn_utils__ = __webpack_require__(76); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_8__utils_cdn_utils__ = __webpack_require__(77); var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }; @@ -7452,7 +7452,7 @@ function assertLanguage(m, language, base) { function syncLang(m, language, _cb) { __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_8__utils_cdn_utils__["a" /* load */])({ method: 'registerLanguageDictionary', - url: __WEBPACK_IMPORTED_MODULE_5__core_index__["languageBaseUrl"](m) + '/js/lock/' + '11.32.2' + '/' + language + '.js', + url: __WEBPACK_IMPORTED_MODULE_5__core_index__["languageBaseUrl"](m) + '/js/lock/' + '11.33.0' + '/' + language + '.js', check: function check(str) { return str && str === language; }, @@ -7504,7 +7504,7 @@ if (typeof window !== 'undefined') { /* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__field_index__ = __webpack_require__(3); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_3__utils_data_utils__ = __webpack_require__(20); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_4__field_email__ = __webpack_require__(19); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_5__field_username__ = __webpack_require__(71); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_5__field_username__ = __webpack_require__(72); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__engine_classic__ = __webpack_require__(34); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__database_index__ = __webpack_require__(10); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_8__store_index__ = __webpack_require__(8); @@ -8415,7 +8415,7 @@ var CallbackQueue = __webpack_require__(128); var PooledClass = __webpack_require__(30); var ReactFeatureFlags = __webpack_require__(133); var ReactReconciler = __webpack_require__(37); -var Transaction = __webpack_require__(61); +var Transaction = __webpack_require__(62); var invariant = __webpack_require__(2); @@ -9159,13 +9159,13 @@ var Auth0WebAPI = function () { /* harmony export (immutable) */ __webpack_exports__["b"] = cancelMFALogin; /* harmony export (immutable) */ __webpack_exports__["d"] = toggleTermsAcceptance; /* unused harmony export showLoginMFAActivity */ -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0_immutable__ = __webpack_require__(11); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0_immutable___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_0_immutable__); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_1__store_index__ = __webpack_require__(8); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__core_web_api__ = __webpack_require__(26); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_3__core_actions__ = __webpack_require__(16); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_4__core_index__ = __webpack_require__(1); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_5__field_index__ = __webpack_require__(3); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0__store_index__ = __webpack_require__(8); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_1__core_web_api__ = __webpack_require__(26); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__core_actions__ = __webpack_require__(16); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_3__core_index__ = __webpack_require__(1); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_4__field_index__ = __webpack_require__(3); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_5_dompurify__ = __webpack_require__(58); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_5_dompurify___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_5_dompurify__); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__index__ = __webpack_require__(10); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__i18n__ = __webpack_require__(12); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_8__captcha__ = __webpack_require__(40); @@ -9180,17 +9180,18 @@ var Auth0WebAPI = function () { + function logIn(id) { var needsMFA = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false; - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["e" /* getEntity */], 'lock', id); + var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); var usernameField = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["l" /* databaseLogInWithEmail */])(m) ? 'email' : 'username'; - var username = __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, usernameField); + var username = __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, usernameField); var params = { connection: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["m" /* databaseConnectionName */])(m), username: username, - password: __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, 'password') + password: __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'password') }; var fields = [usernameField, 'password']; @@ -9200,14 +9201,14 @@ function logIn(id) { return __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_8__captcha__["b" /* showMissingCaptcha */])(m, id); } - var mfaCode = __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, 'mfa_code'); + var mfaCode = __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'mfa_code'); if (needsMFA) { params['mfa_code'] = mfaCode; fields.push('mfa_code'); } - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_3__core_actions__["h" /* logIn */])(id, fields, params, function (id, error, fields, next) { + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__core_actions__["h" /* logIn */])(id, fields, params, function (id, error, fields, next) { if (error.error === 'a0.mfa_required') { return showLoginMFAActivity(id); } @@ -9232,7 +9233,7 @@ function generateRandomUsername(length) { } function signUp(id) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["e" /* getEntity */], 'lock', id); + var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); var fields = ['email', 'password']; // Skip the username validation if signUpHideUsernameField option is enabled. @@ -9243,11 +9244,11 @@ function signUp(id) { return fields.push(x.get('name')); }); - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_3__core_actions__["i" /* validateAndSubmit */])(id, fields, function (m) { + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__core_actions__["i" /* validateAndSubmit */])(id, fields, function (m) { var params = { connection: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["m" /* databaseConnectionName */])(m), - email: __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, 'email'), - password: __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, 'password'), + email: __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'email'), + password: __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'password'), autoLogin: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["q" /* shouldAutoLogin */])(m) }; @@ -9262,7 +9263,7 @@ function signUp(id) { var range = usernameValidation ? usernameValidation.toJS() : { max: 15 }; params.username = generateRandomUsername(range.max); } else { - params.username = __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, 'username'); + params.username = __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'username'); } } @@ -9271,7 +9272,8 @@ function signUp(id) { __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["p" /* additionalSignUpFields */])(m).forEach(function (x) { var storage = x.get('storage'); var fieldName = x.get('name'); - var fieldValue = __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, x.get('name')); + var fieldValue = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_5_dompurify__["sanitize"])(__WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, x.get('name')), { ALLOWED_TAGS: [] }); + switch (storage) { case 'root': params[fieldName] = fieldValue; @@ -9305,8 +9307,8 @@ function signUp(id) { // If we need it later, it'll save a breaking change in hooks already in use. var context = null; - __WEBPACK_IMPORTED_MODULE_4__core_index__["runHook"](m, 'signingUp', context, function () { - __WEBPACK_IMPORTED_MODULE_2__core_web_api__["a" /* default */].signUp(id, params, function (error, result, popupHandler) { + __WEBPACK_IMPORTED_MODULE_3__core_index__["runHook"](m, 'signingUp', context, function () { + __WEBPACK_IMPORTED_MODULE_1__core_web_api__["a" /* default */].signUp(id, params, function (error, result, popupHandler) { for (var _len = arguments.length, args = Array(_len > 3 ? _len - 3 : 0), _key = 3; _key < _len; _key++) { args[_key - 3] = arguments[_key]; } @@ -9325,27 +9327,27 @@ function signUp(id) { } function signUpSuccess(id, result, popupHandler) { - var lock = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["e" /* getEntity */], 'lock', id); + var lock = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); - __WEBPACK_IMPORTED_MODULE_4__core_index__["emitEvent"](lock, 'signup success', result); + __WEBPACK_IMPORTED_MODULE_3__core_index__["emitEvent"](lock, 'signup success', result); if (__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["q" /* shouldAutoLogin */])(lock)) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, function (m) { + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, function (m) { return m.set('signedUp', true); }); // TODO: check options, redirect is missing var options = { connection: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["m" /* databaseConnectionName */])(lock), - username: __WEBPACK_IMPORTED_MODULE_5__field_index__["g" /* email */](lock), - password: __WEBPACK_IMPORTED_MODULE_5__field_index__["h" /* password */](lock) + username: __WEBPACK_IMPORTED_MODULE_4__field_index__["g" /* email */](lock), + password: __WEBPACK_IMPORTED_MODULE_4__field_index__["h" /* password */](lock) }; if (!!popupHandler) { options.popupHandler = popupHandler; } - return __WEBPACK_IMPORTED_MODULE_2__core_web_api__["a" /* default */].logIn(id, options, __WEBPACK_IMPORTED_MODULE_4__core_index__["auth"].params(lock).toJS(), function (error) { + return __WEBPACK_IMPORTED_MODULE_1__core_web_api__["a" /* default */].logIn(id, options, __WEBPACK_IMPORTED_MODULE_3__core_index__["auth"].params(lock).toJS(), function (error) { for (var _len2 = arguments.length, args = Array(_len2 > 1 ? _len2 - 1 : 0), _key2 = 1; _key2 < _len2; _key2++) { args[_key2 - 1] = arguments[_key2]; } @@ -9355,24 +9357,24 @@ function signUpSuccess(id, result, popupHandler) { return autoLogInError(id, error); }, 250); } else { - __WEBPACK_IMPORTED_MODULE_3__core_actions__["j" /* logInSuccess */].apply(undefined, [id].concat(args)); + __WEBPACK_IMPORTED_MODULE_2__core_actions__["j" /* logInSuccess */].apply(undefined, [id].concat(args)); } }); } - var autoclose = __WEBPACK_IMPORTED_MODULE_4__core_index__["ui"].autoclose(lock); + var autoclose = __WEBPACK_IMPORTED_MODULE_3__core_index__["ui"].autoclose(lock); if (!autoclose) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, function (lock) { - return __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"](lock, false).set('signedUp', true); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, function (lock) { + return __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"](lock, false).set('signedUp', true); }); } else { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_3__core_actions__["c" /* closeLock */])(id, false); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__core_actions__["c" /* closeLock */])(id, false); } } function signUpError(id, error) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["e" /* getEntity */], 'lock', id); + var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); var invalidPasswordKeys = { PasswordDictionaryError: 'password_dictionary_error', @@ -9380,46 +9382,46 @@ function signUpError(id, error) { PasswordStrengthError: 'password_strength_error' }; - __WEBPACK_IMPORTED_MODULE_4__core_index__["emitEvent"](m, 'signup error', error); + __WEBPACK_IMPORTED_MODULE_3__core_index__["emitEvent"](m, 'signup error', error); var errorKey = error.code === 'invalid_password' && invalidPasswordKeys[error.name] || error.code; var errorMessage = __WEBPACK_IMPORTED_MODULE_7__i18n__["html"](m, ['error', 'signUp', errorKey]) || __WEBPACK_IMPORTED_MODULE_7__i18n__["html"](m, ['error', 'signUp', 'lock.fallback']); if (error.code === 'hook_error') { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"], false, error.description || errorMessage); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"], false, error.description || errorMessage); return; } if (errorKey === 'invalid_captcha') { errorMessage = __WEBPACK_IMPORTED_MODULE_7__i18n__["html"](m, ['error', 'login', errorKey]); return __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_8__captcha__["c" /* swapCaptcha */])(id, true, function () { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"], false, errorMessage); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"], false, errorMessage); }); } - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"], false, errorMessage); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"], false, errorMessage); } function autoLogInError(id, error) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, function (m) { - var errorMessage = __WEBPACK_IMPORTED_MODULE_4__core_index__["loginErrorMessage"](m, error); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, function (m) { + var errorMessage = __WEBPACK_IMPORTED_MODULE_3__core_index__["loginErrorMessage"](m, error); if (__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["i" /* hasScreen */])(m, 'login')) { - return __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"](__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */])(m, 'login'), false, errorMessage); + return __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"](__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */])(m, 'login'), false, errorMessage); } else { - return __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"](m, false, errorMessage); + return __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"](m, false, errorMessage); } }); } function resetPassword(id) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_3__core_actions__["i" /* validateAndSubmit */])(id, ['email'], function (m) { + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__core_actions__["i" /* validateAndSubmit */])(id, ['email'], function (m) { var params = { connection: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["m" /* databaseConnectionName */])(m), - email: __WEBPACK_IMPORTED_MODULE_5__field_index__["c" /* getFieldValue */](m, 'email') + email: __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'email') }; - __WEBPACK_IMPORTED_MODULE_2__core_web_api__["a" /* default */].resetPassword(id, params, function (error) { + __WEBPACK_IMPORTED_MODULE_1__core_web_api__["a" /* default */].resetPassword(id, params, function (error) { if (error) { setTimeout(function () { return resetPasswordError(id, error); @@ -9432,53 +9434,53 @@ function resetPassword(id) { } function resetPasswordSuccess(id) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["e" /* getEntity */], 'lock', id); + var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); if (__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["i" /* hasScreen */])(m, 'login')) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, function (m) { - return __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */])(__WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"](m, false), 'login', ['']); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, function (m) { + return __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */])(__WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"](m, false), 'login', ['']); } // array with one empty string tells the function to not clear any field ); // TODO: should be handled by box setTimeout(function () { var successMessage = __WEBPACK_IMPORTED_MODULE_7__i18n__["html"](m, ['success', 'forgotPassword']); - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_4__core_index__["setGlobalSuccess"], successMessage); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_3__core_index__["setGlobalSuccess"], successMessage); }, 500); } else { - if (__WEBPACK_IMPORTED_MODULE_4__core_index__["ui"].autoclose(m)) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_3__core_actions__["c" /* closeLock */])(id); + if (__WEBPACK_IMPORTED_MODULE_3__core_index__["ui"].autoclose(m)) { + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__core_actions__["c" /* closeLock */])(id); } else { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, function (m) { - return __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"](m, false).set('passwordResetted', true); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, function (m) { + return __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"](m, false).set('passwordResetted', true); }); } } } function resetPasswordError(id, error) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["e" /* getEntity */], 'lock', id); + var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); var errorMessage = __WEBPACK_IMPORTED_MODULE_7__i18n__["html"](m, ['error', 'forgotPassword', error.code]) || __WEBPACK_IMPORTED_MODULE_7__i18n__["html"](m, ['error', 'forgotPassword', 'lock.fallback']); - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_4__core_index__["setSubmitting"], false, errorMessage); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_3__core_index__["setSubmitting"], false, errorMessage); } function showLoginActivity(id) { var fields = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : ['password']; - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'login', fields); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'login', fields); } function showSignUpActivity(id) { var fields = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : ['password']; - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'signUp', fields); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'signUp', fields); } function showResetPasswordActivity(id) { var fields = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : ['password']; - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'forgotPassword', fields); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'forgotPassword', fields); } function cancelResetPassword(id) { @@ -9490,13 +9492,13 @@ function cancelMFALogin(id) { } function toggleTermsAcceptance(id) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["t" /* toggleTermsAcceptance */]); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["t" /* toggleTermsAcceptance */]); } function showLoginMFAActivity(id) { var fields = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : ['mfa_code']; - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'mfaLogin', fields); + __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["s" /* setScreen */], 'mfaLogin', fields); } /***/ }), @@ -9890,12 +9892,15 @@ function resendEmailError(id, error) { __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_6__index__["k" /* setResendFailed */]); } -function sendEmail(m, successFn, errorFn) { - var connections = __WEBPACK_IMPORTED_MODULE_5__core_index__["connections"](m, 'passwordless', 'email'); - var connectionName = connections.size > 0 && __WEBPACK_IMPORTED_MODULE_5__core_index__["useCustomPasswordlessConnection"](m) ? connections.first().get('name') : 'email'; +function getPasswordlessConnectionName(m, defaultPasswordlessConnection) { + var connections = __WEBPACK_IMPORTED_MODULE_5__core_index__["connections"](m, 'passwordless', defaultPasswordlessConnection); + + return connections.size > 0 && __WEBPACK_IMPORTED_MODULE_5__core_index__["useCustomPasswordlessConnection"](m) ? connections.first().get('name') : defaultPasswordlessConnection; +} +function sendEmail(m, successFn, errorFn) { var params = { - connection: connectionName, + connection: getPasswordlessConnectionName(m, 'email'), email: __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'email'), send: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["l" /* send */])(m) }; @@ -9917,11 +9922,8 @@ function sendEmail(m, successFn, errorFn) { function sendSMS(id) { __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__core_actions__["i" /* validateAndSubmit */])(id, ['phoneNumber'], function (m) { - var connections = __WEBPACK_IMPORTED_MODULE_5__core_index__["connections"](m, 'passwordless', 'sms'); - var connectionName = connections.size > 0 && __WEBPACK_IMPORTED_MODULE_5__core_index__["useCustomPasswordlessConnection"](m) ? connections.first().get('name') : 'sms'; - var params = { - connection: connectionName, + connection: getPasswordlessConnectionName(m, 'sms'), phoneNumber: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_7__field_phone_number__["c" /* phoneNumberWithDiallingCode */])(m), send: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["l" /* send */])(m) }; @@ -9959,10 +9961,10 @@ function logIn(id) { verificationCode: __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'vcode') }, authParams); if (__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__index__["b" /* isEmail */])(m)) { - params.connection = 'email'; + params.connection = getPasswordlessConnectionName(m, 'email'); params.email = __WEBPACK_IMPORTED_MODULE_4__field_index__["c" /* getFieldValue */](m, 'email'); } else { - params.connection = 'sms'; + params.connection = getPasswordlessConnectionName(m, 'sms'); params.phoneNumber = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_7__field_phone_number__["c" /* phoneNumberWithDiallingCode */])(m); } __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_1__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_5__core_index__["setSubmitting"], true); @@ -10169,14 +10171,14 @@ function toggleTermsAcceptance(m) { /* harmony import */ var __WEBPACK_IMPORTED_MODULE_5__core_sso_index__ = __webpack_require__(51); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__connection_database_index__ = __webpack_require__(10); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__connection_enterprise__ = __webpack_require__(13); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_8__core_tenant__ = __webpack_require__(67); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_8__core_tenant__ = __webpack_require__(68); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_9__field_email__ = __webpack_require__(19); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_10__field_username__ = __webpack_require__(71); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_10__field_username__ = __webpack_require__(72); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_11__core_index__ = __webpack_require__(1); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_12__connection_enterprise_kerberos_screen__ = __webpack_require__(172); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_13__connection_enterprise_hrd_screen__ = __webpack_require__(171); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_14__connection_enterprise_quick_auth_screen__ = __webpack_require__(173); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_15__quick_auth__ = __webpack_require__(73); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_15__quick_auth__ = __webpack_require__(74); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_16__core_loading_screen__ = __webpack_require__(113); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_17__core_error_screen__ = __webpack_require__(112); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_18__core_sso_last_login_screen__ = __webpack_require__(114); @@ -10393,7 +10395,7 @@ Classic.SCREENS = { var DOMNamespaces = __webpack_require__(86); -var setInnerHTML = __webpack_require__(63); +var setInnerHTML = __webpack_require__(64); var createMicrosoftUnsafeLocalFunction = __webpack_require__(94); var setTextContent = __webpack_require__(146); @@ -12577,7 +12579,7 @@ SocialButtonsPane.defaultProps = { /* harmony export (immutable) */ __webpack_exports__["c"] = skipQuickAuth; /* harmony export (immutable) */ __webpack_exports__["a"] = logIn; /* harmony export (immutable) */ __webpack_exports__["b"] = checkSession; -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0__quick_auth__ = __webpack_require__(73); +/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0__quick_auth__ = __webpack_require__(74); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_1__store_index__ = __webpack_require__(8); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__core_actions__ = __webpack_require__(16); /* harmony import */ var __WEBPACK_IMPORTED_MODULE_3__core_index__ = __webpack_require__(1); @@ -12814,3642 +12816,3659 @@ function isSmallScreen() { /***/ }), /* 58 */ -/***/ (function(module, exports) { +/***/ (function(module, exports, __webpack_require__) { -// shim for using process in browser -var process = module.exports = {}; +/*! @license DOMPurify 2.3.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.6/LICENSE */ -// cached from whatever global is present so that test runners that stub it -// don't break things. But we need to wrap it in a try catch in case it is -// wrapped in strict mode code which doesn't define any globals. It's inside a -// function because try/catches deoptimize in certain engines. +(function (global, factory) { + true ? module.exports = factory() : + typeof define === 'function' && define.amd ? define(factory) : + (global = global || self, global.DOMPurify = factory()); +}(this, function () { 'use strict'; -var cachedSetTimeout; -var cachedClearTimeout; + function _toConsumableArray(arr) { if (Array.isArray(arr)) { for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) { arr2[i] = arr[i]; } return arr2; } else { return Array.from(arr); } } -function defaultSetTimout() { - throw new Error('setTimeout has not been defined'); -} -function defaultClearTimeout () { - throw new Error('clearTimeout has not been defined'); -} -(function () { - try { - if (typeof setTimeout === 'function') { - cachedSetTimeout = setTimeout; - } else { - cachedSetTimeout = defaultSetTimout; - } - } catch (e) { - cachedSetTimeout = defaultSetTimout; + var hasOwnProperty = Object.hasOwnProperty, + setPrototypeOf = Object.setPrototypeOf, + isFrozen = Object.isFrozen, + getPrototypeOf = Object.getPrototypeOf, + getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor; + var freeze = Object.freeze, + seal = Object.seal, + create = Object.create; // eslint-disable-line import/no-mutable-exports + + var _ref = typeof Reflect !== 'undefined' && Reflect, + apply = _ref.apply, + construct = _ref.construct; + + if (!apply) { + apply = function apply(fun, thisValue, args) { + return fun.apply(thisValue, args); + }; + } + + if (!freeze) { + freeze = function freeze(x) { + return x; + }; + } + + if (!seal) { + seal = function seal(x) { + return x; + }; + } + + if (!construct) { + construct = function construct(Func, args) { + return new (Function.prototype.bind.apply(Func, [null].concat(_toConsumableArray(args))))(); + }; + } + + var arrayForEach = unapply(Array.prototype.forEach); + var arrayPop = unapply(Array.prototype.pop); + var arrayPush = unapply(Array.prototype.push); + + var stringToLowerCase = unapply(String.prototype.toLowerCase); + var stringMatch = unapply(String.prototype.match); + var stringReplace = unapply(String.prototype.replace); + var stringIndexOf = unapply(String.prototype.indexOf); + var stringTrim = unapply(String.prototype.trim); + + var regExpTest = unapply(RegExp.prototype.test); + + var typeErrorCreate = unconstruct(TypeError); + + function unapply(func) { + return function (thisArg) { + for (var _len = arguments.length, args = Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) { + args[_key - 1] = arguments[_key]; + } + + return apply(func, thisArg, args); + }; + } + + function unconstruct(func) { + return function () { + for (var _len2 = arguments.length, args = Array(_len2), _key2 = 0; _key2 < _len2; _key2++) { + args[_key2] = arguments[_key2]; + } + + return construct(func, args); + }; + } + + /* Add properties to a lookup table */ + function addToSet(set, array) { + if (setPrototypeOf) { + // Make 'in' and truthy checks like Boolean(set.constructor) + // independent of any properties defined on Object.prototype. + // Prevent prototype setters from intercepting set as a this value. + setPrototypeOf(set, null); } - try { - if (typeof clearTimeout === 'function') { - cachedClearTimeout = clearTimeout; - } else { - cachedClearTimeout = defaultClearTimeout; + + var l = array.length; + while (l--) { + var element = array[l]; + if (typeof element === 'string') { + var lcElement = stringToLowerCase(element); + if (lcElement !== element) { + // Config presets (e.g. tags.js, attrs.js) are immutable. + if (!isFrozen(array)) { + array[l] = lcElement; + } + + element = lcElement; } - } catch (e) { - cachedClearTimeout = defaultClearTimeout; - } -} ()) -function runTimeout(fun) { - if (cachedSetTimeout === setTimeout) { - //normal enviroments in sane situations - return setTimeout(fun, 0); + } + + set[element] = true; } - // if setTimeout wasn't available but was latter defined - if ((cachedSetTimeout === defaultSetTimout || !cachedSetTimeout) && setTimeout) { - cachedSetTimeout = setTimeout; - return setTimeout(fun, 0); + + return set; + } + + /* Shallow clone an object */ + function clone(object) { + var newObject = create(null); + + var property = void 0; + for (property in object) { + if (apply(hasOwnProperty, object, [property])) { + newObject[property] = object[property]; + } } - try { - // when when somebody has screwed with setTimeout but no I.E. maddness - return cachedSetTimeout(fun, 0); - } catch(e){ - try { - // When we are in I.E. but the script has been evaled so I.E. doesn't trust the global object when called normally - return cachedSetTimeout.call(null, fun, 0); - } catch(e){ - // same as above but when it's a version of I.E. that must have the global object for 'this', hopfully our context correct otherwise it will throw a global error - return cachedSetTimeout.call(this, fun, 0); + + return newObject; + } + + /* IE10 doesn't support __lookupGetter__ so lets' + * simulate it. It also automatically checks + * if the prop is function or getter and behaves + * accordingly. */ + function lookupGetter(object, prop) { + while (object !== null) { + var desc = getOwnPropertyDescriptor(object, prop); + if (desc) { + if (desc.get) { + return unapply(desc.get); } - } + if (typeof desc.value === 'function') { + return unapply(desc.value); + } + } -} -function runClearTimeout(marker) { - if (cachedClearTimeout === clearTimeout) { - //normal enviroments in sane situations - return clearTimeout(marker); - } - // if clearTimeout wasn't available but was latter defined - if ((cachedClearTimeout === defaultClearTimeout || !cachedClearTimeout) && clearTimeout) { - cachedClearTimeout = clearTimeout; - return clearTimeout(marker); + object = getPrototypeOf(object); } - try { - // when when somebody has screwed with setTimeout but no I.E. maddness - return cachedClearTimeout(marker); - } catch (e){ - try { - // When we are in I.E. but the script has been evaled so I.E. doesn't trust the global object when called normally - return cachedClearTimeout.call(null, marker); - } catch (e){ - // same as above but when it's a version of I.E. that must have the global object for 'this', hopfully our context correct otherwise it will throw a global error. - // Some versions of I.E. have different rules for clearTimeout vs setTimeout - return cachedClearTimeout.call(this, marker); - } + + function fallbackValue(element) { + console.warn('fallback value for', element); + return null; } + return fallbackValue; + } + var html = freeze(['a', 'abbr', 'acronym', 'address', 'area', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'big', 'blink', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'content', 'data', 'datalist', 'dd', 'decorator', 'del', 'details', 'dfn', 'dialog', 'dir', 'div', 'dl', 'dt', 'element', 'em', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'marquee', 'menu', 'menuitem', 'meter', 'nav', 'nobr', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'shadow', 'small', 'source', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'template', 'textarea', 'tfoot', 'th', 'thead', 'time', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr']); -} -var queue = []; -var draining = false; -var currentQueue; -var queueIndex = -1; + // SVG + var svg = freeze(['svg', 'a', 'altglyph', 'altglyphdef', 'altglyphitem', 'animatecolor', 'animatemotion', 'animatetransform', 'circle', 'clippath', 'defs', 'desc', 'ellipse', 'filter', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line', 'lineargradient', 'marker', 'mask', 'metadata', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialgradient', 'rect', 'stop', 'style', 'switch', 'symbol', 'text', 'textpath', 'title', 'tref', 'tspan', 'view', 'vkern']); -function cleanUpNextTick() { - if (!draining || !currentQueue) { - return; - } - draining = false; - if (currentQueue.length) { - queue = currentQueue.concat(queue); - } else { - queueIndex = -1; - } - if (queue.length) { - drainQueue(); - } -} + var svgFilters = freeze(['feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence']); -function drainQueue() { - if (draining) { - return; + // List of SVG elements that are disallowed by default. + // We still need to know them so that we can do namespace + // checks properly in case one wants to add them to + // allow-list. + var svgDisallowed = freeze(['animate', 'color-profile', 'cursor', 'discard', 'fedropshadow', 'font-face', 'font-face-format', 'font-face-name', 'font-face-src', 'font-face-uri', 'foreignobject', 'hatch', 'hatchpath', 'mesh', 'meshgradient', 'meshpatch', 'meshrow', 'missing-glyph', 'script', 'set', 'solidcolor', 'unknown', 'use']); + + var mathMl = freeze(['math', 'menclose', 'merror', 'mfenced', 'mfrac', 'mglyph', 'mi', 'mlabeledtr', 'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom', 'mroot', 'mrow', 'ms', 'mspace', 'msqrt', 'mstyle', 'msub', 'msup', 'msubsup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder', 'munderover']); + + // Similarly to SVG, we want to know all MathML elements, + // even those that we disallow by default. + var mathMlDisallowed = freeze(['maction', 'maligngroup', 'malignmark', 'mlongdiv', 'mscarries', 'mscarry', 'msgroup', 'mstack', 'msline', 'msrow', 'semantics', 'annotation', 'annotation-xml', 'mprescripts', 'none']); + + var text = freeze(['#text']); + + var html$1 = freeze(['accept', 'action', 'align', 'alt', 'autocapitalize', 'autocomplete', 'autopictureinpicture', 'autoplay', 'background', 'bgcolor', 'border', 'capture', 'cellpadding', 'cellspacing', 'checked', 'cite', 'class', 'clear', 'color', 'cols', 'colspan', 'controls', 'controlslist', 'coords', 'crossorigin', 'datetime', 'decoding', 'default', 'dir', 'disabled', 'disablepictureinpicture', 'disableremoteplayback', 'download', 'draggable', 'enctype', 'enterkeyhint', 'face', 'for', 'headers', 'height', 'hidden', 'high', 'href', 'hreflang', 'id', 'inputmode', 'integrity', 'ismap', 'kind', 'label', 'lang', 'list', 'loading', 'loop', 'low', 'max', 'maxlength', 'media', 'method', 'min', 'minlength', 'multiple', 'muted', 'name', 'nonce', 'noshade', 'novalidate', 'nowrap', 'open', 'optimum', 'pattern', 'placeholder', 'playsinline', 'poster', 'preload', 'pubdate', 'radiogroup', 'readonly', 'rel', 'required', 'rev', 'reversed', 'role', 'rows', 'rowspan', 'spellcheck', 'scope', 'selected', 'shape', 'size', 'sizes', 'span', 'srclang', 'start', 'src', 'srcset', 'step', 'style', 'summary', 'tabindex', 'title', 'translate', 'type', 'usemap', 'valign', 'value', 'width', 'xmlns', 'slot']); + + var svg$1 = freeze(['accent-height', 'accumulate', 'additive', 'alignment-baseline', 'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseline-shift', 'begin', 'bias', 'by', 'class', 'clip', 'clippathunits', 'clip-path', 'clip-rule', 'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile', 'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction', 'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity', 'fill-rule', 'filter', 'filterunits', 'flood-color', 'flood-opacity', 'font-family', 'font-size', 'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform', 'height', 'href', 'id', 'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints', 'keysplines', 'keytimes', 'lang', 'lengthadjust', 'letter-spacing', 'kernelmatrix', 'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid', 'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits', 'maskunits', 'max', 'mask', 'media', 'method', 'mode', 'min', 'name', 'numoctaves', 'offset', 'operator', 'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order', 'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits', 'points', 'preservealpha', 'preserveaspectratio', 'primitiveunits', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount', 'repeatdur', 'restart', 'result', 'rotate', 'scale', 'seed', 'shape-rendering', 'specularconstant', 'specularexponent', 'spreadmethod', 'startoffset', 'stddeviation', 'stitchtiles', 'stop-color', 'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap', 'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width', 'style', 'surfacescale', 'systemlanguage', 'tabindex', 'targetx', 'targety', 'transform', 'transform-origin', 'text-anchor', 'text-decoration', 'text-rendering', 'textlength', 'type', 'u1', 'u2', 'unicode', 'values', 'viewbox', 'visibility', 'version', 'vert-adv-y', 'vert-origin-x', 'vert-origin-y', 'width', 'word-spacing', 'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2', 'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan']); + + var mathMl$1 = freeze(['accent', 'accentunder', 'align', 'bevelled', 'close', 'columnsalign', 'columnlines', 'columnspan', 'denomalign', 'depth', 'dir', 'display', 'displaystyle', 'encoding', 'fence', 'frame', 'height', 'href', 'id', 'largeop', 'length', 'linethickness', 'lspace', 'lquote', 'mathbackground', 'mathcolor', 'mathsize', 'mathvariant', 'maxsize', 'minsize', 'movablelimits', 'notation', 'numalign', 'open', 'rowalign', 'rowlines', 'rowspacing', 'rowspan', 'rspace', 'rquote', 'scriptlevel', 'scriptminsize', 'scriptsizemultiplier', 'selection', 'separator', 'separators', 'stretchy', 'subscriptshift', 'supscriptshift', 'symmetric', 'voffset', 'width', 'xmlns']); + + var xml = freeze(['xlink:href', 'xml:id', 'xlink:title', 'xml:space', 'xmlns:xlink']); + + // eslint-disable-next-line unicorn/better-regex + var MUSTACHE_EXPR = seal(/\{\{[\s\S]*|[\s\S]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode + var ERB_EXPR = seal(/<%[\s\S]*|[\s\S]*%>/gm); + var DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape + var ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape + var IS_ALLOWED_URI = seal(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape + ); + var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i); + var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g // eslint-disable-line no-control-regex + ); + var DOCTYPE_NAME = seal(/^html$/i); + + var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }; + + function _toConsumableArray$1(arr) { if (Array.isArray(arr)) { for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) { arr2[i] = arr[i]; } return arr2; } else { return Array.from(arr); } } + + var getGlobal = function getGlobal() { + return typeof window === 'undefined' ? null : window; + }; + + /** + * Creates a no-op policy for internal use only. + * Don't export this function outside this module! + * @param {?TrustedTypePolicyFactory} trustedTypes The policy factory. + * @param {Document} document The document object (to determine policy name suffix) + * @return {?TrustedTypePolicy} The policy created (or null, if Trusted Types + * are not supported). + */ + var _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, document) { + if ((typeof trustedTypes === 'undefined' ? 'undefined' : _typeof(trustedTypes)) !== 'object' || typeof trustedTypes.createPolicy !== 'function') { + return null; } - var timeout = runTimeout(cleanUpNextTick); - draining = true; - var len = queue.length; - while(len) { - currentQueue = queue; - queue = []; - while (++queueIndex < len) { - if (currentQueue) { - currentQueue[queueIndex].run(); - } - } - queueIndex = -1; - len = queue.length; + // Allow the callers to control the unique policy name + // by adding a data-tt-policy-suffix to the script element with the DOMPurify. + // Policy creation with duplicate names throws in Trusted Types. + var suffix = null; + var ATTR_NAME = 'data-tt-policy-suffix'; + if (document.currentScript && document.currentScript.hasAttribute(ATTR_NAME)) { + suffix = document.currentScript.getAttribute(ATTR_NAME); } - currentQueue = null; - draining = false; - runClearTimeout(timeout); -} -process.nextTick = function (fun) { - var args = new Array(arguments.length - 1); - if (arguments.length > 1) { - for (var i = 1; i < arguments.length; i++) { - args[i - 1] = arguments[i]; + var policyName = 'dompurify' + (suffix ? '#' + suffix : ''); + + try { + return trustedTypes.createPolicy(policyName, { + createHTML: function createHTML(html$$1) { + return html$$1; } + }); + } catch (_) { + // Policy creation failed (most likely another DOMPurify script has + // already run). Skip creating the policy, as this will only cause errors + // if TT are enforced. + console.warn('TrustedTypes policy ' + policyName + ' could not be created.'); + return null; } - queue.push(new Item(fun, args)); - if (queue.length === 1 && !draining) { - runTimeout(drainQueue); + }; + + function createDOMPurify() { + var window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal(); + + var DOMPurify = function DOMPurify(root) { + return createDOMPurify(root); + }; + + /** + * Version label, exposed for easier checks + * if DOMPurify is up to date or not + */ + DOMPurify.version = '2.3.6'; + + /** + * Array of elements that DOMPurify removed during sanitation. + * Empty if nothing was removed. + */ + DOMPurify.removed = []; + + if (!window || !window.document || window.document.nodeType !== 9) { + // Not running in a browser, provide a factory function + // so that you can pass your own Window + DOMPurify.isSupported = false; + + return DOMPurify; } -}; -// v8 likes predictible objects -function Item(fun, array) { - this.fun = fun; - this.array = array; -} -Item.prototype.run = function () { - this.fun.apply(null, this.array); -}; -process.title = 'browser'; -process.browser = true; -process.env = {}; -process.argv = []; -process.version = ''; // empty string to avoid regexp issues -process.versions = {}; + var originalDocument = window.document; -function noop() {} + var document = window.document; + var DocumentFragment = window.DocumentFragment, + HTMLTemplateElement = window.HTMLTemplateElement, + Node = window.Node, + Element = window.Element, + NodeFilter = window.NodeFilter, + _window$NamedNodeMap = window.NamedNodeMap, + NamedNodeMap = _window$NamedNodeMap === undefined ? window.NamedNodeMap || window.MozNamedAttrMap : _window$NamedNodeMap, + HTMLFormElement = window.HTMLFormElement, + DOMParser = window.DOMParser, + trustedTypes = window.trustedTypes; -process.on = noop; -process.addListener = noop; -process.once = noop; -process.off = noop; -process.removeListener = noop; -process.removeAllListeners = noop; -process.emit = noop; -process.prependListener = noop; -process.prependOnceListener = noop; -process.listeners = function (name) { return [] } + var ElementPrototype = Element.prototype; -process.binding = function (name) { - throw new Error('process.binding is not supported'); -}; + var cloneNode = lookupGetter(ElementPrototype, 'cloneNode'); + var getNextSibling = lookupGetter(ElementPrototype, 'nextSibling'); + var getChildNodes = lookupGetter(ElementPrototype, 'childNodes'); + var getParentNode = lookupGetter(ElementPrototype, 'parentNode'); -process.cwd = function () { return '/' }; -process.chdir = function (dir) { - throw new Error('process.chdir is not supported'); -}; -process.umask = function() { return 0; }; + // As per issue #47, the web-components registry is inherited by a + // new document created via createHTMLDocument. As per the spec + // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries) + // a new empty registry is used when creating a template contents owner + // document, so we use that as our parent document to ensure nothing + // is inherited. + if (typeof HTMLTemplateElement === 'function') { + var template = document.createElement('template'); + if (template.content && template.content.ownerDocument) { + document = template.content.ownerDocument; + } + } + var trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, originalDocument); + var emptyHTML = trustedTypesPolicy ? trustedTypesPolicy.createHTML('') : ''; -/***/ }), -/* 59 */ -/***/ (function(module, exports, __webpack_require__) { + var _document = document, + implementation = _document.implementation, + createNodeIterator = _document.createNodeIterator, + createDocumentFragment = _document.createDocumentFragment, + getElementsByTagName = _document.getElementsByTagName; + var importNode = originalDocument.importNode; -"use strict"; -/** - * Copyright (c) 2013-present, Facebook, Inc. - * - * This source code is licensed under the MIT license found in the - * LICENSE file in the root directory of this source tree. - * - */ + var documentMode = {}; + try { + documentMode = clone(document).documentMode ? document.documentMode : {}; + } catch (_) {} + var hooks = {}; -var _assign = __webpack_require__(7); + /** + * Expose whether this browser supports running the full DOMPurify. + */ + DOMPurify.isSupported = typeof getParentNode === 'function' && implementation && typeof implementation.createHTMLDocument !== 'undefined' && documentMode !== 9; -var EventPluginRegistry = __webpack_require__(87); -var ReactEventEmitterMixin = __webpack_require__(293); -var ViewportMetrics = __webpack_require__(138); + var MUSTACHE_EXPR$$1 = MUSTACHE_EXPR, + ERB_EXPR$$1 = ERB_EXPR, + DATA_ATTR$$1 = DATA_ATTR, + ARIA_ATTR$$1 = ARIA_ATTR, + IS_SCRIPT_OR_DATA$$1 = IS_SCRIPT_OR_DATA, + ATTR_WHITESPACE$$1 = ATTR_WHITESPACE; + var IS_ALLOWED_URI$$1 = IS_ALLOWED_URI; -var getVendorPrefixedEventName = __webpack_require__(325); -var isEventSupported = __webpack_require__(98); + /** + * We consider the elements and attributes below to be safe. Ideally + * don't add any new ones but feel free to remove unwanted ones. + */ -/** - * Summary of `ReactBrowserEventEmitter` event handling: - * - * - Top-level delegation is used to trap most native browser events. This - * may only occur in the main thread and is the responsibility of - * ReactEventListener, which is injected and can therefore support pluggable - * event sources. This is the only work that occurs in the main thread. - * - * - We normalize and de-duplicate events to account for browser quirks. This - * may be done in the worker thread. - * - * - Forward these native events (with the associated top-level type used to - * trap it) to `EventPluginHub`, which in turn will ask plugins if they want - * to extract any synthetic events. - * - * - The `EventPluginHub` will then process each event by annotating them with - * "dispatches", a sequence of listeners and IDs that care about that event. - * - * - The `EventPluginHub` then dispatches the events. - * - * Overview of React and the event system: - * - * +------------+ . - * | DOM | . - * +------------+ . - * | . - * v . - * +------------+ . - * | ReactEvent | . - * | Listener | . - * +------------+ . +-----------+ - * | . +--------+|SimpleEvent| - * | . | |Plugin | - * +-----|------+ . v +-----------+ - * | | | . +--------------+ +------------+ - * | +-----------.--->|EventPluginHub| | Event | - * | | . | | +-----------+ | Propagators| - * | ReactEvent | . | | |TapEvent | |------------| - * | Emitter | . | |<---+|Plugin | |other plugin| - * | | . | | +-----------+ | utilities | - * | +-----------.--->| | +------------+ - * | | | . +--------------+ - * +-----|------+ . ^ +-----------+ - * | . | |Enter/Leave| - * + . +-------+|Plugin | - * +-------------+ . +-----------+ - * | application | . - * |-------------| . - * | | . - * | | . - * +-------------+ . - * . - * React Core . General Purpose Event Plugin System - */ - -var hasEventPageXY; -var alreadyListeningTo = {}; -var isMonitoringScrollValue = false; -var reactTopListenersCounter = 0; - -// For events like 'submit' which don't consistently bubble (which we trap at a -// lower node than `document`), binding at `document` would cause duplicate -// events so we don't include them here -var topEventMapping = { - topAbort: 'abort', - topAnimationEnd: getVendorPrefixedEventName('animationend') || 'animationend', - topAnimationIteration: getVendorPrefixedEventName('animationiteration') || 'animationiteration', - topAnimationStart: getVendorPrefixedEventName('animationstart') || 'animationstart', - topBlur: 'blur', - topCanPlay: 'canplay', - topCanPlayThrough: 'canplaythrough', - topChange: 'change', - topClick: 'click', - topCompositionEnd: 'compositionend', - topCompositionStart: 'compositionstart', - topCompositionUpdate: 'compositionupdate', - topContextMenu: 'contextmenu', - topCopy: 'copy', - topCut: 'cut', - topDoubleClick: 'dblclick', - topDrag: 'drag', - topDragEnd: 'dragend', - topDragEnter: 'dragenter', - topDragExit: 'dragexit', - topDragLeave: 'dragleave', - topDragOver: 'dragover', - topDragStart: 'dragstart', - topDrop: 'drop', - topDurationChange: 'durationchange', - topEmptied: 'emptied', - topEncrypted: 'encrypted', - topEnded: 'ended', - topError: 'error', - topFocus: 'focus', - topInput: 'input', - topKeyDown: 'keydown', - topKeyPress: 'keypress', - topKeyUp: 'keyup', - topLoadedData: 'loadeddata', - topLoadedMetadata: 'loadedmetadata', - topLoadStart: 'loadstart', - topMouseDown: 'mousedown', - topMouseMove: 'mousemove', - topMouseOut: 'mouseout', - topMouseOver: 'mouseover', - topMouseUp: 'mouseup', - topPaste: 'paste', - topPause: 'pause', - topPlay: 'play', - topPlaying: 'playing', - topProgress: 'progress', - topRateChange: 'ratechange', - topScroll: 'scroll', - topSeeked: 'seeked', - topSeeking: 'seeking', - topSelectionChange: 'selectionchange', - topStalled: 'stalled', - topSuspend: 'suspend', - topTextInput: 'textInput', - topTimeUpdate: 'timeupdate', - topTouchCancel: 'touchcancel', - topTouchEnd: 'touchend', - topTouchMove: 'touchmove', - topTouchStart: 'touchstart', - topTransitionEnd: getVendorPrefixedEventName('transitionend') || 'transitionend', - topVolumeChange: 'volumechange', - topWaiting: 'waiting', - topWheel: 'wheel' -}; - -/** - * To ensure no conflicts with other potential React instances on the page - */ -var topListenersIDKey = '_reactListenersID' + String(Math.random()).slice(2); + /* allowed element names */ -function getListeningForDocument(mountAt) { - // In IE8, `mountAt` is a host object and doesn't have `hasOwnProperty` - // directly. - if (!Object.prototype.hasOwnProperty.call(mountAt, topListenersIDKey)) { - mountAt[topListenersIDKey] = reactTopListenersCounter++; - alreadyListeningTo[mountAt[topListenersIDKey]] = {}; - } - return alreadyListeningTo[mountAt[topListenersIDKey]]; -} + var ALLOWED_TAGS = null; + var DEFAULT_ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(html), _toConsumableArray$1(svg), _toConsumableArray$1(svgFilters), _toConsumableArray$1(mathMl), _toConsumableArray$1(text))); -/** - * `ReactBrowserEventEmitter` is used to attach top-level event listeners. For - * example: - * - * EventPluginHub.putListener('myID', 'onClick', myFunction); - * - * This would allocate a "registration" of `('onClick', myFunction)` on 'myID'. - * - * @internal - */ -var ReactBrowserEventEmitter = _assign({}, ReactEventEmitterMixin, { - /** - * Injectable event backend - */ - ReactEventListener: null, + /* Allowed attribute names */ + var ALLOWED_ATTR = null; + var DEFAULT_ALLOWED_ATTR = addToSet({}, [].concat(_toConsumableArray$1(html$1), _toConsumableArray$1(svg$1), _toConsumableArray$1(mathMl$1), _toConsumableArray$1(xml))); - injection: { - /** - * @param {object} ReactEventListener + /* + * Configure how DOMPUrify should handle custom elements and their attributes as well as customized built-in elements. + * @property {RegExp|Function|null} tagNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any custom elements) + * @property {RegExp|Function|null} attributeNameCheck one of [null, regexPattern, predicate]. Default: `null` (disallow any attributes not on the allow list) + * @property {boolean} allowCustomizedBuiltInElements allow custom elements derived from built-ins if they pass CUSTOM_ELEMENT_HANDLING.tagNameCheck. Default: `false`. */ - injectReactEventListener: function (ReactEventListener) { - ReactEventListener.setHandleTopLevel(ReactBrowserEventEmitter.handleTopLevel); - ReactBrowserEventEmitter.ReactEventListener = ReactEventListener; - } - }, - - /** - * Sets whether or not any created callbacks should be enabled. - * - * @param {boolean} enabled True if callbacks should be enabled. - */ - setEnabled: function (enabled) { - if (ReactBrowserEventEmitter.ReactEventListener) { - ReactBrowserEventEmitter.ReactEventListener.setEnabled(enabled); - } - }, - - /** - * @return {boolean} True if callbacks are enabled. - */ - isEnabled: function () { - return !!(ReactBrowserEventEmitter.ReactEventListener && ReactBrowserEventEmitter.ReactEventListener.isEnabled()); - }, - - /** - * We listen for bubbled touch events on the document object. - * - * Firefox v8.01 (and possibly others) exhibited strange behavior when - * mounting `onmousemove` events at some node that was not the document - * element. The symptoms were that if your mouse is not moving over something - * contained within that mount point (for example on the background) the - * top-level listeners for `onmousemove` won't be called. However, if you - * register the `mousemove` on the document object, then it will of course - * catch all `mousemove`s. This along with iOS quirks, justifies restricting - * top-level listeners to the document object only, at least for these - * movement types of events and possibly all events. - * - * @see http://www.quirksmode.org/blog/archives/2010/09/click_event_del.html - * - * Also, `keyup`/`keypress`/`keydown` do not bubble to the window on IE, but - * they bubble to document. - * - * @param {string} registrationName Name of listener (e.g. `onClick`). - * @param {object} contentDocumentHandle Document which owns the container - */ - listenTo: function (registrationName, contentDocumentHandle) { - var mountAt = contentDocumentHandle; - var isListening = getListeningForDocument(mountAt); - var dependencies = EventPluginRegistry.registrationNameDependencies[registrationName]; - - for (var i = 0; i < dependencies.length; i++) { - var dependency = dependencies[i]; - if (!(isListening.hasOwnProperty(dependency) && isListening[dependency])) { - if (dependency === 'topWheel') { - if (isEventSupported('wheel')) { - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent('topWheel', 'wheel', mountAt); - } else if (isEventSupported('mousewheel')) { - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent('topWheel', 'mousewheel', mountAt); - } else { - // Firefox needs to capture a different mouse scroll event. - // @see http://www.quirksmode.org/dom/events/tests/scroll.html - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent('topWheel', 'DOMMouseScroll', mountAt); - } - } else if (dependency === 'topScroll') { - if (isEventSupported('scroll', true)) { - ReactBrowserEventEmitter.ReactEventListener.trapCapturedEvent('topScroll', 'scroll', mountAt); - } else { - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent('topScroll', 'scroll', ReactBrowserEventEmitter.ReactEventListener.WINDOW_HANDLE); - } - } else if (dependency === 'topFocus' || dependency === 'topBlur') { - if (isEventSupported('focus', true)) { - ReactBrowserEventEmitter.ReactEventListener.trapCapturedEvent('topFocus', 'focus', mountAt); - ReactBrowserEventEmitter.ReactEventListener.trapCapturedEvent('topBlur', 'blur', mountAt); - } else if (isEventSupported('focusin')) { - // IE has `focusin` and `focusout` events which bubble. - // @see http://www.quirksmode.org/blog/archives/2008/04/delegating_the.html - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent('topFocus', 'focusin', mountAt); - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent('topBlur', 'focusout', mountAt); - } - - // to make sure blur and focus event listeners are only attached once - isListening.topBlur = true; - isListening.topFocus = true; - } else if (topEventMapping.hasOwnProperty(dependency)) { - ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent(dependency, topEventMapping[dependency], mountAt); - } - - isListening[dependency] = true; + var CUSTOM_ELEMENT_HANDLING = Object.seal(Object.create(null, { + tagNameCheck: { + writable: true, + configurable: false, + enumerable: true, + value: null + }, + attributeNameCheck: { + writable: true, + configurable: false, + enumerable: true, + value: null + }, + allowCustomizedBuiltInElements: { + writable: true, + configurable: false, + enumerable: true, + value: false } - } - }, - - trapBubbledEvent: function (topLevelType, handlerBaseName, handle) { - return ReactBrowserEventEmitter.ReactEventListener.trapBubbledEvent(topLevelType, handlerBaseName, handle); - }, - - trapCapturedEvent: function (topLevelType, handlerBaseName, handle) { - return ReactBrowserEventEmitter.ReactEventListener.trapCapturedEvent(topLevelType, handlerBaseName, handle); - }, - - /** - * Protect against document.createEvent() returning null - * Some popup blocker extensions appear to do this: - * https://github.com/facebook/react/issues/6887 - */ - supportsEventPageXY: function () { - if (!document.createEvent) { - return false; - } - var ev = document.createEvent('MouseEvent'); - return ev != null && 'pageX' in ev; - }, + })); - /** - * Listens to window scroll and resize events. We cache scroll values so that - * application code can access them without triggering reflows. - * - * ViewportMetrics is only used by SyntheticMouse/TouchEvent and only when - * pageX/pageY isn't supported (legacy browsers). - * - * NOTE: Scroll events do not bubble. - * - * @see http://www.quirksmode.org/dom/events/scroll.html - */ - ensureScrollValueMonitoring: function () { - if (hasEventPageXY === undefined) { - hasEventPageXY = ReactBrowserEventEmitter.supportsEventPageXY(); - } - if (!hasEventPageXY && !isMonitoringScrollValue) { - var refresh = ViewportMetrics.refreshScrollValues; - ReactBrowserEventEmitter.ReactEventListener.monitorScrollValue(refresh); - isMonitoringScrollValue = true; - } - } -}); + /* Explicitly forbidden tags (overrides ALLOWED_TAGS/ADD_TAGS) */ + var FORBID_TAGS = null; -module.exports = ReactBrowserEventEmitter; + /* Explicitly forbidden attributes (overrides ALLOWED_ATTR/ADD_ATTR) */ + var FORBID_ATTR = null; -/***/ }), -/* 60 */ -/***/ (function(module, exports, __webpack_require__) { + /* Decide if ARIA attributes are okay */ + var ALLOW_ARIA_ATTR = true; -"use strict"; -/** - * Copyright (c) 2013-present, Facebook, Inc. - * - * This source code is licensed under the MIT license found in the - * LICENSE file in the root directory of this source tree. - * - */ + /* Decide if custom data attributes are okay */ + var ALLOW_DATA_ATTR = true; + /* Decide if unknown protocols are okay */ + var ALLOW_UNKNOWN_PROTOCOLS = false; + /* Output should be safe for common template engines. + * This means, DOMPurify removes data attributes, mustaches and ERB + */ + var SAFE_FOR_TEMPLATES = false; -var SyntheticUIEvent = __webpack_require__(46); -var ViewportMetrics = __webpack_require__(138); + /* Decide if document with ... should be returned */ + var WHOLE_DOCUMENT = false; -var getEventModifierState = __webpack_require__(96); + /* Track whether config is already set on this instance of DOMPurify. */ + var SET_CONFIG = false; -/** - * @interface MouseEvent - * @see http://www.w3.org/TR/DOM-Level-3-Events/ - */ -var MouseEventInterface = { - screenX: null, - screenY: null, - clientX: null, - clientY: null, - ctrlKey: null, - shiftKey: null, - altKey: null, - metaKey: null, - getModifierState: getEventModifierState, - button: function (event) { - // Webkit, Firefox, IE9+ - // which: 1 2 3 - // button: 0 1 2 (standard) - var button = event.button; - if ('which' in event) { - return button; - } - // IE<9 - // which: undefined - // button: 0 0 0 - // button: 1 4 2 (onmouseup) - return button === 2 ? 2 : button === 4 ? 1 : 0; - }, - buttons: null, - relatedTarget: function (event) { - return event.relatedTarget || (event.fromElement === event.srcElement ? event.toElement : event.fromElement); - }, - // "Proprietary" Interface. - pageX: function (event) { - return 'pageX' in event ? event.pageX : event.clientX + ViewportMetrics.currentScrollLeft; - }, - pageY: function (event) { - return 'pageY' in event ? event.pageY : event.clientY + ViewportMetrics.currentScrollTop; - } -}; + /* Decide if all elements (e.g. style, script) must be children of + * document.body. By default, browsers might move them to document.head */ + var FORCE_BODY = false; -/** - * @param {object} dispatchConfig Configuration used to dispatch this event. - * @param {string} dispatchMarker Marker identifying the event target. - * @param {object} nativeEvent Native browser event. - * @extends {SyntheticUIEvent} - */ -function SyntheticMouseEvent(dispatchConfig, dispatchMarker, nativeEvent, nativeEventTarget) { - return SyntheticUIEvent.call(this, dispatchConfig, dispatchMarker, nativeEvent, nativeEventTarget); -} + /* Decide if a DOM `HTMLBodyElement` should be returned, instead of a html + * string (or a TrustedHTML object if Trusted Types are supported). + * If `WHOLE_DOCUMENT` is enabled a `HTMLHtmlElement` will be returned instead + */ + var RETURN_DOM = false; -SyntheticUIEvent.augmentClass(SyntheticMouseEvent, MouseEventInterface); + /* Decide if a DOM `DocumentFragment` should be returned, instead of a html + * string (or a TrustedHTML object if Trusted Types are supported) */ + var RETURN_DOM_FRAGMENT = false; -module.exports = SyntheticMouseEvent; + /* Try to return a Trusted Type object instead of a string, return a string in + * case Trusted Types are not supported */ + var RETURN_TRUSTED_TYPE = false; -/***/ }), -/* 61 */ -/***/ (function(module, exports, __webpack_require__) { + /* Output should be free from DOM clobbering attacks? */ + var SANITIZE_DOM = true; -"use strict"; -/** - * Copyright (c) 2013-present, Facebook, Inc. - * - * This source code is licensed under the MIT license found in the - * LICENSE file in the root directory of this source tree. - * - * - */ + /* Keep element content when removing element? */ + var KEEP_CONTENT = true; + /* If a `Node` is passed to sanitize(), then performs sanitization in-place instead + * of importing it into a new Document and returning a sanitized copy */ + var IN_PLACE = false; + /* Allow usage of profiles like html, svg and mathMl */ + var USE_PROFILES = {}; -var _prodInvariant = __webpack_require__(5); + /* Tags to ignore content of when KEEP_CONTENT is true */ + var FORBID_CONTENTS = null; + var DEFAULT_FORBID_CONTENTS = addToSet({}, ['annotation-xml', 'audio', 'colgroup', 'desc', 'foreignobject', 'head', 'iframe', 'math', 'mi', 'mn', 'mo', 'ms', 'mtext', 'noembed', 'noframes', 'noscript', 'plaintext', 'script', 'style', 'svg', 'template', 'thead', 'title', 'video', 'xmp']); -var invariant = __webpack_require__(2); + /* Tags that are safe for data: URIs */ + var DATA_URI_TAGS = null; + var DEFAULT_DATA_URI_TAGS = addToSet({}, ['audio', 'video', 'img', 'source', 'image', 'track']); -var OBSERVED_ERROR = {}; + /* Attributes safe for values like "javascript:" */ + var URI_SAFE_ATTRIBUTES = null; + var DEFAULT_URI_SAFE_ATTRIBUTES = addToSet({}, ['alt', 'class', 'for', 'id', 'label', 'name', 'pattern', 'placeholder', 'role', 'summary', 'title', 'value', 'style', 'xmlns']); -/** - * `Transaction` creates a black box that is able to wrap any method such that - * certain invariants are maintained before and after the method is invoked - * (Even if an exception is thrown while invoking the wrapped method). Whoever - * instantiates a transaction can provide enforcers of the invariants at - * creation time. The `Transaction` class itself will supply one additional - * automatic invariant for you - the invariant that any transaction instance - * should not be run while it is already being run. You would typically create a - * single instance of a `Transaction` for reuse multiple times, that potentially - * is used to wrap several different methods. Wrappers are extremely simple - - * they only require implementing two methods. - * - *
- *                       wrappers (injected at creation time)
- *                                      +        +
- *                                      |        |
- *                    +-----------------|--------|--------------+
- *                    |                 v        |              |
- *                    |      +---------------+   |              |
- *                    |   +--|    wrapper1   |---|----+         |
- *                    |   |  +---------------+   v    |         |
- *                    |   |          +-------------+  |         |
- *                    |   |     +----|   wrapper2  |--------+   |
- *                    |   |     |    +-------------+  |     |   |
- *                    |   |     |                     |     |   |
- *                    |   v     v                     v     v   | wrapper
- *                    | +---+ +---+   +---------+   +---+ +---+ | invariants
- * perform(anyMethod) | |   | |   |   |         |   |   | |   | | maintained
- * +----------------->|-|---|-|---|-->|anyMethod|---|---|-|---|-|-------->
- *                    | |   | |   |   |         |   |   | |   | |
- *                    | |   | |   |   |         |   |   | |   | |
- *                    | |   | |   |   |         |   |   | |   | |
- *                    | +---+ +---+   +---------+   +---+ +---+ |
- *                    |  initialize                    close    |
- *                    +-----------------------------------------+
- * 
- * - * Use cases: - * - Preserving the input selection ranges before/after reconciliation. - * Restoring selection even in the event of an unexpected error. - * - Deactivating events while rearranging the DOM, preventing blurs/focuses, - * while guaranteeing that afterwards, the event system is reactivated. - * - Flushing a queue of collected DOM mutations to the main UI thread after a - * reconciliation takes place in a worker thread. - * - Invoking any collected `componentDidUpdate` callbacks after rendering new - * content. - * - (Future use case): Wrapping particular flushes of the `ReactWorker` queue - * to preserve the `scrollTop` (an automatic scroll aware DOM). - * - (Future use case): Layout calculations before and after DOM updates. - * - * Transactional plugin API: - * - A module that has an `initialize` method that returns any precomputation. - * - and a `close` method that accepts the precomputation. `close` is invoked - * when the wrapped process is completed, or has failed. - * - * @param {Array} transactionWrapper Wrapper modules - * that implement `initialize` and `close`. - * @return {Transaction} Single transaction for reuse in thread. - * - * @class Transaction - */ -var TransactionImpl = { - /** - * Sets up this instance so that it is prepared for collecting metrics. Does - * so such that this setup method may be used on an instance that is already - * initialized, in a way that does not consume additional memory upon reuse. - * That can be useful if you decide to make your subclass of this mixin a - * "PooledClass". - */ - reinitializeTransaction: function () { - this.transactionWrappers = this.getTransactionWrappers(); - if (this.wrapperInitData) { - this.wrapperInitData.length = 0; - } else { - this.wrapperInitData = []; - } - this._isInTransaction = false; - }, + var MATHML_NAMESPACE = 'http://www.w3.org/1998/Math/MathML'; + var SVG_NAMESPACE = 'http://www.w3.org/2000/svg'; + var HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml'; + /* Document namespace */ + var NAMESPACE = HTML_NAMESPACE; + var IS_EMPTY_INPUT = false; - _isInTransaction: false, + /* Parsing of strict XHTML documents */ + var PARSER_MEDIA_TYPE = void 0; + var SUPPORTED_PARSER_MEDIA_TYPES = ['application/xhtml+xml', 'text/html']; + var DEFAULT_PARSER_MEDIA_TYPE = 'text/html'; + var transformCaseFunc = void 0; - /** - * @abstract - * @return {Array} Array of transaction wrappers. - */ - getTransactionWrappers: null, + /* Keep a reference to config to pass to hooks */ + var CONFIG = null; - isInTransaction: function () { - return !!this._isInTransaction; - }, + /* Ideally, do not touch anything below this line */ + /* ______________________________________________ */ - /* eslint-disable space-before-function-paren */ + var formElement = document.createElement('form'); - /** - * Executes the function within a safety window. Use this for the top level - * methods that result in large amounts of computation/mutations that would - * need to be safety checked. The optional arguments helps prevent the need - * to bind in many cases. - * - * @param {function} method Member of scope to call. - * @param {Object} scope Scope to invoke from. - * @param {Object?=} a Argument to pass to the method. - * @param {Object?=} b Argument to pass to the method. - * @param {Object?=} c Argument to pass to the method. - * @param {Object?=} d Argument to pass to the method. - * @param {Object?=} e Argument to pass to the method. - * @param {Object?=} f Argument to pass to the method. - * - * @return {*} Return value from `method`. - */ - perform: function (method, scope, a, b, c, d, e, f) { - /* eslint-enable space-before-function-paren */ - !!this.isInTransaction() ? false ? invariant(false, 'Transaction.perform(...): Cannot initialize a transaction when there is already an outstanding transaction.') : _prodInvariant('27') : void 0; - var errorThrown; - var ret; - try { - this._isInTransaction = true; - // Catching errors makes debugging more difficult, so we start with - // errorThrown set to true before setting it to false after calling - // close -- if it's still set to true in the finally block, it means - // one of these calls threw. - errorThrown = true; - this.initializeAll(0); - ret = method.call(scope, a, b, c, d, e, f); - errorThrown = false; - } finally { - try { - if (errorThrown) { - // If `method` throws, prefer to show that stack trace over any thrown - // by invoking `closeAll`. - try { - this.closeAll(0); - } catch (err) {} - } else { - // Since `method` didn't throw, we don't want to silence the exception - // here. - this.closeAll(0); - } - } finally { - this._isInTransaction = false; - } - } - return ret; - }, + var isRegexOrFunction = function isRegexOrFunction(testValue) { + return testValue instanceof RegExp || testValue instanceof Function; + }; - initializeAll: function (startIndex) { - var transactionWrappers = this.transactionWrappers; - for (var i = startIndex; i < transactionWrappers.length; i++) { - var wrapper = transactionWrappers[i]; - try { - // Catching errors makes debugging more difficult, so we start with the - // OBSERVED_ERROR state before overwriting it with the real return value - // of initialize -- if it's still set to OBSERVED_ERROR in the finally - // block, it means wrapper.initialize threw. - this.wrapperInitData[i] = OBSERVED_ERROR; - this.wrapperInitData[i] = wrapper.initialize ? wrapper.initialize.call(this) : null; - } finally { - if (this.wrapperInitData[i] === OBSERVED_ERROR) { - // The initializer for wrapper i threw an error; initialize the - // remaining wrappers but silence any exceptions from them to ensure - // that the first error is the one to bubble up. - try { - this.initializeAll(i + 1); - } catch (err) {} - } + /** + * _parseConfig + * + * @param {Object} cfg optional config literal + */ + // eslint-disable-next-line complexity + var _parseConfig = function _parseConfig(cfg) { + if (CONFIG && CONFIG === cfg) { + return; } - } - }, - /** - * Invokes each of `this.transactionWrappers.close[i]` functions, passing into - * them the respective return values of `this.transactionWrappers.init[i]` - * (`close`rs that correspond to initializers that failed will not be - * invoked). - */ - closeAll: function (startIndex) { - !this.isInTransaction() ? false ? invariant(false, 'Transaction.closeAll(): Cannot close transaction when none are open.') : _prodInvariant('28') : void 0; - var transactionWrappers = this.transactionWrappers; - for (var i = startIndex; i < transactionWrappers.length; i++) { - var wrapper = transactionWrappers[i]; - var initData = this.wrapperInitData[i]; - var errorThrown; - try { - // Catching errors makes debugging more difficult, so we start with - // errorThrown set to true before setting it to false after calling - // close -- if it's still set to true in the finally block, it means - // wrapper.close threw. - errorThrown = true; - if (initData !== OBSERVED_ERROR && wrapper.close) { - wrapper.close.call(this, initData); - } - errorThrown = false; - } finally { - if (errorThrown) { - // The closer for wrapper i threw an error; close the remaining - // wrappers but silence any exceptions from them to ensure that the - // first error is the one to bubble up. - try { - this.closeAll(i + 1); - } catch (e) {} - } + /* Shield configuration object from tampering */ + if (!cfg || (typeof cfg === 'undefined' ? 'undefined' : _typeof(cfg)) !== 'object') { + cfg = {}; } - } - this.wrapperInitData.length = 0; - } -}; -module.exports = TransactionImpl; - -/***/ }), -/* 62 */ -/***/ (function(module, exports, __webpack_require__) { - -"use strict"; -/** - * Copyright (c) 2016-present, Facebook, Inc. - * - * This source code is licensed under the MIT license found in the - * LICENSE file in the root directory of this source tree. - * - * Based on the escape-html library, which is used under the MIT License below: - * - * Copyright (c) 2012-2013 TJ Holowaychuk - * Copyright (c) 2015 Andreas Lubbe - * Copyright (c) 2015 Tiancheng "Timothy" Gu - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * 'Software'), to deal in the Software without restriction, including - * without limitation the rights to use, copy, modify, merge, publish, - * distribute, sublicense, and/or sell copies of the Software, and to - * permit persons to whom the Software is furnished to do so, subject to - * the following conditions: - * - * The above copyright notice and this permission notice shall be - * included in all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, - * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. - * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY - * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, - * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE - * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - * - */ - - - -// code copied and modified from escape-html -/** - * Module variables. - * @private - */ - -var matchHtmlRegExp = /["'&<>]/; - -/** - * Escape special characters in the given string of html. - * - * @param {string} string The string to escape for inserting into HTML - * @return {string} - * @public - */ - -function escapeHtml(string) { - var str = '' + string; - var match = matchHtmlRegExp.exec(str); + /* Shield configuration object from prototype pollution */ + cfg = clone(cfg); - if (!match) { - return str; - } + /* Set configuration parameters */ + ALLOWED_TAGS = 'ALLOWED_TAGS' in cfg ? addToSet({}, cfg.ALLOWED_TAGS) : DEFAULT_ALLOWED_TAGS; + ALLOWED_ATTR = 'ALLOWED_ATTR' in cfg ? addToSet({}, cfg.ALLOWED_ATTR) : DEFAULT_ALLOWED_ATTR; + URI_SAFE_ATTRIBUTES = 'ADD_URI_SAFE_ATTR' in cfg ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR) : DEFAULT_URI_SAFE_ATTRIBUTES; + DATA_URI_TAGS = 'ADD_DATA_URI_TAGS' in cfg ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS) : DEFAULT_DATA_URI_TAGS; + FORBID_CONTENTS = 'FORBID_CONTENTS' in cfg ? addToSet({}, cfg.FORBID_CONTENTS) : DEFAULT_FORBID_CONTENTS; + FORBID_TAGS = 'FORBID_TAGS' in cfg ? addToSet({}, cfg.FORBID_TAGS) : {}; + FORBID_ATTR = 'FORBID_ATTR' in cfg ? addToSet({}, cfg.FORBID_ATTR) : {}; + USE_PROFILES = 'USE_PROFILES' in cfg ? cfg.USE_PROFILES : false; + ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false; // Default true + ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false; // Default true + ALLOW_UNKNOWN_PROTOCOLS = cfg.ALLOW_UNKNOWN_PROTOCOLS || false; // Default false + SAFE_FOR_TEMPLATES = cfg.SAFE_FOR_TEMPLATES || false; // Default false + WHOLE_DOCUMENT = cfg.WHOLE_DOCUMENT || false; // Default false + RETURN_DOM = cfg.RETURN_DOM || false; // Default false + RETURN_DOM_FRAGMENT = cfg.RETURN_DOM_FRAGMENT || false; // Default false + RETURN_TRUSTED_TYPE = cfg.RETURN_TRUSTED_TYPE || false; // Default false + FORCE_BODY = cfg.FORCE_BODY || false; // Default false + SANITIZE_DOM = cfg.SANITIZE_DOM !== false; // Default true + KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true + IN_PLACE = cfg.IN_PLACE || false; // Default false + IS_ALLOWED_URI$$1 = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI$$1; + NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE; + if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck)) { + CUSTOM_ELEMENT_HANDLING.tagNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.tagNameCheck; + } - var escape; - var html = ''; - var index = 0; - var lastIndex = 0; + if (cfg.CUSTOM_ELEMENT_HANDLING && isRegexOrFunction(cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)) { + CUSTOM_ELEMENT_HANDLING.attributeNameCheck = cfg.CUSTOM_ELEMENT_HANDLING.attributeNameCheck; + } - for (index = match.index; index < str.length; index++) { - switch (str.charCodeAt(index)) { - case 34: - // " - escape = '"'; - break; - case 38: - // & - escape = '&'; - break; - case 39: - // ' - escape = '''; // modified from escape-html; used to be ''' - break; - case 60: - // < - escape = '<'; - break; - case 62: - // > - escape = '>'; - break; - default: - continue; - } + if (cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements === 'boolean') { + CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = cfg.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements; + } - if (lastIndex !== index) { - html += str.substring(lastIndex, index); - } + PARSER_MEDIA_TYPE = + // eslint-disable-next-line unicorn/prefer-includes + SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? PARSER_MEDIA_TYPE = DEFAULT_PARSER_MEDIA_TYPE : PARSER_MEDIA_TYPE = cfg.PARSER_MEDIA_TYPE; - lastIndex = index + 1; - html += escape; - } + // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is. + transformCaseFunc = PARSER_MEDIA_TYPE === 'application/xhtml+xml' ? function (x) { + return x; + } : stringToLowerCase; - return lastIndex !== index ? html + str.substring(lastIndex, index) : html; -} -// end code copied and modified from escape-html + if (SAFE_FOR_TEMPLATES) { + ALLOW_DATA_ATTR = false; + } -/** - * Escapes text to prevent scripting attacks. - * - * @param {*} text Text value to escape. - * @return {string} An escaped string. - */ -function escapeTextContentForBrowser(text) { - if (typeof text === 'boolean' || typeof text === 'number') { - // this shortcircuit helps perf for types that we know will never have - // special characters, especially given that this function is used often - // for numeric dom ids. - return '' + text; - } - return escapeHtml(text); -} + if (RETURN_DOM_FRAGMENT) { + RETURN_DOM = true; + } -module.exports = escapeTextContentForBrowser; + /* Parse profile info */ + if (USE_PROFILES) { + ALLOWED_TAGS = addToSet({}, [].concat(_toConsumableArray$1(text))); + ALLOWED_ATTR = []; + if (USE_PROFILES.html === true) { + addToSet(ALLOWED_TAGS, html); + addToSet(ALLOWED_ATTR, html$1); + } -/***/ }), -/* 63 */ -/***/ (function(module, exports, __webpack_require__) { + if (USE_PROFILES.svg === true) { + addToSet(ALLOWED_TAGS, svg); + addToSet(ALLOWED_ATTR, svg$1); + addToSet(ALLOWED_ATTR, xml); + } -"use strict"; -/** - * Copyright (c) 2013-present, Facebook, Inc. - * - * This source code is licensed under the MIT license found in the - * LICENSE file in the root directory of this source tree. - * - */ + if (USE_PROFILES.svgFilters === true) { + addToSet(ALLOWED_TAGS, svgFilters); + addToSet(ALLOWED_ATTR, svg$1); + addToSet(ALLOWED_ATTR, xml); + } + if (USE_PROFILES.mathMl === true) { + addToSet(ALLOWED_TAGS, mathMl); + addToSet(ALLOWED_ATTR, mathMl$1); + addToSet(ALLOWED_ATTR, xml); + } + } + /* Merge configuration parameters */ + if (cfg.ADD_TAGS) { + if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) { + ALLOWED_TAGS = clone(ALLOWED_TAGS); + } -var ExecutionEnvironment = __webpack_require__(14); -var DOMNamespaces = __webpack_require__(86); + addToSet(ALLOWED_TAGS, cfg.ADD_TAGS); + } -var WHITESPACE_TEST = /^[ \r\n\t\f]/; -var NONVISIBLE_TEST = /<(!--|link|noscript|meta|script|style)[ \r\n\t\f\/>]/; + if (cfg.ADD_ATTR) { + if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) { + ALLOWED_ATTR = clone(ALLOWED_ATTR); + } -var createMicrosoftUnsafeLocalFunction = __webpack_require__(94); + addToSet(ALLOWED_ATTR, cfg.ADD_ATTR); + } -// SVG temp container for IE lacking innerHTML -var reusableSVGContainer; + if (cfg.ADD_URI_SAFE_ATTR) { + addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR); + } -/** - * Set the innerHTML property of a node, ensuring that whitespace is preserved - * even in IE8. - * - * @param {DOMElement} node - * @param {string} html - * @internal - */ -var setInnerHTML = createMicrosoftUnsafeLocalFunction(function (node, html) { - // IE does not have innerHTML for SVG nodes, so instead we inject the - // new markup in a temp node and then move the child nodes across into - // the target node - if (node.namespaceURI === DOMNamespaces.svg && !('innerHTML' in node)) { - reusableSVGContainer = reusableSVGContainer || document.createElement('div'); - reusableSVGContainer.innerHTML = '' + html + ''; - var svgNode = reusableSVGContainer.firstChild; - while (svgNode.firstChild) { - node.appendChild(svgNode.firstChild); - } - } else { - node.innerHTML = html; - } -}); + if (cfg.FORBID_CONTENTS) { + if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) { + FORBID_CONTENTS = clone(FORBID_CONTENTS); + } -if (ExecutionEnvironment.canUseDOM) { - // IE8: When updating a just created node with innerHTML only leading - // whitespace is removed. When updating an existing node with innerHTML - // whitespace in root TextNodes is also collapsed. - // @see quirksmode.org/bugreports/archives/2004/11/innerhtml_and_t.html + addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS); + } - // Feature detection; only IE8 is known to behave improperly like this. - var testElement = document.createElement('div'); - testElement.innerHTML = ' '; - if (testElement.innerHTML === '') { - setInnerHTML = function (node, html) { - // Magic theory: IE8 supposedly differentiates between added and updated - // nodes when processing innerHTML, innerHTML on updated nodes suffers - // from worse whitespace behavior. Re-adding a node like this triggers - // the initial and more favorable whitespace behavior. - // TODO: What to do on a detached node? - if (node.parentNode) { - node.parentNode.replaceChild(node, node); + /* Add #text in case KEEP_CONTENT is set to true */ + if (KEEP_CONTENT) { + ALLOWED_TAGS['#text'] = true; } - // We also implement a workaround for non-visible tags disappearing into - // thin air on IE8, this only happens if there is no visible text - // in-front of the non-visible tags. Piggyback on the whitespace fix - // and simply check if any non-visible tags appear in the source. - if (WHITESPACE_TEST.test(html) || html[0] === '<' && NONVISIBLE_TEST.test(html)) { - // Recover leading whitespace by temporarily prepending any character. - // \uFEFF has the potential advantage of being zero-width/invisible. - // UglifyJS drops U+FEFF chars when parsing, so use String.fromCharCode - // in hopes that this is preserved even if "\uFEFF" is transformed to - // the actual Unicode character (by Babel, for example). - // https://github.com/mishoo/UglifyJS2/blob/v2.4.20/lib/parse.js#L216 - node.innerHTML = String.fromCharCode(0xfeff) + html; + /* Add html, head and body to ALLOWED_TAGS in case WHOLE_DOCUMENT is true */ + if (WHOLE_DOCUMENT) { + addToSet(ALLOWED_TAGS, ['html', 'head', 'body']); + } - // deleteData leaves an empty `TextNode` which offsets the index of all - // children. Definitely want to avoid this. - var textNode = node.firstChild; - if (textNode.data.length === 1) { - node.removeChild(textNode); - } else { - textNode.deleteData(0, 1); - } - } else { - node.innerHTML = html; + /* Add tbody to ALLOWED_TAGS in case tables are permitted, see #286, #365 */ + if (ALLOWED_TAGS.table) { + addToSet(ALLOWED_TAGS, ['tbody']); + delete FORBID_TAGS.tbody; } - }; - } - testElement = null; -} -module.exports = setInnerHTML; + // Prevent further manipulation of configuration. + // Not available in IE8, Safari 5, etc. + if (freeze) { + freeze(cfg); + } -/***/ }), -/* 64 */ -/***/ (function(module, exports, __webpack_require__) { + CONFIG = cfg; + }; -"use strict"; + var MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']); + var HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']); -Object.defineProperty(exports, "__esModule", { - value: true -}); -exports.default = assertString; + /* Keep track of all possible SVG and MathML tags + * so that we can perform the namespace checks + * correctly. */ + var ALL_SVG_TAGS = addToSet({}, svg); + addToSet(ALL_SVG_TAGS, svgFilters); + addToSet(ALL_SVG_TAGS, svgDisallowed); -function _typeof(obj) { "@babel/helpers - typeof"; if (typeof Symbol === "function" && typeof Symbol.iterator === "symbol") { _typeof = function _typeof(obj) { return typeof obj; }; } else { _typeof = function _typeof(obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }; } return _typeof(obj); } + var ALL_MATHML_TAGS = addToSet({}, mathMl); + addToSet(ALL_MATHML_TAGS, mathMlDisallowed); -function assertString(input) { - var isString = typeof input === 'string' || input instanceof String; + /** + * + * + * @param {Element} element a DOM element whose namespace is being checked + * @returns {boolean} Return false if the element has a + * namespace that a spec-compliant parser would never + * return. Return true otherwise. + */ + var _checkValidNamespace = function _checkValidNamespace(element) { + var parent = getParentNode(element); - if (!isString) { - var invalidType = _typeof(input); + // In JSDOM, if we're inside shadow DOM, then parentNode + // can be null. We just simulate parent in this case. + if (!parent || !parent.tagName) { + parent = { + namespaceURI: HTML_NAMESPACE, + tagName: 'template' + }; + } - if (input === null) invalidType = 'null';else if (invalidType === 'object') invalidType = input.constructor.name; - throw new TypeError("Expected a string but received a ".concat(invalidType)); - } -} + var tagName = stringToLowerCase(element.tagName); + var parentTagName = stringToLowerCase(parent.tagName); -module.exports = exports.default; -module.exports.default = exports.default; + if (element.namespaceURI === SVG_NAMESPACE) { + // The only way to switch from HTML namespace to SVG + // is via . If it happens via any other tag, then + // it should be killed. + if (parent.namespaceURI === HTML_NAMESPACE) { + return tagName === 'svg'; + } -/***/ }), -/* 65 */ -/***/ (function(module, __webpack_exports__, __webpack_require__) { + // The only way to switch from MathML to SVG is via + // svg if parent is either or MathML + // text integration points. + if (parent.namespaceURI === MATHML_NAMESPACE) { + return tagName === 'svg' && (parentTagName === 'annotation-xml' || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]); + } -"use strict"; -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0_react__ = __webpack_require__(0); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0_react___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_0_react__); + // We only allow elements that are defined in SVG + // spec. All others are disallowed in SVG namespace. + return Boolean(ALL_SVG_TAGS[tagName]); + } + if (element.namespaceURI === MATHML_NAMESPACE) { + // The only way to switch from HTML namespace to MathML + // is via . If it happens via any other tag, then + // it should be killed. + if (parent.namespaceURI === HTML_NAMESPACE) { + return tagName === 'math'; + } -var SignUpTerms = function SignUpTerms(_ref) { - var checkHandler = _ref.checkHandler, - checked = _ref.checked, - children = _ref.children, - showCheckbox = _ref.showCheckbox; + // The only way to switch from SVG to MathML is via + // and HTML integration points + if (parent.namespaceURI === SVG_NAMESPACE) { + return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName]; + } - return checkHandler ? __WEBPACK_IMPORTED_MODULE_0_react___default.a.createElement( - "span", - { className: "auth0-lock-sign-up-terms-agreement" }, - __WEBPACK_IMPORTED_MODULE_0_react___default.a.createElement( - "label", - null, - showCheckbox && __WEBPACK_IMPORTED_MODULE_0_react___default.a.createElement("input", { type: "checkbox", onChange: checkHandler, checked: checked }), - children - ) - ) : children; -}; + // We only allow elements that are defined in MathML + // spec. All others are disallowed in MathML namespace. + return Boolean(ALL_MATHML_TAGS[tagName]); + } -/* harmony default export */ __webpack_exports__["a"] = (SignUpTerms); + if (element.namespaceURI === HTML_NAMESPACE) { + // The only way to switch from SVG to HTML is via + // HTML integration points, and from MathML to HTML + // is via MathML text integration points + if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) { + return false; + } -/***/ }), -/* 66 */ -/***/ (function(module, __webpack_exports__, __webpack_require__) { + if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) { + return false; + } -"use strict"; -/* harmony export (immutable) */ __webpack_exports__["a"] = startHRD; -/* harmony export (immutable) */ __webpack_exports__["c"] = cancelHRD; -/* harmony export (immutable) */ __webpack_exports__["b"] = logIn; -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0__store_index__ = __webpack_require__(8); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_1__enterprise__ = __webpack_require__(13); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__field_index__ = __webpack_require__(3); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_3__field_email__ = __webpack_require__(19); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_4__core_actions__ = __webpack_require__(16); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_5__core_index__ = __webpack_require__(1); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_6__captcha__ = __webpack_require__(40); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_7__database_index__ = __webpack_require__(10); -var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; + // Certain elements are allowed in both SVG and HTML + // namespace. We need to specify them explicitly + // so that they don't get erronously deleted from + // HTML namespace. + var commonSvgAndHTMLElements = addToSet({}, ['title', 'style', 'font', 'a', 'script']); + // We disallow tags that are specific for MathML + // or SVG and should never appear in HTML namespace + return !ALL_MATHML_TAGS[tagName] && (commonSvgAndHTMLElements[tagName] || !ALL_SVG_TAGS[tagName]); + } + // The code should never reach this place (this means + // that the element somehow got namespace that is not + // HTML, SVG or MathML). Return false just in case. + return false; + }; + /** + * _forceRemove + * + * @param {Node} node a DOM node + */ + var _forceRemove = function _forceRemove(node) { + arrayPush(DOMPurify.removed, { element: node }); + try { + // eslint-disable-next-line unicorn/prefer-dom-node-remove + node.parentNode.removeChild(node); + } catch (_) { + try { + node.outerHTML = emptyHTML; + } catch (_) { + node.remove(); + } + } + }; + /** + * _removeAttribute + * + * @param {String} name an Attribute name + * @param {Node} node a DOM node + */ + var _removeAttribute = function _removeAttribute(name, node) { + try { + arrayPush(DOMPurify.removed, { + attribute: node.getAttributeNode(name), + from: node + }); + } catch (_) { + arrayPush(DOMPurify.removed, { + attribute: null, + from: node + }); + } + node.removeAttribute(name); + // We void attribute values for unremovable "is"" attributes + if (name === 'is' && !ALLOWED_ATTR[name]) { + if (RETURN_DOM || RETURN_DOM_FRAGMENT) { + try { + _forceRemove(node); + } catch (_) {} + } else { + try { + node.setAttribute(name, ''); + } catch (_) {} + } + } + }; + /** + * _initDocument + * + * @param {String} dirty a string of dirty markup + * @return {Document} a DOM, filled with the dirty markup + */ + var _initDocument = function _initDocument(dirty) { + /* Create a HTML document */ + var doc = void 0; + var leadingWhitespace = void 0; + if (FORCE_BODY) { + dirty = '' + dirty; + } else { + /* If FORCE_BODY isn't used, leading whitespace needs to be preserved manually */ + var matches = stringMatch(dirty, /^[\r\n\t ]+/); + leadingWhitespace = matches && matches[0]; + } -// TODO: enterprise connections should not depend on database -// connections. However, we now allow a username input to contain also -// an email and this information is in the database module. We should -// make this information flow from the UI (like we do for the startHRD -// function). Including this dependency here allows us to do that -// incrementally. + if (PARSER_MEDIA_TYPE === 'application/xhtml+xml') { + // Root of XHTML doc must contain xmlns declaration (see https://www.w3.org/TR/xhtml1/normative.html#strict) + dirty = '' + dirty + ''; + } + var dirtyPayload = trustedTypesPolicy ? trustedTypesPolicy.createHTML(dirty) : dirty; + /* + * Use the DOMParser API by default, fallback later if needs be + * DOMParser not work for svg when has multiple root element. + */ + if (NAMESPACE === HTML_NAMESPACE) { + try { + doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE); + } catch (_) {} + } -function startHRD(id, email) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, __WEBPACK_IMPORTED_MODULE_1__enterprise__["l" /* toggleHRD */], email); -} + /* Use createHTMLDocument in case DOMParser is not available */ + if (!doc || !doc.documentElement) { + doc = implementation.createDocument(NAMESPACE, 'template', null); + try { + doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload; + } catch (_) { + // Syntax error if dirtyPayload is invalid xml + } + } -function cancelHRD(id) { - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["b" /* swap */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["c" /* updateEntity */], 'lock', id, function (m) { - m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__enterprise__["l" /* toggleHRD */])(m, false); - m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__field_index__["a" /* hideInvalidFields */])(m); - return m; - }); -} + var body = doc.body || doc.documentElement; -function getConnectionScopesFrom(m, connection) { - var connectionScopes = __WEBPACK_IMPORTED_MODULE_5__core_index__["auth"].connectionScopes(m); - return connectionScopes.get(connection.get('name')); -} + if (dirty && leadingWhitespace) { + body.insertBefore(document.createTextNode(leadingWhitespace), body.childNodes[0] || null); + } -function logIn(id) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); - var email = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__field_index__["c" /* getFieldValue */])(m, __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_7__database_index__["l" /* databaseLogInWithEmail */])(m) ? 'email' : 'username'); - var ssoConnection = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__enterprise__["m" /* matchConnection */])(m, email); - var enterpriseConnection = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__enterprise__["n" /* enterpriseActiveFlowConnection */])(m); - var connectionScopes = getConnectionScopesFrom(m, ssoConnection || enterpriseConnection); - var usernameField = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_7__database_index__["l" /* databaseLogInWithEmail */])(m) ? 'email' : 'username'; - var fields = [usernameField, 'password']; + /* Work on whole document or just its body */ + if (NAMESPACE === HTML_NAMESPACE) { + return getElementsByTagName.call(doc, WHOLE_DOCUMENT ? 'html' : 'body')[0]; + } - var params = { - connection_scope: connectionScopes ? connectionScopes.toJS() : undefined - }; + return WHOLE_DOCUMENT ? doc.documentElement : body; + }; - if (ssoConnection && !__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__enterprise__["i" /* isHRDActive */])(m)) { - return logInSSO(id, ssoConnection, params); - } + /** + * _createIterator + * + * @param {Document} root document/fragment to create iterator for + * @return {Iterator} iterator instance + */ + var _createIterator = function _createIterator(root) { + return createNodeIterator.call(root.ownerDocument || root, root, + // eslint-disable-next-line no-bitwise + NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT, null, false); + }; - var isCaptchaValid = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__captcha__["a" /* setCaptchaParams */])(m, params, fields); + /** + * _isClobbered + * + * @param {Node} elm element to check for clobbering attacks + * @return {Boolean} true if clobbered, false if safe + */ + var _isClobbered = function _isClobbered(elm) { + return elm instanceof HTMLFormElement && (typeof elm.nodeName !== 'string' || typeof elm.textContent !== 'string' || typeof elm.removeChild !== 'function' || !(elm.attributes instanceof NamedNodeMap) || typeof elm.removeAttribute !== 'function' || typeof elm.setAttribute !== 'function' || typeof elm.namespaceURI !== 'string' || typeof elm.insertBefore !== 'function'); + }; - if (!isCaptchaValid && !ssoConnection) { - return __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__captcha__["b" /* showMissingCaptcha */])(m, id); - } + /** + * _isNode + * + * @param {Node} obj object to check whether it's a DOM node + * @return {Boolean} true is object is a DOM node + */ + var _isNode = function _isNode(object) { + return (typeof Node === 'undefined' ? 'undefined' : _typeof(Node)) === 'object' ? object instanceof Node : object && (typeof object === 'undefined' ? 'undefined' : _typeof(object)) === 'object' && typeof object.nodeType === 'number' && typeof object.nodeName === 'string'; + }; - logInActiveFlow(id, params); -} + /** + * _executeHook + * Execute user configurable hooks + * + * @param {String} entryPoint Name of the hook's entry point + * @param {Node} currentNode node to work on with the hook + * @param {Object} data additional hook parameters + */ + var _executeHook = function _executeHook(entryPoint, currentNode, data) { + if (!hooks[entryPoint]) { + return; + } -function logInActiveFlow(id, params) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); - var usernameField = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__enterprise__["i" /* isHRDActive */])(m) || !__webpack_require__.i(__WEBPACK_IMPORTED_MODULE_7__database_index__["l" /* databaseLogInWithEmail */])(m) ? 'username' : 'email'; + arrayForEach(hooks[entryPoint], function (hook) { + hook.call(DOMPurify, currentNode, data, CONFIG); + }); + }; - var originalUsername = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__field_index__["c" /* getFieldValue */])(m, usernameField); - var connection = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_1__enterprise__["n" /* enterpriseActiveFlowConnection */])(m); + /** + * _sanitizeElements + * + * @protect nodeName + * @protect textContent + * @protect removeChild + * + * @param {Node} currentNode to check for permission to exist + * @return {Boolean} true if node was killed, false if left alive + */ + var _sanitizeElements = function _sanitizeElements(currentNode) { + var content = void 0; - var username = __WEBPACK_IMPORTED_MODULE_5__core_index__["defaultADUsernameFromEmailPrefix"](m) ? __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_3__field_email__["b" /* emailLocalPart */])(originalUsername) : originalUsername; + /* Execute a hook if present */ + _executeHook('beforeSanitizeElements', currentNode, null); - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_4__core_actions__["h" /* logIn */])(id, ['password', usernameField], _extends({}, params, { - connection: connection ? connection.get('name') : null, - username: username, - password: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__field_index__["c" /* getFieldValue */])(m, 'password'), - login_hint: username - }), function (id, error, fields, next) { - var wasCaptchaInvalid = error && error.code === 'invalid captcha'; - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_6__captcha__["c" /* swapCaptcha */])(id, wasCaptchaInvalid, next); - }); -} + /* Check if element is clobbered or can clobber */ + if (_isClobbered(currentNode)) { + _forceRemove(currentNode); + return true; + } -function logInSSO(id, connection, params) { - var m = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_0__store_index__["d" /* read */])(__WEBPACK_IMPORTED_MODULE_0__store_index__["e" /* getEntity */], 'lock', id); - var field = __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_7__database_index__["l" /* databaseLogInWithEmail */])(m) ? 'email' : 'username'; + /* Check if tagname contains Unicode */ + if (stringMatch(currentNode.nodeName, /[\u0080-\uFFFF]/)) { + _forceRemove(currentNode); + return true; + } - __WEBPACK_IMPORTED_MODULE_5__core_index__["emitEvent"](m, 'sso login', { - lockID: id, - connection: connection, - field: field - }); + /* Now let's check the element's type and name */ + var tagName = transformCaseFunc(currentNode.nodeName); - __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_4__core_actions__["h" /* logIn */])(id, [field], _extends({}, params, { - connection: connection.get('name'), - login_hint: __webpack_require__.i(__WEBPACK_IMPORTED_MODULE_2__field_index__["c" /* getFieldValue */])(m, field) - })); -} + /* Execute a hook if present */ + _executeHook('uponSanitizeElement', currentNode, { + tagName: tagName, + allowedTags: ALLOWED_TAGS + }); -/***/ }), -/* 67 */ -/***/ (function(module, __webpack_exports__, __webpack_require__) { + /* Detect mXSS attempts abusing namespace confusion */ + if (!_isNode(currentNode.firstElementChild) && (!_isNode(currentNode.content) || !_isNode(currentNode.content.firstElementChild)) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) { + _forceRemove(currentNode); + return true; + } -"use strict"; -/* harmony export (immutable) */ __webpack_exports__["c"] = initTenant; -/* unused harmony export tenantConnections */ -/* harmony export (immutable) */ __webpack_exports__["b"] = defaultDirectory; -/* harmony export (immutable) */ __webpack_exports__["a"] = defaultDirectoryName; -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0_immutable__ = __webpack_require__(11); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_0_immutable___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_0_immutable__); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_1_auth0_password_policies__ = __webpack_require__(105); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_1_auth0_password_policies___default = __webpack_require__.n(__WEBPACK_IMPORTED_MODULE_1_auth0_password_policies__); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_2__utils_data_utils__ = __webpack_require__(20); -/* harmony import */ var __WEBPACK_IMPORTED_MODULE_3__index__ = __webpack_require__(1); -var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; + /* Mitigate a problem with templates inside select */ + if (tagName === 'select' && regExpTest(/