mirror of
https://github.com/actions/setup-java.git
synced 2026-08-25 10:03:13 +01:00
59b3450628
* Combine Dependabot npm updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Rebuild action bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5d254ad-e29c-4477-ae66-cba6e36d7e03 * Update Licensed cache for XML dependencies Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5d254ad-e29c-4477-ae66-cba6e36d7e03 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5d254ad-e29c-4477-ae66-cba6e36d7e03
7165 lines
222 KiB
JavaScript
7165 lines
222 KiB
JavaScript
export const id = 824;
|
||
export const ids = [824];
|
||
export const modules = {
|
||
|
||
/***/ 5824:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ XMLParser: () => (/* reexport safe */ _xmlparser_XMLParser_js__WEBPACK_IMPORTED_MODULE_1__.A),
|
||
/* harmony export */ i: () => (/* binding */ XMLValidator)
|
||
/* harmony export */ });
|
||
/* harmony import */ var _validator_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1176);
|
||
/* harmony import */ var _xmlparser_XMLParser_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6009);
|
||
|
||
|
||
|
||
|
||
|
||
|
||
const XMLValidator = {
|
||
validate: _validator_js__WEBPACK_IMPORTED_MODULE_0__/* .validate */ .t
|
||
}
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 984:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ Eo: () => (/* binding */ isName),
|
||
/* harmony export */ Xe: () => (/* binding */ getAllMatches),
|
||
/* harmony export */ q9: () => (/* binding */ DANGEROUS_PROPERTY_NAMES),
|
||
/* harmony export */ vl: () => (/* binding */ criticalProperties),
|
||
/* harmony export */ yQ: () => (/* binding */ isExist)
|
||
/* harmony export */ });
|
||
/* unused harmony exports nameRegexp, isEmptyObject, getValue */
|
||
|
||
|
||
const nameStartChar = ':A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD';
|
||
const nameChar = nameStartChar + '\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040';
|
||
const nameRegexp = '[' + nameStartChar + '][' + nameChar + ']*';
|
||
const regexName = new RegExp('^' + nameRegexp + '$');
|
||
|
||
function getAllMatches(string, regex) {
|
||
const matches = [];
|
||
let match = regex.exec(string);
|
||
while (match) {
|
||
const allmatches = [];
|
||
allmatches.startIndex = regex.lastIndex - match[0].length;
|
||
const len = match.length;
|
||
for (let index = 0; index < len; index++) {
|
||
allmatches.push(match[index]);
|
||
}
|
||
matches.push(allmatches);
|
||
match = regex.exec(string);
|
||
}
|
||
return matches;
|
||
}
|
||
|
||
const isName = function (string) {
|
||
const match = regexName.exec(string);
|
||
return !(match === null || typeof match === 'undefined');
|
||
}
|
||
|
||
function isExist(v) {
|
||
return typeof v !== 'undefined';
|
||
}
|
||
|
||
function isEmptyObject(obj) {
|
||
return Object.keys(obj).length === 0;
|
||
}
|
||
|
||
function getValue(v) {
|
||
if (exports.isExist(v)) {
|
||
return v;
|
||
} else {
|
||
return '';
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Dangerous property names that could lead to prototype pollution or security issues
|
||
*/
|
||
const DANGEROUS_PROPERTY_NAMES = [
|
||
// '__proto__',
|
||
// 'constructor',
|
||
// 'prototype',
|
||
'hasOwnProperty',
|
||
'toString',
|
||
'valueOf',
|
||
'__defineGetter__',
|
||
'__defineSetter__',
|
||
'__lookupGetter__',
|
||
'__lookupSetter__'
|
||
];
|
||
|
||
const criticalProperties = ["__proto__", "constructor", "prototype"];
|
||
|
||
/***/ }),
|
||
|
||
/***/ 1176:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ t: () => (/* binding */ validate)
|
||
/* harmony export */ });
|
||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(984);
|
||
|
||
|
||
|
||
|
||
const defaultOptions = {
|
||
allowBooleanAttributes: false, //A tag can have attributes without any value
|
||
unpairedTags: []
|
||
};
|
||
|
||
//const tagsPattern = new RegExp("<\\/?([\\w:\\-_\.]+)\\s*\/?>","g");
|
||
function validate(xmlData, options) {
|
||
options = Object.assign({}, defaultOptions, options);
|
||
|
||
//xmlData = xmlData.replace(/(\r\n|\n|\r)/gm,"");//make it single line
|
||
//xmlData = xmlData.replace(/(^\s*<\?xml.*?\?>)/g,"");//Remove XML starting tag
|
||
//xmlData = xmlData.replace(/(<!DOCTYPE[\s\w\"\.\/\-\:]+(\[.*\])*\s*>)/g,"");//Remove DOCTYPE
|
||
const tags = [];
|
||
let tagFound = false;
|
||
|
||
//indicates that the root tag has been closed (aka. depth 0 has been reached)
|
||
let reachedRoot = false;
|
||
|
||
if (xmlData[0] === '\ufeff') {
|
||
// check for byte order mark (BOM)
|
||
xmlData = xmlData.substr(1);
|
||
}
|
||
|
||
for (let i = 0; i < xmlData.length; i++) {
|
||
|
||
if (xmlData[i] === '<' && xmlData[i + 1] === '?') {
|
||
i += 2;
|
||
i = readPI(xmlData, i);
|
||
if (i.err) return i;
|
||
} else if (xmlData[i] === '<') {
|
||
//starting of tag
|
||
//read until you reach to '>' avoiding any '>' in attribute value
|
||
let tagStartPos = i;
|
||
i++;
|
||
|
||
if (xmlData[i] === '!') {
|
||
i = readCommentAndCDATA(xmlData, i);
|
||
continue;
|
||
} else {
|
||
let closingTag = false;
|
||
if (xmlData[i] === '/') {
|
||
//closing tag
|
||
closingTag = true;
|
||
i++;
|
||
}
|
||
//read tagname
|
||
let tagName = '';
|
||
for (; i < xmlData.length &&
|
||
xmlData[i] !== '>' &&
|
||
xmlData[i] !== ' ' &&
|
||
xmlData[i] !== '\t' &&
|
||
xmlData[i] !== '\n' &&
|
||
xmlData[i] !== '\r'; i++
|
||
) {
|
||
tagName += xmlData[i];
|
||
}
|
||
tagName = tagName.trim();
|
||
//console.log(tagName);
|
||
|
||
if (tagName[tagName.length - 1] === '/') {
|
||
//self closing tag without attributes
|
||
tagName = tagName.substring(0, tagName.length - 1);
|
||
//continue;
|
||
i--;
|
||
}
|
||
if (!validateTagName(tagName)) {
|
||
let msg;
|
||
if (tagName.trim().length === 0) {
|
||
msg = "Invalid space after '<'.";
|
||
} else {
|
||
msg = "Tag '" + tagName + "' is an invalid name.";
|
||
}
|
||
return getErrorObject('InvalidTag', msg, getLineNumberForPosition(xmlData, i));
|
||
}
|
||
|
||
const result = readAttributeStr(xmlData, i);
|
||
if (result === false) {
|
||
return getErrorObject('InvalidAttr', "Attributes for '" + tagName + "' have open quote.", getLineNumberForPosition(xmlData, i));
|
||
}
|
||
let attrStr = result.value;
|
||
i = result.index;
|
||
|
||
if (attrStr[attrStr.length - 1] === '/') {
|
||
//self closing tag
|
||
const attrStrStart = i - attrStr.length;
|
||
attrStr = attrStr.substring(0, attrStr.length - 1);
|
||
const isValid = validateAttributeString(attrStr, options);
|
||
if (isValid === true) {
|
||
tagFound = true;
|
||
//continue; //text may presents after self closing tag
|
||
} else {
|
||
//the result from the nested function returns the position of the error within the attribute
|
||
//in order to get the 'true' error line, we need to calculate the position where the attribute begins (i - attrStr.length) and then add the position within the attribute
|
||
//this gives us the absolute index in the entire xml, which we can use to find the line at last
|
||
return getErrorObject(isValid.err.code, isValid.err.msg, getLineNumberForPosition(xmlData, attrStrStart + isValid.err.line));
|
||
}
|
||
} else if (closingTag) {
|
||
if (!result.tagClosed) {
|
||
return getErrorObject('InvalidTag', "Closing tag '" + tagName + "' doesn't have proper closing.", getLineNumberForPosition(xmlData, i));
|
||
} else if (attrStr.trim().length > 0) {
|
||
return getErrorObject('InvalidTag', "Closing tag '" + tagName + "' can't have attributes or invalid starting.", getLineNumberForPosition(xmlData, tagStartPos));
|
||
} else if (tags.length === 0) {
|
||
return getErrorObject('InvalidTag', "Closing tag '" + tagName + "' has not been opened.", getLineNumberForPosition(xmlData, tagStartPos));
|
||
} else {
|
||
const otg = tags.pop();
|
||
if (tagName !== otg.tagName) {
|
||
let openPos = getLineNumberForPosition(xmlData, otg.tagStartPos);
|
||
return getErrorObject('InvalidTag',
|
||
"Expected closing tag '" + otg.tagName + "' (opened in line " + openPos.line + ", col " + openPos.col + ") instead of closing tag '" + tagName + "'.",
|
||
getLineNumberForPosition(xmlData, tagStartPos));
|
||
}
|
||
|
||
//when there are no more tags, we reached the root level.
|
||
if (tags.length == 0) {
|
||
reachedRoot = true;
|
||
}
|
||
}
|
||
} else {
|
||
const isValid = validateAttributeString(attrStr, options);
|
||
if (isValid !== true) {
|
||
//the result from the nested function returns the position of the error within the attribute
|
||
//in order to get the 'true' error line, we need to calculate the position where the attribute begins (i - attrStr.length) and then add the position within the attribute
|
||
//this gives us the absolute index in the entire xml, which we can use to find the line at last
|
||
return getErrorObject(isValid.err.code, isValid.err.msg, getLineNumberForPosition(xmlData, i - attrStr.length + isValid.err.line));
|
||
}
|
||
|
||
//if the root level has been reached before ...
|
||
if (reachedRoot === true) {
|
||
return getErrorObject('InvalidXml', 'Multiple possible root nodes found.', getLineNumberForPosition(xmlData, i));
|
||
} else if (options.unpairedTags.indexOf(tagName) !== -1) {
|
||
//don't push into stack
|
||
} else {
|
||
tags.push({ tagName, tagStartPos });
|
||
}
|
||
tagFound = true;
|
||
}
|
||
|
||
//skip tag text value
|
||
//It may include comments and CDATA value
|
||
for (i++; i < xmlData.length; i++) {
|
||
if (xmlData[i] === '<') {
|
||
if (xmlData[i + 1] === '!') {
|
||
//comment or CADATA
|
||
i++;
|
||
i = readCommentAndCDATA(xmlData, i);
|
||
continue;
|
||
} else if (xmlData[i + 1] === '?') {
|
||
i = readPI(xmlData, ++i);
|
||
if (i.err) return i;
|
||
} else {
|
||
break;
|
||
}
|
||
} else if (xmlData[i] === '&') {
|
||
const afterAmp = validateAmpersand(xmlData, i);
|
||
if (afterAmp == -1)
|
||
return getErrorObject('InvalidChar', "char '&' is not expected.", getLineNumberForPosition(xmlData, i));
|
||
i = afterAmp;
|
||
} else {
|
||
if (reachedRoot === true && !isWhiteSpace(xmlData[i])) {
|
||
return getErrorObject('InvalidXml', "Extra text at the end", getLineNumberForPosition(xmlData, i));
|
||
}
|
||
}
|
||
} //end of reading tag text value
|
||
if (xmlData[i] === '<') {
|
||
i--;
|
||
}
|
||
}
|
||
} else {
|
||
if (isWhiteSpace(xmlData[i])) {
|
||
continue;
|
||
}
|
||
return getErrorObject('InvalidChar', "char '" + xmlData[i] + "' is not expected.", getLineNumberForPosition(xmlData, i));
|
||
}
|
||
}
|
||
|
||
if (!tagFound) {
|
||
return getErrorObject('InvalidXml', 'Start tag expected.', 1);
|
||
} else if (tags.length == 1) {
|
||
return getErrorObject('InvalidTag', "Unclosed tag '" + tags[0].tagName + "'.", getLineNumberForPosition(xmlData, tags[0].tagStartPos));
|
||
} else if (tags.length > 0) {
|
||
return getErrorObject('InvalidXml', "Invalid '" +
|
||
JSON.stringify(tags.map(t => t.tagName), null, 4).replace(/\r?\n/g, '') +
|
||
"' found.", { line: 1, col: 1 });
|
||
}
|
||
|
||
return true;
|
||
};
|
||
|
||
function isWhiteSpace(char) {
|
||
return char === ' ' || char === '\t' || char === '\n' || char === '\r';
|
||
}
|
||
/**
|
||
* Read Processing insstructions and skip
|
||
* @param {*} xmlData
|
||
* @param {*} i
|
||
*/
|
||
function readPI(xmlData, i) {
|
||
const start = i;
|
||
for (; i < xmlData.length; i++) {
|
||
if (xmlData[i] == '?' || xmlData[i] == ' ') {
|
||
//tagname
|
||
const tagname = xmlData.substr(start, i - start);
|
||
if (i > 5 && tagname === 'xml') {
|
||
return getErrorObject('InvalidXml', 'XML declaration allowed only at the start of the document.', getLineNumberForPosition(xmlData, i));
|
||
} else if (xmlData[i] == '?' && xmlData[i + 1] == '>') {
|
||
//check if valid attribut string
|
||
i++;
|
||
break;
|
||
} else {
|
||
continue;
|
||
}
|
||
}
|
||
}
|
||
return i;
|
||
}
|
||
|
||
function readCommentAndCDATA(xmlData, i) {
|
||
if (xmlData.length > i + 5 && xmlData[i + 1] === '-' && xmlData[i + 2] === '-') {
|
||
//comment
|
||
for (i += 3; i < xmlData.length; i++) {
|
||
if (xmlData[i] === '-' && xmlData[i + 1] === '-' && xmlData[i + 2] === '>') {
|
||
i += 2;
|
||
break;
|
||
}
|
||
}
|
||
} else if (
|
||
xmlData.length > i + 8 &&
|
||
xmlData[i + 1] === 'D' &&
|
||
xmlData[i + 2] === 'O' &&
|
||
xmlData[i + 3] === 'C' &&
|
||
xmlData[i + 4] === 'T' &&
|
||
xmlData[i + 5] === 'Y' &&
|
||
xmlData[i + 6] === 'P' &&
|
||
xmlData[i + 7] === 'E'
|
||
) {
|
||
let angleBracketsCount = 1;
|
||
for (i += 8; i < xmlData.length; i++) {
|
||
if (xmlData[i] === '<') {
|
||
angleBracketsCount++;
|
||
} else if (xmlData[i] === '>') {
|
||
angleBracketsCount--;
|
||
if (angleBracketsCount === 0) {
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
} else if (
|
||
xmlData.length > i + 9 &&
|
||
xmlData[i + 1] === '[' &&
|
||
xmlData[i + 2] === 'C' &&
|
||
xmlData[i + 3] === 'D' &&
|
||
xmlData[i + 4] === 'A' &&
|
||
xmlData[i + 5] === 'T' &&
|
||
xmlData[i + 6] === 'A' &&
|
||
xmlData[i + 7] === '['
|
||
) {
|
||
for (i += 8; i < xmlData.length; i++) {
|
||
if (xmlData[i] === ']' && xmlData[i + 1] === ']' && xmlData[i + 2] === '>') {
|
||
i += 2;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
|
||
return i;
|
||
}
|
||
|
||
const doubleQuote = '"';
|
||
const singleQuote = "'";
|
||
|
||
/**
|
||
* Keep reading xmlData until '<' is found outside the attribute value.
|
||
* @param {string} xmlData
|
||
* @param {number} i
|
||
*/
|
||
function readAttributeStr(xmlData, i) {
|
||
let attrStr = '';
|
||
let startChar = '';
|
||
let tagClosed = false;
|
||
for (; i < xmlData.length; i++) {
|
||
if (xmlData[i] === doubleQuote || xmlData[i] === singleQuote) {
|
||
if (startChar === '') {
|
||
startChar = xmlData[i];
|
||
} else if (startChar !== xmlData[i]) {
|
||
//if vaue is enclosed with double quote then single quotes are allowed inside the value and vice versa
|
||
} else {
|
||
startChar = '';
|
||
}
|
||
} else if (xmlData[i] === '>') {
|
||
if (startChar === '') {
|
||
tagClosed = true;
|
||
break;
|
||
}
|
||
}
|
||
attrStr += xmlData[i];
|
||
}
|
||
if (startChar !== '') {
|
||
return false;
|
||
}
|
||
|
||
return {
|
||
value: attrStr,
|
||
index: i,
|
||
tagClosed: tagClosed
|
||
};
|
||
}
|
||
|
||
/**
|
||
* Select all the attributes whether valid or invalid.
|
||
*/
|
||
const validAttrStrRegxp = new RegExp('(\\s*)([^\\s=]+)(\\s*=)?(\\s*([\'"])(([\\s\\S])*?)\\5)?', 'g');
|
||
|
||
//attr, ="sd", a="amit's", a="sd"b="saf", ab cd=""
|
||
|
||
function validateAttributeString(attrStr, options) {
|
||
//console.log("start:"+attrStr+":end");
|
||
|
||
//if(attrStr.trim().length === 0) return true; //empty string
|
||
|
||
const matches = (0,_util_js__WEBPACK_IMPORTED_MODULE_0__/* .getAllMatches */ .Xe)(attrStr, validAttrStrRegxp);
|
||
const attrNames = {};
|
||
|
||
for (let i = 0; i < matches.length; i++) {
|
||
if (matches[i][1].length === 0) {
|
||
//nospace before attribute name: a="sd"b="saf"
|
||
return getErrorObject('InvalidAttr', "Attribute '" + matches[i][2] + "' has no space in starting.", getPositionFromMatch(matches[i]))
|
||
} else if (matches[i][3] !== undefined && matches[i][4] === undefined) {
|
||
return getErrorObject('InvalidAttr', "Attribute '" + matches[i][2] + "' is without value.", getPositionFromMatch(matches[i]));
|
||
} else if (matches[i][3] === undefined && !options.allowBooleanAttributes) {
|
||
//independent attribute: ab
|
||
return getErrorObject('InvalidAttr', "boolean attribute '" + matches[i][2] + "' is not allowed.", getPositionFromMatch(matches[i]));
|
||
}
|
||
/* else if(matches[i][6] === undefined){//attribute without value: ab=
|
||
return { err: { code:"InvalidAttr",msg:"attribute " + matches[i][2] + " has no value assigned."}};
|
||
} */
|
||
const attrName = matches[i][2];
|
||
if (!validateAttrName(attrName)) {
|
||
return getErrorObject('InvalidAttr', "Attribute '" + attrName + "' is an invalid name.", getPositionFromMatch(matches[i]));
|
||
}
|
||
if (!Object.prototype.hasOwnProperty.call(attrNames, attrName)) {
|
||
//check for duplicate attribute.
|
||
attrNames[attrName] = 1;
|
||
} else {
|
||
return getErrorObject('InvalidAttr', "Attribute '" + attrName + "' is repeated.", getPositionFromMatch(matches[i]));
|
||
}
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
function validateNumberAmpersand(xmlData, i) {
|
||
let re = /\d/;
|
||
if (xmlData[i] === 'x') {
|
||
i++;
|
||
re = /[\da-fA-F]/;
|
||
}
|
||
for (; i < xmlData.length; i++) {
|
||
if (xmlData[i] === ';')
|
||
return i;
|
||
if (!xmlData[i].match(re))
|
||
break;
|
||
}
|
||
return -1;
|
||
}
|
||
|
||
function validateAmpersand(xmlData, i) {
|
||
// https://www.w3.org/TR/xml/#dt-charref
|
||
i++;
|
||
if (xmlData[i] === ';')
|
||
return -1;
|
||
if (xmlData[i] === '#') {
|
||
i++;
|
||
return validateNumberAmpersand(xmlData, i);
|
||
}
|
||
let count = 0;
|
||
for (; i < xmlData.length; i++, count++) {
|
||
if (xmlData[i].match(/\w/) && count < 20)
|
||
continue;
|
||
if (xmlData[i] === ';')
|
||
break;
|
||
return -1;
|
||
}
|
||
return i;
|
||
}
|
||
|
||
function getErrorObject(code, message, lineNumber) {
|
||
return {
|
||
err: {
|
||
code: code,
|
||
msg: message,
|
||
line: lineNumber.line || lineNumber,
|
||
col: lineNumber.col,
|
||
},
|
||
};
|
||
}
|
||
|
||
function validateAttrName(attrName) {
|
||
return (0,_util_js__WEBPACK_IMPORTED_MODULE_0__/* .isName */ .Eo)(attrName);
|
||
}
|
||
|
||
// const startsWithXML = /^xml/i;
|
||
|
||
function validateTagName(tagname) {
|
||
return (0,_util_js__WEBPACK_IMPORTED_MODULE_0__/* .isName */ .Eo)(tagname) /* && !tagname.match(startsWithXML) */;
|
||
}
|
||
|
||
//this function returns the line number for the character at the given index
|
||
function getLineNumberForPosition(xmlData, index) {
|
||
const lines = xmlData.substring(0, index).split(/\r?\n/);
|
||
return {
|
||
line: lines.length,
|
||
|
||
// column number is last line's length + 1, because column numbering starts at 1:
|
||
col: lines[lines.length - 1].length + 1
|
||
};
|
||
}
|
||
|
||
//this function returns the position of the first character of match within attrStr
|
||
function getPositionFromMatch(match) {
|
||
return match.startIndex + match[1].length;
|
||
}
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 6009:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
|
||
// EXPORTS
|
||
__webpack_require__.d(__webpack_exports__, {
|
||
A: () => (/* binding */ XMLParser)
|
||
});
|
||
|
||
// EXTERNAL MODULE: ./node_modules/fast-xml-parser/src/util.js
|
||
var util = __webpack_require__(984);
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/OptionsBuilder.js
|
||
|
||
|
||
|
||
const defaultOnDangerousProperty = (name) => {
|
||
if (util/* DANGEROUS_PROPERTY_NAMES */.q9.includes(name)) {
|
||
return "__" + name;
|
||
}
|
||
return name;
|
||
};
|
||
|
||
|
||
const defaultOptions = {
|
||
preserveOrder: false,
|
||
attributeNamePrefix: '@_',
|
||
attributesGroupName: false,
|
||
textNodeName: '#text',
|
||
ignoreAttributes: true,
|
||
removeNSPrefix: false, // remove NS from tag name or attribute name if true
|
||
allowBooleanAttributes: false, //a tag can have attributes without any value
|
||
//ignoreRootElement : false,
|
||
parseTagValue: true,
|
||
parseAttributeValue: false,
|
||
trimValues: true, //Trim string values of tag and attributes
|
||
cdataPropName: false,
|
||
numberParseOptions: {
|
||
hex: true,
|
||
leadingZeros: true,
|
||
eNotation: true,
|
||
unicode: false
|
||
},
|
||
tagValueProcessor: function (tagName, val) {
|
||
return val;
|
||
},
|
||
attributeValueProcessor: function (attrName, val) {
|
||
return val;
|
||
},
|
||
stopNodes: [], //nested tags will not be parsed even for errors
|
||
alwaysCreateTextNode: false,
|
||
isArray: () => false,
|
||
commentPropName: false,
|
||
unpairedTags: [],
|
||
processEntities: true,
|
||
htmlEntities: false,
|
||
entityDecoder: null,
|
||
ignoreDeclaration: false,
|
||
ignorePiTags: false,
|
||
transformTagName: false,
|
||
transformAttributeName: false,
|
||
updateTag: function (tagName, jPath, attrs) {
|
||
return tagName
|
||
},
|
||
// skipEmptyListItem: false
|
||
captureMetaData: false,
|
||
maxNestedTags: 100,
|
||
strictReservedNames: true,
|
||
jPath: true, // if true, pass jPath string to callbacks; if false, pass matcher instance
|
||
onDangerousProperty: defaultOnDangerousProperty
|
||
};
|
||
|
||
|
||
/**
|
||
* Validates that a property name is safe to use
|
||
* @param {string} propertyName - The property name to validate
|
||
* @param {string} optionName - The option field name (for error message)
|
||
* @throws {Error} If property name is dangerous
|
||
*/
|
||
function validatePropertyName(propertyName, optionName) {
|
||
if (typeof propertyName !== 'string') {
|
||
return; // Only validate string property names
|
||
}
|
||
|
||
const normalized = propertyName.toLowerCase();
|
||
if (util/* DANGEROUS_PROPERTY_NAMES */.q9.some(dangerous => normalized === dangerous.toLowerCase())) {
|
||
throw new Error(
|
||
`[SECURITY] Invalid ${optionName}: "${propertyName}" is a reserved JavaScript keyword that could cause prototype pollution`
|
||
);
|
||
}
|
||
|
||
if (util/* criticalProperties */.vl.some(dangerous => normalized === dangerous.toLowerCase())) {
|
||
throw new Error(
|
||
`[SECURITY] Invalid ${optionName}: "${propertyName}" is a reserved JavaScript keyword that could cause prototype pollution`
|
||
);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Normalizes processEntities option for backward compatibility
|
||
* @param {boolean|object} value
|
||
* @returns {object} Always returns normalized object
|
||
*/
|
||
function normalizeProcessEntities(value, htmlEntities) {
|
||
// Boolean backward compatibility
|
||
if (typeof value === 'boolean') {
|
||
return {
|
||
enabled: value, // true or false
|
||
maxEntitySize: 10000,
|
||
maxExpansionDepth: 10000,
|
||
maxTotalExpansions: Infinity,
|
||
maxExpandedLength: 100000,
|
||
maxEntityCount: 1000,
|
||
allowedTags: null,
|
||
tagFilter: null,
|
||
appliesTo: "all",
|
||
};
|
||
}
|
||
|
||
// Object config - merge with defaults
|
||
if (typeof value === 'object' && value !== null) {
|
||
return {
|
||
enabled: value.enabled !== false,
|
||
maxEntitySize: Math.max(1, value.maxEntitySize ?? 10000),
|
||
maxExpansionDepth: Math.max(1, value.maxExpansionDepth ?? 10000),
|
||
maxTotalExpansions: Math.max(1, value.maxTotalExpansions ?? Infinity),
|
||
maxExpandedLength: Math.max(1, value.maxExpandedLength ?? 100000),
|
||
maxEntityCount: Math.max(1, value.maxEntityCount ?? 1000),
|
||
allowedTags: value.allowedTags ?? null,
|
||
tagFilter: value.tagFilter ?? null,
|
||
appliesTo: value.appliesTo ?? "all",
|
||
};
|
||
}
|
||
|
||
// Default to enabled with limits
|
||
return normalizeProcessEntities(true);
|
||
}
|
||
|
||
const buildOptions = function (options) {
|
||
const built = Object.assign({}, defaultOptions, options);
|
||
|
||
// Validate property names to prevent prototype pollution
|
||
const propertyNameOptions = [
|
||
{ value: built.attributeNamePrefix, name: 'attributeNamePrefix' },
|
||
{ value: built.attributesGroupName, name: 'attributesGroupName' },
|
||
{ value: built.textNodeName, name: 'textNodeName' },
|
||
{ value: built.cdataPropName, name: 'cdataPropName' },
|
||
{ value: built.commentPropName, name: 'commentPropName' }
|
||
];
|
||
|
||
for (const { value, name } of propertyNameOptions) {
|
||
if (value) {
|
||
validatePropertyName(value, name);
|
||
}
|
||
}
|
||
|
||
if (built.onDangerousProperty === null) {
|
||
built.onDangerousProperty = defaultOnDangerousProperty;
|
||
}
|
||
|
||
// Always normalize processEntities for backward compatibility and validation
|
||
built.processEntities = normalizeProcessEntities(built.processEntities, built.htmlEntities);
|
||
built.unpairedTagsSet = new Set(built.unpairedTags);
|
||
// Convert old-style stopNodes for backward compatibility
|
||
if (built.stopNodes && Array.isArray(built.stopNodes)) {
|
||
built.stopNodes = built.stopNodes.map(node => {
|
||
if (typeof node === 'string' && node.startsWith('*.')) {
|
||
// Old syntax: *.tagname meant "tagname anywhere"
|
||
// Convert to new syntax: ..tagname
|
||
return '..' + node.substring(2);
|
||
}
|
||
return node;
|
||
});
|
||
}
|
||
//console.debug(built.processEntities)
|
||
return built;
|
||
};
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/xmlNode.js
|
||
|
||
|
||
let METADATA_SYMBOL;
|
||
|
||
if (typeof Symbol !== "function") {
|
||
METADATA_SYMBOL = "@@xmlMetadata";
|
||
} else {
|
||
METADATA_SYMBOL = Symbol("XML Node Metadata");
|
||
}
|
||
|
||
class XmlNode {
|
||
constructor(tagname) {
|
||
this.tagname = tagname;
|
||
this.child = []; //nested tags, text, cdata, comments in order
|
||
this[":@"] = Object.create(null); //attributes map
|
||
}
|
||
add(key, val) {
|
||
// this.child.push( {name : key, val: val, isCdata: isCdata });
|
||
if (key === "__proto__") key = "#__proto__";
|
||
this.child.push({ [key]: val });
|
||
}
|
||
addChild(node, startIndex) {
|
||
if (node.tagname === "__proto__") node.tagname = "#__proto__";
|
||
if (node[":@"] && Object.keys(node[":@"]).length > 0) {
|
||
this.child.push({ [node.tagname]: node.child, [":@"]: node[":@"] });
|
||
} else {
|
||
this.child.push({ [node.tagname]: node.child });
|
||
}
|
||
// if requested, add the startIndex
|
||
this.addStartIndex(startIndex);
|
||
}
|
||
|
||
addStartIndex(startIndex) {
|
||
if (startIndex !== undefined) {
|
||
// Note: for now we just overwrite the metadata. If we had more complex metadata,
|
||
// we might need to do an object append here: metadata = { ...metadata, startIndex }
|
||
this.child[this.child.length - 1][METADATA_SYMBOL] = { startIndex };
|
||
}
|
||
}
|
||
|
||
addEndIndex(endIndex) {
|
||
const lastChild = this.child[this.child.length - 1];
|
||
// endIndex is write-once: when updateTag drops a node, the last child is a
|
||
// previously completed sibling whose endIndex must not be overwritten
|
||
if (lastChild !== undefined && lastChild[METADATA_SYMBOL] !== undefined
|
||
&& lastChild[METADATA_SYMBOL].endIndex === undefined) {
|
||
lastChild[METADATA_SYMBOL].endIndex = endIndex;
|
||
}
|
||
}
|
||
/** symbol used for metadata */
|
||
static getMetaDataSymbol() {
|
||
return METADATA_SYMBOL;
|
||
}
|
||
}
|
||
|
||
// EXTERNAL MODULE: ./node_modules/xml-naming/src/index.js
|
||
var src = __webpack_require__(4658);
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js
|
||
|
||
|
||
class DocTypeReader {
|
||
constructor(options, xmlVersion) {
|
||
this.suppressValidationErr = !options;
|
||
this.options = options;
|
||
this.xmlVersion = xmlVersion || 1.0;
|
||
}
|
||
|
||
setXmlVersion(xmlVersion = 1.0) {
|
||
this.xmlVersion = xmlVersion;
|
||
}
|
||
readDocType(xmlData, i) {
|
||
const entities = Object.create(null);
|
||
let entityCount = 0;
|
||
|
||
if (xmlData[i + 3] === 'O' &&
|
||
xmlData[i + 4] === 'C' &&
|
||
xmlData[i + 5] === 'T' &&
|
||
xmlData[i + 6] === 'Y' &&
|
||
xmlData[i + 7] === 'P' &&
|
||
xmlData[i + 8] === 'E') {
|
||
i = i + 9;
|
||
let angleBracketsCount = 1;
|
||
let hasBody = false, comment = false;
|
||
let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
|
||
let exp = "";
|
||
for (; i < xmlData.length; i++) {
|
||
// Inside a quoted external-identifier literal — XML allows '<'
|
||
// and '>' as plain data here, so they must not be interpreted
|
||
// as DOCTYPE structure until the matching quote closes.
|
||
if (quoteChar !== null) {
|
||
if (xmlData[i] === quoteChar) quoteChar = null;
|
||
exp += xmlData[i];
|
||
continue;
|
||
}
|
||
if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
|
||
quoteChar = xmlData[i];
|
||
exp += xmlData[i];
|
||
continue;
|
||
}
|
||
|
||
if (xmlData[i] === '<' && !comment) { //Determine the tag type
|
||
if (hasBody && hasSeq(xmlData, "!ENTITY", i)) {
|
||
i += 7;
|
||
let entityName, val;
|
||
[entityName, val, i] = this.readEntityExp(xmlData, i + 1, this.suppressValidationErr);
|
||
if (val.indexOf("&") === -1) { //Parameter entities are not supported
|
||
if (this.options.enabled !== false &&
|
||
this.options.maxEntityCount != null &&
|
||
entityCount >= this.options.maxEntityCount) {
|
||
throw new Error(
|
||
`Entity count (${entityCount + 1}) exceeds maximum allowed (${this.options.maxEntityCount})`
|
||
);
|
||
}
|
||
//const escaped = entityName.replace(/[.\-+*:]/g, '\\.');
|
||
//const escaped = entityName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
||
entities[entityName] = val;
|
||
entityCount++;
|
||
}
|
||
}
|
||
else if (hasBody && hasSeq(xmlData, "!ELEMENT", i)) {
|
||
i += 8;//Not supported
|
||
const { index } = this.readElementExp(xmlData, i + 1);
|
||
i = index;
|
||
} else if (hasBody && hasSeq(xmlData, "!ATTLIST", i)) {
|
||
i += 8;//Not supported
|
||
// const {index} = this.readAttlistExp(xmlData,i+1);
|
||
// i = index;
|
||
} else if (hasBody && hasSeq(xmlData, "!NOTATION", i)) {
|
||
i += 9;//Not supported
|
||
const { index } = this.readNotationExp(xmlData, i + 1, this.suppressValidationErr);
|
||
i = index;
|
||
} else if (hasSeq(xmlData, "!--", i)) comment = true;
|
||
else throw new Error(`Invalid DOCTYPE`);
|
||
|
||
angleBracketsCount++;
|
||
exp = "";
|
||
} else if (xmlData[i] === '>') { //Read tag content
|
||
if (comment) {
|
||
if (xmlData[i - 1] === "-" && xmlData[i - 2] === "-") {
|
||
comment = false;
|
||
angleBracketsCount--;
|
||
}
|
||
} else {
|
||
angleBracketsCount--;
|
||
}
|
||
if (angleBracketsCount === 0) {
|
||
break;
|
||
}
|
||
} else if (xmlData[i] === '[') {
|
||
hasBody = true;
|
||
} else {
|
||
exp += xmlData[i];
|
||
}
|
||
}
|
||
if (quoteChar !== null || angleBracketsCount !== 0) {
|
||
throw new Error(`Unclosed DOCTYPE`);
|
||
}
|
||
} else {
|
||
throw new Error(`Invalid Tag instead of DOCTYPE`);
|
||
}
|
||
return { entities, i };
|
||
}
|
||
readEntityExp(xmlData, i) {
|
||
//External entities are not supported
|
||
// <!ENTITY ext SYSTEM "http://normal-website.com" >
|
||
|
||
//Parameter entities are not supported
|
||
// <!ENTITY entityname "&anotherElement;">
|
||
|
||
//Internal entities are supported
|
||
// <!ENTITY entityname "replacement text">
|
||
|
||
// Skip leading whitespace after <!ENTITY
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read entity name
|
||
const startIndex = i;
|
||
while (i < xmlData.length && !/\s/.test(xmlData[i]) && xmlData[i] !== '"' && xmlData[i] !== "'") {
|
||
i++;
|
||
}
|
||
let entityName = xmlData.substring(startIndex, i);
|
||
|
||
validateEntityName(entityName, { xmlVersion: this.xmlVersion });
|
||
|
||
// Skip whitespace after entity name
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Check for unsupported constructs (external entities or parameter entities)
|
||
if (!this.suppressValidationErr) {
|
||
if (xmlData.substring(i, i + 6).toUpperCase() === "SYSTEM") {
|
||
throw new Error("External entities are not supported");
|
||
} else if (xmlData[i] === "%") {
|
||
throw new Error("Parameter entities are not supported");
|
||
}
|
||
}
|
||
|
||
// Read entity value (internal entity)
|
||
let entityValue = "";
|
||
[i, entityValue] = this.readIdentifierVal(xmlData, i, "entity");
|
||
|
||
// Validate entity size
|
||
if (this.options.enabled !== false &&
|
||
this.options.maxEntitySize != null &&
|
||
entityValue.length > this.options.maxEntitySize) {
|
||
throw new Error(
|
||
`Entity "${entityName}" size (${entityValue.length}) exceeds maximum allowed size (${this.options.maxEntitySize})`
|
||
);
|
||
}
|
||
|
||
i--;
|
||
return [entityName, entityValue, i];
|
||
}
|
||
|
||
readNotationExp(xmlData, i) {
|
||
// Skip leading whitespace after <!NOTATION
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read notation name
|
||
|
||
const startIndex = i;
|
||
while (i < xmlData.length && !/\s/.test(xmlData[i])) {
|
||
i++;
|
||
}
|
||
let notationName = xmlData.substring(startIndex, i);
|
||
|
||
!this.suppressValidationErr && validateEntityName(notationName, { xmlVersion: this.xmlVersion });
|
||
|
||
// Skip whitespace after notation name
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Check identifier type (SYSTEM or PUBLIC)
|
||
const identifierType = xmlData.substring(i, i + 6).toUpperCase();
|
||
if (!this.suppressValidationErr && identifierType !== "SYSTEM" && identifierType !== "PUBLIC") {
|
||
throw new Error(`Expected SYSTEM or PUBLIC, found "${identifierType}"`);
|
||
}
|
||
i += identifierType.length;
|
||
|
||
// Skip whitespace after identifier type
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read public identifier (if PUBLIC)
|
||
let publicIdentifier = null;
|
||
let systemIdentifier = null;
|
||
|
||
if (identifierType === "PUBLIC") {
|
||
[i, publicIdentifier] = this.readIdentifierVal(xmlData, i, "publicIdentifier");
|
||
|
||
// Skip whitespace after public identifier
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Optionally read system identifier
|
||
if (xmlData[i] === '"' || xmlData[i] === "'") {
|
||
[i, systemIdentifier] = this.readIdentifierVal(xmlData, i, "systemIdentifier");
|
||
}
|
||
} else if (identifierType === "SYSTEM") {
|
||
// Read system identifier (mandatory for SYSTEM)
|
||
[i, systemIdentifier] = this.readIdentifierVal(xmlData, i, "systemIdentifier");
|
||
|
||
if (!this.suppressValidationErr && !systemIdentifier) {
|
||
throw new Error("Missing mandatory system identifier for SYSTEM notation");
|
||
}
|
||
}
|
||
|
||
return { notationName, publicIdentifier, systemIdentifier, index: --i };
|
||
}
|
||
|
||
readIdentifierVal(xmlData, i, type) {
|
||
let identifierVal = "";
|
||
const startChar = xmlData[i];
|
||
if (startChar !== '"' && startChar !== "'") {
|
||
throw new Error(`Expected quoted string, found "${startChar}"`);
|
||
}
|
||
i++;
|
||
|
||
const startIndex = i;
|
||
while (i < xmlData.length && xmlData[i] !== startChar) {
|
||
i++;
|
||
}
|
||
identifierVal = xmlData.substring(startIndex, i);
|
||
|
||
if (xmlData[i] !== startChar) {
|
||
throw new Error(`Unterminated ${type} value`);
|
||
}
|
||
i++;
|
||
return [i, identifierVal];
|
||
}
|
||
|
||
readElementExp(xmlData, i) {
|
||
// <!ELEMENT br EMPTY>
|
||
// <!ELEMENT div ANY>
|
||
// <!ELEMENT title (#PCDATA)>
|
||
// <!ELEMENT book (title, author+)>
|
||
// <!ELEMENT name (content-model)>
|
||
|
||
// Skip leading whitespace after <!ELEMENT
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read element name
|
||
const startIndex = i;
|
||
while (i < xmlData.length && !/\s/.test(xmlData[i])) {
|
||
i++;
|
||
}
|
||
let elementName = xmlData.substring(startIndex, i);
|
||
|
||
// Validate element name
|
||
if (!this.suppressValidationErr && !(0,src/* qName */.fG)(elementName, { xmlVersion: this.xmlVersion })) {
|
||
throw new Error(`Invalid element name: "${elementName}"`);
|
||
}
|
||
|
||
// Skip whitespace after element name
|
||
i = skipWhitespace(xmlData, i);
|
||
let contentModel = "";
|
||
// Expect '(' to start content model
|
||
if (xmlData[i] === "E" && hasSeq(xmlData, "MPTY", i)) i += 4;
|
||
else if (xmlData[i] === "A" && hasSeq(xmlData, "NY", i)) i += 2;
|
||
else if (xmlData[i] === "(") {
|
||
i++; // Move past '('
|
||
|
||
// Read content model
|
||
const startIndex = i;
|
||
while (i < xmlData.length && xmlData[i] !== ")") {
|
||
i++;
|
||
}
|
||
contentModel = xmlData.substring(startIndex, i);
|
||
|
||
if (xmlData[i] !== ")") {
|
||
throw new Error("Unterminated content model");
|
||
}
|
||
|
||
} else if (!this.suppressValidationErr) {
|
||
throw new Error(`Invalid Element Expression, found "${xmlData[i]}"`);
|
||
}
|
||
|
||
return {
|
||
elementName,
|
||
contentModel: contentModel.trim(),
|
||
index: i
|
||
};
|
||
}
|
||
|
||
readAttlistExp(xmlData, i) {
|
||
// Skip leading whitespace after <!ATTLIST
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read element name
|
||
let startIndex = i;
|
||
while (i < xmlData.length && !/\s/.test(xmlData[i])) {
|
||
i++;
|
||
}
|
||
let elementName = xmlData.substring(startIndex, i);
|
||
|
||
// Validate element name
|
||
validateEntityName(elementName, { xmlVersion: this.xmlVersion })
|
||
|
||
// Skip whitespace after element name
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read attribute name
|
||
startIndex = i;
|
||
while (i < xmlData.length && !/\s/.test(xmlData[i])) {
|
||
i++;
|
||
}
|
||
let attributeName = xmlData.substring(startIndex, i);
|
||
|
||
// Validate attribute name
|
||
if (!validateEntityName(attributeName, { xmlVersion: this.xmlVersion })) {
|
||
throw new Error(`Invalid attribute name: "${attributeName}"`);
|
||
}
|
||
|
||
// Skip whitespace after attribute name
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read attribute type
|
||
let attributeType = "";
|
||
if (xmlData.substring(i, i + 8).toUpperCase() === "NOTATION") {
|
||
attributeType = "NOTATION";
|
||
i += 8; // Move past "NOTATION"
|
||
|
||
// Skip whitespace after "NOTATION"
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Expect '(' to start the list of notations
|
||
if (xmlData[i] !== "(") {
|
||
throw new Error(`Expected '(', found "${xmlData[i]}"`);
|
||
}
|
||
i++; // Move past '('
|
||
|
||
// Read the list of allowed notations
|
||
let allowedNotations = [];
|
||
while (i < xmlData.length && xmlData[i] !== ")") {
|
||
|
||
|
||
const startIndex = i;
|
||
while (i < xmlData.length && xmlData[i] !== "|" && xmlData[i] !== ")") {
|
||
i++;
|
||
}
|
||
let notation = xmlData.substring(startIndex, i);
|
||
|
||
// Validate notation name
|
||
notation = notation.trim();
|
||
if (!validateEntityName(notation, { xmlVersion: this.xmlVersion })) {
|
||
throw new Error(`Invalid notation name: "${notation}"`);
|
||
}
|
||
|
||
allowedNotations.push(notation);
|
||
|
||
// Skip '|' separator or exit loop
|
||
if (xmlData[i] === "|") {
|
||
i++; // Move past '|'
|
||
i = skipWhitespace(xmlData, i); // Skip optional whitespace after '|'
|
||
}
|
||
}
|
||
|
||
if (xmlData[i] !== ")") {
|
||
throw new Error("Unterminated list of notations");
|
||
}
|
||
i++; // Move past ')'
|
||
|
||
// Store the allowed notations as part of the attribute type
|
||
attributeType += " (" + allowedNotations.join("|") + ")";
|
||
} else {
|
||
// Handle simple types (e.g., CDATA, ID, IDREF, etc.)
|
||
const startIndex = i;
|
||
while (i < xmlData.length && !/\s/.test(xmlData[i])) {
|
||
i++;
|
||
}
|
||
attributeType += xmlData.substring(startIndex, i);
|
||
|
||
// Validate simple attribute type
|
||
const validTypes = ["CDATA", "ID", "IDREF", "IDREFS", "ENTITY", "ENTITIES", "NMTOKEN", "NMTOKENS"];
|
||
if (!this.suppressValidationErr && !validTypes.includes(attributeType.toUpperCase())) {
|
||
throw new Error(`Invalid attribute type: "${attributeType}"`);
|
||
}
|
||
}
|
||
|
||
// Skip whitespace after attribute type
|
||
i = skipWhitespace(xmlData, i);
|
||
|
||
// Read default value
|
||
let defaultValue = "";
|
||
if (xmlData.substring(i, i + 8).toUpperCase() === "#REQUIRED") {
|
||
defaultValue = "#REQUIRED";
|
||
i += 8;
|
||
} else if (xmlData.substring(i, i + 7).toUpperCase() === "#IMPLIED") {
|
||
defaultValue = "#IMPLIED";
|
||
i += 7;
|
||
} else {
|
||
[i, defaultValue] = this.readIdentifierVal(xmlData, i, "ATTLIST");
|
||
}
|
||
|
||
return {
|
||
elementName,
|
||
attributeName,
|
||
attributeType,
|
||
defaultValue,
|
||
index: i
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
|
||
const skipWhitespace = (data, index) => {
|
||
while (index < data.length && /\s/.test(data[index])) {
|
||
index++;
|
||
}
|
||
return index;
|
||
};
|
||
|
||
|
||
|
||
function hasSeq(data, seq, i) {
|
||
for (let j = 0; j < seq.length; j++) {
|
||
if (seq[j] !== data[i + j + 1]) return false;
|
||
}
|
||
return true;
|
||
}
|
||
|
||
function validateEntityName(name, xmlVersion) {
|
||
if ((0,src/* qName */.fG)(name, { xmlVersion: xmlVersion }))
|
||
return name;
|
||
else
|
||
throw new Error(`Invalid entity name ${name}`);
|
||
}
|
||
;// CONCATENATED MODULE: ./node_modules/anynum/digitTable.js
|
||
/**
|
||
* Flat lookup table: maps Unicode code point → ASCII digit (0-9).
|
||
* Only decimal digit characters (Unicode category Nd) are included.
|
||
*
|
||
* Strategy: Int32Array of size (maxCodePoint - minCodePoint + 1).
|
||
* Value 0xFF means "not a digit". Value 0-9 is the ASCII digit value.
|
||
* This gives O(1) lookup with no branching, no bisect, no loop.
|
||
*
|
||
* Memory: range is 0x0660 to 0x1FBF0 → ~129,936 entries × 1 byte = ~127 KB.
|
||
* Acceptable for a one-time init; lookup is a single array index.
|
||
*/
|
||
|
||
// All known Unicode Nd (decimal digit) script zero code points.
|
||
// Each script has exactly 10 consecutive digits: zero+0 .. zero+9.
|
||
const SCRIPT_ZEROS = [
|
||
// Basic Latin (ASCII) — included for completeness / pass-through
|
||
0x0030, // 0-9
|
||
|
||
// Arabic scripts
|
||
0x0660, // Arabic-Indic ٠١٢٣٤٥٦٧٨٩
|
||
0x06F0, // Extended Arabic-Indic (Urdu/Persian/Sindhi) ۰۱۲۳
|
||
|
||
// Indic scripts
|
||
0x0966, // Devanagari ०१२३४५६७८९
|
||
0x09E6, // Bengali ০১২৩৪৫৬৭৮৯
|
||
0x0A66, // Gurmukhi ੦੧੨੩੪੫੬੭੮੯
|
||
0x0AE6, // Gujarati ૦૧૨૩૪૫૬૭૮૯
|
||
0x0B66, // Odia ୦୧୨୩୪୫୬୭୮୯
|
||
0x0BE6, // Tamil ௦௧௨௩௪௫௬௭௮௯
|
||
0x0C66, // Telugu ౦౧౨౩౪౫౬౭౮౯
|
||
0x0CE6, // Kannada ೦೧೨೩೪೫೬೭೮೯
|
||
0x0D66, // Malayalam ൦൧൨൩൪൫൬൭൮൯
|
||
0x0DE6, // Sinhala Archaic ෦෧෨෩෪෫෬෭෮෯
|
||
|
||
// Southeast Asian scripts
|
||
0x0E50, // Thai ๐๑๒๓๔๕๖๗๘๙
|
||
0x0ED0, // Lao ໐໑໒໓໔໕໖໗໘໙
|
||
0x0F20, // Tibetan ༠༡༢༣༤༥༦༧༨༩
|
||
0x1040, // Myanmar ၀၁၂၃၄၅၆၇၈၉
|
||
0x1090, // Myanmar Shan ႐႑႒႓႔႕႖႗႘႙
|
||
0x17E0, // Khmer ០១២៣៤៥៦៧៨៩
|
||
0x1810, // Mongolian ᠐᠑᠒᠓᠔᠕᠖᠗᠘᠙
|
||
0x1946, // Limbu ᥆᥇᥈᥉᥊᥋᥌᥍᥎᥏
|
||
0x19D0, // New Tai Lue ᧐᧑᧒᧓᧔᧕᧖᧗᧘᧙
|
||
0x1A80, // Tai Tham Hora ᪀᪁᪂᪃᪄᪅᪆᪇᪈᪉
|
||
0x1A90, // Tai Tham Tham ᪐᪑᪒᪓᪔᪕᪖᪗᪘᪙
|
||
0x1B50, // Balinese ᭐᭑᭒᭓᭔᭕᭖᭗᭘᭙
|
||
0x1BB0, // Sundanese ᮰᮱᮲᮳᮴᮵᮶᮷᮸᮹
|
||
0x1C40, // Lepcha ᱀᱁᱂᱃᱄᱅᱆᱇᱈᱉
|
||
0x1C50, // Ol Chiki ᱐᱑᱒᱓᱔᱕᱖᱗᱘᱙
|
||
|
||
// Fullwidth (CJK context)
|
||
0xFF10, // Fullwidth ０１２３４５６７８９
|
||
|
||
// Mathematical digit variants (Unicode math block)
|
||
0x1D7CE, // Mathematical Bold
|
||
0x1D7D8, // Mathematical Double-Struck
|
||
0x1D7E2, // Mathematical Sans-Serif
|
||
0x1D7EC, // Mathematical Sans-Serif Bold
|
||
0x1D7F6, // Mathematical Monospace
|
||
|
||
// Other scripts
|
||
0x104A0, // Osmanya 𐒠𐒡𐒢𐒣𐒤𐒥𐒦𐒧𐒨𐒩
|
||
0x10D30, // Hanifi Rohingya 𐴰𐴱𐴲𐴳𐴴𐴵𐴶𐴷𐴸𐴹
|
||
0x11066, // Brahmi 𑁦𑁧𑁨𑁩𑁪𑁫𑁬𑁭𑁮𑁯
|
||
0x110F0, // Sora Sompeng 𑃰𑃱𑃲𑃳𑃴𑃵𑃶𑃷𑃸𑃹
|
||
0x11136, // Chakma 𑄶𑄷𑄸𑄹𑄺𑄻𑄼𑄽𑄾𑄿
|
||
0x111D0, // Sharada 𑇐𑇑𑇒𑇓𑇔𑇕𑇖𑇗𑇘𑇙
|
||
0x112F0, // Khudawadi 𑋰𑋱𑋲𑋳𑋴𑋵𑋶𑋷𑋸𑋹
|
||
0x11450, // Newa 𑑐𑑑𑑒𑑓𑑔𑑕𑑖𑑗𑑘𑑙
|
||
0x114D0, // Tirhuta 𑓐𑓑𑓒𑓓𑓔𑓕𑓖𑓗𑓘𑓙
|
||
0x11650, // Modi 𑙐𑙑𑙒𑙓𑙔𑙕𑙖𑙗𑙘𑙙
|
||
0x116C0, // Takri 𑛀𑛁𑛂𑛃𑛄𑛅𑛆𑛇𑛈𑛉
|
||
0x11730, // Ahom 𑜰𑜱𑜲𑜳𑜴𑜵𑜶𑜷𑜸𑜹
|
||
0x118E0, // Warang Citi 𑣠𑣡𑣢𑣣𑣤𑣥𑣦𑣧𑣨𑣩
|
||
0x11950, // Dives Akuru 𑥐𑥑𑥒𑥓𑥔𑥕𑥖𑥗𑥘𑥙
|
||
0x11BF0, // Khitan Small Script
|
||
0x11C50, // Bhaiksuki 𑱐𑱑𑱒𑱓𑱔𑱕𑱖𑱗𑱘𑱙
|
||
0x11D50, // Masaram Gondi 𑵐𑵑𑵒𑵓𑵔𑵕𑵖𑵗𑵘𑵙
|
||
0x11DA0, // Gunjala Gondi 𑶠𑶡𑶢𑶣𑶤𑶥𑶦𑶧𑶨𑶩
|
||
0x11F50, // Kawi 𑽐𑽑𑽒𑽓𑽔𑽕𑽖𑽗𑽘𑽙
|
||
0x16A60, // Mro 𖩠𖩡𖩢𖩣𖩤𖩥𖩦𖩧𖩨𖩩
|
||
0x16AC0, // Tangsa 𖫀𖫁𖫂𖫃𖫄𖫅𖫆𖫇𖫈𖫉
|
||
0x16B50, // Pahawh Hmong 𖭐𖭑𖭒𖭓𖭔𖭕𖭖𖭗𖭘𖭙
|
||
0x1E140, // Nyiakeng Puachue Hmong 𞅀𞅁𞅂𞅃𞅄𞅅𞅆𞅇𞅈𞅉
|
||
0x1E2F0, // Wancho 𞋰𞋱𞋲𞋳𞋴𞋵𞋶𞋷𞋸𞋹
|
||
0x1E4F0, // Nag Mundari 𞓰𞓱𞓲𞓳𞓴𞓵𞓶𞓷𞓸𞓹
|
||
0x1E950, // Adlam 𞥐𞥑𞥒𞥓𞥔𞥕𞥖𞥗𞥘𞥙
|
||
0x1FBF0, // Segmented digit symbols 🯰🯱🯲🯳🯴🯵🯶🯷🯸🯹
|
||
];
|
||
|
||
// Build a sparse Map for scripts above 0xFFFF (surrogate-pair range).
|
||
// These can't go into a flat Uint8Array indexed by code point efficiently.
|
||
const NOT_DIGIT = 0xFF;
|
||
const HIGH_MAP = new Map(); // codePoint → digit value (0-9)
|
||
|
||
const LOW_MAX = 0xFFFF;
|
||
const LOW_MIN = 0x0660; // first non-ASCII digit script
|
||
|
||
// Flat Uint8Array covering 0x0660 .. 0xFFFF
|
||
const TABLE_OFFSET = LOW_MIN;
|
||
const TABLE_SIZE = LOW_MAX - LOW_MIN + 1;
|
||
const TABLE = new Uint8Array(TABLE_SIZE).fill(NOT_DIGIT);
|
||
|
||
for (const zero of SCRIPT_ZEROS) {
|
||
for (let d = 0; d < 10; d++) {
|
||
const cp = zero + d;
|
||
if (cp <= LOW_MAX) {
|
||
TABLE[cp - TABLE_OFFSET] = d;
|
||
} else {
|
||
HIGH_MAP.set(cp, d);
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/anynum/anynum.js
|
||
|
||
|
||
|
||
|
||
const CHAR_0 = 48; // '0'.charCodeAt(0)
|
||
const CHAR_9 = 57; // '9'.charCodeAt(0)
|
||
const CHAR_MINUS = 45; // '-'.charCodeAt(0)
|
||
|
||
// Unicode minus/hyphen variants worth normalizing to ASCII '-' in numeric context:
|
||
// U+2212 MINUS SIGN − (mathematically correct minus)
|
||
// U+FF0D FULLWIDTH HYPHEN-MINUS － (Japanese fullwidth context)
|
||
// U+FE63 SMALL HYPHEN-MINUS ﹣ (small form variant)
|
||
//
|
||
// NOT normalized (deliberate):
|
||
// U+2013 EN DASH – (punctuation, not a numeric sign)
|
||
// U+2014 EM DASH — (punctuation)
|
||
// U+2010 HYPHEN ‐ (typographic hyphen)
|
||
//
|
||
// Rationale: only characters a human or locale formatter would plausibly use
|
||
// as a numeric minus sign are normalized. Dashes used for punctuation are left
|
||
// alone to avoid mangling non-numeric strings.
|
||
const MINUS_SET = new Set([0x2212, 0xFF0D, 0xFE63]);
|
||
|
||
/**
|
||
* Normalize all Unicode decimal digit characters in a string to ASCII (0-9),
|
||
* and normalize Unicode minus variants to ASCII '-' (U+002D).
|
||
*
|
||
* Non-digit, non-minus characters are passed through unchanged.
|
||
*
|
||
* Performance design:
|
||
* - Fast path: if the string has no convertible characters, return it unchanged
|
||
* (zero allocation).
|
||
* - BMP digits (0x0660..0xFFFF excl. surrogates): flat Uint8Array lookup (O(1)).
|
||
* - Supplementary plane digits (> 0xFFFF, encoded as surrogate pairs): Map lookup.
|
||
* - Minus variants: checked inline with a small fixed Set.
|
||
*
|
||
* @param {string} str
|
||
* @returns {string}
|
||
*/
|
||
function anynum(str) {
|
||
if (typeof str !== 'string') return str;
|
||
|
||
const len = str.length;
|
||
if (len === 0) return str;
|
||
|
||
// Scan for first character needing conversion.
|
||
// If none found, return original string (zero allocation).
|
||
let firstHit = -1;
|
||
|
||
for (let i = 0; i < len; i++) {
|
||
const cc = str.charCodeAt(i);
|
||
|
||
// ASCII digit or ASCII minus — already normalized, skip fast
|
||
if ((cc >= CHAR_0 && cc <= CHAR_9) || cc === CHAR_MINUS) continue;
|
||
|
||
// Below first unicode digit script — check minus variants only
|
||
if (cc < TABLE_OFFSET) {
|
||
if (MINUS_SET.has(cc)) { firstHit = i; break; }
|
||
continue;
|
||
}
|
||
|
||
// Surrogate pairs live in BMP range 0xD800-0xDFFF — check before TABLE
|
||
if (cc >= 0xD800 && cc <= 0xDBFF) {
|
||
if (i + 1 < len) {
|
||
const low = str.charCodeAt(i + 1);
|
||
if (low >= 0xDC00 && low <= 0xDFFF) {
|
||
const cp = 0x10000 + ((cc - 0xD800) << 10) + (low - 0xDC00);
|
||
if (HIGH_MAP.has(cp)) { firstHit = i; break; }
|
||
}
|
||
}
|
||
continue;
|
||
}
|
||
|
||
// BMP non-surrogate: flat table lookup; also check minus variants in this range
|
||
if (TABLE[cc - TABLE_OFFSET] !== NOT_DIGIT || MINUS_SET.has(cc)) {
|
||
firstHit = i;
|
||
break;
|
||
}
|
||
}
|
||
|
||
// Nothing to replace — return original, zero allocation
|
||
if (firstHit === -1) return str;
|
||
|
||
// Build result: copy unchanged prefix, then convert from firstHit onward
|
||
const chars = [];
|
||
|
||
if (firstHit > 0) chars.push(str.slice(0, firstHit));
|
||
|
||
for (let i = firstHit; i < len; i++) {
|
||
const cc = str.charCodeAt(i);
|
||
|
||
// ASCII digit or ASCII minus — pass through
|
||
if ((cc >= CHAR_0 && cc <= CHAR_9) || cc === CHAR_MINUS) {
|
||
chars.push(str[i]);
|
||
continue;
|
||
}
|
||
|
||
// Below TABLE_OFFSET — check minus variants, else pass through
|
||
if (cc < TABLE_OFFSET) {
|
||
chars.push(MINUS_SET.has(cc) ? '-' : str[i]);
|
||
continue;
|
||
}
|
||
|
||
// Surrogate pairs
|
||
if (cc >= 0xD800 && cc <= 0xDBFF) {
|
||
if (i + 1 < len) {
|
||
const low = str.charCodeAt(i + 1);
|
||
if (low >= 0xDC00 && low <= 0xDFFF) {
|
||
const cp = 0x10000 + ((cc - 0xD800) << 10) + (low - 0xDC00);
|
||
const d = HIGH_MAP.get(cp);
|
||
if (d !== undefined) {
|
||
chars.push(String.fromCharCode(d + 48));
|
||
i++; // consume low surrogate
|
||
continue;
|
||
}
|
||
}
|
||
}
|
||
chars.push(str[i]);
|
||
continue;
|
||
}
|
||
|
||
// BMP non-surrogate: flat table lookup + minus variants
|
||
if (MINUS_SET.has(cc)) {
|
||
chars.push('-');
|
||
continue;
|
||
}
|
||
const d = TABLE[cc - TABLE_OFFSET];
|
||
chars.push(d !== NOT_DIGIT ? String.fromCharCode(d + 48) : str[i]);
|
||
}
|
||
|
||
return chars.join('');
|
||
}
|
||
|
||
|
||
/* harmony default export */ const anynum_anynum = (anynum);
|
||
;// CONCATENATED MODULE: ./node_modules/strnum/strnum.js
|
||
const hexRegex = /^[-+]?0x[a-fA-F0-9]+$/;
|
||
const binRegex = /^0b[01]+$/;
|
||
const octRegex = /^0o[0-7]+$/;
|
||
const numRegex = /^([\-\+])?(0*)([0-9]*(\.[0-9]*)?)$/;
|
||
|
||
|
||
|
||
const consider = {
|
||
hex: true,
|
||
binary: false,
|
||
octal: false,
|
||
leadingZeros: true,
|
||
decimalPoint: "\.",
|
||
eNotation: true,
|
||
//skipLike: /regex/,
|
||
infinity: "original", // "null", "infinity" (Infinity type), "string" ("Infinity" (the string literal))
|
||
unicode: false,
|
||
};
|
||
|
||
function toNumber(str, options = {}) {
|
||
options = Object.assign({}, consider, options);
|
||
if (!str || typeof str !== "string") return str;
|
||
|
||
let trimmedStr = str.trim();
|
||
|
||
if (trimmedStr.length === 0) return str;
|
||
else if (options.skipLike !== undefined && options.skipLike.test(trimmedStr)) return str;
|
||
else if (trimmedStr === "0") return 0;
|
||
|
||
if (options.unicode) {
|
||
trimmedStr = anynum_anynum(trimmedStr);
|
||
if (trimmedStr === "0") return 0; // re-check after normalization
|
||
}
|
||
if (options.hex && hexRegex.test(trimmedStr)) {
|
||
return parse_int(trimmedStr, 16);
|
||
} else if (options.binary && binRegex.test(trimmedStr)) {
|
||
return parse_int(trimmedStr, 2);
|
||
} else if (options.octal && octRegex.test(trimmedStr)) {
|
||
return parse_int(trimmedStr, 8);
|
||
} else if (!isFinite(trimmedStr)) { //Infinity
|
||
return handleInfinity(str, Number(trimmedStr), options);
|
||
} else if (trimmedStr.includes('e') || trimmedStr.includes('E')) { //eNotation
|
||
return resolveEnotation(str, trimmedStr, options);
|
||
} else {
|
||
//separate negative sign, leading zeros, and rest number
|
||
const match = numRegex.exec(trimmedStr);
|
||
// +00.123 => [ , '+', '00', '.123', ..
|
||
if (match) {
|
||
const sign = match[1] || "";
|
||
const leadingZeros = match[2];
|
||
let numTrimmedByZeros = trimZeros(match[3]); //complete num without leading zeros
|
||
const decimalAdjacentToLeadingZeros = sign ? // 0., -00., 000.
|
||
str[leadingZeros.length + 1] === "."
|
||
: str[leadingZeros.length] === ".";
|
||
|
||
//trim ending zeros for floating number
|
||
if (!options.leadingZeros //leading zeros are not allowed
|
||
&& (leadingZeros.length > 1
|
||
|| (leadingZeros.length === 1 && !decimalAdjacentToLeadingZeros))) {
|
||
// 00, 00.3, +03.24, 03, 03.24
|
||
return str;
|
||
}
|
||
else {//no leading zeros or leading zeros are allowed
|
||
const num = Number(trimmedStr);
|
||
const parsedStr = String(num);
|
||
|
||
if (num === 0) return num;
|
||
if (parsedStr.search(/[eE]/) !== -1) { //given number is long and parsed to eNotation
|
||
if (options.eNotation) return num;
|
||
else return str;
|
||
} else if (trimmedStr.indexOf(".") !== -1) { //floating number
|
||
if (parsedStr === "0") return num; //0.0
|
||
else if (parsedStr === numTrimmedByZeros) return num; //0.456. 0.79000
|
||
else if (parsedStr === `${sign}${numTrimmedByZeros}`) return num;
|
||
else return str;
|
||
}
|
||
|
||
let n = leadingZeros ? numTrimmedByZeros : trimmedStr;
|
||
if (leadingZeros) {
|
||
// -009 => -9
|
||
return (n === parsedStr) || (sign + n === parsedStr) ? num : str
|
||
} else {
|
||
// +9
|
||
return (n === parsedStr) || (n === sign + parsedStr) ? num : str
|
||
}
|
||
}
|
||
} else { //non-numeric string
|
||
return str;
|
||
}
|
||
}
|
||
}
|
||
|
||
const eNotationRegx = /^([-+])?(0*)(\d*(\.\d*)?[eE][-\+]?\d+)$/;
|
||
function resolveEnotation(str, trimmedStr, options) {
|
||
if (!options.eNotation) return str;
|
||
const notation = trimmedStr.match(eNotationRegx);
|
||
if (notation) {
|
||
let sign = notation[1] || "";
|
||
const eChar = notation[3].indexOf("e") === -1 ? "E" : "e";
|
||
const leadingZeros = notation[2];
|
||
const eAdjacentToLeadingZeros = sign ? // 0E.
|
||
str[leadingZeros.length + 1] === eChar
|
||
: str[leadingZeros.length] === eChar;
|
||
|
||
if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str;
|
||
else if (leadingZeros.length === 1
|
||
&& (notation[3].startsWith(`.${eChar}`) || notation[3][0] === eChar)) {
|
||
return Number(trimmedStr);
|
||
} else if (leadingZeros.length > 0) {
|
||
// Has leading zeros — only accept if leadingZeros option allows it
|
||
if (options.leadingZeros && !eAdjacentToLeadingZeros) {
|
||
trimmedStr = (notation[1] || "") + notation[3];
|
||
return Number(trimmedStr);
|
||
} else return str;
|
||
} else {
|
||
// No leading zeros — always valid e-notation, parse it
|
||
return Number(trimmedStr);
|
||
}
|
||
} else {
|
||
return str;
|
||
}
|
||
}
|
||
|
||
/**
|
||
*
|
||
* @param {string} numStr without leading zeros
|
||
* @returns
|
||
*/
|
||
function trimZeros(numStr) {
|
||
if (numStr && numStr.indexOf(".") !== -1) {//float
|
||
//remove ending zeros without the O(n^2) backtracking that /0+$/ hits
|
||
//when the string doesn't end in 0 but has a long internal zero-run
|
||
let end = numStr.length;
|
||
while (end > 0 && numStr.charCodeAt(end - 1) === 48 /* '0' */) end--;
|
||
numStr = numStr.slice(0, end);
|
||
if (numStr === ".") numStr = "0";
|
||
else if (numStr[0] === ".") numStr = "0" + numStr;
|
||
else if (numStr[numStr.length - 1] === ".") numStr = numStr.substring(0, numStr.length - 1);
|
||
return numStr;
|
||
}
|
||
return numStr;
|
||
}
|
||
|
||
function parse_int(numStr, base) {
|
||
const str = numStr.trim();
|
||
if (base === 2 || base === 8) numStr = str.substring(2);
|
||
|
||
if (parseInt) return parseInt(numStr, base);
|
||
else if (Number.parseInt) return Number.parseInt(numStr, base);
|
||
else if (window && window.parseInt) return window.parseInt(numStr, base);
|
||
else throw new Error("parseInt, Number.parseInt, window.parseInt are not supported");
|
||
}
|
||
|
||
/**
|
||
* Handle infinite values based on user option
|
||
* @param {string} str - original input string
|
||
* @param {number} num - parsed number (Infinity or -Infinity)
|
||
* @param {object} options - user options
|
||
* @returns {string|number|null} based on infinity option
|
||
*/
|
||
function handleInfinity(str, num, options) {
|
||
const isPositive = num === Infinity;
|
||
|
||
switch (options.infinity.toLowerCase()) {
|
||
case "null":
|
||
return null;
|
||
case "infinity":
|
||
return num; // Return Infinity or -Infinity
|
||
case "string":
|
||
return isPositive ? "Infinity" : "-Infinity";
|
||
case "original":
|
||
default:
|
||
return str; // Return original string like "1e1000"
|
||
}
|
||
}
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/ignoreAttributes.js
|
||
function getIgnoreAttributesFn(ignoreAttributes) {
|
||
if (typeof ignoreAttributes === 'function') {
|
||
return ignoreAttributes
|
||
}
|
||
if (Array.isArray(ignoreAttributes)) {
|
||
return (attrName) => {
|
||
for (const pattern of ignoreAttributes) {
|
||
if (typeof pattern === 'string' && attrName === pattern) {
|
||
return true
|
||
}
|
||
if (pattern instanceof RegExp && pattern.test(attrName)) {
|
||
return true
|
||
}
|
||
}
|
||
}
|
||
}
|
||
return () => false
|
||
}
|
||
// EXTERNAL MODULE: ./node_modules/path-expression-matcher/src/Matcher.js
|
||
var Matcher = __webpack_require__(8257);
|
||
// EXTERNAL MODULE: ./node_modules/path-expression-matcher/src/Expression.js
|
||
var Expression = __webpack_require__(3945);
|
||
;// CONCATENATED MODULE: ./node_modules/path-expression-matcher/src/ExpressionSet.js
|
||
/**
|
||
* ExpressionSet - An indexed collection of Expressions for efficient bulk matching
|
||
*
|
||
* Instead of iterating all expressions on every tag, ExpressionSet pre-indexes
|
||
* them at insertion time by depth and terminal tag name. At match time, only
|
||
* the relevant bucket is evaluated — typically reducing checks from O(E) to O(1)
|
||
* lookup plus O(small bucket) matches.
|
||
*
|
||
* Three buckets are maintained:
|
||
* - `_byDepthAndTag` — exact depth + exact tag name (tightest, used first)
|
||
* - `_wildcardByDepth` — exact depth + wildcard tag `*` (depth-matched only)
|
||
* - `_deepWildcards` — expressions containing `..` (cannot be depth-indexed)
|
||
*
|
||
* @example
|
||
* import { Expression, ExpressionSet } from 'fast-xml-tagger';
|
||
*
|
||
* // Build once at config time
|
||
* const stopNodes = new ExpressionSet();
|
||
* stopNodes.add(new Expression('root.users.user'));
|
||
* stopNodes.add(new Expression('root.config.setting'));
|
||
* stopNodes.add(new Expression('..script'));
|
||
*
|
||
* // Query on every tag — hot path
|
||
* if (stopNodes.matchesAny(matcher)) { ... }
|
||
*/
|
||
class ExpressionSet {
|
||
constructor() {
|
||
/** @type {Map<string, import('./Expression.js').default[]>} depth:tag → expressions */
|
||
this._byDepthAndTag = new Map();
|
||
|
||
/** @type {Map<number, import('./Expression.js').default[]>} depth → wildcard-tag expressions */
|
||
this._wildcardByDepth = new Map();
|
||
|
||
/** @type {import('./Expression.js').default[]} expressions containing deep wildcard (..) */
|
||
this._deepWildcards = [];
|
||
|
||
/** @type {Map<string, import('./Expression.js').default[]>} terminalTag → deep wildcard expressions */
|
||
this._deepByTerminalTag = new Map();
|
||
|
||
/** @type {Set<string>} pattern strings already added — used for deduplication */
|
||
this._patterns = new Set();
|
||
|
||
/** @type {boolean} whether the set is sealed against further additions */
|
||
this._sealed = false;
|
||
}
|
||
|
||
/**
|
||
* Add an Expression to the set.
|
||
* Duplicate patterns (same pattern string) are silently ignored.
|
||
*
|
||
* @param {import('./Expression.js').default} expression - A pre-constructed Expression instance
|
||
* @returns {this} for chaining
|
||
* @throws {TypeError} if called after seal()
|
||
*
|
||
* @example
|
||
* set.add(new Expression('root.users.user'));
|
||
* set.add(new Expression('..script'));
|
||
*/
|
||
add(expression) {
|
||
if (this._sealed) {
|
||
throw new TypeError(
|
||
'ExpressionSet is sealed. Create a new ExpressionSet to add more expressions.'
|
||
);
|
||
}
|
||
|
||
// Deduplicate by pattern string
|
||
if (this._patterns.has(expression.pattern)) return this;
|
||
this._patterns.add(expression.pattern);
|
||
|
||
if (expression.hasDeepWildcard()) {
|
||
const lastSeg = expression.segments[expression.segments.length - 1];
|
||
if (lastSeg && lastSeg.type !== 'deep-wildcard' && lastSeg.tag !== '*') {
|
||
const tag = lastSeg.tag;
|
||
if (!this._deepByTerminalTag.has(tag)) this._deepByTerminalTag.set(tag, []);
|
||
this._deepByTerminalTag.get(tag).push(expression);
|
||
} else {
|
||
this._deepWildcards.push(expression);
|
||
}
|
||
return this;
|
||
}
|
||
|
||
const depth = expression.length;
|
||
const lastSeg = expression.segments[expression.segments.length - 1];
|
||
const tag = lastSeg?.tag;
|
||
|
||
if (!tag || tag === '*') {
|
||
// Can index by depth but not by tag
|
||
if (!this._wildcardByDepth.has(depth)) this._wildcardByDepth.set(depth, []);
|
||
this._wildcardByDepth.get(depth).push(expression);
|
||
} else {
|
||
// Tightest bucket: depth + tag
|
||
const key = `${depth}:${tag}`;
|
||
if (!this._byDepthAndTag.has(key)) this._byDepthAndTag.set(key, []);
|
||
this._byDepthAndTag.get(key).push(expression);
|
||
}
|
||
|
||
return this;
|
||
}
|
||
|
||
/**
|
||
* Add multiple expressions at once.
|
||
*
|
||
* @param {import('./Expression.js').default[]} expressions - Array of Expression instances
|
||
* @returns {this} for chaining
|
||
*
|
||
* @example
|
||
* set.addAll([
|
||
* new Expression('root.users.user'),
|
||
* new Expression('root.config.setting'),
|
||
* ]);
|
||
*/
|
||
addAll(expressions) {
|
||
for (const expr of expressions) this.add(expr);
|
||
return this;
|
||
}
|
||
|
||
/**
|
||
* Check whether a pattern string is already present in the set.
|
||
*
|
||
* @param {import('./Expression.js').default} expression
|
||
* @returns {boolean}
|
||
*/
|
||
has(expression) {
|
||
return this._patterns.has(expression.pattern);
|
||
}
|
||
|
||
/**
|
||
* Number of expressions in the set.
|
||
* @type {number}
|
||
*/
|
||
get size() {
|
||
return this._patterns.size;
|
||
}
|
||
|
||
/**
|
||
* Seal the set against further modifications.
|
||
* Useful to prevent accidental mutations after config is built.
|
||
* Calling add() or addAll() on a sealed set throws a TypeError.
|
||
*
|
||
* @returns {this}
|
||
*/
|
||
seal() {
|
||
this._sealed = true;
|
||
return this;
|
||
}
|
||
|
||
/**
|
||
* Whether the set has been sealed.
|
||
* @type {boolean}
|
||
*/
|
||
get isSealed() {
|
||
return this._sealed;
|
||
}
|
||
|
||
/**
|
||
* Test whether the matcher's current path matches any expression in the set.
|
||
*
|
||
* Evaluation order (cheapest → most expensive):
|
||
* 1. Exact depth + tag bucket — O(1) lookup, typically 0–2 expressions
|
||
* 2. Depth-only wildcard bucket — O(1) lookup, rare
|
||
* 3. Deep-wildcard list — always checked, but usually small
|
||
*
|
||
* @param {import('./Matcher.js').default} matcher - Matcher instance (or readOnly view)
|
||
* @returns {boolean} true if any expression matches the current path
|
||
*
|
||
* @example
|
||
* if (stopNodes.matchesAny(matcher)) {
|
||
* // handle stop node
|
||
* }
|
||
*/
|
||
matchesAny(matcher) {
|
||
return this.findMatch(matcher) !== null;
|
||
}
|
||
/**
|
||
* Find and return the first Expression that matches the matcher's current path.
|
||
*
|
||
* Uses the same evaluation order as matchesAny (cheapest → most expensive):
|
||
* 1. Exact depth + tag bucket
|
||
* 2. Depth-only wildcard bucket
|
||
* 3. Deep-wildcard list
|
||
*
|
||
* @param {import('./Matcher.js').default} matcher - Matcher instance (or readOnly view)
|
||
* @returns {import('./Expression.js').default | null} the first matching Expression, or null
|
||
*
|
||
* @example
|
||
* const expr = stopNodes.findMatch(matcher);
|
||
* if (expr) {
|
||
* // access expr.config, expr.pattern, etc.
|
||
* }
|
||
*/
|
||
findMatch(matcher) {
|
||
const depth = matcher.getDepth();
|
||
const tag = matcher.getCurrentTag();
|
||
|
||
// 1. Tightest bucket — most expressions live here
|
||
const exactKey = `${depth}:${tag}`;
|
||
const exactBucket = this._byDepthAndTag.get(exactKey);
|
||
if (exactBucket) {
|
||
for (let i = 0; i < exactBucket.length; i++) {
|
||
if (matcher.matches(exactBucket[i])) return exactBucket[i];
|
||
}
|
||
}
|
||
|
||
// 2. Depth-matched wildcard-tag expressions
|
||
const wildcardBucket = this._wildcardByDepth.get(depth);
|
||
if (wildcardBucket) {
|
||
for (let i = 0; i < wildcardBucket.length; i++) {
|
||
if (matcher.matches(wildcardBucket[i])) return wildcardBucket[i];
|
||
}
|
||
}
|
||
|
||
// 3. Deep wildcards — indexed by terminal tag, then unindexed fallback
|
||
const deepBucket = this._deepByTerminalTag.get(tag);
|
||
if (deepBucket) {
|
||
for (let i = 0; i < deepBucket.length; i++) {
|
||
if (matcher.matches(deepBucket[i])) return deepBucket[i];
|
||
}
|
||
}
|
||
for (let i = 0; i < this._deepWildcards.length; i++) {
|
||
if (matcher.matches(this._deepWildcards[i])) return this._deepWildcards[i];
|
||
}
|
||
|
||
return null;
|
||
}
|
||
}
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/@nodable/entities/src/entities.js
|
||
// ---------------------------------------------------------------------------
|
||
// Complete HTML5 named entity reference
|
||
// Organized by logical categories for easy maintenance and selective importing
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Basic Latin & Special Characters
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const BASIC_LATIN = {
|
||
amp: '&',
|
||
AMP: '&',
|
||
lt: '<',
|
||
LT: '<',
|
||
gt: '>',
|
||
GT: '>',
|
||
quot: '"',
|
||
QUOT: '"',
|
||
apos: "'",
|
||
lsquo: '‘',
|
||
rsquo: '’',
|
||
ldquo: '“',
|
||
rdquo: '”',
|
||
lsquor: '‚',
|
||
rsquor: '’',
|
||
ldquor: '„',
|
||
bdquo: '„',
|
||
comma: ',',
|
||
period: '.',
|
||
colon: ':',
|
||
semi: ';',
|
||
excl: '!',
|
||
quest: '?',
|
||
num: '#',
|
||
dollar: '$',
|
||
percent: '%',
|
||
ast: '*',
|
||
commat: '@',
|
||
lowbar: '_',
|
||
verbar: '|',
|
||
vert: '|',
|
||
sol: '/',
|
||
bsol: '\\',
|
||
lbrace: '{',
|
||
rbrace: '}',
|
||
lbrack: '[',
|
||
rbrack: ']',
|
||
lpar: '(',
|
||
rpar: ')',
|
||
nbsp: '\u00a0',
|
||
iexcl: '¡',
|
||
cent: '¢',
|
||
pound: '£',
|
||
curren: '¤',
|
||
yen: '¥',
|
||
brvbar: '¦',
|
||
sect: '§',
|
||
uml: '¨',
|
||
copy: '©',
|
||
COPY: '©',
|
||
ordf: 'ª',
|
||
laquo: '«',
|
||
not: '¬',
|
||
shy: '\u00ad',
|
||
reg: '®',
|
||
REG: '®',
|
||
macr: '¯',
|
||
deg: '°',
|
||
plusmn: '±',
|
||
sup2: '²',
|
||
sup3: '³',
|
||
acute: '´',
|
||
micro: 'µ',
|
||
para: '¶',
|
||
middot: '·',
|
||
cedil: '¸',
|
||
sup1: '¹',
|
||
ordm: 'º',
|
||
raquo: '»',
|
||
frac14: '¼',
|
||
frac12: '½',
|
||
half: '½',
|
||
frac34: '¾',
|
||
iquest: '¿',
|
||
times: '×',
|
||
div: '÷',
|
||
divide: '÷',
|
||
};
|
||
|
||
/**
|
||
* Latin Extended & Accented Letters (A-Z)
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const LATIN_ACCENTS = {
|
||
Agrave: 'À',
|
||
agrave: 'à',
|
||
Aacute: 'Á',
|
||
aacute: 'á',
|
||
Acirc: 'Â',
|
||
acirc: 'â',
|
||
Atilde: 'Ã',
|
||
atilde: 'ã',
|
||
Auml: 'Ä',
|
||
auml: 'ä',
|
||
Aring: 'Å',
|
||
aring: 'å',
|
||
AElig: 'Æ',
|
||
aelig: 'æ',
|
||
Ccedil: 'Ç',
|
||
ccedil: 'ç',
|
||
Egrave: 'È',
|
||
egrave: 'è',
|
||
Eacute: 'É',
|
||
eacute: 'é',
|
||
Ecirc: 'Ê',
|
||
ecirc: 'ê',
|
||
Euml: 'Ë',
|
||
euml: 'ë',
|
||
Igrave: 'Ì',
|
||
igrave: 'ì',
|
||
Iacute: 'Í',
|
||
iacute: 'í',
|
||
Icirc: 'Î',
|
||
icirc: 'î',
|
||
Iuml: 'Ï',
|
||
iuml: 'ï',
|
||
ETH: 'Ð',
|
||
eth: 'ð',
|
||
Ntilde: 'Ñ',
|
||
ntilde: 'ñ',
|
||
Ograve: 'Ò',
|
||
ograve: 'ò',
|
||
Oacute: 'Ó',
|
||
oacute: 'ó',
|
||
Ocirc: 'Ô',
|
||
ocirc: 'ô',
|
||
Otilde: 'Õ',
|
||
otilde: 'õ',
|
||
Ouml: 'Ö',
|
||
ouml: 'ö',
|
||
Oslash: 'Ø',
|
||
oslash: 'ø',
|
||
Ugrave: 'Ù',
|
||
ugrave: 'ù',
|
||
Uacute: 'Ú',
|
||
uacute: 'ú',
|
||
Ucirc: 'Û',
|
||
ucirc: 'û',
|
||
Uuml: 'Ü',
|
||
uuml: 'ü',
|
||
Yacute: 'Ý',
|
||
yacute: 'ý',
|
||
THORN: 'Þ',
|
||
thorn: 'þ',
|
||
szlig: 'ß',
|
||
yuml: 'ÿ',
|
||
Yuml: 'Ÿ',
|
||
};
|
||
|
||
/**
|
||
* Latin Extended (Letters with diacritics)
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const LATIN_EXTENDED = {
|
||
Amacr: 'Ā',
|
||
amacr: 'ā',
|
||
Abreve: 'Ă',
|
||
abreve: 'ă',
|
||
Aogon: 'Ą',
|
||
aogon: 'ą',
|
||
Cacute: 'Ć',
|
||
cacute: 'ć',
|
||
Ccirc: 'Ĉ',
|
||
ccirc: 'ĉ',
|
||
Cdot: 'Ċ',
|
||
cdot: 'ċ',
|
||
Ccaron: 'Č',
|
||
ccaron: 'č',
|
||
Dcaron: 'Ď',
|
||
dcaron: 'ď',
|
||
Dstrok: 'Đ',
|
||
dstrok: 'đ',
|
||
Emacr: 'Ē',
|
||
emacr: 'ē',
|
||
Ecaron: 'Ě',
|
||
ecaron: 'ě',
|
||
Edot: 'Ė',
|
||
edot: 'ė',
|
||
Eogon: 'Ę',
|
||
eogon: 'ę',
|
||
Gcirc: 'Ĝ',
|
||
gcirc: 'ĝ',
|
||
Gbreve: 'Ğ',
|
||
gbreve: 'ğ',
|
||
Gdot: 'Ġ',
|
||
gdot: 'ġ',
|
||
Gcedil: 'Ģ',
|
||
Hcirc: 'Ĥ',
|
||
hcirc: 'ĥ',
|
||
Hstrok: 'Ħ',
|
||
hstrok: 'ħ',
|
||
Itilde: 'Ĩ',
|
||
itilde: 'ĩ',
|
||
Imacr: 'Ī',
|
||
imacr: 'ī',
|
||
Iogon: 'Į',
|
||
iogon: 'į',
|
||
Idot: 'İ',
|
||
IJlig: 'IJ',
|
||
ijlig: 'ij',
|
||
Jcirc: 'Ĵ',
|
||
jcirc: 'ĵ',
|
||
Kcedil: 'Ķ',
|
||
kcedil: 'ķ',
|
||
kgreen: 'ĸ',
|
||
Lacute: 'Ĺ',
|
||
lacute: 'ĺ',
|
||
Lcedil: 'Ļ',
|
||
lcedil: 'ļ',
|
||
Lcaron: 'Ľ',
|
||
lcaron: 'ľ',
|
||
Lmidot: 'Ŀ',
|
||
lmidot: 'ŀ',
|
||
Lstrok: 'Ł',
|
||
lstrok: 'ł',
|
||
Nacute: 'Ń',
|
||
nacute: 'ń',
|
||
Ncaron: 'Ň',
|
||
ncaron: 'ň',
|
||
Ncedil: 'Ņ',
|
||
ncedil: 'ņ',
|
||
ENG: 'Ŋ',
|
||
eng: 'ŋ',
|
||
Omacr: 'Ō',
|
||
omacr: 'ō',
|
||
Odblac: 'Ő',
|
||
odblac: 'ő',
|
||
OElig: 'Œ',
|
||
oelig: 'œ',
|
||
Racute: 'Ŕ',
|
||
racute: 'ŕ',
|
||
Rcaron: 'Ř',
|
||
rcaron: 'ř',
|
||
Rcedil: 'Ŗ',
|
||
rcedil: 'ŗ',
|
||
Sacute: 'Ś',
|
||
sacute: 'ś',
|
||
Scirc: 'Ŝ',
|
||
scirc: 'ŝ',
|
||
Scedil: 'Ş',
|
||
scedil: 'ş',
|
||
Scaron: 'Š',
|
||
scaron: 'š',
|
||
Tcedil: 'Ţ',
|
||
tcedil: 'ţ',
|
||
Tcaron: 'Ť',
|
||
tcaron: 'ť',
|
||
Tstrok: 'Ŧ',
|
||
tstrok: 'ŧ',
|
||
Utilde: 'Ũ',
|
||
utilde: 'ũ',
|
||
Umacr: 'Ū',
|
||
umacr: 'ū',
|
||
Ubreve: 'Ŭ',
|
||
ubreve: 'ŭ',
|
||
Uring: 'Ů',
|
||
uring: 'ů',
|
||
Udblac: 'Ű',
|
||
udblac: 'ű',
|
||
Uogon: 'Ų',
|
||
uogon: 'ų',
|
||
Wcirc: 'Ŵ',
|
||
wcirc: 'ŵ',
|
||
Ycirc: 'Ŷ',
|
||
ycirc: 'ŷ',
|
||
Zacute: 'Ź',
|
||
zacute: 'ź',
|
||
Zdot: 'Ż',
|
||
zdot: 'ż',
|
||
Zcaron: 'Ž',
|
||
zcaron: 'ž',
|
||
};
|
||
|
||
/**
|
||
* Greek Letters
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const GREEK = {
|
||
Alpha: 'Α',
|
||
alpha: 'α',
|
||
Beta: 'Β',
|
||
beta: 'β',
|
||
Gamma: 'Γ',
|
||
gamma: 'γ',
|
||
Delta: 'Δ',
|
||
delta: 'δ',
|
||
Epsilon: 'Ε',
|
||
epsilon: 'ε',
|
||
epsiv: 'ϵ',
|
||
varepsilon: 'ϵ',
|
||
Zeta: 'Ζ',
|
||
zeta: 'ζ',
|
||
Eta: 'Η',
|
||
eta: 'η',
|
||
Theta: 'Θ',
|
||
theta: 'θ',
|
||
thetasym: 'ϑ',
|
||
vartheta: 'ϑ',
|
||
Iota: 'Ι',
|
||
iota: 'ι',
|
||
Kappa: 'Κ',
|
||
kappa: 'κ',
|
||
kappav: 'ϰ',
|
||
varkappa: 'ϰ',
|
||
Lambda: 'Λ',
|
||
lambda: 'λ',
|
||
Mu: 'Μ',
|
||
mu: 'μ',
|
||
Nu: 'Ν',
|
||
nu: 'ν',
|
||
Xi: 'Ξ',
|
||
xi: 'ξ',
|
||
Omicron: 'Ο',
|
||
omicron: 'ο',
|
||
Pi: 'Π',
|
||
pi: 'π',
|
||
piv: 'ϖ',
|
||
varpi: 'ϖ',
|
||
Rho: 'Ρ',
|
||
rho: 'ρ',
|
||
rhov: 'ϱ',
|
||
varrho: 'ϱ',
|
||
Sigma: 'Σ',
|
||
sigma: 'σ',
|
||
sigmaf: 'ς',
|
||
sigmav: 'ς',
|
||
varsigma: 'ς',
|
||
Tau: 'Τ',
|
||
tau: 'τ',
|
||
Upsilon: 'Υ',
|
||
upsilon: 'υ',
|
||
upsi: 'υ',
|
||
Upsi: 'ϒ',
|
||
upsih: 'ϒ',
|
||
Phi: 'Φ',
|
||
phi: 'φ',
|
||
phiv: 'ϕ',
|
||
varphi: 'ϕ',
|
||
Chi: 'Χ',
|
||
chi: 'χ',
|
||
Psi: 'Ψ',
|
||
psi: 'ψ',
|
||
Omega: 'Ω',
|
||
omega: 'ω',
|
||
ohm: 'Ω',
|
||
Gammad: 'Ϝ',
|
||
gammad: 'ϝ',
|
||
digamma: 'ϝ',
|
||
};
|
||
|
||
/**
|
||
* Cyrillic Letters
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const CYRILLIC = {
|
||
Afr: '𝔄',
|
||
afr: '𝔞',
|
||
Acy: 'А',
|
||
acy: 'а',
|
||
Bcy: 'Б',
|
||
bcy: 'б',
|
||
Vcy: 'В',
|
||
vcy: 'в',
|
||
Gcy: 'Г',
|
||
gcy: 'г',
|
||
Dcy: 'Д',
|
||
dcy: 'д',
|
||
IEcy: 'Е',
|
||
iecy: 'е',
|
||
IOcy: 'Ё',
|
||
iocy: 'ё',
|
||
ZHcy: 'Ж',
|
||
zhcy: 'ж',
|
||
Zcy: 'З',
|
||
zcy: 'з',
|
||
Icy: 'И',
|
||
icy: 'и',
|
||
Jcy: 'Й',
|
||
jcy: 'й',
|
||
Kcy: 'К',
|
||
kcy: 'к',
|
||
Lcy: 'Л',
|
||
lcy: 'л',
|
||
Mcy: 'М',
|
||
mcy: 'м',
|
||
Ncy: 'Н',
|
||
ncy: 'н',
|
||
Ocy: 'О',
|
||
ocy: 'о',
|
||
Pcy: 'П',
|
||
pcy: 'п',
|
||
Rcy: 'Р',
|
||
rcy: 'р',
|
||
Scy: 'С',
|
||
scy: 'с',
|
||
Tcy: 'Т',
|
||
tcy: 'т',
|
||
Ucy: 'У',
|
||
ucy: 'у',
|
||
Fcy: 'Ф',
|
||
fcy: 'ф',
|
||
KHcy: 'Х',
|
||
khcy: 'х',
|
||
TScy: 'Ц',
|
||
tscy: 'ц',
|
||
CHcy: 'Ч',
|
||
chcy: 'ч',
|
||
SHcy: 'Ш',
|
||
shcy: 'ш',
|
||
SHCHcy: 'Щ',
|
||
shchcy: 'щ',
|
||
HARDcy: 'Ъ',
|
||
hardcy: 'ъ',
|
||
Ycy: 'Ы',
|
||
ycy: 'ы',
|
||
SOFTcy: 'Ь',
|
||
softcy: 'ь',
|
||
Ecy: 'Э',
|
||
ecy: 'э',
|
||
YUcy: 'Ю',
|
||
yucy: 'ю',
|
||
YAcy: 'Я',
|
||
yacy: 'я',
|
||
DJcy: 'Ђ',
|
||
djcy: 'ђ',
|
||
GJcy: 'Ѓ',
|
||
gjcy: 'ѓ',
|
||
Jukcy: 'Є',
|
||
jukcy: 'є',
|
||
DScy: 'Ѕ',
|
||
dscy: 'ѕ',
|
||
Iukcy: 'І',
|
||
iukcy: 'і',
|
||
YIcy: 'Ї',
|
||
yicy: 'ї',
|
||
Jsercy: 'Ј',
|
||
jsercy: 'ј',
|
||
LJcy: 'Љ',
|
||
ljcy: 'љ',
|
||
NJcy: 'Њ',
|
||
njcy: 'њ',
|
||
TSHcy: 'Ћ',
|
||
tshcy: 'ћ',
|
||
KJcy: 'Ќ',
|
||
kjcy: 'ќ',
|
||
Ubrcy: 'Ў',
|
||
ubrcy: 'ў',
|
||
DZcy: 'Џ',
|
||
dzcy: 'џ',
|
||
};
|
||
|
||
/**
|
||
* Mathematical Operators & Relations
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const MATH = {
|
||
plus: '+',
|
||
pm: '±',
|
||
times: '×',
|
||
div: '÷',
|
||
divide: '÷',
|
||
sdot: '⋅',
|
||
star: '☆',
|
||
starf: '★',
|
||
bigstar: '★',
|
||
lowast: '∗',
|
||
ast: '*',
|
||
midast: '*',
|
||
compfn: '∘',
|
||
smallcircle: '∘',
|
||
bullet: '•',
|
||
bull: '•',
|
||
nbsp: '\u00a0',
|
||
hellip: '…',
|
||
mldr: '…',
|
||
prime: '′',
|
||
Prime: '″',
|
||
tprime: '‴',
|
||
bprime: '‵',
|
||
backprime: '‵',
|
||
minus: '−',
|
||
minusd: '∸',
|
||
dotminus: '∸',
|
||
plusdo: '∔',
|
||
dotplus: '∔',
|
||
plusmn: '±',
|
||
minusplus: '∓',
|
||
mnplus: '∓',
|
||
mp: '∓',
|
||
setminus: '∖',
|
||
smallsetminus: '∖',
|
||
Backslash: '∖',
|
||
setmn: '∖',
|
||
ssetmn: '∖',
|
||
lowbar: '_',
|
||
verbar: '|',
|
||
vert: '|',
|
||
VerticalLine: '|',
|
||
colon: ':',
|
||
Colon: '∷',
|
||
Proportion: '∷',
|
||
ratio: '∶',
|
||
equals: '=',
|
||
ne: '≠',
|
||
nequiv: '≢',
|
||
equiv: '≡',
|
||
Congruent: '≡',
|
||
sim: '∼',
|
||
thicksim: '∼',
|
||
thksim: '∼',
|
||
sime: '≃',
|
||
simeq: '≃',
|
||
TildeEqual: '≃',
|
||
asymp: '≈',
|
||
approx: '≈',
|
||
thickapprox: '≈',
|
||
thkap: '≈',
|
||
TildeTilde: '≈',
|
||
ncong: '≇',
|
||
cong: '≅',
|
||
TildeFullEqual: '≅',
|
||
asympeq: '≍',
|
||
CupCap: '≍',
|
||
bump: '≎',
|
||
Bumpeq: '≎',
|
||
HumpDownHump: '≎',
|
||
bumpe: '≏',
|
||
bumpeq: '≏',
|
||
HumpEqual: '≏',
|
||
le: '≤',
|
||
LessEqual: '≤',
|
||
ge: '≥',
|
||
GreaterEqual: '≥',
|
||
lesseqgtr: '⋚',
|
||
lesseqqgtr: '⪋',
|
||
greater: '>',
|
||
less: '<',
|
||
};
|
||
|
||
/**
|
||
* Mathematical Operators (Advanced)
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const MATH_ADVANCED = {
|
||
alefsym: 'ℵ',
|
||
aleph: 'ℵ',
|
||
beth: 'ℶ',
|
||
gimel: 'ℷ',
|
||
daleth: 'ℸ',
|
||
forall: '∀',
|
||
ForAll: '∀',
|
||
part: '∂',
|
||
PartialD: '∂',
|
||
exist: '∃',
|
||
Exists: '∃',
|
||
nexist: '∄',
|
||
nexists: '∄',
|
||
empty: '∅',
|
||
emptyset: '∅',
|
||
emptyv: '∅',
|
||
varnothing: '∅',
|
||
nabla: '∇',
|
||
Del: '∇',
|
||
isin: '∈',
|
||
isinv: '∈',
|
||
in: '∈',
|
||
Element: '∈',
|
||
notin: '∉',
|
||
notinva: '∉',
|
||
ni: '∋',
|
||
niv: '∋',
|
||
SuchThat: '∋',
|
||
ReverseElement: '∋',
|
||
notni: '∌',
|
||
notniva: '∌',
|
||
prod: '∏',
|
||
Product: '∏',
|
||
coprod: '∐',
|
||
Coproduct: '∐',
|
||
sum: '∑',
|
||
Sum: '∑',
|
||
minus: '−',
|
||
mp: '∓',
|
||
plusdo: '∔',
|
||
dotplus: '∔',
|
||
setminus: '∖',
|
||
lowast: '∗',
|
||
radic: '√',
|
||
Sqrt: '√',
|
||
prop: '∝',
|
||
propto: '∝',
|
||
Proportional: '∝',
|
||
varpropto: '∝',
|
||
infin: '∞',
|
||
infintie: '⧝',
|
||
ang: '∠',
|
||
angle: '∠',
|
||
angmsd: '∡',
|
||
measuredangle: '∡',
|
||
angsph: '∢',
|
||
mid: '∣',
|
||
VerticalBar: '∣',
|
||
nmid: '∤',
|
||
nsmid: '∤',
|
||
npar: '∦',
|
||
parallel: '∥',
|
||
spar: '∥',
|
||
nparallel: '∦',
|
||
nspar: '∦',
|
||
and: '∧',
|
||
wedge: '∧',
|
||
or: '∨',
|
||
vee: '∨',
|
||
cap: '∩',
|
||
cup: '∪',
|
||
int: '∫',
|
||
Integral: '∫',
|
||
conint: '∮',
|
||
ContourIntegral: '∮',
|
||
Conint: '∯',
|
||
DoubleContourIntegral: '∯',
|
||
Cconint: '∰',
|
||
there4: '∴',
|
||
therefore: '∴',
|
||
Therefore: '∴',
|
||
becaus: '∵',
|
||
because: '∵',
|
||
Because: '∵',
|
||
ratio: '∶',
|
||
Proportion: '∷',
|
||
minusd: '∸',
|
||
dotminus: '∸',
|
||
mDDot: '∺',
|
||
homtht: '∻',
|
||
sim: '∼',
|
||
bsimg: '∽',
|
||
backsim: '∽',
|
||
ac: '∾',
|
||
mstpos: '∾',
|
||
acd: '∿',
|
||
VerticalTilde: '≀',
|
||
wr: '≀',
|
||
wreath: '≀',
|
||
nsime: '≄',
|
||
nsimeq: '≄',
|
||
ncong: '≇',
|
||
simne: '≆',
|
||
ncongdot: '⩭̸',
|
||
ngsim: '≵',
|
||
nsim: '≁',
|
||
napprox: '≉',
|
||
nap: '≉',
|
||
ngeq: '≱',
|
||
nge: '≱',
|
||
nleq: '≰',
|
||
nle: '≰',
|
||
ngtr: '≯',
|
||
ngt: '≯',
|
||
nless: '≮',
|
||
nlt: '≮',
|
||
nprec: '⊀',
|
||
npr: '⊀',
|
||
nsucc: '⊁',
|
||
nsc: '⊁',
|
||
};
|
||
|
||
/**
|
||
* Arrows
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const ARROWS = {
|
||
larr: '←',
|
||
leftarrow: '←',
|
||
LeftArrow: '←',
|
||
uarr: '↑',
|
||
uparrow: '↑',
|
||
UpArrow: '↑',
|
||
rarr: '→',
|
||
rightarrow: '→',
|
||
RightArrow: '→',
|
||
darr: '↓',
|
||
downarrow: '↓',
|
||
DownArrow: '↓',
|
||
harr: '↔',
|
||
leftrightarrow: '↔',
|
||
LeftRightArrow: '↔',
|
||
varr: '↕',
|
||
updownarrow: '↕',
|
||
UpDownArrow: '↕',
|
||
nwarr: '↖',
|
||
nwarrow: '↖',
|
||
UpperLeftArrow: '↖',
|
||
nearr: '↗',
|
||
nearrow: '↗',
|
||
UpperRightArrow: '↗',
|
||
searr: '↘',
|
||
searrow: '↘',
|
||
LowerRightArrow: '↘',
|
||
swarr: '↙',
|
||
swarrow: '↙',
|
||
LowerLeftArrow: '↙',
|
||
lArr: '⇐',
|
||
Leftarrow: '⇐',
|
||
uArr: '⇑',
|
||
Uparrow: '⇑',
|
||
rArr: '⇒',
|
||
Rightarrow: '⇒',
|
||
dArr: '⇓',
|
||
Downarrow: '⇓',
|
||
hArr: '⇔',
|
||
Leftrightarrow: '⇔',
|
||
iff: '⇔',
|
||
vArr: '⇕',
|
||
Updownarrow: '⇕',
|
||
lAarr: '⇚',
|
||
Lleftarrow: '⇚',
|
||
rAarr: '⇛',
|
||
Rrightarrow: '⇛',
|
||
lrarr: '⇆',
|
||
leftrightarrows: '⇆',
|
||
rlarr: '⇄',
|
||
rightleftarrows: '⇄',
|
||
lrhar: '⇋',
|
||
leftrightharpoons: '⇋',
|
||
ReverseEquilibrium: '⇋',
|
||
rlhar: '⇌',
|
||
rightleftharpoons: '⇌',
|
||
Equilibrium: '⇌',
|
||
udarr: '⇅',
|
||
UpArrowDownArrow: '⇅',
|
||
duarr: '⇵',
|
||
DownArrowUpArrow: '⇵',
|
||
llarr: '⇇',
|
||
leftleftarrows: '⇇',
|
||
rrarr: '⇉',
|
||
rightrightarrows: '⇉',
|
||
ddarr: '⇊',
|
||
downdownarrows: '⇊',
|
||
har: '↽',
|
||
lhard: '↽',
|
||
leftharpoondown: '↽',
|
||
lharu: '↼',
|
||
leftharpoonup: '↼',
|
||
rhard: '⇁',
|
||
rightharpoondown: '⇁',
|
||
rharu: '⇀',
|
||
rightharpoonup: '⇀',
|
||
lsh: '↰',
|
||
Lsh: '↰',
|
||
rsh: '↱',
|
||
Rsh: '↱',
|
||
ldsh: '↲',
|
||
rdsh: '↳',
|
||
hookleftarrow: '↩',
|
||
hookrightarrow: '↪',
|
||
mapstoleft: '↤',
|
||
mapstoup: '↥',
|
||
map: '↦',
|
||
mapsto: '↦',
|
||
mapstodown: '↧',
|
||
crarr: '↵',
|
||
nleftarrow: '↚',
|
||
nleftrightarrow: '↮',
|
||
nrightarrow: '↛',
|
||
nrarr: '↛',
|
||
larrtl: '↢',
|
||
rarrtl: '↣',
|
||
leftarrowtail: '↢',
|
||
rightarrowtail: '↣',
|
||
twoheadleftarrow: '↞',
|
||
twoheadrightarrow: '↠',
|
||
Larr: '↞',
|
||
Rarr: '↠',
|
||
larrhk: '↩',
|
||
rarrhk: '↪',
|
||
larrlp: '↫',
|
||
looparrowleft: '↫',
|
||
rarrlp: '↬',
|
||
looparrowright: '↬',
|
||
harrw: '↭',
|
||
leftrightsquigarrow: '↭',
|
||
nrarrw: '↝̸',
|
||
rarrw: '↝',
|
||
rightsquigarrow: '↝',
|
||
larrbfs: '⤟',
|
||
rarrbfs: '⤠',
|
||
nvHarr: '⤄',
|
||
nvlArr: '⤂',
|
||
nvrArr: '⤃',
|
||
larrfs: '⤝',
|
||
rarrfs: '⤞',
|
||
Map: '⤅',
|
||
larrsim: '⥳',
|
||
rarrsim: '⥴',
|
||
harrcir: '⥈',
|
||
Uarrocir: '⥉',
|
||
lurdshar: '⥊',
|
||
ldrdhar: '⥧',
|
||
ldrushar: '⥋',
|
||
rdldhar: '⥩',
|
||
lrhard: '⥭',
|
||
uharr: '↾',
|
||
uharl: '↿',
|
||
dharr: '⇂',
|
||
dharl: '⇃',
|
||
Uarr: '↟',
|
||
Darr: '↡',
|
||
zigrarr: '⇝',
|
||
nwArr: '⇖',
|
||
neArr: '⇗',
|
||
seArr: '⇘',
|
||
swArr: '⇙',
|
||
nharr: '↮',
|
||
nhArr: '⇎',
|
||
nlarr: '↚',
|
||
nlArr: '⇍',
|
||
nrArr: '⇏',
|
||
larrb: '⇤',
|
||
LeftArrowBar: '⇤',
|
||
rarrb: '⇥',
|
||
RightArrowBar: '⇥',
|
||
};
|
||
|
||
/**
|
||
* Geometric Shapes
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const SHAPES = {
|
||
square: '□',
|
||
Square: '□',
|
||
squ: '□',
|
||
squf: '▪',
|
||
squarf: '▪',
|
||
blacksquar: '▪',
|
||
blacksquare: '▪',
|
||
FilledVerySmallSquare: '▪',
|
||
blk34: '▓',
|
||
blk12: '▒',
|
||
blk14: '░',
|
||
block: '█',
|
||
srect: '▭',
|
||
rect: '▭',
|
||
sdot: '⋅',
|
||
sdotb: '⊡',
|
||
dotsquare: '⊡',
|
||
triangle: '▵',
|
||
tri: '▵',
|
||
trine: '▵',
|
||
utri: '▵',
|
||
triangledown: '▿',
|
||
dtri: '▿',
|
||
tridown: '▿',
|
||
triangleleft: '◃',
|
||
ltri: '◃',
|
||
triangleright: '▹',
|
||
rtri: '▹',
|
||
blacktriangle: '▴',
|
||
utrif: '▴',
|
||
blacktriangledown: '▾',
|
||
dtrif: '▾',
|
||
blacktriangleleft: '◂',
|
||
ltrif: '◂',
|
||
blacktriangleright: '▸',
|
||
rtrif: '▸',
|
||
loz: '◊',
|
||
lozenge: '◊',
|
||
blacklozenge: '⧫',
|
||
lozf: '⧫',
|
||
bigcirc: '◯',
|
||
xcirc: '◯',
|
||
circ: 'ˆ',
|
||
Circle: '○',
|
||
cir: '○',
|
||
o: '○',
|
||
bullet: '•',
|
||
bull: '•',
|
||
hellip: '…',
|
||
mldr: '…',
|
||
nldr: '‥',
|
||
boxh: '─',
|
||
HorizontalLine: '─',
|
||
boxv: '│',
|
||
boxdr: '┌',
|
||
boxdl: '┐',
|
||
boxur: '└',
|
||
boxul: '┘',
|
||
boxvr: '├',
|
||
boxvl: '┤',
|
||
boxhd: '┬',
|
||
boxhu: '┴',
|
||
boxvh: '┼',
|
||
boxH: '═',
|
||
boxV: '║',
|
||
boxdR: '╒',
|
||
boxDr: '╓',
|
||
boxDR: '╔',
|
||
boxDl: '╕',
|
||
boxdL: '╖',
|
||
boxDL: '╗',
|
||
boxuR: '╘',
|
||
boxUr: '╙',
|
||
boxUR: '╚',
|
||
boxUl: '╜',
|
||
boxuL: '╛',
|
||
boxUL: '╝',
|
||
boxvR: '╞',
|
||
boxVr: '╟',
|
||
boxVR: '╠',
|
||
boxVl: '╢',
|
||
boxvL: '╡',
|
||
boxVL: '╣',
|
||
boxHd: '╤',
|
||
boxhD: '╥',
|
||
boxHD: '╦',
|
||
boxHu: '╧',
|
||
boxhU: '╨',
|
||
boxHU: '╩',
|
||
boxvH: '╪',
|
||
boxVh: '╫',
|
||
boxVH: '╬',
|
||
};
|
||
|
||
/**
|
||
* Punctuation & Diacritics
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const PUNCTUATION = {
|
||
excl: '!',
|
||
iexcl: '¡',
|
||
brvbar: '¦',
|
||
sect: '§',
|
||
uml: '¨',
|
||
copy: '©',
|
||
ordf: 'ª',
|
||
laquo: '«',
|
||
not: '¬',
|
||
shy: '\u00ad',
|
||
reg: '®',
|
||
macr: '¯',
|
||
deg: '°',
|
||
plusmn: '±',
|
||
sup2: '²',
|
||
sup3: '³',
|
||
acute: '´',
|
||
micro: 'µ',
|
||
para: '¶',
|
||
middot: '·',
|
||
cedil: '¸',
|
||
sup1: '¹',
|
||
ordm: 'º',
|
||
raquo: '»',
|
||
frac14: '¼',
|
||
frac12: '½',
|
||
frac34: '¾',
|
||
iquest: '¿',
|
||
nbsp: '\u00a0',
|
||
comma: ',',
|
||
period: '.',
|
||
colon: ':',
|
||
semi: ';',
|
||
vert: '|',
|
||
Verbar: '‖',
|
||
verbar: '|',
|
||
dblac: '˝',
|
||
circ: 'ˆ',
|
||
caron: 'ˇ',
|
||
breve: '˘',
|
||
dot: '˙',
|
||
ring: '˚',
|
||
ogon: '˛',
|
||
tilde: '˜',
|
||
DiacriticalGrave: '`',
|
||
DiacriticalAcute: '´',
|
||
DiacriticalTilde: '˜',
|
||
DiacriticalDot: '˙',
|
||
DiacriticalDoubleAcute: '˝',
|
||
grave: '`',
|
||
};
|
||
|
||
/**
|
||
* Currency Symbols
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const CURRENCY = {
|
||
cent: '¢',
|
||
pound: '£',
|
||
curren: '¤',
|
||
yen: '¥',
|
||
euro: '€',
|
||
dollar: '$',
|
||
fnof: 'ƒ',
|
||
inr: '₹',
|
||
af: '؋',
|
||
birr: 'ብር',
|
||
peso: '₱',
|
||
rub: '₽',
|
||
won: '₩',
|
||
yuan: '¥',
|
||
cedil: '¸',
|
||
};
|
||
|
||
/**
|
||
* Fractions
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const FRACTIONS = {
|
||
frac12: '½',
|
||
half: '½',
|
||
frac13: '⅓',
|
||
frac14: '¼',
|
||
frac15: '⅕',
|
||
frac16: '⅙',
|
||
frac18: '⅛',
|
||
frac23: '⅔',
|
||
frac25: '⅖',
|
||
frac34: '¾',
|
||
frac35: '⅗',
|
||
frac38: '⅜',
|
||
frac45: '⅘',
|
||
frac56: '⅚',
|
||
frac58: '⅝',
|
||
frac78: '⅞',
|
||
frasl: '⁄',
|
||
};
|
||
|
||
/**
|
||
* Miscellaneous Symbols
|
||
* @type {Record<string, string>}
|
||
*/
|
||
const MISC_SYMBOLS = {
|
||
trade: '™',
|
||
TRADE: '™',
|
||
telrec: '⌕',
|
||
target: '⌖',
|
||
ulcorn: '⌜',
|
||
ulcorner: '⌜',
|
||
urcorn: '⌝',
|
||
urcorner: '⌝',
|
||
dlcorn: '⌞',
|
||
llcorner: '⌞',
|
||
drcorn: '⌟',
|
||
lrcorner: '⌟',
|
||
intercal: '⊺',
|
||
intcal: '⊺',
|
||
oplus: '⊕',
|
||
CirclePlus: '⊕',
|
||
ominus: '⊖',
|
||
CircleMinus: '⊖',
|
||
otimes: '⊗',
|
||
CircleTimes: '⊗',
|
||
osol: '⊘',
|
||
odot: '⊙',
|
||
CircleDot: '⊙',
|
||
oast: '⊛',
|
||
circledast: '⊛',
|
||
odash: '⊝',
|
||
circleddash: '⊝',
|
||
ocirc: '⊚',
|
||
circledcirc: '⊚',
|
||
boxplus: '⊞',
|
||
plusb: '⊞',
|
||
boxminus: '⊟',
|
||
minusb: '⊟',
|
||
boxtimes: '⊠',
|
||
timesb: '⊠',
|
||
boxdot: '⊡',
|
||
sdotb: '⊡',
|
||
veebar: '⊻',
|
||
vee: '∨',
|
||
barvee: '⊽',
|
||
and: '∧',
|
||
wedge: '∧',
|
||
Cap: '⋒',
|
||
Cup: '⋓',
|
||
Fork: '⋔',
|
||
pitchfork: '⋔',
|
||
epar: '⋕',
|
||
ltlarr: '⥶',
|
||
nvap: '≍⃒',
|
||
nvsim: '∼⃒',
|
||
nvge: '≥⃒',
|
||
nvle: '≤⃒',
|
||
nvlt: '<⃒',
|
||
nvgt: '>⃒',
|
||
nvltrie: '⊴⃒',
|
||
nvrtrie: '⊵⃒',
|
||
Vdash: '⊩',
|
||
dashv: '⊣',
|
||
vDash: '⊨',
|
||
Vvdash: '⊪',
|
||
nvdash: '⊬',
|
||
nvDash: '⊭',
|
||
nVdash: '⊮',
|
||
nVDash: '⊯',
|
||
};
|
||
|
||
const XML = {
|
||
amp: "&",
|
||
apos: "'",
|
||
gt: ">",
|
||
lt: "<",
|
||
quot: "\""
|
||
}
|
||
const COMMON_HTML = {
|
||
nbsp: '\u00a0',
|
||
copy: '\u00a9',
|
||
reg: '\u00ae',
|
||
trade: '\u2122',
|
||
mdash: '\u2014',
|
||
ndash: '\u2013',
|
||
hellip: '\u2026',
|
||
laquo: '\u00ab',
|
||
raquo: '\u00bb',
|
||
lsquo: '\u2018',
|
||
rsquo: '\u2019',
|
||
ldquo: '\u201c',
|
||
rdquo: '\u201d',
|
||
bull: '\u2022',
|
||
para: '\u00b6',
|
||
sect: '\u00a7',
|
||
deg: '\u00b0',
|
||
frac12: '\u00bd',
|
||
frac14: '\u00bc',
|
||
frac34: '\u00be',
|
||
}
|
||
// ---------------------------------------------------------------------------
|
||
// Note: NUMERIC_ENTITIES (&#NNN; / &#xHH;) are handled by the scanner directly
|
||
// via String.fromCodePoint() without any map lookup.
|
||
// ---------------------------------------------------------------------------
|
||
;// CONCATENATED MODULE: ./node_modules/@nodable/entities/src/EntityDecoder.js
|
||
// ---------------------------------------------------------------------------
|
||
// Built-in named entity map (name → replacement string)
|
||
// No regex, no {regex,val} objects — just flat key/value pairs.
|
||
// ---------------------------------------------------------------------------
|
||
|
||
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Entity hook action constants
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Action constants for `onExternalEntity` and `onInputEntity` hooks.
|
||
*
|
||
* Use these instead of raw strings to avoid typos:
|
||
*
|
||
* @example
|
||
* import EntityDecoder, { ENTITY_ACTION } from './EntityDecoder.js';
|
||
* const dec = new EntityDecoder({
|
||
* onInputEntity: (name, value) => ENTITY_ACTION.BLOCK,
|
||
* });
|
||
*/
|
||
const ENTITY_ACTION = Object.freeze({
|
||
/** Resolve and expand the entity normally. */
|
||
ALLOW: 'allow',
|
||
/** Silently skip this entity — it will not be registered. */
|
||
BLOCK: 'block',
|
||
/** Throw an error, aborting entity registration entirely. */
|
||
THROW: 'throw',
|
||
});
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Helpers
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const SPECIAL_CHARS = new Set('!?\\\\/[]$%{}^&*()<>|+');
|
||
|
||
/**
|
||
* Validate that an entity name contains no dangerous characters.
|
||
* @param {string} name
|
||
* @returns {string} the name, unchanged
|
||
* @throws {Error} on invalid characters
|
||
*/
|
||
function EntityDecoder_validateEntityName(name) {
|
||
if (name[0] === '#') {
|
||
throw new Error(`[EntityReplacer] Invalid character '#' in entity name: "${name}"`);
|
||
}
|
||
for (const ch of name) {
|
||
if (SPECIAL_CHARS.has(ch)) {
|
||
throw new Error(`[EntityReplacer] Invalid character '${ch}' in entity name: "${name}"`);
|
||
}
|
||
}
|
||
return name;
|
||
}
|
||
|
||
/**
|
||
* Merge one or more entity maps into a flat name→string map.
|
||
* Accepts either:
|
||
* - plain string values: { amp: '&' }
|
||
* - legacy {regex,val} / {regx,val}: { lt: { regex: /.../, val: '<' } }
|
||
*
|
||
* Values containing '&' are skipped (recursive expansion risk).
|
||
*
|
||
* @param {...object} maps
|
||
* @returns {Record<string, string>}
|
||
*/
|
||
function mergeEntityMaps(...maps) {
|
||
const out = Object.create(null);
|
||
for (const map of maps) {
|
||
if (!map) continue;
|
||
for (const key of Object.keys(map)) {
|
||
const raw = map[key];
|
||
if (typeof raw === 'string') {
|
||
out[key] = raw;
|
||
} else if (raw && typeof raw === 'object' && raw.val !== undefined) {
|
||
// Legacy {regex,val} or {regx,val} — extract the string val only
|
||
const val = raw.val;
|
||
if (typeof val === 'string') {
|
||
out[key] = val;
|
||
}
|
||
// function vals are not supported in the scanner — skip
|
||
}
|
||
}
|
||
}
|
||
return out;
|
||
}
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// applyLimitsTo helpers
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const LIMIT_TIER_EXTERNAL = 'external'; // input/runtime + persistent external maps
|
||
const LIMIT_TIER_BASE = 'base'; // DEFAULT_XML_ENTITIES + namedEntities (system) maps
|
||
const LIMIT_TIER_ALL = 'all'; // every entity regardless of tier
|
||
|
||
/**
|
||
* Resolve `applyLimitsTo` option into a normalised Set of tier strings.
|
||
* Accepted values: 'external' | 'base' | 'all' | string[]
|
||
* Default: 'external' (only untrusted injected entities are counted).
|
||
* @param {string|string[]|undefined} raw
|
||
* @returns {Set<string>}
|
||
*/
|
||
function parseLimitTiers(raw) {
|
||
if (!raw || raw === LIMIT_TIER_EXTERNAL) return new Set([LIMIT_TIER_EXTERNAL]);
|
||
if (raw === LIMIT_TIER_ALL) return new Set([LIMIT_TIER_ALL]);
|
||
if (raw === LIMIT_TIER_BASE) return new Set([LIMIT_TIER_BASE]);
|
||
if (Array.isArray(raw)) return new Set(raw);
|
||
return new Set([LIMIT_TIER_EXTERNAL]); // safe default for unrecognised values
|
||
}
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// NCR (Numeric Character Reference) classification
|
||
// ---------------------------------------------------------------------------
|
||
|
||
// Severity order — higher number = stricter action.
|
||
// Used to enforce minimum action levels for specific codepoint ranges.
|
||
const NCR_LEVEL = Object.freeze({ allow: 0, leave: 1, remove: 2, throw: 3 });
|
||
|
||
// XML 1.0 §2.2: allowed chars are #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
|
||
// Restricted C0: U+0001–U+001F excluding U+0009, U+000A, U+000D
|
||
const XML10_ALLOWED_C0 = new Set([0x09, 0x0A, 0x0D]);
|
||
|
||
/**
|
||
* Parse the `ncr` constructor option into flat, hot-path-friendly fields.
|
||
* @param {object|undefined} ncr
|
||
* @returns {{ xmlVersion: number, onLevel: number, nullLevel: number }}
|
||
*/
|
||
function parseNCRConfig(ncr) {
|
||
if (!ncr) {
|
||
return { xmlVersion: 1.0, onLevel: NCR_LEVEL.allow, nullLevel: NCR_LEVEL.remove };
|
||
}
|
||
const xmlVersion = ncr.xmlVersion === 1.1 ? 1.1 : 1.0;
|
||
const onLevel = NCR_LEVEL[ncr.onNCR] ?? NCR_LEVEL.allow;
|
||
const nullLevel = NCR_LEVEL[ncr.nullNCR] ?? NCR_LEVEL.remove;
|
||
// 'allow' is not meaningful for null — clamp to at least 'remove'
|
||
const clampedNull = Math.max(nullLevel, NCR_LEVEL.remove);
|
||
return { xmlVersion, onLevel, nullLevel: clampedNull };
|
||
}
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// EntityReplacer
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Single-pass, zero-regex entity replacer for XML/HTML content.
|
||
*
|
||
* Algorithm: scan the string once for '&', read to ';', resolve via map
|
||
* or direct codepoint conversion, build output chunks, join once at the end.
|
||
*
|
||
* Entity lookup priority (highest → lowest):
|
||
* 1. input / runtime (DOCTYPE entities for current document)
|
||
* 2. persistent external (survive across documents)
|
||
* 3. base named map (DEFAULT_XML_ENTITIES + user-supplied namedEntities)
|
||
*
|
||
* Both input and external resolve as the 'external' tier for limit purposes.
|
||
* Base map entities resolve as the 'base' tier.
|
||
*
|
||
* Numeric / hex references (&#NNN; / &#xHH;) are resolved directly via
|
||
* String.fromCodePoint() — no map needed. They count as 'base' tier.
|
||
*
|
||
* @example
|
||
* const replacer = new EntityReplacer({ namedEntities: COMMON_HTML });
|
||
* replacer.setExternalEntities({ brand: 'Acme' });
|
||
*
|
||
* const instance = replacer.reset();
|
||
* instance.addInputEntities({ version: '1.0' });
|
||
* instance.encode('&brand; v&version; <'); // 'Acme v1.0 <'
|
||
*/
|
||
class EntityDecoder {
|
||
/**
|
||
* @param {object} [options]
|
||
* @param {object|null} [options.namedEntities] — extra named entities merged into base map
|
||
* @param {object} [options.limit] — security limits
|
||
* @param {number} [options.limit.maxTotalExpansions=0] — 0 = unlimited
|
||
* @param {number} [options.limit.maxExpandedLength=0] — 0 = unlimited
|
||
* @param {'external'|'base'|'all'|string[]} [options.limit.applyLimitsTo='external']
|
||
* Which entity tiers count against the security limits:
|
||
* - 'external' (default) — only input/runtime + persistent external entities
|
||
* - 'base' — only DEFAULT_XML_ENTITIES + namedEntities
|
||
* - 'all' — every entity regardless of tier
|
||
* - string[] — explicit combination, e.g. ['external', 'base']
|
||
* @param {((resolved: string, original: string) => string)|null} [options.postCheck=null]
|
||
* @param {string[]} [options.remove=[]] — entity names (e.g. ['nbsp', '#13']) to delete (replace with empty string)
|
||
* @param {string[]} [options.leave=[]] — entity names to keep as literal (unchanged in output)
|
||
* @param {object} [options.ncr] — Numeric Character Reference controls
|
||
* @param {1.0|1.1} [options.ncr.xmlVersion=1.0]
|
||
* XML version governing which codepoint ranges are restricted:
|
||
* - 1.0 — C0 controls U+0001–U+001F (except U+0009/000A/000D) are prohibited
|
||
* - 1.1 — C0 controls are allowed when written as NCRs; C1 (U+007F–U+009F) decoded as-is
|
||
* @param {'allow'|'leave'|'remove'|'throw'} [options.ncr.onNCR='allow']
|
||
* Base action for numeric references. Severity order: allow < leave < remove < throw.
|
||
* For codepoint ranges that carry a minimum level (surrogates → remove, XML 1.0 C0 → remove),
|
||
* the effective action is max(onNCR, rangeMinimum).
|
||
* @param {'remove'|'throw'} [options.ncr.nullNCR='remove']
|
||
* Action for U+0000 (null). 'allow' and 'leave' are clamped to 'remove' since null is never safe.
|
||
* @param {((name: string, value: string) => 'allow'|'block'|'throw')|null} [options.onExternalEntity=null]
|
||
* Hook called when an external entity is registered via `setExternalEntities()` or
|
||
* `addExternalEntity()`. Return `ENTITY_ACTION.ALLOW` to accept the entity,
|
||
* `ENTITY_ACTION.BLOCK` to silently skip it, or `ENTITY_ACTION.THROW` to abort with an error.
|
||
* @param {((name: string, value: string) => 'allow'|'block'|'throw')|null} [options.onInputEntity=null]
|
||
* Hook called when an input entity is registered via `addInputEntities()`. Return
|
||
* `ENTITY_ACTION.ALLOW` to accept, `ENTITY_ACTION.BLOCK` to silently skip, or
|
||
* `ENTITY_ACTION.THROW` to abort with an error.
|
||
*/
|
||
constructor(options = {}) {
|
||
this._limit = options.limit || {};
|
||
this._maxTotalExpansions = this._limit.maxTotalExpansions || 0;
|
||
this._maxExpandedLength = this._limit.maxExpandedLength || 0;
|
||
this._postCheck = typeof options.postCheck === 'function' ? options.postCheck : r => r;
|
||
this._limitTiers = parseLimitTiers(this._limit.applyLimitsTo ?? LIMIT_TIER_EXTERNAL);
|
||
this._numericAllowed = options.numericAllowed ?? true;
|
||
// Base map: DEFAULT_XML_ENTITIES + user-supplied extras. Immutable after construction.
|
||
this._baseMap = mergeEntityMaps(XML, options.namedEntities || null);
|
||
|
||
// Persistent external entities — survive across documents.
|
||
// Stored as a separate map so reset() never touches them.
|
||
/** @type {Record<string, string>} */
|
||
this._externalMap = Object.create(null);
|
||
|
||
// Input / runtime entities — current document only, wiped on reset().
|
||
/** @type {Record<string, string>} */
|
||
this._inputMap = Object.create(null);
|
||
|
||
// Per-document counters
|
||
this._totalExpansions = 0;
|
||
this._expandedLength = 0;
|
||
|
||
// --- New: remove / leave sets ---
|
||
/** @type {Set<string>} */
|
||
this._removeSet = new Set(options.remove && Array.isArray(options.remove) ? options.remove : []);
|
||
/** @type {Set<string>} */
|
||
this._leaveSet = new Set(options.leave && Array.isArray(options.leave) ? options.leave : []);
|
||
|
||
// --- NCR config (parsed into flat fields for hot-path speed) ---
|
||
const ncrCfg = parseNCRConfig(options.ncr);
|
||
this._ncrXmlVersion = ncrCfg.xmlVersion;
|
||
this._ncrOnLevel = ncrCfg.onLevel;
|
||
this._ncrNullLevel = ncrCfg.nullLevel;
|
||
|
||
// --- Registration hooks ---
|
||
/** @type {((name: string, value: string) => 'allow'|'block'|'throw')|null} */
|
||
this._onExternalEntity = typeof options.onExternalEntity === 'function'
|
||
? options.onExternalEntity
|
||
: null;
|
||
/** @type {((name: string, value: string) => 'allow'|'block'|'throw')|null} */
|
||
this._onInputEntity = typeof options.onInputEntity === 'function'
|
||
? options.onInputEntity
|
||
: null;
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Private: registration hook dispatch
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Invoke a registration hook for a single entity name/value pair.
|
||
* Returns true when the entity should be accepted, false when it should be
|
||
* silently skipped (BLOCK), and throws when the hook returns THROW.
|
||
*
|
||
* @param {((name: string, value: string) => 'allow'|'block'|'throw')|null} hook
|
||
* @param {string} name
|
||
* @param {string} value
|
||
* @param {string} context — used in error messages ('external' | 'input')
|
||
* @returns {boolean} true = accept, false = skip
|
||
*/
|
||
_applyRegistrationHook(hook, name, value, context) {
|
||
if (!hook) return true; // no hook → always accept
|
||
const action = hook(name, value);
|
||
if (action === ENTITY_ACTION.BLOCK) return false;
|
||
if (action === ENTITY_ACTION.THROW) {
|
||
throw new Error(
|
||
`[EntityDecoder] Registration of ${context} entity "&${name};" was rejected by hook`
|
||
);
|
||
}
|
||
return true; // ALLOW or any unknown return value → accept
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Persistent external entity registration
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Replace the full set of persistent external entities.
|
||
* All keys are validated — throws on invalid characters.
|
||
* If `onExternalEntity` is set, it is called once per entry; entries that
|
||
* return `ENTITY_ACTION.BLOCK` are silently omitted, `ENTITY_ACTION.THROW`
|
||
* aborts the whole call.
|
||
* @param {Record<string, string | { regex?: RegExp, val: string }>} map
|
||
*/
|
||
setExternalEntities(map) {
|
||
if (map) {
|
||
for (const key of Object.keys(map)) {
|
||
EntityDecoder_validateEntityName(key);
|
||
}
|
||
}
|
||
if (!this._onExternalEntity) {
|
||
this._externalMap = mergeEntityMaps(map);
|
||
return;
|
||
}
|
||
// Hook present — resolve values first, then filter
|
||
const flat = mergeEntityMaps(map);
|
||
const filtered = Object.create(null);
|
||
for (const [name, value] of Object.entries(flat)) {
|
||
if (this._applyRegistrationHook(this._onExternalEntity, name, value, 'external')) {
|
||
filtered[name] = value;
|
||
}
|
||
}
|
||
this._externalMap = filtered;
|
||
}
|
||
|
||
/**
|
||
* Add a single persistent external entity.
|
||
* If `onExternalEntity` is set it is called before the entity is stored;
|
||
* `ENTITY_ACTION.BLOCK` silently skips storage, `ENTITY_ACTION.THROW` raises.
|
||
* @param {string} key
|
||
* @param {string} value
|
||
*/
|
||
addExternalEntity(key, value) {
|
||
EntityDecoder_validateEntityName(key);
|
||
if (typeof value === 'string' && value.indexOf('&') === -1) {
|
||
if (this._applyRegistrationHook(this._onExternalEntity, key, value, 'external')) {
|
||
this._externalMap[key] = value;
|
||
}
|
||
}
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Input / runtime entity registration (per document)
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Inject DOCTYPE entities for the current document.
|
||
* Also resets per-document expansion counters.
|
||
* If `onInputEntity` is set it is called once per entry; entries returning
|
||
* `ENTITY_ACTION.BLOCK` are silently omitted, `ENTITY_ACTION.THROW` aborts.
|
||
* @param {Record<string, string | { regx?: RegExp, regex?: RegExp, val: string }>} map
|
||
*/
|
||
addInputEntities(map) {
|
||
this._totalExpansions = 0;
|
||
this._expandedLength = 0;
|
||
if (!this._onInputEntity) {
|
||
this._inputMap = mergeEntityMaps(map);
|
||
return;
|
||
}
|
||
const flat = mergeEntityMaps(map);
|
||
const filtered = Object.create(null);
|
||
for (const [name, value] of Object.entries(flat)) {
|
||
if (this._applyRegistrationHook(this._onInputEntity, name, value, 'input')) {
|
||
filtered[name] = value;
|
||
}
|
||
}
|
||
this._inputMap = filtered;
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Per-document reset
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Wipe input/runtime entities and reset counters.
|
||
* Call this before processing each new document.
|
||
* @returns {this}
|
||
*/
|
||
reset() {
|
||
this._inputMap = Object.create(null);
|
||
this._totalExpansions = 0;
|
||
this._expandedLength = 0;
|
||
return this;
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// XML version (can be set after construction, e.g. once parser reads <?xml?>)
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Update the XML version used for NCR classification.
|
||
* Call this as soon as the document's `<?xml version="...">` declaration is parsed.
|
||
* @param {1.0|1.1|number} version
|
||
*/
|
||
setXmlVersion(version) {
|
||
this._ncrXmlVersion = version === 1.1 ? 1.1 : 1.0;
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Primary API
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Replace all entity references in `str` in a single pass.
|
||
*
|
||
* @param {string} str
|
||
* @returns {string}
|
||
*/
|
||
decode(str) {
|
||
if (typeof str !== 'string' || str.length === 0) return str;
|
||
//TODO: check if needed
|
||
if (str.indexOf('&') === -1) return str; // fast path — no entities at all
|
||
|
||
const original = str;
|
||
const chunks = [];
|
||
const len = str.length;
|
||
let last = 0; // start of next unprocessed literal chunk
|
||
let i = 0;
|
||
|
||
const limitExpansions = this._maxTotalExpansions > 0;
|
||
const limitLength = this._maxExpandedLength > 0;
|
||
const checkLimits = limitExpansions || limitLength;
|
||
|
||
while (i < len) {
|
||
// Scan forward to next '&'
|
||
if (str.charCodeAt(i) !== 38 /* '&' */) { i++; continue; }
|
||
|
||
// --- Found '&' at position i ---
|
||
|
||
// Scan forward to ';'
|
||
let j = i + 1;
|
||
while (j < len && str.charCodeAt(j) !== 59 /* ';' */ && (j - i) <= 32) j++;
|
||
|
||
if (j >= len || str.charCodeAt(j) !== 59) {
|
||
// No closing ';' within window — treat '&' as literal
|
||
i++;
|
||
continue;
|
||
}
|
||
|
||
// Raw token between '&' and ';' (exclusive)
|
||
const token = str.slice(i + 1, j);
|
||
if (token.length === 0) { i++; continue; }
|
||
|
||
let replacement;
|
||
let tier; // which limit tier this entity belongs to
|
||
|
||
if (this._removeSet.has(token)) {
|
||
// Remove entity: replace with empty string
|
||
replacement = '';
|
||
// If entity was unknown (replacement undefined), we still need a tier for limits.
|
||
// Treat as external tier because it's user-directed removal of an unknown reference.
|
||
if (tier === undefined) {
|
||
tier = LIMIT_TIER_EXTERNAL;
|
||
}
|
||
} else if (this._leaveSet.has(token)) {
|
||
// Do not replace — keep original &token; as literal
|
||
i++;
|
||
continue;
|
||
} else if (token.charCodeAt(0) === 35 /* '#' */) {
|
||
// ---- Numeric / NCR reference ----
|
||
// NCR classification always runs first — prohibited codepoints must be
|
||
// caught regardless of numericAllowed.
|
||
const ncrResult = this._resolveNCR(token);
|
||
if (ncrResult === undefined) {
|
||
// 'leave' action — keep original &token; as-is
|
||
i++;
|
||
continue;
|
||
}
|
||
replacement = ncrResult; // '' for remove, char string for allow
|
||
tier = LIMIT_TIER_BASE;
|
||
} else {
|
||
// ---- Named reference ----
|
||
const resolved = this._resolveName(token);
|
||
replacement = resolved?.value;
|
||
tier = resolved?.tier;
|
||
}
|
||
|
||
if (replacement === undefined) {
|
||
// Unknown entity — leave as-is, advance past '&' only
|
||
i++;
|
||
continue;
|
||
}
|
||
|
||
// Flush literal chunk before this entity
|
||
if (i > last) chunks.push(str.slice(last, i));
|
||
chunks.push(replacement);
|
||
last = j + 1; // skip past ';'
|
||
i = last;
|
||
|
||
// Apply expansion limits only if this tier is being tracked
|
||
if (checkLimits && this._tierCounts(tier)) {
|
||
if (limitExpansions) {
|
||
this._totalExpansions++;
|
||
if (this._totalExpansions > this._maxTotalExpansions) {
|
||
throw new Error(
|
||
`[EntityReplacer] Entity expansion count limit exceeded: ` +
|
||
`${this._totalExpansions} > ${this._maxTotalExpansions}`
|
||
);
|
||
}
|
||
}
|
||
if (limitLength) {
|
||
// delta: replacement.length minus the raw &token; length (token.length + 2 for '&' and ';')
|
||
const delta = replacement.length - (token.length + 2);
|
||
if (delta > 0) {
|
||
this._expandedLength += delta;
|
||
if (this._expandedLength > this._maxExpandedLength) {
|
||
throw new Error(
|
||
`[EntityReplacer] Expanded content length limit exceeded: ` +
|
||
`${this._expandedLength} > ${this._maxExpandedLength}`
|
||
);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
// Flush trailing literal
|
||
if (last < len) chunks.push(str.slice(last));
|
||
|
||
// If nothing was replaced, chunks is empty — return original
|
||
const result = chunks.length === 0 ? str : chunks.join('');
|
||
|
||
return this._postCheck(result, original);
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Private: limit tier check
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Returns true if a resolved entity of the given tier should count
|
||
* against the expansion/length limits.
|
||
* @param {string} tier — LIMIT_TIER_EXTERNAL | LIMIT_TIER_BASE
|
||
* @returns {boolean}
|
||
*/
|
||
_tierCounts(tier) {
|
||
if (this._limitTiers.has(LIMIT_TIER_ALL)) return true;
|
||
return this._limitTiers.has(tier);
|
||
}
|
||
|
||
// -------------------------------------------------------------------------
|
||
// Private: entity resolution
|
||
// -------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Resolve a named entity token (without & and ;).
|
||
* Priority: inputMap > externalMap > baseMap
|
||
* Returns the resolved value tagged with its limit tier.
|
||
*
|
||
* @param {string} name
|
||
* @returns {{ value: string, tier: string }|undefined}
|
||
*/
|
||
_resolveName(name) {
|
||
// input and external both count as 'external' tier for limit purposes —
|
||
// they are injected at runtime and are the untrusted surface.
|
||
if (name in this._inputMap) return { value: this._inputMap[name], tier: LIMIT_TIER_EXTERNAL };
|
||
if (name in this._externalMap) return { value: this._externalMap[name], tier: LIMIT_TIER_EXTERNAL };
|
||
if (name in this._baseMap) return { value: this._baseMap[name], tier: LIMIT_TIER_BASE };
|
||
return undefined;
|
||
}
|
||
|
||
/**
|
||
* Classify a codepoint and return the minimum action level that must be applied.
|
||
* Returns -1 when no minimum is imposed (normal allow path).
|
||
*
|
||
* Ranges checked (in priority order):
|
||
* 1. U+0000 — null, governed by nullNCR (always ≥ remove)
|
||
* 2. U+D800–U+DFFF — surrogates, always prohibited (min: remove)
|
||
* 3. U+0001–U+001F \ {0x09,0x0A,0x0D} — XML 1.0 restricted C0 (min: remove)
|
||
* (skipped in XML 1.1 — C0 controls are allowed when written as NCRs)
|
||
*
|
||
* @param {number} cp — codepoint
|
||
* @returns {number} — minimum NCR_LEVEL value, or -1 for no restriction
|
||
*/
|
||
_classifyNCR(cp) {
|
||
// 1. Null
|
||
if (cp === 0) return this._ncrNullLevel;
|
||
|
||
// 2. Surrogates — always prohibited, minimum 'remove'
|
||
if (cp >= 0xD800 && cp <= 0xDFFF) return NCR_LEVEL.remove;
|
||
|
||
// 3. XML 1.0 restricted C0 controls
|
||
if (this._ncrXmlVersion === 1.0) {
|
||
if (cp >= 0x01 && cp <= 0x1F && !XML10_ALLOWED_C0.has(cp)) return NCR_LEVEL.remove;
|
||
}
|
||
|
||
return -1; // no restriction
|
||
}
|
||
|
||
/**
|
||
* Execute a resolved NCR action.
|
||
*
|
||
* @param {number} action — NCR_LEVEL value
|
||
* @param {string} token — raw token (e.g. '#38') for error messages
|
||
* @param {number} cp — codepoint, used only for error messages
|
||
* @returns {string|undefined}
|
||
* - decoded character string → 'allow'
|
||
* - '' → 'remove'
|
||
* - undefined → 'leave' (caller must skip past '&' only)
|
||
* - throws Error → 'throw'
|
||
*/
|
||
_applyNCRAction(action, token, cp) {
|
||
switch (action) {
|
||
case NCR_LEVEL.allow: return String.fromCodePoint(cp);
|
||
case NCR_LEVEL.remove: return '';
|
||
case NCR_LEVEL.leave: return undefined; // signal: keep literal
|
||
case NCR_LEVEL.throw:
|
||
throw new Error(
|
||
`[EntityDecoder] Prohibited numeric character reference ` +
|
||
`&${token}; (U+${cp.toString(16).toUpperCase().padStart(4, '0')})`
|
||
);
|
||
default: return String.fromCodePoint(cp);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Full NCR resolution pipeline for a numeric token.
|
||
*
|
||
* Steps:
|
||
* 1. Parse the codepoint (decimal or hex).
|
||
* 2. Validate the raw codepoint range (NaN, <0, >0x10FFFF).
|
||
* 3. If numericAllowed is false and no minimum restriction applies → leave as-is.
|
||
* 4. Classify the codepoint to find the minimum required action level.
|
||
* 5. Resolve effective action = max(onNCR, minimum).
|
||
* 6. Apply and return.
|
||
*
|
||
* @param {string} token — e.g. '#38', '#x26', '#X26'
|
||
* @returns {string|undefined}
|
||
* - string (incl. '') — replacement ('' = remove)
|
||
* - undefined — leave original &token; as-is
|
||
*/
|
||
_resolveNCR(token) {
|
||
// Step 1: parse codepoint
|
||
const second = token.charCodeAt(1);
|
||
let cp;
|
||
if (second === 120 /* x */ || second === 88 /* X */) {
|
||
cp = parseInt(token.slice(2), 16);
|
||
} else {
|
||
cp = parseInt(token.slice(1), 10);
|
||
}
|
||
|
||
// Step 2: out-of-range → leave as-is unconditionally
|
||
if (Number.isNaN(cp) || cp < 0 || cp > 0x10FFFF) return undefined;
|
||
|
||
// Step 3: classify to get minimum action level
|
||
const minimum = this._classifyNCR(cp);
|
||
|
||
// Step 4: if numericAllowed is false and no hard minimum → leave
|
||
if (!this._numericAllowed && minimum < NCR_LEVEL.remove) return undefined;
|
||
|
||
// Step 5: effective action = max(configured onNCR, range minimum)
|
||
const effective = minimum === -1
|
||
? this._ncrOnLevel
|
||
: Math.max(this._ncrOnLevel, minimum);
|
||
|
||
// Step 6: apply
|
||
return this._applyNCRAction(effective, token, cp);
|
||
}
|
||
}
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/sql.js
|
||
/**
|
||
* SQL context patterns — high-precision rules only.
|
||
*
|
||
* These rules have very low false-positive risk and are safe to apply to
|
||
* general user text (names, descriptions, search queries, etc.).
|
||
* All patterns are ReDoS-safe — unlike the `sql-injection` npm package
|
||
* which has an active CVE on its own detection regexes.
|
||
*
|
||
* For exhaustive coverage including noisier heuristics (comment sequences,
|
||
* hex literals, stacked queries with semicolons), use 'SQL-STRICT' instead.
|
||
* Apply 'SQL-STRICT' only to strings that are specifically SQL fragments,
|
||
* not to general free-text fields.
|
||
*/
|
||
|
||
const SQL_PATTERNS = [
|
||
{
|
||
id: 'sql-block-comment-open',
|
||
description: 'SQL block comment open: /* ... */ — unusual in legitimate user text',
|
||
pattern: /\/\*/,
|
||
},
|
||
{
|
||
id: 'sql-union-select',
|
||
description: 'UNION SELECT — most common SQL injection aggregation attack',
|
||
pattern: /\bUNION\s{1,20}(?:ALL\s{1,20})?SELECT\b/i,
|
||
},
|
||
{
|
||
id: 'sql-drop-table',
|
||
description: 'DROP TABLE — destructive DDL injection',
|
||
pattern: /\bDROP\s{1,20}TABLE\b/i,
|
||
},
|
||
{
|
||
id: 'sql-drop-database',
|
||
description: 'DROP DATABASE — destructive DDL injection',
|
||
pattern: /\bDROP\s{1,20}DATABASE\b/i,
|
||
},
|
||
{
|
||
id: 'sql-insert-into',
|
||
description: 'INSERT INTO — data injection',
|
||
pattern: /\bINSERT\s{1,20}INTO\b/i,
|
||
},
|
||
{
|
||
id: 'sql-delete-from',
|
||
description: 'DELETE FROM — data deletion injection',
|
||
pattern: /\bDELETE\s{1,20}FROM\b/i,
|
||
},
|
||
{
|
||
id: 'sql-update-set',
|
||
description: 'UPDATE ... SET — data modification injection',
|
||
// Allows arbitrary content between UPDATE and SET (table name, alias, etc.)
|
||
pattern: /\bUPDATE\b[\s\S]{1,60}\bSET\b/i,
|
||
},
|
||
{
|
||
id: 'sql-exec-xp',
|
||
description: 'EXEC xp_ — MSSQL extended stored procedure execution',
|
||
pattern: /\bEXEC(?:UTE)?\s{1,20}xp_/i,
|
||
},
|
||
{
|
||
id: 'sql-tautology-string',
|
||
description: "Classic string tautology: ' OR '1'='1 or \" OR \"1\"=\"1\"",
|
||
// Last quote is optional — injection may truncate it: ' OR '1'='1--
|
||
pattern: /'\s{0,10}OR\s{0,10}'[^']{0,20}'\s*=\s*'[^']{0,20}/i,
|
||
},
|
||
{
|
||
id: 'sql-tautology-numeric',
|
||
description: 'Numeric tautology: OR 1=1',
|
||
pattern: /\bOR\s{1,10}1\s*=\s*1\b/i,
|
||
},
|
||
{
|
||
id: 'sql-always-true-zero',
|
||
description: 'Numeric tautology: OR 0=0',
|
||
pattern: /\bOR\s{1,10}0\s*=\s*0\b/i,
|
||
},
|
||
{
|
||
id: 'sql-sleep-benchmark',
|
||
description: 'Time-based blind injection: SLEEP() or BENCHMARK()',
|
||
pattern: /\b(?:SLEEP|BENCHMARK)\s*\(/i,
|
||
},
|
||
{
|
||
id: 'sql-waitfor-delay',
|
||
description: 'MSSQL time-based blind injection: WAITFOR DELAY',
|
||
pattern: /\bWAITFOR\s{1,20}DELAY\b/i,
|
||
},
|
||
{
|
||
id: 'sql-char-function',
|
||
description: 'CHAR() function — used to obfuscate injected strings',
|
||
pattern: /\bCHAR\s*\(\s*\d{1,3}/i,
|
||
},
|
||
{
|
||
id: 'sql-information-schema',
|
||
description: 'INFORMATION_SCHEMA — reconnaissance query for table/column enumeration',
|
||
pattern: /\bINFORMATION_SCHEMA\b/i,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const sql = (SQL_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/sql-strict.js
|
||
/**
|
||
* SQL-STRICT context patterns.
|
||
*
|
||
* Extends the base 'SQL' context with three additional rules that are
|
||
* effective at detecting real injections but carry a higher false-positive
|
||
* risk on general free-text input.
|
||
*
|
||
* Use 'SQL-STRICT' when:
|
||
* - The string is specifically a SQL fragment or database identifier
|
||
* - You control the input domain (e.g. a dedicated SQL search field)
|
||
* - You can tolerate occasional false positives in exchange for broader coverage
|
||
*
|
||
* Use 'SQL' (not STRICT) when:
|
||
* - The field is general user text (names, descriptions, comments)
|
||
* - False positives would block legitimate content (e.g. "see note -- above")
|
||
*
|
||
* Rules moved here from 'SQL' due to false-positive risk:
|
||
*
|
||
* sql-line-comment — "--" fires on "see note -- above", "value--", CSS var(--primary)
|
||
* sql-stacked-query — "; SELECT" fires on legitimate prose with semicolons + SQL words
|
||
* sql-hex-encoding — "0xDEAD" fires on hex values in technical docs and log output
|
||
*/
|
||
|
||
|
||
|
||
const SQL_STRICT_EXTRA = [
|
||
{
|
||
id: 'sql-line-comment',
|
||
description: 'SQL line comment: -- followed by whitespace or end of string',
|
||
pattern: /--(?:\s|$)/,
|
||
},
|
||
{
|
||
id: 'sql-stacked-query',
|
||
description: 'Stacked queries: semicolon immediately followed by a SQL keyword',
|
||
pattern: /;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i,
|
||
},
|
||
{
|
||
id: 'sql-hex-encoding',
|
||
description: 'Hex-encoded string injection: 0x41414141 style (MySQL)',
|
||
pattern: /\b0x[0-9a-f]{4,}/i,
|
||
},
|
||
];
|
||
|
||
// SQL-STRICT = all base SQL rules + the three noisy extras
|
||
const SQL_STRICT_PATTERNS = [...sql, ...SQL_STRICT_EXTRA];
|
||
|
||
/* harmony default export */ const sql_strict = (SQL_STRICT_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/html.js
|
||
/**
|
||
* HTML context patterns.
|
||
*
|
||
* Detects XSS vectors that are dangerous when a string ends up rendered as HTML.
|
||
* All patterns use bounded quantifiers to ensure linear-time matching (ReDoS-safe).
|
||
*
|
||
* Each entry is { pattern: RegExp, id: string, description: string }
|
||
* so callers can inspect which rule fired if they need to.
|
||
*/
|
||
|
||
const HTML_PATTERNS = [
|
||
{
|
||
id: 'html-script-open',
|
||
description: '<script opening tag',
|
||
pattern: /<script[\s>/]/i,
|
||
},
|
||
{
|
||
id: 'html-script-close',
|
||
description: '</script closing tag',
|
||
pattern: /<\/script[\s>]/i,
|
||
},
|
||
{
|
||
id: 'html-javascript-protocol',
|
||
description: 'javascript: URI scheme (with optional whitespace/encoding)',
|
||
// Handles javascript:, j\u0061vascript:, and whitespace variants
|
||
pattern: /j[\t\n\r ]*a[\t\n\r ]*v[\t\n\r ]*a[\t\n\r ]*s[\t\n\r ]*c[\t\n\r ]*r[\t\n\r ]*i[\t\n\r ]*p[\t\n\r ]*t[\t\n\r ]*:/i,
|
||
},
|
||
{
|
||
id: 'html-vbscript-protocol',
|
||
description: 'vbscript: URI scheme',
|
||
pattern: /vbscript[\t\n\r ]*:/i,
|
||
},
|
||
{
|
||
id: 'html-data-html',
|
||
description: 'data:text/html URI — can execute scripts in browsers',
|
||
pattern: /data[\t\n\r ]*:[\t\n\r ]*text\/html/i,
|
||
},
|
||
{
|
||
id: 'html-data-xhtml',
|
||
description: 'data:application/xhtml+xml URI',
|
||
pattern: /data[\t\n\r ]*:[\t\n\r ]*application\/xhtml/i,
|
||
},
|
||
{
|
||
id: 'html-data-svg',
|
||
description: 'data:image/svg+xml URI — can execute scripts',
|
||
pattern: /data[\t\n\r ]*:[\t\n\r ]*image\/svg\+xml/i,
|
||
},
|
||
{
|
||
id: 'html-inline-event-handler',
|
||
description: 'Inline event handler attributes: onclick=, onerror=, onload=, etc.',
|
||
// \bon ensures we match a word boundary so "phonetic=" is not caught
|
||
pattern: /\bon\w{1,30}\s*=/i,
|
||
},
|
||
{
|
||
id: 'html-entity-obfuscated-script',
|
||
description: 'HTML-entity-encoded <script (e.g. <script or <script)',
|
||
// Entities include optional trailing semicolon: < or < (both valid in HTML5)
|
||
pattern: /(?:�*3[Cc];?|�*60;?|<)\s*script/i,
|
||
},
|
||
{
|
||
id: 'html-entity-obfuscated-javascript',
|
||
description: 'HTML-entity-encoded javascript: (partial — catches common j or j for "j")',
|
||
pattern: /(?:�*6[Aa];?|�*106;?)\s*(?:�*61;?|a)[\s\S]{0,80}script\s*:/i,
|
||
},
|
||
{
|
||
id: 'html-style-expression',
|
||
description: 'CSS expression() — IE-era code execution in style attributes',
|
||
pattern: /style[\s\S]{0,20}expression\s*\(/i,
|
||
},
|
||
{
|
||
id: 'html-object-embed',
|
||
description: '<object or <embed tags that can load active content',
|
||
pattern: /<(?:object|embed)[\s>/]/i,
|
||
},
|
||
{
|
||
id: 'html-base-tag',
|
||
description: '<base href= — can hijack all relative URLs on a page',
|
||
pattern: /<base[\s>]/i,
|
||
},
|
||
{
|
||
id: 'html-meta-refresh',
|
||
description: '<meta http-equiv="refresh" — can redirect users',
|
||
pattern: /<meta[\s\S]{0,40}http-equiv[\s\S]{0,20}refresh/i,
|
||
},
|
||
{
|
||
id: 'html-srcdoc',
|
||
description: 'srcdoc= attribute on iframes — embeds HTML that can run scripts',
|
||
pattern: /srcdoc\s*=/i,
|
||
},
|
||
{
|
||
id: 'html-iframe',
|
||
description: '<iframe tag',
|
||
pattern: /<iframe[\s>/]/i,
|
||
},
|
||
{
|
||
id: 'html-form',
|
||
description: '<form tag — can be used for phishing / credential harvesting injection',
|
||
pattern: /<form[\s>/]/i,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const html = (HTML_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/xml.js
|
||
/**
|
||
* XML context patterns.
|
||
*
|
||
* Detects injection vectors that are specifically dangerous when a string
|
||
* is inserted into an XML document (not HTML rendering context).
|
||
*
|
||
* Key distinction from HTML: these patterns target parser-level attacks —
|
||
* things that can confuse or subvert an XML parser, trigger external entity
|
||
* resolution, or inject DTD content. HTML rendering concerns (XSS) belong
|
||
* in the HTML context.
|
||
*/
|
||
|
||
const XML_PATTERNS = [
|
||
{
|
||
id: 'xml-cdata-injection',
|
||
description: 'CDATA section injection: <![CDATA[ breaks out of text node context',
|
||
pattern: /<!\[CDATA\[/i,
|
||
},
|
||
{
|
||
id: 'xml-cdata-close',
|
||
description: 'CDATA close sequence: ]]> can terminate an enclosing CDATA section',
|
||
pattern: /\]\]>/,
|
||
},
|
||
{
|
||
id: 'xml-processing-instruction',
|
||
description: 'XML processing instruction: <?xml-stylesheet or <?php etc.',
|
||
pattern: /<\?(?:xml[\- ]|php|asp)/i,
|
||
},
|
||
{
|
||
id: 'xml-doctype-injection',
|
||
description: 'DOCTYPE declaration embedded in content — can define entities',
|
||
// Match <!DOCTYPE followed by end-of-string, whitespace, or [ (internal subset)
|
||
pattern: /<!DOCTYPE(?:[\s[]|$)/i,
|
||
},
|
||
{
|
||
id: 'xml-entity-system',
|
||
description: 'SYSTEM keyword — used in external entity declarations (XXE)',
|
||
pattern: /\bSYSTEM\s+["']/i,
|
||
},
|
||
{
|
||
id: 'xml-entity-public',
|
||
description: 'PUBLIC keyword — used in external entity declarations (XXE)',
|
||
pattern: /\bPUBLIC\s+["']/i,
|
||
},
|
||
{
|
||
id: 'xml-entity-declaration',
|
||
description: '<!ENTITY declaration — defines entities, potential XXE or entity expansion',
|
||
pattern: /<!ENTITY[\s%]/i,
|
||
},
|
||
{
|
||
id: 'xml-billion-laughs',
|
||
description: 'Entity reference chaining / billion laughs: repeated &eX; style references',
|
||
// Heuristic: 3+ consecutive entity refs suggests expansion attack
|
||
pattern: /(?:&\w{1,20};){3,}/,
|
||
},
|
||
{
|
||
id: 'xml-namespace-confusion',
|
||
description: 'xmlns: attribute injection — can redefine namespaces to confuse parsers',
|
||
pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
|
||
},
|
||
{
|
||
id: 'xml-comment-injection',
|
||
description: '<!-- comment injection — can hide content from some parsers',
|
||
pattern: /<!--/,
|
||
},
|
||
{
|
||
id: 'xml-comment-close',
|
||
description: '--> closes an enclosing XML comment',
|
||
pattern: /--!?>/,
|
||
},
|
||
{
|
||
id: 'xml-pi-close',
|
||
description: '?> closes an enclosing processing instruction',
|
||
pattern: /\?>/,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const xml = (XML_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/svg.js
|
||
/**
|
||
* SVG context patterns.
|
||
*
|
||
* SVG is XML-based but renders in browsers, giving it a unique attack surface
|
||
* that combines XML parser behaviour with browser rendering and JavaScript execution.
|
||
*
|
||
* Many of these vectors bypass HTML sanitizers that don't understand SVG semantics
|
||
* (DOMPurify has documented bypass vulnerabilities specifically in SVG/XML context).
|
||
*/
|
||
|
||
const SVG_PATTERNS = [
|
||
{
|
||
id: 'svg-script-element',
|
||
description: '<script element inside SVG executes JavaScript',
|
||
pattern: /<script[\s>/]/i,
|
||
},
|
||
{
|
||
id: 'svg-xlink-href-javascript',
|
||
description: 'xlink:href with javascript: — classic SVG XSS via <a> or <use>',
|
||
pattern: /xlink\s*:\s*href\s*=\s*["']?\s*javascript\s*:/i,
|
||
},
|
||
{
|
||
id: 'svg-href-javascript',
|
||
description: 'href= with javascript: in SVG context (<a>, <animate>, etc.)',
|
||
pattern: /href\s*=\s*["']?\s*javascript\s*:/i,
|
||
},
|
||
{
|
||
id: 'svg-foreignobject',
|
||
description: '<foreignObject embeds HTML inside SVG — can execute scripts',
|
||
pattern: /<foreignObject[\s>/]/i,
|
||
},
|
||
{
|
||
id: 'svg-use-external',
|
||
description: '<use xlink:href or href pointing to external resource (non-fragment URL)',
|
||
// Match <use with href= where the value starts with a non-# character (external URL)
|
||
// [\"'][^#] catches quoted values not starting with #; [^\"'#\s>] catches unquoted
|
||
pattern: /<use[\s\S]{0,60}(?:xlink\s*:\s*)?href\s*=\s*(?:["'][^#]|[^"'#\s>])/i,
|
||
},
|
||
{
|
||
id: 'svg-animate-href',
|
||
description: '<animate attributeName="href" — can dynamically change href to javascript:',
|
||
pattern: /<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*href["']/i,
|
||
},
|
||
{
|
||
id: 'svg-animate-xlinkhref',
|
||
description: '<animate attributeName="xlink:href"',
|
||
pattern: /<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*xlink\s*:\s*href["']/i,
|
||
},
|
||
{
|
||
id: 'svg-set-javascript',
|
||
description: '<set to="javascript:..." — sets an attribute to a javascript: URI',
|
||
pattern: /<set[\s\S]{0,80}to\s*=\s*["']?\s*javascript\s*:/i,
|
||
},
|
||
{
|
||
id: 'svg-event-handler',
|
||
description: 'SVG-specific event handler attributes: onload=, onerror=, onactivate=, etc.',
|
||
pattern: /\bon(?:load|error|activate|begin|end|repeat|focus|blur|click|mouse\w{1,20}|key\w{1,20})\s*=/i,
|
||
},
|
||
{
|
||
id: 'svg-handler-generic',
|
||
description: 'Generic on* handler catch-all for SVG attributes',
|
||
pattern: /\bon\w{1,30}\s*=/i,
|
||
},
|
||
{
|
||
id: 'svg-filter-feimage',
|
||
description: '<feImage href= — filter primitive that can load external resources',
|
||
pattern: /<feImage[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=/i,
|
||
},
|
||
{
|
||
id: 'svg-image-external',
|
||
description: '<image xlink:href with http/https or javascript protocol',
|
||
pattern: /<image[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=\s*["']?\s*(?:https?|javascript)\s*:/i,
|
||
},
|
||
{
|
||
id: 'svg-style-javascript',
|
||
description: 'style= attribute containing javascript: (e.g. background:url(javascript:...))',
|
||
pattern: /style\s*=[\s\S]{0,60}javascript\s*:/i,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const svg = (SVG_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/shell.js
|
||
/**
|
||
* SHELL context patterns.
|
||
*
|
||
* Detects shell injection vectors and path traversal patterns.
|
||
* Designed for use when a string will be passed to a shell command,
|
||
* used as a file path, or interpolated into OS-level operations.
|
||
*/
|
||
|
||
const SHELL_PATTERNS = [
|
||
{
|
||
id: 'shell-path-traversal-unix',
|
||
description: 'Unix path traversal: ../ — climbing the directory tree',
|
||
pattern: /\.\.\//,
|
||
},
|
||
{
|
||
id: 'shell-path-traversal-windows',
|
||
description: 'Windows path traversal: ..\\ — climbing the directory tree',
|
||
pattern: /\.\.\\/,
|
||
},
|
||
{
|
||
id: 'shell-path-traversal-encoded',
|
||
description: 'URL-encoded path traversal: %2e%2e or %2f variants',
|
||
pattern: /%2e%2e|%2f\.\.|\.\.%2f/i,
|
||
},
|
||
{
|
||
id: 'shell-null-byte',
|
||
description: 'Null byte injection: \\x00 or %00 — truncates strings in C-backed functions',
|
||
pattern: /\x00|%00/,
|
||
},
|
||
{
|
||
id: 'shell-semicolon',
|
||
description: 'Semicolon command separator: cmd1; cmd2',
|
||
pattern: /;/,
|
||
},
|
||
{
|
||
id: 'shell-pipe',
|
||
description: 'Pipe operator: cmd1 | cmd2',
|
||
pattern: /\|/,
|
||
},
|
||
{
|
||
id: 'shell-and-operator',
|
||
description: 'AND operator: cmd1 && cmd2',
|
||
pattern: /&&/,
|
||
},
|
||
{
|
||
id: 'shell-or-operator',
|
||
description: 'OR operator: cmd1 || cmd2',
|
||
pattern: /\|\|/,
|
||
},
|
||
{
|
||
id: 'shell-backtick',
|
||
description: 'Backtick command substitution: `cmd`',
|
||
pattern: /`/,
|
||
},
|
||
{
|
||
id: 'shell-dollar-paren',
|
||
description: 'Dollar-paren command substitution: $(cmd)',
|
||
pattern: /\$\(/,
|
||
},
|
||
{
|
||
id: 'shell-dollar-brace',
|
||
description: 'Dollar-brace variable expansion: ${var} — can be abused for injection',
|
||
pattern: /\$\{/,
|
||
},
|
||
{
|
||
id: 'shell-redirect-out',
|
||
description: 'Output redirection: cmd > file or cmd >> file',
|
||
pattern: />{1,2}/,
|
||
},
|
||
{
|
||
id: 'shell-redirect-in',
|
||
description: 'Input redirection: cmd < file',
|
||
pattern: /</,
|
||
},
|
||
{
|
||
id: 'shell-newline-injection',
|
||
description: 'Newline injection: \\n or \\r — can inject new shell commands',
|
||
pattern: /[\n\r]/,
|
||
},
|
||
{
|
||
id: 'shell-glob-star',
|
||
description: 'Glob expansion: * or ? — can expand to unintended files',
|
||
// Only flag when combined with path separators to reduce false positives
|
||
pattern: /[/\\][*?]/,
|
||
},
|
||
{
|
||
id: 'shell-absolute-root',
|
||
description: 'Absolute root path injection: string starting with / or \\ (Windows UNC)',
|
||
pattern: /^(?:\/|\\\\)/,
|
||
},
|
||
{
|
||
id: 'shell-windows-drive',
|
||
description: 'Windows drive letter path injection: C:\\ or D:/',
|
||
pattern: /^[a-zA-Z]:[/\\]/,
|
||
},
|
||
{
|
||
id: 'shell-curl-wget',
|
||
description: 'curl/wget with URL or flags — can exfiltrate data or download payloads',
|
||
// Require a URL scheme (http/https/ftp) or a flag (-) to reduce false positives
|
||
// "curl is a tool" won't match; "curl http://..." or "curl -s ..." will
|
||
pattern: /\b(?:curl|wget)\s+(?:https?:\/\/|ftp:\/\/|-)/i,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const shell = (SHELL_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/redos.js
|
||
/**
|
||
* REDOS context patterns.
|
||
*
|
||
* Detects strings that, if used as regular expressions, could cause
|
||
* catastrophic backtracking (ReDoS — Regular Expression Denial of Service).
|
||
*
|
||
* These patterns detect the structural forms that lead to exponential or
|
||
* polynomial backtracking in NFA-based regex engines (V8, PCRE, Java, etc.).
|
||
*
|
||
* Use this context when user-supplied strings will be compiled into RegExp objects.
|
||
*/
|
||
|
||
const REDOS_PATTERNS = [
|
||
{
|
||
id: 'redos-nested-quantifier-plus',
|
||
description: 'Nested + quantifier inside a group with outer quantifier: (a+)+, (.+b)*, etc.',
|
||
// Matches any group containing a + quantifier, with an outer * or + — catches (a+)+, (.+b)*, etc.
|
||
pattern: /\([^)]*\+[^)]*\)[+*]/,
|
||
},
|
||
{
|
||
id: 'redos-nested-quantifier-star',
|
||
description: 'Nested * quantifier: (a*)* or (a*)+ — catastrophic backtracking',
|
||
pattern: /\([^)]*\*[^)]*\)[*+]/,
|
||
},
|
||
{
|
||
id: 'redos-nested-groups',
|
||
description: 'Doubly nested quantified groups: ((a+)+) — guaranteed catastrophic',
|
||
pattern: /\(\([^)]{0,40}\)[+*]\)[+*]/,
|
||
},
|
||
{
|
||
id: 'redos-alternation-overlap',
|
||
description: 'Overlapping alternation under quantifier: (a|a)+ — ambiguous NFA paths',
|
||
// Detect repeated identical alternatives under a quantifier
|
||
pattern: /\(([^|()]{1,20})\|(?:\1)(?:\|[^|()]{1,20}){0,5}\)[+*?]{1,2}/,
|
||
},
|
||
{
|
||
id: 'redos-star-plus-concat',
|
||
description: '(x*x)+ pattern — triggers super-linear backtracking',
|
||
pattern: /\([^)]{0,10}\*[^)]{0,10}\)[+*]/,
|
||
},
|
||
{
|
||
id: 'redos-dot-star-greedy',
|
||
description: '(.*){n,} or (.+){n,} — repeated greedy dot quantifiers',
|
||
pattern: /\(\.[*+]\)\{?\d/,
|
||
},
|
||
{
|
||
id: 'redos-large-repetition',
|
||
description: 'Very large fixed or range repetition count {1000,} or {1000,n} — denial of service via backtracking',
|
||
// Matches { followed by 4+ digits (≥1000), then optional ,digits }
|
||
pattern: /\{\d{4,}(?:,\d*)?\}/,
|
||
},
|
||
{
|
||
id: 'redos-catastrophic-alternation',
|
||
description: 'Long alternation with many similar branches — polynomial backtracking risk',
|
||
// Heuristic: 10+ pipe-separated alternatives in a single group
|
||
pattern: /\([^)]{0,200}(?:\|[^|)]{0,50}){9,}\)/,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const redos = (REDOS_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/nosql.js
|
||
/**
|
||
* NOSQL context patterns.
|
||
*
|
||
* Detects injection vectors specific to NoSQL databases (primarily MongoDB)
|
||
* and JavaScript-evaluated queries.
|
||
*
|
||
* Attack categories:
|
||
* 1. MongoDB query operator injection: $where, $ne, $gt, $regex, $or, $and, etc.
|
||
* These operators, when injected into a JSON query object, can bypass
|
||
* authentication or exfiltrate data without knowing passwords.
|
||
*
|
||
* 2. JavaScript execution: $where clauses execute arbitrary JS server-side.
|
||
*
|
||
* 3. Prototype pollution: __proto__, constructor.prototype — can corrupt
|
||
* the prototype chain of all objects in the Node.js process.
|
||
*
|
||
* Pattern note: MongoDB operators appear as JSON keys. In JSON, keys are
|
||
* quoted: {"$where": ...} so the pattern must allow an optional closing
|
||
* quote between the operator name and the colon: /\$where["'\s]*:/
|
||
*/
|
||
|
||
// Shared suffix: optional closing quote/whitespace before the colon
|
||
// Handles: $op: (bare), "$op": (JSON), '$op': (single-quoted)
|
||
const SEP = /["'\s]*:/;
|
||
const sep = '["\'\\s]*:';
|
||
|
||
const NOSQL_PATTERNS = [
|
||
// ─── MongoDB $ operator injection ────────────────────────────────────────
|
||
{
|
||
id: 'nosql-where-operator',
|
||
description: '$where — executes arbitrary JavaScript server-side in MongoDB',
|
||
pattern: new RegExp(`\\$where${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-ne-operator',
|
||
description: '$ne — "not equal" operator used to bypass equality checks',
|
||
pattern: new RegExp(`\\$ne${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-gt-operator',
|
||
description: '$gt — "greater than" used to bypass password/value checks',
|
||
pattern: new RegExp(`\\$gte?${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-lt-operator',
|
||
description: '$lt / $lte — "less than" bypass variants',
|
||
pattern: new RegExp(`\\$lte?${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-regex-operator',
|
||
description: '$regex — can be used to extract data character by character (blind injection)',
|
||
pattern: new RegExp(`\\$regex${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-or-operator',
|
||
description: '$or — logical OR; used to create always-true conditions',
|
||
pattern: new RegExp(`\\$or${sep}\\s*\\[`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-and-operator',
|
||
description: '$and — logical AND operator injection',
|
||
pattern: new RegExp(`\\$and${sep}\\s*\\[`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-nor-operator',
|
||
description: '$nor — logical NOR operator injection',
|
||
pattern: new RegExp(`\\$nor${sep}\\s*\\[`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-exists-operator',
|
||
description: '$exists — can enumerate fields to determine schema',
|
||
pattern: new RegExp(`\\$exists${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-in-operator',
|
||
description: '$in — matches any value in a list; can enumerate values',
|
||
pattern: new RegExp(`\\$in${sep}\\s*\\[`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-expr-operator',
|
||
description: '$expr — allows aggregation expressions in queries (MongoDB 3.6+)',
|
||
pattern: new RegExp(`\\$expr${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-function-operator',
|
||
description: '$function — executes arbitrary JavaScript in MongoDB 4.4+',
|
||
pattern: new RegExp(`\\$function${sep}`, 'i'),
|
||
},
|
||
{
|
||
id: 'nosql-accumulator-operator',
|
||
description: '$accumulator — custom aggregation with arbitrary JS execution',
|
||
pattern: new RegExp(`\\$accumulator${sep}`, 'i'),
|
||
},
|
||
// ─── Prototype pollution ─────────────────────────────────────────────────
|
||
{
|
||
id: 'nosql-proto-pollution',
|
||
description: '__proto__ — prototype pollution via object key injection',
|
||
pattern: /__proto__/,
|
||
},
|
||
{
|
||
id: 'nosql-constructor-prototype',
|
||
description: 'constructor.prototype — alternative prototype pollution vector (dot notation or JSON key)',
|
||
// Matches dot-notation (obj.constructor.prototype) and JSON key adjacency
|
||
// ("constructor": {"prototype": ...})
|
||
pattern: /constructor[\s"':.,{\[]*prototype/i,
|
||
},
|
||
{
|
||
id: 'nosql-proto-bracket',
|
||
description: '["__proto__"] — bracket-notation prototype pollution',
|
||
pattern: /\[["']__proto__["']\]/,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const nosql = (NOSQL_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/contexts/log.js
|
||
/**
|
||
* LOG context patterns.
|
||
*
|
||
* Detects injection vectors that are dangerous when a string is written
|
||
* to a log file, passed to a logging framework, or interpolated into
|
||
* a log message that will be parsed or displayed.
|
||
*
|
||
* Attack categories:
|
||
* 1. CRLF injection — injects fake log lines by embedding newlines
|
||
* 2. Log4Shell (CVE-2021-44228) — ${jndi:...} triggers JNDI lookup in Log4j
|
||
* 3. SSTI in log templates — {{...}}, #{...} trigger template evaluation
|
||
* if the log message is passed through a template engine
|
||
* 4. Null byte injection — truncates log entries in some implementations
|
||
* 5. ANSI escape injection — manipulates terminal output when logs are
|
||
* tailed in a terminal (colour codes, cursor movement, etc.)
|
||
*
|
||
* Note: Newline characters (\n, \r) will produce false positives for
|
||
* multi-line legitimate values. Use this context only for single-line
|
||
* log field values (usernames, IDs, request parameters, etc.).
|
||
*/
|
||
|
||
const LOG_PATTERNS = [
|
||
// ─── CRLF / newline injection ─────────────────────────────────────────────
|
||
{
|
||
id: 'log-crlf-injection',
|
||
description: 'CRLF injection: literal \\r or \\n embeds fake log lines',
|
||
pattern: /[\r\n]/,
|
||
},
|
||
{
|
||
id: 'log-url-encoded-crlf',
|
||
description: 'URL-encoded CRLF: %0d, %0a, %0D, %0A — decoded by some log parsers',
|
||
pattern: /%0[dDaA]/,
|
||
},
|
||
{
|
||
id: 'log-unicode-newline',
|
||
description: 'Unicode newline variants: U+2028 (line separator), U+2029 (paragraph separator)',
|
||
pattern: /[\u2028\u2029]/,
|
||
},
|
||
|
||
// ─── Log4Shell / JNDI injection (CVE-2021-44228) ─────────────────────────
|
||
{
|
||
id: 'log-log4shell-jndi',
|
||
description: 'Log4Shell: ${jndi:...} triggers remote code execution in Apache Log4j',
|
||
pattern: /\$\{jndi\s*:/i,
|
||
},
|
||
{
|
||
id: 'log-log4shell-obfuscated',
|
||
description: 'Obfuscated Log4Shell: ${::-j}... lookup-bypass prefix used to evade WAF detection',
|
||
// ${::- is the Log4j lookup-bypass escape sequence; presence alone is suspicious
|
||
pattern: /\$\{::-/,
|
||
},
|
||
{
|
||
id: 'log-log4j-lookup',
|
||
description: 'Log4j lookup syntax: ${env:...}, ${sys:...}, ${ctx:...} — data exfiltration',
|
||
pattern: /\$\{(?:env|sys|ctx|main|map|sd|web|docker|k8s|spring)\s*:/i,
|
||
},
|
||
|
||
// ─── Server-Side Template Injection (SSTI) in log messages ───────────────
|
||
{
|
||
id: 'log-ssti-double-brace',
|
||
description: 'SSTI double-brace: {{expression}} — Jinja2, Twig, Handlebars, etc.',
|
||
pattern: /\{\{[\s\S]{0,80}\}\}/,
|
||
},
|
||
{
|
||
id: 'log-ssti-hash-brace',
|
||
description: 'SSTI hash-brace: #{expression} — Thymeleaf, Velocity, Ruby ERB',
|
||
pattern: /#\{[\s\S]{0,80}\}/,
|
||
},
|
||
{
|
||
id: 'log-ssti-dollar-brace',
|
||
description: 'SSTI/EL injection: ${expression with operators or method calls} — JSP EL, Freemarker, SpEL',
|
||
// Require that the ${...} content looks like an expression, not a plain variable name.
|
||
// Flags if the content contains: . ( * + operators, or known SSTI keywords.
|
||
// This avoids flagging ${PATH}, ${HOME} etc. (plain shell variables).
|
||
pattern: /\$\{[^}]*(?:\.|\(|\*|\+|\bclass\b|\bruntime\b|\bprocess\b|\bexec\b)[^}]{0,80}\}/i,
|
||
},
|
||
{
|
||
id: 'log-ssti-percent-tag',
|
||
description: 'SSTI ERB/ASP tag: <%= expression %> — Ruby ERB, ASP',
|
||
pattern: /<%=[\s\S]{0,80}%>/,
|
||
},
|
||
|
||
// ─── Null byte ────────────────────────────────────────────────────────────
|
||
{
|
||
id: 'log-null-byte',
|
||
description: 'Null byte: \\x00 or %00 — can truncate log entries in C-backed loggers',
|
||
pattern: /\x00|%00/,
|
||
},
|
||
|
||
// ─── ANSI escape injection ────────────────────────────────────────────────
|
||
{
|
||
id: 'log-ansi-escape',
|
||
description: 'ANSI escape sequence: ESC[ — can manipulate terminal output when logs are tailed',
|
||
pattern: /\x1b\[/,
|
||
},
|
||
];
|
||
|
||
/* harmony default export */ const log = (LOG_PATTERNS);
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/is-unsafe/src/index.js
|
||
/**
|
||
* is-unsafe v2
|
||
*
|
||
* Zero-dependency, DOM-free, pure predicate for detecting unsafe strings
|
||
* across HTML, XML, SVG, SQL, SQL-STRICT, SHELL, REDOS, NOSQL, and LOG contexts.
|
||
*
|
||
* v2 change: contexts are imported as named pattern arrays rather than resolved
|
||
* via a string-keyed registry. This makes each context independently
|
||
* tree-shakeable — bundlers can drop any context you never import.
|
||
*
|
||
* @module is-unsafe
|
||
*/
|
||
|
||
// ─── Context pattern arrays (named exports) ────────────────────────────────
|
||
// Import only the ones you need. Each is independently tree-shakeable.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
// SQL-STRICT needs a quoted identifier because of the hyphen
|
||
|
||
|
||
|
||
// ─── VALID_CONTEXTS convenience re-export ─────────────────────────────────
|
||
// Importing this pulls in ALL contexts. Use it only when you need all of them
|
||
// (e.g. for validation UI, tooling, or exhaustive audits).
|
||
// If you only need a subset, import the named contexts directly instead.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
// ─── Attach labels to named contexts ──────────────────────────────────────
|
||
// Each built-in PatternList carries its canonical name so matchList can read
|
||
// list.label directly — no registry lookup needed at match time.
|
||
// Custom PatternLists default to 'CUSTOM' unless the caller sets list.label.
|
||
|
||
html.label = 'HTML';
|
||
xml.label = 'XML';
|
||
svg.label = 'SVG';
|
||
sql.label = 'SQL';
|
||
sql_strict.label = 'SQL-STRICT';
|
||
shell.label = 'SHELL';
|
||
redos.label = 'REDOS';
|
||
nosql.label = 'NOSQL';
|
||
log.label = 'LOG';
|
||
|
||
const VALID_CONTEXTS = Object.freeze({
|
||
HTML: html,
|
||
XML: xml,
|
||
SVG: svg,
|
||
SQL: sql,
|
||
'SQL-STRICT': sql_strict,
|
||
SHELL: shell,
|
||
REDOS: redos,
|
||
NOSQL: nosql,
|
||
LOG: log,
|
||
});
|
||
|
||
// ─── Types ────────────────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* @typedef {{ id: string, description: string, pattern: RegExp }} Rule
|
||
*/
|
||
|
||
/**
|
||
* @typedef {Rule[]} PatternList
|
||
*/
|
||
|
||
/**
|
||
* @typedef {Object} MatchResult
|
||
* @property {string} context - Label identifying which context matched ('HTML', 'CUSTOM', etc.)
|
||
* @property {string} id - Rule identifier
|
||
* @property {string} description - Human-readable description of what was matched
|
||
* @property {RegExp} pattern - The pattern that matched
|
||
*/
|
||
|
||
// ─── Internal helpers ──────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* @param {unknown} value
|
||
*/
|
||
function assertString(value) {
|
||
if (typeof value !== 'string') {
|
||
throw new TypeError(
|
||
`is-unsafe: first argument must be a string, got ${typeof value}`
|
||
);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* @param {unknown} context
|
||
*/
|
||
function assertContext(context) {
|
||
if (context instanceof RegExp) return;
|
||
|
||
if (Array.isArray(context)) {
|
||
if (context.length === 0) {
|
||
throw new TypeError('is-unsafe: context must not be an empty array');
|
||
}
|
||
// Detect array-of-arrays vs flat pattern list
|
||
if (Array.isArray(context[0])) {
|
||
// Array of PatternLists
|
||
for (const list of context) {
|
||
if (!Array.isArray(list) || list.length === 0) {
|
||
throw new TypeError(
|
||
'is-unsafe: each context in the array must be a non-empty pattern array (PatternList)'
|
||
);
|
||
}
|
||
}
|
||
}
|
||
// else: flat PatternList — trust it, no deep validation needed
|
||
return;
|
||
}
|
||
|
||
throw new TypeError(
|
||
`is-unsafe: second argument must be a PatternList (e.g. HTML), ` +
|
||
`an array of PatternLists (e.g. [HTML, XML]), or a RegExp. Got: ${typeof context}`
|
||
);
|
||
}
|
||
|
||
/**
|
||
* Normalise any valid context arg into an array of PatternLists.
|
||
*
|
||
* @param {Rule[]|Rule[][]|RegExp} context
|
||
* @returns {{ lists: Rule[][]|null, regex: RegExp|null }}
|
||
*/
|
||
function normalise(context) {
|
||
if (context instanceof RegExp) return { lists: null, regex: context };
|
||
// Distinguish PatternList (array of rule objects) from array of PatternLists
|
||
if (Array.isArray(context[0])) return { lists: context, regex: null };
|
||
return { lists: [context], regex: null };
|
||
}
|
||
|
||
/**
|
||
* Test value against a single PatternList. Returns the first MatchResult or null.
|
||
*
|
||
* @param {string} value
|
||
* @param {Rule[]} list
|
||
* @returns {MatchResult|null}
|
||
*/
|
||
function matchList(value, list) {
|
||
const label = list.label ?? 'CUSTOM';
|
||
for (const rule of list) {
|
||
if (rule.pattern.test(value)) {
|
||
return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern };
|
||
}
|
||
}
|
||
return null;
|
||
}
|
||
|
||
// ─── Public API ───────────────────────────────────────────────────────────
|
||
|
||
/**
|
||
* Returns `true` if `value` is unsafe in the given context(s), `false` otherwise.
|
||
*
|
||
* @param {string} value - The string to test
|
||
* @param {PatternList | PatternList[] | RegExp} context
|
||
* - A PatternList imported from is-unsafe (e.g. `HTML`, `XML`)
|
||
* - An array of PatternLists — returns true if unsafe in **any** of them
|
||
* - A custom RegExp — returns true if the pattern matches
|
||
* @returns {boolean}
|
||
*
|
||
* @example
|
||
* import { isUnsafe, HTML, SQL } from 'is-unsafe';
|
||
*
|
||
* isUnsafe('<script>alert(1)</script>', HTML) // true
|
||
* isUnsafe('hello world', HTML) // false
|
||
* isUnsafe('value', [HTML, SQL]) // false
|
||
* isUnsafe('value', /my-pattern/i) // false
|
||
*/
|
||
function isUnsafe(value, context) {
|
||
assertString(value);
|
||
assertContext(context);
|
||
|
||
const { lists, regex } = normalise(context);
|
||
|
||
if (regex) return regex.test(value);
|
||
|
||
for (const list of lists) {
|
||
if (matchList(value, list) !== null) return true;
|
||
}
|
||
return false;
|
||
}
|
||
|
||
/**
|
||
* Like `isUnsafe`, but returns the first `MatchResult` describing **why**
|
||
* the value was flagged, or `null` if it is safe.
|
||
*
|
||
* @param {string} value
|
||
* @param {PatternList | PatternList[] | RegExp} context
|
||
* @returns {MatchResult|null}
|
||
*
|
||
* @example
|
||
* import { whyUnsafe, HTML } from 'is-unsafe';
|
||
*
|
||
* whyUnsafe('<script>alert(1)</script>', HTML)
|
||
* // { context: 'HTML', id: 'html-script-open', description: '...', pattern: /.../ }
|
||
*/
|
||
function whyUnsafe(value, context) {
|
||
assertString(value);
|
||
assertContext(context);
|
||
|
||
const { lists, regex } = normalise(context);
|
||
|
||
if (regex) {
|
||
return regex.test(value)
|
||
? { context: 'CUSTOM', id: 'custom-regex', description: 'Matched caller-supplied pattern', pattern: regex }
|
||
: null;
|
||
}
|
||
|
||
for (const list of lists) {
|
||
const result = matchList(value, list);
|
||
if (result !== null) return result;
|
||
}
|
||
return null;
|
||
}
|
||
|
||
/**
|
||
* Returns **all** matching rules across the given context(s), or an empty
|
||
* array if the value is safe. Useful for comprehensive auditing.
|
||
*
|
||
* @param {string} value
|
||
* @param {PatternList | PatternList[] | RegExp} context
|
||
* @returns {MatchResult[]}
|
||
*/
|
||
function allUnsafe(value, context) {
|
||
assertString(value);
|
||
assertContext(context);
|
||
|
||
const { lists, regex } = normalise(context);
|
||
const results = [];
|
||
|
||
if (regex) {
|
||
if (regex.test(value)) {
|
||
results.push({ context: 'CUSTOM', id: 'custom-regex', description: 'Matched caller-supplied pattern', pattern: regex });
|
||
}
|
||
return results;
|
||
}
|
||
|
||
for (const list of lists) {
|
||
const label = list.label ?? 'CUSTOM';
|
||
for (const rule of list) {
|
||
if (rule.pattern.test(value)) {
|
||
results.push({ context: label, id: rule.id, description: rule.description, pattern: rule.pattern });
|
||
}
|
||
}
|
||
}
|
||
|
||
return results;
|
||
}
|
||
|
||
|
||
/* harmony default export */ const is_unsafe_src = ((/* unused pure expression or super */ null && (isUnsafe)));
|
||
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/OrderedObjParser.js
|
||
|
||
///@ts-check
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
// const regx =
|
||
// '<((!\\[CDATA\\[([\\s\\S]*?)(]]>))|((NAME:)?(NAME))([^>]*)>|((\\/)(NAME)\\s*>))([^<]*)'
|
||
// .replace(/NAME/g, util.nameRegexp);
|
||
|
||
//const tagsRegx = new RegExp("<(\\/?[\\w:\\-\._]+)([^>]*)>(\\s*"+cdataRegx+")*([^<]+)?","g");
|
||
//const tagsRegx = new RegExp("<(\\/?)((\\w*:)?([\\w:\\-\._]+))([^>]*)>([^<]*)("+cdataRegx+"([^<]*))*([^<]+)?","g");
|
||
|
||
// Helper functions for attribute and namespace handling
|
||
|
||
/**
|
||
* Extract raw attributes (without prefix) from prefixed attribute map
|
||
* @param {object} prefixedAttrs - Attributes with prefix from buildAttributesMap
|
||
* @param {object} options - Parser options containing attributeNamePrefix
|
||
* @returns {object} Raw attributes for matcher
|
||
*/
|
||
function extractRawAttributes(prefixedAttrs, options) {
|
||
if (!prefixedAttrs) return {};
|
||
|
||
// Handle attributesGroupName option
|
||
const attrs = options.attributesGroupName
|
||
? prefixedAttrs[options.attributesGroupName]
|
||
: prefixedAttrs;
|
||
|
||
if (!attrs) return {};
|
||
|
||
const rawAttrs = {};
|
||
for (const key in attrs) {
|
||
// Remove the attribute prefix to get raw name
|
||
if (key.startsWith(options.attributeNamePrefix)) {
|
||
const rawName = key.substring(options.attributeNamePrefix.length);
|
||
rawAttrs[rawName] = attrs[key];
|
||
} else {
|
||
// Attribute without prefix (shouldn't normally happen, but be safe)
|
||
rawAttrs[key] = attrs[key];
|
||
}
|
||
}
|
||
return rawAttrs;
|
||
}
|
||
|
||
/**
|
||
* Extract namespace from raw tag name
|
||
* @param {string} rawTagName - Tag name possibly with namespace (e.g., "soap:Envelope")
|
||
* @returns {string|undefined} Namespace or undefined
|
||
*/
|
||
function extractNamespace(rawTagName) {
|
||
if (!rawTagName || typeof rawTagName !== 'string') return undefined;
|
||
|
||
const colonIndex = rawTagName.indexOf(':');
|
||
if (colonIndex !== -1 && colonIndex > 0) {
|
||
const ns = rawTagName.substring(0, colonIndex);
|
||
// Don't treat xmlns as a namespace
|
||
if (ns !== 'xmlns') {
|
||
return ns;
|
||
}
|
||
}
|
||
return undefined;
|
||
}
|
||
|
||
class OrderedObjParser {
|
||
constructor(options, externalEntities) {
|
||
this.options = options;
|
||
this.currentNode = null;
|
||
this.tagsNodeStack = [];
|
||
this.parseXml = parseXml;
|
||
this.parseTextData = parseTextData;
|
||
this.resolveNameSpace = resolveNameSpace;
|
||
this.buildAttributesMap = buildAttributesMap;
|
||
this.isItStopNode = isItStopNode;
|
||
this.replaceEntitiesValue = replaceEntitiesValue;
|
||
this.readStopNodeData = readStopNodeData;
|
||
this.saveTextToParentTag = saveTextToParentTag;
|
||
this.addChild = addChild;
|
||
this.ignoreAttributesFn = getIgnoreAttributesFn(this.options.ignoreAttributes)
|
||
this.entityExpansionCount = 0;
|
||
this.currentExpandedLength = 0;
|
||
this.doctypefound = false;
|
||
let namedEntities = { ...XML };
|
||
if (this.options.entityDecoder) {
|
||
this.entityDecoder = this.options.entityDecoder
|
||
} else {
|
||
if (typeof this.options.htmlEntities === "object") namedEntities = this.options.htmlEntities;
|
||
else if (this.options.htmlEntities === true) namedEntities = { ...COMMON_HTML, ...CURRENCY };
|
||
this.entityDecoder = new EntityDecoder({
|
||
namedEntities: { ...namedEntities, ...externalEntities },
|
||
numericAllowed: this.options.htmlEntities,
|
||
limit: {
|
||
maxTotalExpansions: this.options.processEntities.maxTotalExpansions,
|
||
maxExpandedLength: this.options.processEntities.maxExpandedLength,
|
||
applyLimitsTo: this.options.processEntities.appliesTo,
|
||
},
|
||
// onExternalEntity: (name, value) => isUnsafe(value) ? 'block' : 'allow',
|
||
onInputEntity: (name, value) =>
|
||
//TODO: VALID_CONTEXTS.HTML should be set only if this.options.htmlEntities
|
||
isUnsafe(value, [html, xml]) ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW,
|
||
|
||
//postCheck: resolved => resolved
|
||
});
|
||
}
|
||
|
||
// Initialize path matcher for path-expression-matcher
|
||
this.matcher = new Matcher/* default */.A();
|
||
this.readonlyMatcher = this.matcher.readOnly();
|
||
|
||
// Flag to track if current node is a stop node (optimization)
|
||
this.isCurrentNodeStopNode = false;
|
||
|
||
// Pre-compile stopNodes expressions
|
||
this.stopNodeExpressionsSet = new ExpressionSet();
|
||
const stopNodesOpts = this.options.stopNodes;
|
||
if (stopNodesOpts && stopNodesOpts.length > 0) {
|
||
for (let i = 0; i < stopNodesOpts.length; i++) {
|
||
const stopNodeExp = stopNodesOpts[i];
|
||
if (typeof stopNodeExp === 'string') {
|
||
// Convert string to Expression object
|
||
this.stopNodeExpressionsSet.add(new Expression/* default */.A(stopNodeExp));
|
||
} else if (stopNodeExp instanceof Expression/* default */.A) {
|
||
// Already an Expression object
|
||
this.stopNodeExpressionsSet.add(stopNodeExp);
|
||
}
|
||
}
|
||
this.stopNodeExpressionsSet.seal();
|
||
}
|
||
}
|
||
|
||
}
|
||
|
||
|
||
/**
|
||
* @param {string} val
|
||
* @param {string} tagName
|
||
* @param {string|Matcher} jPath - jPath string or Matcher instance based on options.jPath
|
||
* @param {boolean} dontTrim
|
||
* @param {boolean} hasAttributes
|
||
* @param {boolean} isLeafNode
|
||
* @param {boolean} escapeEntities
|
||
*/
|
||
function parseTextData(val, tagName, jPath, dontTrim, hasAttributes, isLeafNode, escapeEntities) {
|
||
const options = this.options;
|
||
if (val !== undefined) {
|
||
if (options.trimValues && !dontTrim) {
|
||
val = val.trim();
|
||
}
|
||
if (val.length > 0) {
|
||
if (!escapeEntities) val = this.replaceEntitiesValue(val, tagName, jPath);
|
||
|
||
// Pass jPath string or matcher based on options.jPath setting
|
||
const jPathOrMatcher = options.jPath ? jPath.toString() : jPath;
|
||
const newval = options.tagValueProcessor(tagName, val, jPathOrMatcher, hasAttributes, isLeafNode);
|
||
if (newval === null || newval === undefined) {
|
||
//don't parse
|
||
return val;
|
||
} else if (typeof newval !== typeof val || newval !== val) {
|
||
//overwrite
|
||
return newval;
|
||
} else if (options.trimValues) {
|
||
return parseValue(val, options.parseTagValue, options.numberParseOptions);
|
||
} else {
|
||
const trimmedVal = val.trim();
|
||
if (trimmedVal === val) {
|
||
return parseValue(val, options.parseTagValue, options.numberParseOptions);
|
||
} else {
|
||
return val;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
function resolveNameSpace(tagname) {
|
||
if (this.options.removeNSPrefix) {
|
||
const tags = tagname.split(':');
|
||
const prefix = tagname.charAt(0) === '/' ? '/' : '';
|
||
if (tags[0] === 'xmlns') {
|
||
return '';
|
||
}
|
||
if (tags.length === 2) {
|
||
tagname = prefix + tags[1];
|
||
}
|
||
}
|
||
return tagname;
|
||
}
|
||
|
||
//TODO: change regex to capture NS
|
||
//const attrsRegx = new RegExp("([\\w\\-\\.\\:]+)\\s*=\\s*(['\"])((.|\n)*?)\\2","gm");
|
||
const attrsRegx = new RegExp('([^\\s=]+)\\s*(=\\s*([\'"])([\\s\\S]*?)\\3)?', 'gm');
|
||
|
||
function buildAttributesMap(attrStr, jPath, tagName, force = false) {
|
||
const options = this.options;
|
||
if (force === true || (options.ignoreAttributes !== true && typeof attrStr === 'string')) {
|
||
// attrStr = attrStr.replace(/\r?\n/g, ' ');
|
||
//attrStr = attrStr || attrStr.trim();
|
||
|
||
const matches = (0,util/* getAllMatches */.Xe)(attrStr, attrsRegx);
|
||
const len = matches.length; //don't make it inline
|
||
const attrs = {};
|
||
|
||
// Pre-process values once: trim + entity replacement
|
||
// Reused in both matcher update and second pass
|
||
const processedVals = new Array(len);
|
||
let hasRawAttrs = false;
|
||
const rawAttrsForMatcher = {};
|
||
|
||
for (let i = 0; i < len; i++) {
|
||
const attrName = this.resolveNameSpace(matches[i][1]);
|
||
const oldVal = matches[i][4];
|
||
|
||
if (attrName.length && oldVal !== undefined) {
|
||
let val = oldVal;
|
||
if (options.trimValues) val = val.trim();
|
||
val = this.replaceEntitiesValue(val, tagName, this.readonlyMatcher);
|
||
processedVals[i] = val;
|
||
|
||
rawAttrsForMatcher[attrName] = val;
|
||
hasRawAttrs = true;
|
||
}
|
||
}
|
||
|
||
// Update matcher ONCE before second pass, if applicable
|
||
if (hasRawAttrs && typeof jPath === 'object' && jPath.updateCurrent) {
|
||
jPath.updateCurrent(rawAttrsForMatcher);
|
||
}
|
||
|
||
// Hoist toString() once — path doesn't change during attribute processing
|
||
const jPathStr = options.jPath ? jPath.toString() : this.readonlyMatcher;
|
||
|
||
// Second pass: apply processors, build final attrs
|
||
let hasAttrs = false;
|
||
for (let i = 0; i < len; i++) {
|
||
const attrName = this.resolveNameSpace(matches[i][1]);
|
||
|
||
if (this.ignoreAttributesFn(attrName, jPathStr)) continue;
|
||
|
||
let aName = options.attributeNamePrefix + attrName;
|
||
|
||
if (attrName.length) {
|
||
if (options.transformAttributeName) {
|
||
aName = options.transformAttributeName(aName);
|
||
}
|
||
aName = sanitizeName(aName, options);
|
||
|
||
if (matches[i][4] !== undefined) {
|
||
// Reuse already-processed value — no double entity replacement
|
||
const oldVal = processedVals[i];
|
||
|
||
const newVal = options.attributeValueProcessor(attrName, oldVal, jPathStr);
|
||
if (newVal === null || newVal === undefined) {
|
||
attrs[aName] = oldVal;
|
||
} else if (typeof newVal !== typeof oldVal || newVal !== oldVal) {
|
||
attrs[aName] = newVal;
|
||
} else {
|
||
attrs[aName] = parseValue(oldVal, options.parseAttributeValue, options.numberParseOptions);
|
||
}
|
||
hasAttrs = true;
|
||
} else if (options.allowBooleanAttributes) {
|
||
attrs[aName] = true;
|
||
hasAttrs = true;
|
||
}
|
||
}
|
||
}
|
||
|
||
if (!hasAttrs) return;
|
||
|
||
if (options.attributesGroupName && !options.preserveOrder) {
|
||
const attrCollection = {};
|
||
attrCollection[options.attributesGroupName] = attrs;
|
||
return attrCollection;
|
||
}
|
||
return attrs;
|
||
}
|
||
}
|
||
const parseXml = function (xmlData) {
|
||
xmlData = xmlData.replace(/\r\n?/g, "\n"); //TODO: remove this line
|
||
const xmlObj = new XmlNode('!xml');
|
||
let currentNode = xmlObj;
|
||
let textData = "";
|
||
|
||
// Reset matcher for new document
|
||
this.matcher.reset();
|
||
this.entityDecoder.reset();
|
||
|
||
// Reset entity expansion counters for this document
|
||
this.entityExpansionCount = 0;
|
||
this.currentExpandedLength = 0;
|
||
this.doctypefound = false;
|
||
const options = this.options;
|
||
const docTypeReader = new DocTypeReader(options.processEntities);
|
||
const xmlLen = xmlData.length;
|
||
for (let i = 0; i < xmlLen; i++) {//for each char in XML data
|
||
const ch = xmlData[i];
|
||
if (ch === '<') {
|
||
// const nextIndex = i+1;
|
||
// const _2ndChar = xmlData[nextIndex];
|
||
const c1 = xmlData.charCodeAt(i + 1);
|
||
if (c1 === 47) {//Closing Tag '/'
|
||
const closeIndex = findClosingIndex(xmlData, ">", i, "Closing Tag is not closed.")
|
||
let tagName = xmlData.substring(i + 2, closeIndex).trim();
|
||
|
||
if (options.removeNSPrefix) {
|
||
const colonIndex = tagName.indexOf(":");
|
||
if (colonIndex !== -1) {
|
||
tagName = tagName.substr(colonIndex + 1);
|
||
}
|
||
}
|
||
|
||
tagName = transformTagName(options.transformTagName, tagName, "", options).tagName;
|
||
|
||
if (currentNode) {
|
||
textData = this.saveTextToParentTag(textData, currentNode, this.readonlyMatcher);
|
||
}
|
||
|
||
//check if last tag of nested tag was unpaired tag
|
||
const lastTagName = this.matcher.getCurrentTag();
|
||
if (tagName && options.unpairedTagsSet.has(tagName)) {
|
||
throw new Error(`Unpaired tag can not be used as closing tag: </${tagName}>`);
|
||
}
|
||
if (lastTagName && options.unpairedTagsSet.has(lastTagName)) {
|
||
// Pop the unpaired tag
|
||
this.matcher.pop();
|
||
this.tagsNodeStack.pop();
|
||
}
|
||
// Pop the closing tag
|
||
this.matcher.pop();
|
||
this.isCurrentNodeStopNode = false; // Reset flag when closing tag
|
||
|
||
//a closing tag with no matching opening tag leaves the stack empty
|
||
currentNode = this.tagsNodeStack.pop() || xmlObj;//avoid recursion, set the parent tag scope
|
||
|
||
if (options.captureMetaData && currentNode) {
|
||
currentNode.addEndIndex(closeIndex + 1);
|
||
}
|
||
textData = "";
|
||
i = closeIndex;
|
||
} else if (c1 === 63) { //'?'
|
||
|
||
let tagData = readTagExp(xmlData, i, false, "?>");
|
||
if (!tagData) throw new Error("Pi Tag is not closed.");
|
||
|
||
textData = this.saveTextToParentTag(textData, currentNode, this.readonlyMatcher);
|
||
const attsMap = this.buildAttributesMap(tagData.tagExp, this.matcher, tagData.tagName, true);
|
||
if (attsMap) {
|
||
const ver = attsMap[this.options.attributeNamePrefix + "version"];
|
||
this.entityDecoder.setXmlVersion(Number(ver) || 1.0);
|
||
docTypeReader.setXmlVersion(Number(ver) || 1.0);
|
||
}
|
||
if ((options.ignoreDeclaration && tagData.tagName === "?xml") || options.ignorePiTags) {
|
||
//do nothing
|
||
} else {
|
||
|
||
const childNode = new XmlNode(tagData.tagName);
|
||
childNode.add(options.textNodeName, "");
|
||
|
||
if (tagData.tagName !== tagData.tagExp && tagData.attrExpPresent && options.ignoreAttributes !== true) {
|
||
childNode[":@"] = attsMap
|
||
}
|
||
this.addChild(currentNode, childNode, this.readonlyMatcher, i);
|
||
|
||
if (options.captureMetaData) {
|
||
// closeIndex points at '?' of the closing '?>'
|
||
currentNode.addEndIndex(tagData.closeIndex + 2);
|
||
}
|
||
}
|
||
|
||
|
||
i = tagData.closeIndex + 1;
|
||
} else if (c1 === 33
|
||
&& xmlData.charCodeAt(i + 2) === 45
|
||
&& xmlData.charCodeAt(i + 3) === 45) { //'!--'
|
||
const endIndex = findClosingIndex(xmlData, "-->", i + 4, "Comment is not closed.")
|
||
if (options.commentPropName) {
|
||
const comment = xmlData.substring(i + 4, endIndex - 2);
|
||
|
||
textData = this.saveTextToParentTag(textData, currentNode, this.readonlyMatcher);
|
||
|
||
currentNode.add(options.commentPropName, [{ [options.textNodeName]: comment }]);
|
||
}
|
||
i = endIndex;
|
||
} else if (c1 === 33
|
||
&& xmlData.charCodeAt(i + 2) === 68) { //'!D'
|
||
if (this.doctypefound) throw new Error("Multiple DOCTYPE declarations found.");
|
||
this.doctypefound = true;
|
||
const result = docTypeReader.readDocType(xmlData, i);
|
||
this.entityDecoder.addInputEntities(result.entities);
|
||
i = result.i;
|
||
} else if (c1 === 33
|
||
&& xmlData.charCodeAt(i + 2) === 91) { // '!['
|
||
const closeIndex = findClosingIndex(xmlData, "]]>", i, "CDATA is not closed.") - 2;
|
||
const tagExp = xmlData.substring(i + 9, closeIndex);
|
||
|
||
textData = this.saveTextToParentTag(textData, currentNode, this.readonlyMatcher);
|
||
|
||
let val = this.parseTextData(tagExp, currentNode.tagname, this.readonlyMatcher, true, false, true, true);
|
||
if (val == undefined) val = "";
|
||
|
||
//cdata should be set even if it is 0 length string
|
||
if (options.cdataPropName) {
|
||
currentNode.add(options.cdataPropName, [{ [options.textNodeName]: tagExp }]);
|
||
} else {
|
||
currentNode.add(options.textNodeName, val);
|
||
}
|
||
|
||
i = closeIndex + 2;
|
||
} else {//Opening tag
|
||
let result = readTagExp(xmlData, i, options.removeNSPrefix);
|
||
|
||
// Safety check: readTagExp can return undefined
|
||
if (!result) {
|
||
// Log context for debugging
|
||
const context = xmlData.substring(Math.max(0, i - 50), Math.min(xmlLen, i + 50));
|
||
throw new Error(`readTagExp returned undefined at position ${i}. Context: "${context}"`);
|
||
}
|
||
|
||
let tagName = result.tagName;
|
||
const rawTagName = result.rawTagName;
|
||
let tagExp = result.tagExp;
|
||
let attrExpPresent = result.attrExpPresent;
|
||
let closeIndex = result.closeIndex;
|
||
|
||
({ tagName, tagExp } = transformTagName(options.transformTagName, tagName, tagExp, options));
|
||
|
||
if (options.strictReservedNames &&
|
||
(tagName === options.commentPropName
|
||
|| tagName === options.cdataPropName
|
||
|| tagName === options.textNodeName
|
||
|| tagName === options.attributesGroupName
|
||
)) {
|
||
throw new Error(`Invalid tag name: ${tagName}`);
|
||
}
|
||
|
||
//save text as child node
|
||
if (currentNode && textData) {
|
||
if (currentNode.tagname !== '!xml') {
|
||
//when nested tag is found
|
||
textData = this.saveTextToParentTag(textData, currentNode, this.readonlyMatcher, false);
|
||
}
|
||
}
|
||
|
||
//check if last tag was unpaired tag
|
||
const lastTag = currentNode;
|
||
if (lastTag && options.unpairedTagsSet.has(lastTag.tagname)) {
|
||
currentNode = this.tagsNodeStack.pop();
|
||
this.matcher.pop();
|
||
}
|
||
|
||
// Clean up self-closing syntax BEFORE processing attributes
|
||
// This is where tagExp gets the trailing / removed
|
||
let isSelfClosing = false;
|
||
if (tagExp.length > 0 && tagExp.lastIndexOf("/") === tagExp.length - 1) {
|
||
isSelfClosing = true;
|
||
if (tagName[tagName.length - 1] === "/") {
|
||
tagName = tagName.substr(0, tagName.length - 1);
|
||
tagExp = tagName;
|
||
} else {
|
||
tagExp = tagExp.substr(0, tagExp.length - 1);
|
||
}
|
||
|
||
// Re-check attrExpPresent after cleaning
|
||
attrExpPresent = (tagName !== tagExp);
|
||
}
|
||
|
||
// Now process attributes with CLEAN tagExp (no trailing /)
|
||
let prefixedAttrs = null;
|
||
let rawAttrs = {};
|
||
let namespace = undefined;
|
||
|
||
// Extract namespace from rawTagName
|
||
namespace = extractNamespace(rawTagName);
|
||
|
||
// Push tag to matcher FIRST (with empty attrs for now) so callbacks see correct path
|
||
if (tagName !== xmlObj.tagname) {
|
||
this.matcher.push(tagName, {}, namespace);
|
||
}
|
||
|
||
// Now build attributes - callbacks will see correct matcher state
|
||
if (tagName !== tagExp && attrExpPresent) {
|
||
// Build attributes (returns prefixed attributes for the tree)
|
||
// Note: buildAttributesMap now internally updates the matcher with raw attributes
|
||
prefixedAttrs = this.buildAttributesMap(tagExp, this.matcher, tagName);
|
||
|
||
if (prefixedAttrs) {
|
||
// Extract raw attributes (without prefix) for our use
|
||
//TODO: seems a performance overhead
|
||
rawAttrs = extractRawAttributes(prefixedAttrs, options);
|
||
}
|
||
}
|
||
|
||
// Now check if this is a stop node (after attributes are set)
|
||
if (tagName !== xmlObj.tagname) {
|
||
this.isCurrentNodeStopNode = this.isItStopNode();
|
||
}
|
||
|
||
const startIndex = i;
|
||
if (this.isCurrentNodeStopNode) {
|
||
let tagContent = "";
|
||
|
||
// For self-closing tags, content is empty
|
||
if (isSelfClosing) {
|
||
i = result.closeIndex;
|
||
}
|
||
//unpaired tag
|
||
else if (options.unpairedTagsSet.has(tagName)) {
|
||
i = result.closeIndex;
|
||
}
|
||
//normal tag
|
||
else {
|
||
//read until closing tag is found
|
||
const result = this.readStopNodeData(xmlData, rawTagName, closeIndex + 1);
|
||
if (!result) throw new Error(`Unexpected end of ${rawTagName}`);
|
||
i = result.i;
|
||
tagContent = result.tagContent;
|
||
}
|
||
|
||
const childNode = new XmlNode(tagName);
|
||
|
||
if (prefixedAttrs) {
|
||
childNode[":@"] = prefixedAttrs;
|
||
}
|
||
|
||
// For stop nodes, store raw content as-is without any processing
|
||
childNode.add(options.textNodeName, tagContent);
|
||
|
||
this.matcher.pop(); // Pop the stop node tag
|
||
this.isCurrentNodeStopNode = false; // Reset flag
|
||
|
||
this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
|
||
|
||
if (options.captureMetaData) {
|
||
currentNode.addEndIndex(i + 1);
|
||
}
|
||
} else {
|
||
//selfClosing tag
|
||
if (isSelfClosing) {
|
||
({ tagName, tagExp } = transformTagName(options.transformTagName, tagName, tagExp, options));
|
||
|
||
const childNode = new XmlNode(tagName);
|
||
if (prefixedAttrs) {
|
||
childNode[":@"] = prefixedAttrs;
|
||
}
|
||
this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
|
||
|
||
if (options.captureMetaData) {
|
||
currentNode.addEndIndex(closeIndex + 1);
|
||
}
|
||
this.matcher.pop(); // Pop self-closing tag
|
||
this.isCurrentNodeStopNode = false; // Reset flag
|
||
}
|
||
else if (options.unpairedTagsSet.has(tagName)) {//unpaired tag
|
||
const childNode = new XmlNode(tagName);
|
||
if (prefixedAttrs) {
|
||
childNode[":@"] = prefixedAttrs;
|
||
}
|
||
this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
|
||
|
||
if (options.captureMetaData) {
|
||
currentNode.addEndIndex(result.closeIndex + 1);
|
||
}
|
||
this.matcher.pop(); // Pop unpaired tag
|
||
this.isCurrentNodeStopNode = false; // Reset flag
|
||
i = result.closeIndex;
|
||
// Continue to next iteration without changing currentNode
|
||
continue;
|
||
}
|
||
//opening tag
|
||
else {
|
||
const childNode = new XmlNode(tagName);
|
||
if (this.tagsNodeStack.length > options.maxNestedTags) {
|
||
throw new Error("Maximum nested tags exceeded");
|
||
}
|
||
this.tagsNodeStack.push(currentNode);
|
||
|
||
if (prefixedAttrs) {
|
||
childNode[":@"] = prefixedAttrs;
|
||
}
|
||
this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
|
||
currentNode = childNode;
|
||
}
|
||
textData = "";
|
||
i = closeIndex;
|
||
}
|
||
}
|
||
} else {
|
||
textData += xmlData[i];
|
||
}
|
||
}
|
||
return xmlObj.child;
|
||
}
|
||
|
||
function addChild(currentNode, childNode, matcher, startIndex) {
|
||
// unset startIndex if not requested
|
||
if (!this.options.captureMetaData) startIndex = undefined;
|
||
|
||
// Pass jPath string or matcher based on options.jPath setting
|
||
const jPathOrMatcher = this.options.jPath ? matcher.toString() : matcher;
|
||
const result = this.options.updateTag(childNode.tagname, jPathOrMatcher, childNode[":@"])
|
||
if (result === false) {
|
||
//do nothing
|
||
} else if (typeof result === "string") {
|
||
childNode.tagname = result
|
||
currentNode.addChild(childNode, startIndex);
|
||
} else {
|
||
currentNode.addChild(childNode, startIndex);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* @param {object} val - Entity object with regex and val properties
|
||
* @param {string} tagName - Tag name
|
||
* @param {string|Matcher} jPath - jPath string or Matcher instance based on options.jPath
|
||
*/
|
||
function replaceEntitiesValue(val, tagName, jPath) {
|
||
const entityConfig = this.options.processEntities;
|
||
|
||
if (!entityConfig || !entityConfig.enabled) {
|
||
return val;
|
||
}
|
||
|
||
// Check if tag is allowed to contain entities
|
||
if (entityConfig.allowedTags) {
|
||
const jPathOrMatcher = this.options.jPath ? jPath.toString() : jPath;
|
||
const allowed = Array.isArray(entityConfig.allowedTags)
|
||
? entityConfig.allowedTags.includes(tagName)
|
||
: entityConfig.allowedTags(tagName, jPathOrMatcher);
|
||
|
||
if (!allowed) {
|
||
return val;
|
||
}
|
||
}
|
||
|
||
// Apply custom tag filter if provided
|
||
if (entityConfig.tagFilter) {
|
||
const jPathOrMatcher = this.options.jPath ? jPath.toString() : jPath;
|
||
if (!entityConfig.tagFilter(tagName, jPathOrMatcher)) {
|
||
return val; // Skip based on custom filter
|
||
}
|
||
}
|
||
|
||
return this.entityDecoder.decode(val);
|
||
}
|
||
|
||
|
||
function saveTextToParentTag(textData, parentNode, matcher, isLeafNode) {
|
||
if (textData) { //store previously collected data as textNode
|
||
if (isLeafNode === undefined) isLeafNode = parentNode.child.length === 0
|
||
|
||
textData = this.parseTextData(textData,
|
||
parentNode.tagname,
|
||
matcher,
|
||
false,
|
||
parentNode[":@"] ? Object.keys(parentNode[":@"]).length !== 0 : false,
|
||
isLeafNode);
|
||
|
||
if (textData !== undefined && textData !== "")
|
||
parentNode.add(this.options.textNodeName, textData);
|
||
textData = "";
|
||
}
|
||
return textData;
|
||
}
|
||
|
||
/**
|
||
* @param {Array<Expression>} stopNodeExpressions - Array of compiled Expression objects
|
||
* @param {Matcher} matcher - Current path matcher
|
||
*/
|
||
function isItStopNode() {
|
||
if (this.stopNodeExpressionsSet.size === 0) return false;
|
||
|
||
return this.matcher.matchesAny(this.stopNodeExpressionsSet);
|
||
}
|
||
|
||
/**
|
||
* Returns the tag Expression and where it is ending handling single-double quotes situation
|
||
* @param {string} xmlData
|
||
* @param {number} i starting index
|
||
* @returns
|
||
*/
|
||
function tagExpWithClosingIndex(xmlData, i, closingChar = ">") {
|
||
//TODO: ignore boolean attributes in tag expression
|
||
//TODO: if ignore attributes, dont read full attribute expression but the end. But read for xml declaration
|
||
let attrBoundary = 0;
|
||
const len = xmlData.length;
|
||
const closeCode0 = closingChar.charCodeAt(0);
|
||
const closeCode1 = closingChar.length > 1 ? closingChar.charCodeAt(1) : -1;
|
||
|
||
let result = '';
|
||
let segmentStart = i;
|
||
|
||
for (let index = i; index < len; index++) {
|
||
const code = xmlData.charCodeAt(index);
|
||
|
||
if (attrBoundary) {
|
||
if (code === attrBoundary) attrBoundary = 0;
|
||
} else if (code === 34 || code === 39) { // " or '
|
||
attrBoundary = code;
|
||
} else if (code === closeCode0) {
|
||
if (closeCode1 !== -1) {
|
||
if (xmlData.charCodeAt(index + 1) === closeCode1) {
|
||
result += xmlData.substring(segmentStart, index);
|
||
return { data: result, index };
|
||
}
|
||
} else {
|
||
result += xmlData.substring(segmentStart, index);
|
||
return { data: result, index };
|
||
}
|
||
} else if (code === 9 && !attrBoundary) { // \t - only replace with space outside attribute values
|
||
// Flush accumulated segment, add space, start new segment
|
||
result += xmlData.substring(segmentStart, index) + ' ';
|
||
segmentStart = index + 1;
|
||
}
|
||
}
|
||
}
|
||
|
||
function findClosingIndex(xmlData, str, i, errMsg) {
|
||
const closingIndex = xmlData.indexOf(str, i);
|
||
if (closingIndex === -1) {
|
||
throw new Error(errMsg)
|
||
} else {
|
||
return closingIndex + str.length - 1;
|
||
}
|
||
}
|
||
|
||
function findClosingChar(xmlData, char, i, errMsg) {
|
||
const closingIndex = xmlData.indexOf(char, i);
|
||
if (closingIndex === -1) throw new Error(errMsg);
|
||
return closingIndex; // no offset needed
|
||
}
|
||
|
||
function readTagExp(xmlData, i, removeNSPrefix, closingChar = ">") {
|
||
const result = tagExpWithClosingIndex(xmlData, i + 1, closingChar);
|
||
if (!result) return;
|
||
let tagExp = result.data;
|
||
const closeIndex = result.index;
|
||
const separatorIndex = tagExp.search(/\s/);
|
||
let tagName = tagExp;
|
||
let attrExpPresent = true;
|
||
if (separatorIndex !== -1) {//separate tag name and attributes expression
|
||
tagName = tagExp.substring(0, separatorIndex);
|
||
tagExp = tagExp.substring(separatorIndex + 1).trimStart();
|
||
}
|
||
|
||
const rawTagName = tagName;
|
||
if (removeNSPrefix) {
|
||
const colonIndex = tagName.indexOf(":");
|
||
if (colonIndex !== -1) {
|
||
tagName = tagName.substr(colonIndex + 1);
|
||
attrExpPresent = tagName !== result.data.substr(colonIndex + 1);
|
||
}
|
||
}
|
||
|
||
return {
|
||
tagName: tagName,
|
||
tagExp: tagExp,
|
||
closeIndex: closeIndex,
|
||
attrExpPresent: attrExpPresent,
|
||
rawTagName: rawTagName,
|
||
}
|
||
}
|
||
/**
|
||
* find paired tag for a stop node
|
||
* @param {string} xmlData
|
||
* @param {string} tagName
|
||
* @param {number} i
|
||
*/
|
||
function readStopNodeData(xmlData, tagName, i) {
|
||
const startIndex = i;
|
||
// Starting at 1 since we already have an open tag
|
||
let openTagCount = 1;
|
||
|
||
const xmllen = xmlData.length;
|
||
for (; i < xmllen; i++) {
|
||
if (xmlData[i] === "<") {
|
||
const c1 = xmlData.charCodeAt(i + 1);
|
||
if (c1 === 47) {//close tag '/'
|
||
const closeIndex = findClosingChar(xmlData, ">", i, `${tagName} is not closed`);
|
||
let closeTagName = xmlData.substring(i + 2, closeIndex).trim();
|
||
if (closeTagName === tagName) {
|
||
openTagCount--;
|
||
if (openTagCount === 0) {
|
||
return {
|
||
tagContent: xmlData.substring(startIndex, i),
|
||
i: closeIndex
|
||
}
|
||
}
|
||
}
|
||
i = closeIndex;
|
||
} else if (c1 === 63) { //?
|
||
const closeIndex = findClosingIndex(xmlData, "?>", i + 1, "StopNode is not closed.")
|
||
i = closeIndex;
|
||
} else if (c1 === 33
|
||
&& xmlData.charCodeAt(i + 2) === 45
|
||
&& xmlData.charCodeAt(i + 3) === 45) { // '!--'
|
||
const closeIndex = findClosingIndex(xmlData, "-->", i + 3, "StopNode is not closed.")
|
||
i = closeIndex;
|
||
} else if (c1 === 33
|
||
&& xmlData.charCodeAt(i + 2) === 91) { // '!['
|
||
const closeIndex = findClosingIndex(xmlData, "]]>", i, "StopNode is not closed.") - 2;
|
||
i = closeIndex;
|
||
} else {
|
||
const tagData = readTagExp(xmlData, i, false)
|
||
|
||
if (tagData) {
|
||
const openTagName = tagData && tagData.tagName;
|
||
if (openTagName === tagName && tagData.tagExp[tagData.tagExp.length - 1] !== "/") {
|
||
openTagCount++;
|
||
}
|
||
i = tagData.closeIndex;
|
||
}
|
||
}
|
||
}
|
||
}//end for loop
|
||
}
|
||
|
||
function parseValue(val, shouldParse, options) {
|
||
if (shouldParse && typeof val === 'string') {
|
||
//console.log(options)
|
||
const newval = val.trim();
|
||
if (newval === 'true') return true;
|
||
else if (newval === 'false') return false;
|
||
else return toNumber(val, options);
|
||
} else {
|
||
if ((0,util/* isExist */.yQ)(val)) {
|
||
return val;
|
||
} else {
|
||
return '';
|
||
}
|
||
}
|
||
}
|
||
|
||
function fromCodePoint(str, base, prefix) {
|
||
const codePoint = Number.parseInt(str, base);
|
||
|
||
if (codePoint >= 0 && codePoint <= 0x10FFFF) {
|
||
return String.fromCodePoint(codePoint);
|
||
} else {
|
||
return prefix + str + ";";
|
||
}
|
||
}
|
||
|
||
function transformTagName(fn, tagName, tagExp, options) {
|
||
if (fn) {
|
||
const newTagName = fn(tagName);
|
||
if (tagExp === tagName) {
|
||
tagExp = newTagName
|
||
}
|
||
tagName = newTagName;
|
||
}
|
||
tagName = sanitizeName(tagName, options);
|
||
return { tagName, tagExp };
|
||
}
|
||
|
||
|
||
|
||
function sanitizeName(name, options) {
|
||
if (util/* criticalProperties */.vl.includes(name)) {
|
||
throw new Error(`[SECURITY] Invalid name: "${name}" is a reserved JavaScript keyword that could cause prototype pollution`);
|
||
} else if (util/* DANGEROUS_PROPERTY_NAMES */.q9.includes(name)) {
|
||
return options.onDangerousProperty(name);
|
||
}
|
||
return name;
|
||
}
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/node2json.js
|
||
|
||
|
||
|
||
|
||
|
||
const node2json_METADATA_SYMBOL = XmlNode.getMetaDataSymbol();
|
||
|
||
/**
|
||
* Helper function to strip attribute prefix from attribute map
|
||
* @param {object} attrs - Attributes with prefix (e.g., {"@_class": "code"})
|
||
* @param {string} prefix - Attribute prefix to remove (e.g., "@_")
|
||
* @returns {object} Attributes without prefix (e.g., {"class": "code"})
|
||
*/
|
||
function stripAttributePrefix(attrs, prefix) {
|
||
if (!attrs || typeof attrs !== 'object') return {};
|
||
if (!prefix) return attrs;
|
||
|
||
const rawAttrs = {};
|
||
for (const key in attrs) {
|
||
if (key.startsWith(prefix)) {
|
||
const rawName = key.substring(prefix.length);
|
||
rawAttrs[rawName] = attrs[key];
|
||
} else {
|
||
// Attribute without prefix (shouldn't normally happen, but be safe)
|
||
rawAttrs[key] = attrs[key];
|
||
}
|
||
}
|
||
return rawAttrs;
|
||
}
|
||
|
||
/**
|
||
*
|
||
* @param {array} node
|
||
* @param {any} options
|
||
* @param {Matcher} matcher - Path matcher instance
|
||
* @returns
|
||
*/
|
||
function prettify(node, options, matcher, readonlyMatcher) {
|
||
return compress(node, options, matcher, readonlyMatcher);
|
||
}
|
||
|
||
/**
|
||
* @param {array} arr
|
||
* @param {object} options
|
||
* @param {Matcher} matcher - Path matcher instance
|
||
* @returns object
|
||
*/
|
||
function compress(arr, options, matcher, readonlyMatcher) {
|
||
let text;
|
||
const compressedObj = {}; //This is intended to be a plain object
|
||
for (let i = 0; i < arr.length; i++) {
|
||
const tagObj = arr[i];
|
||
const property = propName(tagObj);
|
||
|
||
// Push current property to matcher WITH RAW ATTRIBUTES (no prefix)
|
||
if (property !== undefined && property !== options.textNodeName) {
|
||
const rawAttrs = stripAttributePrefix(
|
||
tagObj[":@"] || {},
|
||
options.attributeNamePrefix
|
||
);
|
||
matcher.push(property, rawAttrs);
|
||
}
|
||
|
||
if (property === options.textNodeName) {
|
||
if (text === undefined) text = tagObj[property];
|
||
else text += "" + tagObj[property];
|
||
} else if (property === undefined) {
|
||
continue;
|
||
} else if (tagObj[property]) {
|
||
|
||
let val = compress(tagObj[property], options, matcher, readonlyMatcher);
|
||
const isLeaf = isLeafTag(val, options);
|
||
|
||
if (Object.keys(val).length === 0 && options.alwaysCreateTextNode) {
|
||
val[options.textNodeName] = "";
|
||
}
|
||
|
||
if (tagObj[":@"]) {
|
||
assignAttributes(val, tagObj[":@"], readonlyMatcher, options);
|
||
} else if (Object.keys(val).length === 1 && val[options.textNodeName] !== undefined && !options.alwaysCreateTextNode) {
|
||
val = val[options.textNodeName];
|
||
} else if (Object.keys(val).length === 0) {
|
||
if (options.alwaysCreateTextNode) val[options.textNodeName] = "";
|
||
else val = "";
|
||
}
|
||
|
||
if (tagObj[node2json_METADATA_SYMBOL] !== undefined && typeof val === "object" && val !== null) {
|
||
val[node2json_METADATA_SYMBOL] = tagObj[node2json_METADATA_SYMBOL]; // copy over metadata
|
||
}
|
||
|
||
|
||
if (compressedObj[property] !== undefined && Object.prototype.hasOwnProperty.call(compressedObj, property)) {
|
||
if (!Array.isArray(compressedObj[property])) {
|
||
compressedObj[property] = [compressedObj[property]];
|
||
}
|
||
compressedObj[property].push(val);
|
||
} else {
|
||
//TODO: if a node is not an array, then check if it should be an array
|
||
//also determine if it is a leaf node
|
||
|
||
// Pass jPath string or readonlyMatcher based on options.jPath setting
|
||
const jPathOrMatcher = options.jPath ? readonlyMatcher.toString() : readonlyMatcher;
|
||
if (options.isArray(property, jPathOrMatcher, isLeaf)) {
|
||
compressedObj[property] = [val];
|
||
} else {
|
||
compressedObj[property] = val;
|
||
}
|
||
}
|
||
|
||
// Pop property from matcher after processing
|
||
if (property !== undefined && property !== options.textNodeName) {
|
||
matcher.pop();
|
||
}
|
||
}
|
||
|
||
}
|
||
// if(text && text.length > 0) compressedObj[options.textNodeName] = text;
|
||
if (typeof text === "string") {
|
||
if (text.length > 0) compressedObj[options.textNodeName] = text;
|
||
} else if (text !== undefined) compressedObj[options.textNodeName] = text;
|
||
|
||
|
||
return compressedObj;
|
||
}
|
||
|
||
function propName(obj) {
|
||
const keys = Object.keys(obj);
|
||
for (let i = 0; i < keys.length; i++) {
|
||
const key = keys[i];
|
||
if (key !== ":@") return key;
|
||
}
|
||
}
|
||
|
||
function assignAttributes(obj, attrMap, readonlyMatcher, options) {
|
||
if (attrMap) {
|
||
const keys = Object.keys(attrMap);
|
||
const len = keys.length; //don't make it inline
|
||
for (let i = 0; i < len; i++) {
|
||
const atrrName = keys[i]; // This is the PREFIXED name (e.g., "@_class")
|
||
|
||
// Strip prefix for matcher path (for isArray callback)
|
||
const rawAttrName = atrrName.startsWith(options.attributeNamePrefix)
|
||
? atrrName.substring(options.attributeNamePrefix.length)
|
||
: atrrName;
|
||
|
||
// For attributes, we need to create a temporary path
|
||
// Pass jPath string or matcher based on options.jPath setting
|
||
const jPathOrMatcher = options.jPath
|
||
? readonlyMatcher.toString() + "." + rawAttrName
|
||
: readonlyMatcher;
|
||
|
||
if (options.isArray(atrrName, jPathOrMatcher, true, true)) {
|
||
obj[atrrName] = [attrMap[atrrName]];
|
||
} else {
|
||
obj[atrrName] = attrMap[atrrName];
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
function isLeafTag(obj, options) {
|
||
const { textNodeName } = options;
|
||
const propCount = Object.keys(obj).length;
|
||
|
||
if (propCount === 0) {
|
||
return true;
|
||
}
|
||
|
||
if (
|
||
propCount === 1 &&
|
||
(obj[textNodeName] || typeof obj[textNodeName] === "boolean" || obj[textNodeName] === 0)
|
||
) {
|
||
return true;
|
||
}
|
||
|
||
return false;
|
||
}
|
||
// EXTERNAL MODULE: ./node_modules/fast-xml-parser/src/validator.js
|
||
var validator = __webpack_require__(1176);
|
||
;// CONCATENATED MODULE: ./node_modules/fast-xml-parser/src/xmlparser/XMLParser.js
|
||
|
||
|
||
|
||
|
||
|
||
|
||
class XMLParser {
|
||
|
||
constructor(options) {
|
||
this.externalEntities = {};
|
||
this.options = buildOptions(options);
|
||
|
||
}
|
||
/**
|
||
* Parse XML dats to JS object
|
||
* @param {string|Uint8Array} xmlData
|
||
* @param {boolean|Object} validationOption
|
||
*/
|
||
parse(xmlData, validationOption) {
|
||
if (typeof xmlData !== "string" && xmlData.toString) {
|
||
xmlData = xmlData.toString();
|
||
} else if (typeof xmlData !== "string") {
|
||
throw new Error("XML data is accepted in String or Bytes[] form.")
|
||
}
|
||
|
||
if (validationOption) {
|
||
if (validationOption === true) validationOption = {}; //validate with default options
|
||
|
||
const result = (0,validator/* validate */.t)(xmlData, validationOption);
|
||
if (result !== true) {
|
||
throw Error(`${result.err.msg}:${result.err.line}:${result.err.col}`)
|
||
}
|
||
}
|
||
const orderedObjParser = new OrderedObjParser(this.options, this.externalEntities);
|
||
// orderedObjParser.entityDecoder.setExternalEntities(this.externalEntities);
|
||
const orderedResult = orderedObjParser.parseXml(xmlData);
|
||
if (this.options.preserveOrder || orderedResult === undefined) return orderedResult;
|
||
else return prettify(orderedResult, this.options, orderedObjParser.matcher, orderedObjParser.readonlyMatcher);
|
||
}
|
||
|
||
/**
|
||
* Add Entity which is not by default supported by this library
|
||
* @param {string} key
|
||
* @param {string} value
|
||
*/
|
||
addEntity(key, value) {
|
||
if (value.indexOf("&") !== -1) {
|
||
throw new Error("Entity value can't have '&'")
|
||
} else if (key.indexOf("&") !== -1 || key.indexOf(";") !== -1) {
|
||
throw new Error("An entity must be set without '&' and ';'. Eg. use '#xD' for '
'")
|
||
} else if (value === "&") {
|
||
throw new Error("An entity with value '&' is not permitted");
|
||
} else {
|
||
this.externalEntities[key] = value;
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Returns a Symbol that can be used to access the metadata
|
||
* property on a node.
|
||
*
|
||
* If Symbol is not available in the environment, an ordinary property is used
|
||
* and the name of the property is here returned.
|
||
*
|
||
* The XMLMetaData property is only present when `captureMetaData`
|
||
* is true in the options.
|
||
*/
|
||
static getMetaDataSymbol() {
|
||
return XmlNode.getMetaDataSymbol();
|
||
}
|
||
}
|
||
|
||
/***/ }),
|
||
|
||
/***/ 3945:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ A: () => (/* binding */ Expression)
|
||
/* harmony export */ });
|
||
/**
|
||
* Expression - Parses and stores a tag pattern expression
|
||
*
|
||
* Patterns are parsed once and stored in an optimized structure for fast matching.
|
||
*
|
||
* @example
|
||
* const expr = new Expression("root.users.user");
|
||
* const expr2 = new Expression("..user[id]:first");
|
||
* const expr3 = new Expression("root/users/user", { separator: '/' });
|
||
*/
|
||
class Expression {
|
||
/**
|
||
* Create a new Expression
|
||
* @param {string} pattern - Pattern string (e.g., "root.users.user", "..user[id]")
|
||
* @param {Object} options - Configuration options
|
||
* @param {string} options.separator - Path separator (default: '.')
|
||
*/
|
||
constructor(pattern, options = {}, data) {
|
||
this.pattern = pattern;
|
||
this.separator = options.separator || '.';
|
||
this.segments = this._parse(pattern);
|
||
this.data = data;
|
||
// Cache expensive checks for performance (O(1) instead of O(n))
|
||
this._hasDeepWildcard = this.segments.some(seg => seg.type === 'deep-wildcard');
|
||
this._hasAttributeCondition = this.segments.some(seg => seg.attrName !== undefined);
|
||
this._hasPositionSelector = this.segments.some(seg => seg.position !== undefined);
|
||
}
|
||
|
||
/**
|
||
* Parse pattern string into segments
|
||
* @private
|
||
* @param {string} pattern - Pattern to parse
|
||
* @returns {Array} Array of segment objects
|
||
*/
|
||
_parse(pattern) {
|
||
const segments = [];
|
||
|
||
// Split by separator but handle ".." specially
|
||
let i = 0;
|
||
let currentPart = '';
|
||
|
||
while (i < pattern.length) {
|
||
if (pattern[i] === this.separator) {
|
||
// Check if next char is also separator (deep wildcard)
|
||
if (i + 1 < pattern.length && pattern[i + 1] === this.separator) {
|
||
// Flush current part if any
|
||
if (currentPart.trim()) {
|
||
segments.push(this._parseSegment(currentPart.trim()));
|
||
currentPart = '';
|
||
}
|
||
// Add deep wildcard
|
||
segments.push({ type: 'deep-wildcard' });
|
||
i += 2; // Skip both separators
|
||
} else {
|
||
// Regular separator
|
||
if (currentPart.trim()) {
|
||
segments.push(this._parseSegment(currentPart.trim()));
|
||
}
|
||
currentPart = '';
|
||
i++;
|
||
}
|
||
} else {
|
||
currentPart += pattern[i];
|
||
i++;
|
||
}
|
||
}
|
||
|
||
// Flush remaining part
|
||
if (currentPart.trim()) {
|
||
segments.push(this._parseSegment(currentPart.trim()));
|
||
}
|
||
|
||
return segments;
|
||
}
|
||
|
||
/**
|
||
* Parse a single segment
|
||
* @private
|
||
* @param {string} part - Segment string (e.g., "user", "ns::user", "user[id]", "ns::user:first")
|
||
* @returns {Object} Segment object
|
||
*/
|
||
_parseSegment(part) {
|
||
const segment = { type: 'tag' };
|
||
|
||
// NEW NAMESPACE SYNTAX (v2.0):
|
||
// ============================
|
||
// Namespace uses DOUBLE colon (::)
|
||
// Position uses SINGLE colon (:)
|
||
//
|
||
// Examples:
|
||
// "user" → tag
|
||
// "user:first" → tag + position
|
||
// "user[id]" → tag + attribute
|
||
// "user[id]:first" → tag + attribute + position
|
||
// "ns::user" → namespace + tag
|
||
// "ns::user:first" → namespace + tag + position
|
||
// "ns::user[id]" → namespace + tag + attribute
|
||
// "ns::user[id]:first" → namespace + tag + attribute + position
|
||
// "ns::first" → namespace + tag named "first" (NO ambiguity!)
|
||
//
|
||
// This eliminates all ambiguity:
|
||
// :: = namespace separator
|
||
// : = position selector
|
||
// [] = attributes
|
||
|
||
// Step 1: Extract brackets [attr] or [attr=value]
|
||
let bracketContent = null;
|
||
let withoutBrackets = part;
|
||
|
||
const bracketMatch = part.match(/^([^\[]+)(\[[^\]]*\])(.*)$/);
|
||
if (bracketMatch) {
|
||
withoutBrackets = bracketMatch[1] + bracketMatch[3];
|
||
if (bracketMatch[2]) {
|
||
const content = bracketMatch[2].slice(1, -1);
|
||
if (content) {
|
||
bracketContent = content;
|
||
}
|
||
}
|
||
}
|
||
|
||
// Step 2: Check for namespace (double colon ::)
|
||
let namespace = undefined;
|
||
let tagAndPosition = withoutBrackets;
|
||
|
||
if (withoutBrackets.includes('::')) {
|
||
const nsIndex = withoutBrackets.indexOf('::');
|
||
namespace = withoutBrackets.substring(0, nsIndex).trim();
|
||
tagAndPosition = withoutBrackets.substring(nsIndex + 2).trim(); // Skip ::
|
||
|
||
if (!namespace) {
|
||
throw new Error(`Invalid namespace in pattern: ${part}`);
|
||
}
|
||
}
|
||
|
||
// Step 3: Parse tag and position (single colon :)
|
||
let tag = undefined;
|
||
let positionMatch = null;
|
||
|
||
if (tagAndPosition.includes(':')) {
|
||
const colonIndex = tagAndPosition.lastIndexOf(':'); // Use last colon for position
|
||
const tagPart = tagAndPosition.substring(0, colonIndex).trim();
|
||
const posPart = tagAndPosition.substring(colonIndex + 1).trim();
|
||
|
||
// Verify position is a valid keyword
|
||
const isPositionKeyword = ['first', 'last', 'odd', 'even'].includes(posPart) ||
|
||
/^nth\(\d+\)$/.test(posPart);
|
||
|
||
if (isPositionKeyword) {
|
||
tag = tagPart;
|
||
positionMatch = posPart;
|
||
} else {
|
||
// Not a valid position keyword, treat whole thing as tag
|
||
tag = tagAndPosition;
|
||
}
|
||
} else {
|
||
tag = tagAndPosition;
|
||
}
|
||
|
||
if (!tag) {
|
||
throw new Error(`Invalid segment pattern: ${part}`);
|
||
}
|
||
|
||
segment.tag = tag;
|
||
if (namespace) {
|
||
segment.namespace = namespace;
|
||
}
|
||
|
||
// Step 4: Parse attributes
|
||
if (bracketContent) {
|
||
if (bracketContent.includes('=')) {
|
||
const eqIndex = bracketContent.indexOf('=');
|
||
segment.attrName = bracketContent.substring(0, eqIndex).trim();
|
||
segment.attrValue = bracketContent.substring(eqIndex + 1).trim();
|
||
} else {
|
||
segment.attrName = bracketContent.trim();
|
||
}
|
||
}
|
||
|
||
// Step 5: Parse position selector
|
||
if (positionMatch) {
|
||
const nthMatch = positionMatch.match(/^nth\((\d+)\)$/);
|
||
if (nthMatch) {
|
||
segment.position = 'nth';
|
||
segment.positionValue = parseInt(nthMatch[1], 10);
|
||
} else {
|
||
segment.position = positionMatch;
|
||
}
|
||
}
|
||
|
||
return segment;
|
||
}
|
||
|
||
/**
|
||
* Get the number of segments
|
||
* @returns {number}
|
||
*/
|
||
get length() {
|
||
return this.segments.length;
|
||
}
|
||
|
||
/**
|
||
* Check if expression contains deep wildcard
|
||
* @returns {boolean}
|
||
*/
|
||
hasDeepWildcard() {
|
||
return this._hasDeepWildcard;
|
||
}
|
||
|
||
/**
|
||
* Check if expression has attribute conditions
|
||
* @returns {boolean}
|
||
*/
|
||
hasAttributeCondition() {
|
||
return this._hasAttributeCondition;
|
||
}
|
||
|
||
/**
|
||
* Check if expression has position selectors
|
||
* @returns {boolean}
|
||
*/
|
||
hasPositionSelector() {
|
||
return this._hasPositionSelector;
|
||
}
|
||
|
||
/**
|
||
* Get string representation
|
||
* @returns {string}
|
||
*/
|
||
toString() {
|
||
return this.pattern;
|
||
}
|
||
}
|
||
|
||
/***/ }),
|
||
|
||
/***/ 8257:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ A: () => (/* binding */ Matcher)
|
||
/* harmony export */ });
|
||
/* unused harmony export MatcherView */
|
||
|
||
|
||
/**
|
||
* MatcherView - A lightweight read-only view over a Matcher's internal state.
|
||
*
|
||
* Created once by Matcher and reused across all callbacks. Holds a direct
|
||
* reference to the parent Matcher so it always reflects current parser state
|
||
* with zero copying or freezing overhead.
|
||
*
|
||
* Users receive this via {@link Matcher#readOnly} or directly from parser
|
||
* callbacks. It exposes all query and matching methods but has no mutation
|
||
* methods — misuse is caught at the TypeScript level rather than at runtime.
|
||
*
|
||
* @example
|
||
* const matcher = new Matcher();
|
||
* const view = matcher.readOnly();
|
||
*
|
||
* matcher.push("root", {});
|
||
* view.getCurrentTag(); // "root"
|
||
* view.getDepth(); // 1
|
||
*/
|
||
class MatcherView {
|
||
/**
|
||
* @param {Matcher} matcher - The parent Matcher instance to read from.
|
||
*/
|
||
constructor(matcher) {
|
||
this._matcher = matcher;
|
||
}
|
||
|
||
/**
|
||
* Get the path separator used by the parent matcher.
|
||
* @returns {string}
|
||
*/
|
||
get separator() {
|
||
return this._matcher.separator;
|
||
}
|
||
|
||
/**
|
||
* Get current tag name.
|
||
* @returns {string|undefined}
|
||
*/
|
||
getCurrentTag() {
|
||
const path = this._matcher.path;
|
||
return path.length > 0 ? path[path.length - 1].tag : undefined;
|
||
}
|
||
|
||
/**
|
||
* Get current namespace.
|
||
* @returns {string|undefined}
|
||
*/
|
||
getCurrentNamespace() {
|
||
const path = this._matcher.path;
|
||
return path.length > 0 ? path[path.length - 1].namespace : undefined;
|
||
}
|
||
|
||
/**
|
||
* Get current node's attribute value.
|
||
* @param {string} attrName
|
||
* @returns {*}
|
||
*/
|
||
getAttrValue(attrName) {
|
||
const path = this._matcher.path;
|
||
if (path.length === 0) return undefined;
|
||
return path[path.length - 1].values?.[attrName];
|
||
}
|
||
|
||
/**
|
||
* Check if current node has an attribute.
|
||
* @param {string} attrName
|
||
* @returns {boolean}
|
||
*/
|
||
hasAttr(attrName) {
|
||
const path = this._matcher.path;
|
||
if (path.length === 0) return false;
|
||
const current = path[path.length - 1];
|
||
return current.values !== undefined && attrName in current.values;
|
||
}
|
||
|
||
/**
|
||
* Get the value of a "kept" attribute from the nearest ancestor (or
|
||
* current node) that declared it via `push(tag, attrs, ns, { keep: [...] })`.
|
||
* @param {string} attrName
|
||
* @returns {*}
|
||
*/
|
||
getAnyParentAttr(attrName) {
|
||
return this._matcher.getAnyParentAttr(attrName);
|
||
}
|
||
|
||
/**
|
||
* Check whether any ancestor (or the current node) kept the given
|
||
* attribute via `push(tag, attrs, ns, { keep: [...] })`.
|
||
* @param {string} attrName
|
||
* @returns {boolean}
|
||
*/
|
||
hasAnyParentAttr(attrName) {
|
||
return this._matcher.hasAnyParentAttr(attrName);
|
||
}
|
||
|
||
/**
|
||
* Get current node's sibling position (child index in parent).
|
||
* @returns {number}
|
||
*/
|
||
getPosition() {
|
||
const path = this._matcher.path;
|
||
if (path.length === 0) return -1;
|
||
return path[path.length - 1].position ?? 0;
|
||
}
|
||
|
||
/**
|
||
* Get current node's repeat counter (occurrence count of this tag name).
|
||
* @returns {number}
|
||
*/
|
||
getCounter() {
|
||
const path = this._matcher.path;
|
||
if (path.length === 0) return -1;
|
||
return path[path.length - 1].counter ?? 0;
|
||
}
|
||
|
||
/**
|
||
* Get current node's sibling index (alias for getPosition).
|
||
* @returns {number}
|
||
* @deprecated Use getPosition() or getCounter() instead
|
||
*/
|
||
getIndex() {
|
||
return this.getPosition();
|
||
}
|
||
|
||
/**
|
||
* Get current path depth.
|
||
* @returns {number}
|
||
*/
|
||
getDepth() {
|
||
return this._matcher.path.length;
|
||
}
|
||
|
||
/**
|
||
* Get path as string.
|
||
* @param {string} [separator] - Optional separator (uses default if not provided)
|
||
* @param {boolean} [includeNamespace=true]
|
||
* @returns {string}
|
||
*/
|
||
toString(separator, includeNamespace = true) {
|
||
return this._matcher.toString(separator, includeNamespace);
|
||
}
|
||
|
||
/**
|
||
* Get path as array of tag names.
|
||
* @returns {string[]}
|
||
*/
|
||
toArray() {
|
||
return this._matcher.path.map(n => n.tag);
|
||
}
|
||
|
||
/**
|
||
* Match current path against an Expression.
|
||
* @param {Expression} expression
|
||
* @returns {boolean}
|
||
*/
|
||
matches(expression) {
|
||
return this._matcher.matches(expression);
|
||
}
|
||
|
||
/**
|
||
* Match any expression in the given set against the current path.
|
||
* @param {ExpressionSet} exprSet
|
||
* @returns {boolean}
|
||
*/
|
||
matchesAny(exprSet) {
|
||
return exprSet.matchesAny(this._matcher);
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Matcher - Tracks current path in XML/JSON tree and matches against Expressions.
|
||
*
|
||
* The matcher maintains a stack of nodes representing the current path from root to
|
||
* current tag. It only stores attribute values for the current (top) node to minimize
|
||
* memory usage. Sibling tracking is used to auto-calculate position and counter.
|
||
*
|
||
* Use {@link Matcher#readOnly} to obtain a {@link MatcherView} safe to pass to
|
||
* user callbacks — it always reflects current state with no Proxy overhead.
|
||
*
|
||
* @example
|
||
* const matcher = new Matcher();
|
||
* matcher.push("root", {});
|
||
* matcher.push("users", {});
|
||
* matcher.push("user", { id: "123", type: "admin" });
|
||
*
|
||
* const expr = new Expression("root.users.user");
|
||
* matcher.matches(expr); // true
|
||
*/
|
||
class Matcher {
|
||
/**
|
||
* Create a new Matcher.
|
||
* @param {Object} [options={}]
|
||
* @param {string} [options.separator='.'] - Default path separator
|
||
*/
|
||
constructor(options = {}) {
|
||
this.separator = options.separator || '.';
|
||
this.path = [];
|
||
this.siblingStacks = [];
|
||
// Each path node: { tag, values, position, counter, namespace? }
|
||
// values only present for current (last) node
|
||
// Each siblingStacks entry: Map<tagName, count> tracking occurrences at each level
|
||
this._pathStringCache = null;
|
||
this._view = new MatcherView(this);
|
||
|
||
// Kept-attribute stack: only populated when push() is called with options.keep.
|
||
this._keptAttrs = [];
|
||
}
|
||
|
||
/**
|
||
* Push a new tag onto the path.
|
||
* @param {string} tagName
|
||
* @param {Object|null} [attrValues=null]
|
||
* @param {string|null} [namespace=null]
|
||
* @param {Object|null} [options=null]
|
||
* @param {string[]} [options.keep] - Names of attributes (from attrValues)
|
||
*/
|
||
push(tagName, attrValues = null, namespace = null, options = null) {
|
||
this._pathStringCache = null;
|
||
|
||
// Remove values from previous current node (now becoming ancestor)
|
||
if (this.path.length > 0) {
|
||
this.path[this.path.length - 1].values = undefined;
|
||
}
|
||
|
||
// Get or create sibling tracking for current level
|
||
const currentLevel = this.path.length;
|
||
let level = this.siblingStacks[currentLevel];
|
||
if (!level) {
|
||
// `counts` tells same-name siblings apart (the "counter" — nth <item>
|
||
// among other <item>s). `total` is every child seen at this level so
|
||
// far, kept as a running number instead of re-added from `counts` on
|
||
// every push — a parent with many differently-named children would
|
||
// otherwise cost more per child the more distinct names it has.
|
||
level = { counts: new Map(), total: 0 };
|
||
this.siblingStacks[currentLevel] = level;
|
||
}
|
||
|
||
// Create a unique key for sibling tracking that includes namespace
|
||
const siblingKey = namespace ? `${namespace}:${tagName}` : tagName;
|
||
|
||
// Calculate counter (how many times this tag appeared at this level)
|
||
const counter = level.counts.get(siblingKey) || 0;
|
||
|
||
// Position = total children at this level seen before this one.
|
||
const position = level.total;
|
||
|
||
// Update sibling count for this tag, and the level's running total.
|
||
level.counts.set(siblingKey, counter + 1);
|
||
level.total++;
|
||
|
||
// Create new node
|
||
const node = {
|
||
tag: tagName,
|
||
position: position,
|
||
counter: counter
|
||
};
|
||
|
||
if (namespace !== null && namespace !== undefined) {
|
||
node.namespace = namespace;
|
||
}
|
||
|
||
if (attrValues !== null && attrValues !== undefined) {
|
||
node.values = attrValues;
|
||
}
|
||
|
||
this.path.push(node);
|
||
|
||
// Depth of the node we just pushed (1-based, matches this.path.length)
|
||
const depth = this.path.length;
|
||
|
||
// Copy only the requested attributes into the kept-attrs stack. This is
|
||
// the one part of push() whose cost scales with input (O(keep.length))
|
||
// rather than being O(1) — by design, since the caller is explicitly
|
||
// opting in for specific attribute names. No options/keep => zero added
|
||
// cost beyond the two property reads below.
|
||
const keep = options !== null ? options.keep : null;
|
||
if (keep !== null && keep !== undefined && keep.length > 0 && attrValues) {
|
||
for (let i = 0; i < keep.length; i++) {
|
||
const name = keep[i];
|
||
if (attrValues[name] !== undefined) {
|
||
this._keptAttrs.push({ depth, name, value: attrValues[name] });
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Pop the last tag from the path.
|
||
* @returns {Object|undefined} The popped node
|
||
*/
|
||
pop() {
|
||
if (this.path.length === 0) return undefined;
|
||
this._pathStringCache = null;
|
||
|
||
const node = this.path.pop();
|
||
|
||
if (this.siblingStacks.length > this.path.length + 1) {
|
||
this.siblingStacks.length = this.path.length + 1;
|
||
}
|
||
|
||
// Drop any kept attributes that belonged to the popped node (or deeper).
|
||
// _keptAttrs is depth-ordered (push only ever appends increasing depths),
|
||
// so this is a backward scan that stops at the first surviving entry —
|
||
// typically O(1) since kept attrs are rare by design.
|
||
const poppedDepth = this.path.length + 1;
|
||
while (
|
||
this._keptAttrs.length > 0 &&
|
||
this._keptAttrs[this._keptAttrs.length - 1].depth >= poppedDepth
|
||
) {
|
||
this._keptAttrs.pop();
|
||
}
|
||
|
||
return node;
|
||
}
|
||
|
||
/**
|
||
* Update current node's attribute values.
|
||
* Useful when attributes are parsed after push.
|
||
* @param {Object} attrValues
|
||
*/
|
||
updateCurrent(attrValues) {
|
||
if (this.path.length > 0) {
|
||
const current = this.path[this.path.length - 1];
|
||
if (attrValues !== null && attrValues !== undefined) {
|
||
current.values = attrValues;
|
||
}
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Get current tag name.
|
||
* @returns {string|undefined}
|
||
*/
|
||
getCurrentTag() {
|
||
return this.path.length > 0 ? this.path[this.path.length - 1].tag : undefined;
|
||
}
|
||
|
||
/**
|
||
* Get current namespace.
|
||
* @returns {string|undefined}
|
||
*/
|
||
getCurrentNamespace() {
|
||
return this.path.length > 0 ? this.path[this.path.length - 1].namespace : undefined;
|
||
}
|
||
|
||
/**
|
||
* Get current node's attribute value.
|
||
* @param {string} attrName
|
||
* @returns {*}
|
||
*/
|
||
getAttrValue(attrName) {
|
||
if (this.path.length === 0) return undefined;
|
||
return this.path[this.path.length - 1].values?.[attrName];
|
||
}
|
||
|
||
/**
|
||
* Check if current node has an attribute.
|
||
* @param {string} attrName
|
||
* @returns {boolean}
|
||
*/
|
||
hasAttr(attrName) {
|
||
if (this.path.length === 0) return false;
|
||
const current = this.path[this.path.length - 1];
|
||
return current.values !== undefined && attrName in current.values;
|
||
}
|
||
|
||
/**
|
||
* Get the value of a "kept" attribute from the nearest ancestor (or
|
||
* current node) that declared it via `push(tag, attrs, ns, { keep: [...] })`.
|
||
* Unlike getAttrValue(), this works regardless of how deep the path has
|
||
* gone since the attribute was pushed — but only for attribute names that
|
||
* were explicitly marked with `keep` at push time. Cost is proportional to
|
||
* the number of currently-kept attributes (typically 0-3), not path depth.
|
||
* @param {string} attrName
|
||
* @returns {*} the value, or undefined if no ancestor kept this attribute
|
||
*/
|
||
getAnyParentAttr(attrName) {
|
||
const kept = this._keptAttrs;
|
||
for (let i = kept.length - 1; i >= 0; i--) {
|
||
if (kept[i].name === attrName) return kept[i].value;
|
||
}
|
||
return undefined;
|
||
}
|
||
|
||
/**
|
||
* Check whether any ancestor (or the current node) kept the given
|
||
* attribute via `push(tag, attrs, ns, { keep: [...] })`.
|
||
* @param {string} attrName
|
||
* @returns {boolean}
|
||
*/
|
||
hasAnyParentAttr(attrName) {
|
||
const kept = this._keptAttrs;
|
||
for (let i = kept.length - 1; i >= 0; i--) {
|
||
if (kept[i].name === attrName) return true;
|
||
}
|
||
return false;
|
||
}
|
||
|
||
/**
|
||
* Get current node's sibling position (child index in parent).
|
||
* @returns {number}
|
||
*/
|
||
getPosition() {
|
||
if (this.path.length === 0) return -1;
|
||
return this.path[this.path.length - 1].position ?? 0;
|
||
}
|
||
|
||
/**
|
||
* Get current node's repeat counter (occurrence count of this tag name).
|
||
* @returns {number}
|
||
*/
|
||
getCounter() {
|
||
if (this.path.length === 0) return -1;
|
||
return this.path[this.path.length - 1].counter ?? 0;
|
||
}
|
||
|
||
/**
|
||
* Get current node's sibling index (alias for getPosition).
|
||
* @returns {number}
|
||
* @deprecated Use getPosition() or getCounter() instead
|
||
*/
|
||
getIndex() {
|
||
return this.getPosition();
|
||
}
|
||
|
||
/**
|
||
* Get current path depth.
|
||
* @returns {number}
|
||
*/
|
||
getDepth() {
|
||
return this.path.length;
|
||
}
|
||
|
||
/**
|
||
* Get path as string.
|
||
* @param {string} [separator] - Optional separator (uses default if not provided)
|
||
* @param {boolean} [includeNamespace=true]
|
||
* @returns {string}
|
||
*/
|
||
toString(separator, includeNamespace = true) {
|
||
const sep = separator || this.separator;
|
||
const isDefault = (sep === this.separator && includeNamespace === true);
|
||
|
||
if (isDefault) {
|
||
if (this._pathStringCache !== null) {
|
||
return this._pathStringCache;
|
||
}
|
||
const result = this.path.map(n =>
|
||
(n.namespace) ? `${n.namespace}:${n.tag}` : n.tag
|
||
).join(sep);
|
||
this._pathStringCache = result;
|
||
return result;
|
||
}
|
||
|
||
return this.path.map(n =>
|
||
(includeNamespace && n.namespace) ? `${n.namespace}:${n.tag}` : n.tag
|
||
).join(sep);
|
||
}
|
||
|
||
/**
|
||
* Get path as array of tag names.
|
||
* @returns {string[]}
|
||
*/
|
||
toArray() {
|
||
return this.path.map(n => n.tag);
|
||
}
|
||
|
||
/**
|
||
* Reset the path to empty.
|
||
*/
|
||
reset() {
|
||
this._pathStringCache = null;
|
||
this.path = [];
|
||
this.siblingStacks = [];
|
||
this._keptAttrs = [];
|
||
}
|
||
|
||
/**
|
||
* Match current path against an Expression.
|
||
* @param {Expression} expression
|
||
* @returns {boolean}
|
||
*/
|
||
matches(expression) {
|
||
const segments = expression.segments;
|
||
|
||
if (segments.length === 0) {
|
||
return false;
|
||
}
|
||
|
||
if (expression.hasDeepWildcard()) {
|
||
return this._matchWithDeepWildcard(segments);
|
||
}
|
||
|
||
return this._matchSimple(segments);
|
||
}
|
||
|
||
/**
|
||
* @private
|
||
*/
|
||
_matchSimple(segments) {
|
||
if (this.path.length !== segments.length) {
|
||
return false;
|
||
}
|
||
|
||
for (let i = 0; i < segments.length; i++) {
|
||
if (!this._matchSegment(segments[i], this.path[i], i === this.path.length - 1)) {
|
||
return false;
|
||
}
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
/**
|
||
* @private
|
||
*/
|
||
_matchWithDeepWildcard(segments) {
|
||
let pathIdx = this.path.length - 1;
|
||
let segIdx = segments.length - 1;
|
||
|
||
while (segIdx >= 0 && pathIdx >= 0) {
|
||
const segment = segments[segIdx];
|
||
|
||
if (segment.type === 'deep-wildcard') {
|
||
segIdx--;
|
||
|
||
if (segIdx < 0) {
|
||
return true;
|
||
}
|
||
|
||
const nextSeg = segments[segIdx];
|
||
let found = false;
|
||
|
||
for (let i = pathIdx; i >= 0; i--) {
|
||
if (this._matchSegment(nextSeg, this.path[i], i === this.path.length - 1)) {
|
||
pathIdx = i - 1;
|
||
segIdx--;
|
||
found = true;
|
||
break;
|
||
}
|
||
}
|
||
|
||
if (!found) {
|
||
return false;
|
||
}
|
||
} else {
|
||
if (!this._matchSegment(segment, this.path[pathIdx], pathIdx === this.path.length - 1)) {
|
||
return false;
|
||
}
|
||
pathIdx--;
|
||
segIdx--;
|
||
}
|
||
}
|
||
|
||
return segIdx < 0;
|
||
}
|
||
|
||
/**
|
||
* @private
|
||
*/
|
||
_matchSegment(segment, node, isCurrentNode) {
|
||
if (segment.tag !== '*' && segment.tag !== node.tag) {
|
||
return false;
|
||
}
|
||
|
||
if (segment.namespace !== undefined) {
|
||
if (segment.namespace !== '*' && segment.namespace !== node.namespace) {
|
||
return false;
|
||
}
|
||
}
|
||
|
||
if (segment.attrName !== undefined) {
|
||
if (!isCurrentNode) {
|
||
return false;
|
||
}
|
||
|
||
if (!node.values || !(segment.attrName in node.values)) {
|
||
return false;
|
||
}
|
||
|
||
if (segment.attrValue !== undefined) {
|
||
if (String(node.values[segment.attrName]) !== String(segment.attrValue)) {
|
||
return false;
|
||
}
|
||
}
|
||
}
|
||
|
||
if (segment.position !== undefined) {
|
||
if (!isCurrentNode) {
|
||
return false;
|
||
}
|
||
|
||
const counter = node.counter ?? 0;
|
||
|
||
if (segment.position === 'first' && counter !== 0) {
|
||
return false;
|
||
} else if (segment.position === 'odd' && counter % 2 !== 1) {
|
||
return false;
|
||
} else if (segment.position === 'even' && counter % 2 !== 0) {
|
||
return false;
|
||
} else if (segment.position === 'nth' && counter !== segment.positionValue) {
|
||
return false;
|
||
}
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
/**
|
||
* Match any expression in the given set against the current path.
|
||
* @param {ExpressionSet} exprSet
|
||
* @returns {boolean}
|
||
*/
|
||
matchesAny(exprSet) {
|
||
return exprSet.matchesAny(this);
|
||
}
|
||
|
||
/**
|
||
* Create a snapshot of current state.
|
||
* @returns {Object}
|
||
*/
|
||
snapshot() {
|
||
return {
|
||
path: this.path.map(node => ({ ...node })),
|
||
siblingStacks: this.siblingStacks.map(level => level ? { counts: new Map(level.counts), total: level.total } : level),
|
||
keptAttrs: this._keptAttrs.map(entry => ({ ...entry }))
|
||
};
|
||
}
|
||
|
||
/**
|
||
* Restore state from snapshot.
|
||
* @param {Object} snapshot
|
||
*/
|
||
restore(snapshot) {
|
||
this._pathStringCache = null;
|
||
this.path = snapshot.path.map(node => ({ ...node }));
|
||
this.siblingStacks = snapshot.siblingStacks.map(level => level ? { counts: new Map(level.counts), total: level.total } : level);
|
||
this._keptAttrs = (snapshot.keptAttrs || []).map(entry => ({ ...entry }));
|
||
}
|
||
|
||
/**
|
||
* Return the read-only {@link MatcherView} for this matcher.
|
||
*
|
||
* The same instance is returned on every call — no allocation occurs.
|
||
* It always reflects the current parser state and is safe to pass to
|
||
* user callbacks without risk of accidental mutation.
|
||
*
|
||
* @returns {MatcherView}
|
||
*
|
||
* @example
|
||
* const view = matcher.readOnly();
|
||
* // pass view to callbacks — it stays in sync automatically
|
||
* view.matches(expr); // ✓
|
||
* view.getCurrentTag(); // ✓
|
||
* // view.push(...) // ✗ method does not exist — caught by TypeScript
|
||
*/
|
||
readOnly() {
|
||
return this._view;
|
||
}
|
||
}
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 4658:
|
||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ fG: () => (/* binding */ qName),
|
||
/* harmony export */ fH: () => (/* binding */ createValidator)
|
||
/* harmony export */ });
|
||
/* unused harmony exports name, ncName, nmToken, nmTokens, validate, validateAll, sanitize */
|
||
/**
|
||
* xml-naming
|
||
* Validates XML Name productions as defined in the XML 1.0 and 1.1 specifications.
|
||
* Covers: Name, NCName, QName, NMToken, NMTokens
|
||
*
|
||
* XML 1.0 spec: https://www.w3.org/TR/xml/#NT-Name
|
||
* XML 1.1 spec: https://www.w3.org/TR/xml11/#NT-NameStartChar
|
||
* XML NS spec: https://www.w3.org/TR/xml-names/#NT-NCName
|
||
*/
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Character class strings — XML 1.0
|
||
//
|
||
// NameStartChar ::= ":" | [A-Z] | "_" | [a-z]
|
||
// | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF]
|
||
// | [#x370-#x37D] | [#x37F-#x1FFF] <- split to exclude #x0487
|
||
// | [#x200C-#x200D]
|
||
// | [#x2070-#x218F] | [#x2C00-#x2FEF]
|
||
// | [#x3001-#xD7FF] | [#xF900-#xFDCF] | [#xFDF0-#xFFFD]
|
||
//
|
||
// NameChar ::= NameStartChar | "-" | "." | [0-9]
|
||
// | #xB7 | [#x0300-#x036F] | [#x203F-#x2040]
|
||
//
|
||
// Note: \u0487 (Combining Cyrillic Millions Sign) was added in Unicode 4.0,
|
||
// after XML 1.0 was defined against Unicode 2.0. It falls inside the range
|
||
// \u037F-\u1FFF but must be excluded. We split that range into
|
||
// \u037F-\u0486 and \u0488-\u1FFF to exclude it explicitly.
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const nameStartChar10 =
|
||
':A-Za-z_' +
|
||
'\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF' +
|
||
'\u0370-\u037D' +
|
||
'\u037F-\u0486\u0488-\u1FFF' + // split to exclude \u0487
|
||
'\u200C-\u200D' +
|
||
'\u2070-\u218F' +
|
||
'\u2C00-\u2FEF' +
|
||
'\u3001-\uD7FF' +
|
||
'\uF900-\uFDCF' +
|
||
'\uFDF0-\uFFFD';
|
||
|
||
const nameChar10 =
|
||
nameStartChar10 +
|
||
'\\-\\.\\d' +
|
||
'\u00B7' +
|
||
'\u0300-\u036F' +
|
||
'\u203F-\u2040';
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Character class strings — XML 1.1
|
||
//
|
||
// Differences from XML 1.0:
|
||
//
|
||
// NameStartChar:
|
||
// 1.0 has split ranges: \u00C0-\u00D6, \u00D8-\u00F6, \u00F8-\u02FF
|
||
// 1.1 merges them into: \u00C0-\u02FF
|
||
// (\u00D7 x and \u00F7 / are division symbols, excluded in both versions)
|
||
//
|
||
// 1.0 tops out at \uFFFD (BMP only)
|
||
// 1.1 adds \u{10000}-\u{EFFFF} (supplementary planes)
|
||
// These require the /u flag on the RegExp — see buildRegexes below.
|
||
//
|
||
// NameChar:
|
||
// 1.1 adds \u0487 (Combining Cyrillic Millions Sign, added in Unicode 4.0)
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const nameStartChar11 =
|
||
':A-Za-z_' +
|
||
'\u00C0-\u02FF' + // merged — 1.0 had three split ranges here
|
||
'\u0370-\u037D' +
|
||
'\u037F-\u0486\u0488-\u1FFF' + // split to exclude \u0487 (combining mark, never a NameStartChar)
|
||
'\u200C-\u200D' +
|
||
'\u2070-\u218F' +
|
||
'\u2C00-\u2FEF' +
|
||
'\u3001-\uD7FF' +
|
||
'\uF900-\uFDCF' +
|
||
'\uFDF0-\uFFFD' +
|
||
'\u{10000}-\u{EFFFF}'; // supplementary planes — REQUIRES /u flag on RegExp
|
||
|
||
const nameChar11 =
|
||
nameStartChar11 +
|
||
'\\-\\.\\d' +
|
||
'\u00B7' +
|
||
'\u0300-\u036F' +
|
||
'\u0487' + // Combining Cyrillic Millions Sign — valid in 1.1, not 1.0
|
||
'\u203F-\u2040';
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Regex builders
|
||
//
|
||
// XML 1.0 regexes: no flags — BMP only, standard JS regex behaviour.
|
||
// XML 1.1 regexes: /u flag — required for \u{10000}-\u{EFFFF} to match actual
|
||
// supplementary code points rather than lone surrogates (which are illegal XML).
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const buildRegexes = (startChar, char, flags = '') => {
|
||
const ncStart = startChar.replace(':', '');
|
||
const ncChar = char.replace(':', '');
|
||
const ncNamePat = `[${ncStart}][${ncChar}]*`;
|
||
|
||
return {
|
||
name: new RegExp(`^[${startChar}][${char}]*$`, flags),
|
||
ncName: new RegExp(`^${ncNamePat}$`, flags),
|
||
qName: new RegExp(`^${ncNamePat}(?::${ncNamePat})?$`, flags),
|
||
nmToken: new RegExp(`^[${char}]+$`, flags),
|
||
nmTokens: new RegExp(`^[${char}]+(?:\\s+[${char}]+)*$`, flags),
|
||
};
|
||
};
|
||
|
||
const regexes10 = buildRegexes(nameStartChar10, nameChar10); // no /u — BMP only
|
||
const regexes11 = buildRegexes(nameStartChar11, nameChar11, 'u'); // /u — enables \u{10000}-\u{EFFFF}
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// ASCII-only fast path (opt-in, off by default)
|
||
//
|
||
// The XML 1.0 vs 1.1 NameStartChar/NameChar productions differ *only* in
|
||
// their non-ASCII ranges (merged vs split Latin-1 ranges, \u0487, and
|
||
// supplementary planes). Restricted to ASCII, both versions collapse to the
|
||
// same character classes, so a single regex pair covers both xmlVersion
|
||
// values — no /u flag needed.
|
||
//
|
||
// Rationale: unicode-aware regexes (the /u flag, required for XML 1.1's
|
||
// supplementary-plane range) are measurably slower in V8 than plain
|
||
// non-unicode regexes on the same input, even when the input is pure ASCII.
|
||
// For the common case — HTML/SVG ids, XML tags — names are ASCII, so callers
|
||
// who know this can opt in to skip the unicode-aware matching path entirely.
|
||
// This is a real but *conditional* win: mainly for XML 1.1 input (avoids /u),
|
||
// or at scale where the larger unicode character classes add engine
|
||
// overhead. It also changes behaviour (rejects legitimate non-ASCII XML
|
||
// 1.0/1.1 names), so it must never be silently enabled — hence off by
|
||
// default.
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const nameStartCharAscii = ':A-Za-z_';
|
||
const nameCharAscii = nameStartCharAscii + '\\-\\.\\d';
|
||
|
||
const regexesAscii = buildRegexes(nameStartCharAscii, nameCharAscii); // no /u — ASCII only
|
||
|
||
const getRegexes = (xmlVersion = '1.0', asciiOnly = false) => {
|
||
if (asciiOnly) return regexesAscii;
|
||
return xmlVersion === '1.1' ? regexes11 : regexes10;
|
||
};
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Boolean validators
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Returns true if the string is a valid XML Name.
|
||
* Colons are allowed anywhere (Name production).
|
||
* Used for: DOCTYPE entity names, notation names, DTD element declarations.
|
||
*
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* asciiOnly: skip unicode-aware matching, ASCII names only (default false).
|
||
*/
|
||
const name = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
|
||
getRegexes(xmlVersion, asciiOnly).name.test(str);
|
||
|
||
/**
|
||
* Returns true if the string is a valid NCName (Non-Colonized Name).
|
||
* Colons are not permitted.
|
||
* Used for: namespace prefixes, local names, SVG id attributes.
|
||
*
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* asciiOnly: skip unicode-aware matching, ASCII names only (default false).
|
||
*/
|
||
const ncName = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
|
||
getRegexes(xmlVersion, asciiOnly).ncName.test(str);
|
||
|
||
/**
|
||
* Returns true if the string is a valid QName (Qualified Name).
|
||
* Allows exactly one colon as a prefix separator: prefix:localName.
|
||
* Used for: element and attribute names in namespace-aware XML/SVG.
|
||
*
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* asciiOnly: skip unicode-aware matching, ASCII names only (default false).
|
||
*/
|
||
const qName = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
|
||
getRegexes(xmlVersion, asciiOnly).qName.test(str);
|
||
|
||
/**
|
||
* Returns true if the string is a valid NMToken.
|
||
* Like Name but no restriction on the first character.
|
||
* Used for: DTD NMTOKEN attribute values.
|
||
*
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* asciiOnly: skip unicode-aware matching, ASCII names only (default false).
|
||
*/
|
||
const nmToken = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
|
||
getRegexes(xmlVersion, asciiOnly).nmToken.test(str);
|
||
|
||
/**
|
||
* Returns true if the string is a valid NMTokens value.
|
||
* A whitespace-separated list of NMToken values.
|
||
* Used for: DTD NMTOKENS attribute values.
|
||
*
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* asciiOnly: skip unicode-aware matching, ASCII names only (default false).
|
||
*/
|
||
const nmTokens = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
|
||
getRegexes(xmlVersion, asciiOnly).nmTokens.test(str);
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Memoized validator factory
|
||
//
|
||
// Real documents reuse a small vocabulary of tag/attribute names across many
|
||
// siblings (e.g. `id`, `class`, `href` repeated across hundreds of elements).
|
||
// The plain boolean validators above re-run the regex on every call
|
||
// regardless of repeats. `createValidator` returns a closure with a private
|
||
// string -> boolean cache, so repeated names after the first become O(1)
|
||
// lookups instead of regex tests.
|
||
//
|
||
// - opts (xmlVersion, asciiOnly) are fixed at creation time, so the regex is
|
||
// resolved once, not on every call.
|
||
// - The cache is private to the returned closure — no shared/global state,
|
||
// no cross-caller pollution.
|
||
// - `maxCacheSize` bounds memory: once the cache reaches this many entries,
|
||
// it stops accepting new ones (existing entries keep serving hits; new
|
||
// misses just fall through to the regex, uncached). This avoids unbounded
|
||
// growth against adversarial/high-cardinality input (e.g. validating
|
||
// attacker-supplied names with no repeats) without the cost/complexity of
|
||
// a full LRU, and without the perf cliff of reset-and-refill thrashing.
|
||
// - Call `.reset()` on the returned function to clear the cache manually
|
||
// (e.g. between unrelated parse calls).
|
||
// ---------------------------------------------------------------------------
|
||
|
||
const PRODUCTIONS = ['name', 'ncName', 'qName', 'nmToken', 'nmTokens'];
|
||
|
||
/**
|
||
* Returns a memoized boolean validator function for a single production,
|
||
* with opts fixed at creation time.
|
||
*
|
||
* @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean, maxCacheSize?: number }} [opts]
|
||
* maxCacheSize: max number of distinct strings to cache (default 2048).
|
||
* Once reached, new strings are validated but not cached; existing cached
|
||
* entries keep being served.
|
||
* @returns {((str: string) => boolean) & { reset: () => void }}
|
||
*/
|
||
const createValidator = (production, { xmlVersion = '1.0', asciiOnly = false, maxCacheSize = 2048 } = {}) => {
|
||
if (!PRODUCTIONS.includes(production)) {
|
||
throw new TypeError(
|
||
`Unknown production "${production}". Must be one of: ${PRODUCTIONS.join(', ')}`
|
||
);
|
||
}
|
||
|
||
const regex = getRegexes(xmlVersion, asciiOnly)[production];
|
||
let cache = new Map();
|
||
|
||
const validator = (str) => {
|
||
const cached = cache.get(str);
|
||
if (cached !== undefined) return cached;
|
||
|
||
const result = regex.test(str);
|
||
if (cache.size < maxCacheSize) cache.set(str, result);
|
||
return result;
|
||
};
|
||
|
||
validator.reset = () => { cache = new Map(); };
|
||
|
||
return validator;
|
||
};
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Diagnostic validator
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Validates a string against a named production and returns a detailed result.
|
||
*
|
||
* @param {string} str
|
||
* @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* @returns {{ valid: boolean, production: string, input: string, reason?: string, position?: number }}
|
||
*/
|
||
const validate = (str, production, { xmlVersion = '1.0', asciiOnly = false } = {}) => {
|
||
if (!PRODUCTIONS.includes(production)) {
|
||
throw new TypeError(
|
||
`Unknown production "${production}". Must be one of: ${PRODUCTIONS.join(', ')}`
|
||
);
|
||
}
|
||
|
||
const validators = { name, ncName, qName, nmToken, nmTokens };
|
||
const isValid = validators[production](str, { xmlVersion, asciiOnly });
|
||
|
||
if (isValid) return { valid: true, production, input: str };
|
||
|
||
let reason = 'Does not match the production rules';
|
||
let position;
|
||
|
||
// Diagnostic fallback char checks must mirror the same character set the
|
||
// boolean validator above used, or the reported reason/position could
|
||
// contradict the `valid: false` result (e.g. flagging a char as illegal
|
||
// that the unicode-aware check would have accepted).
|
||
const startCharPattern = asciiOnly ? /^[:A-Za-z_]/ : /^[:A-Za-z_\u00C0-\uFFFD]/;
|
||
const namePattern = asciiOnly ? /[\w\-\\.:]/ : /[\w\-\\.:\u00B7\u00C0-\uFFFD]/;
|
||
|
||
if (str.length === 0) {
|
||
reason = 'Input is empty';
|
||
} else if (production === 'ncName' && str.includes(':')) {
|
||
position = str.indexOf(':');
|
||
reason = 'Colon is not allowed in NCName';
|
||
} else if (production === 'qName' && str.startsWith(':')) {
|
||
reason = 'QName cannot start with a colon';
|
||
position = 0;
|
||
} else if (production === 'qName' && str.endsWith(':')) {
|
||
reason = 'QName cannot end with a colon';
|
||
position = str.length - 1;
|
||
} else if (production === 'qName' && (str.match(/:/g) || []).length > 1) {
|
||
reason = 'QName can have at most one colon';
|
||
position = str.lastIndexOf(':');
|
||
} else if (
|
||
['name', 'ncName', 'qName'].includes(production) &&
|
||
!startCharPattern.test(str[0])
|
||
) {
|
||
reason = `First character "${str[0]}" is not a valid NameStartChar`;
|
||
position = 0;
|
||
} else {
|
||
for (let i = 0; i < str.length; i++) {
|
||
if (!namePattern.test(str[i])) {
|
||
reason = `Character "${str[i]}" at position ${i} is not a valid NameChar`;
|
||
position = i;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
|
||
return { valid: false, production, input: str, reason, position };
|
||
};
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Batch validator
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Validates an array of strings against a named production.
|
||
*
|
||
* @param {string[]} strings
|
||
* @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
|
||
* @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
|
||
* @returns {Array<{ valid: boolean, production: string, input: string, reason?: string, position?: number }>}
|
||
*/
|
||
const validateAll = (strings, production, opts = {}) =>
|
||
strings.map(str => validate(str, production, opts));
|
||
|
||
// ---------------------------------------------------------------------------
|
||
// Sanitizer
|
||
// ---------------------------------------------------------------------------
|
||
|
||
/**
|
||
* Transforms an invalid string into the nearest valid XML name for the given production.
|
||
*
|
||
* @param {string} str
|
||
* @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
|
||
* @param {{ replacement?: string, asciiOnly?: boolean }} [opts]
|
||
* asciiOnly: also replace any non-ASCII character, not just XML-illegal
|
||
* ones (default false).
|
||
* @returns {string}
|
||
*/
|
||
const sanitize = (str, production = 'name', { replacement = '_', asciiOnly = false } = {}) => {
|
||
if (!str) return replacement;
|
||
|
||
let result = str;
|
||
|
||
// Strip colons for NCName
|
||
if (production === 'ncName') {
|
||
result = result.replace(/:/g, '');
|
||
}
|
||
|
||
// Replace illegal characters
|
||
const allowedCharPattern = asciiOnly ? /[^\w\-\.:]/g : /[^\w\-\.:\u00B7\u00C0-\uFFFD]/g;
|
||
result = result.replace(allowedCharPattern, replacement);
|
||
|
||
// Fix invalid start character for Name / NCName / QName
|
||
if (production !== 'nmToken' && production !== 'nmTokens') {
|
||
if (/^[\-\.\d]/.test(result)) {
|
||
result = replacement + result;
|
||
}
|
||
}
|
||
|
||
return result || replacement;
|
||
};
|
||
|
||
/***/ })
|
||
|
||
};
|