9856469587

Committed 09 Jul 2024 11:49AM CUT coverage: 96.07%. Remained the same

Build # 9856469587

Build Type

Pull #40619

github

Committed by

web-flow

Commit Message

Merge ac79a1794 into 7c392498f

Pull Request Pull Request #40619: Docs: Fix a minor accessibility issue (checkout example missing h1)

Run Details

666 of 726 branches covered (91.74%)

Branch coverage included in aggregate %.

2023 of 2073 relevant lines covered (97.59%)

249.89 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

95.24

/js/src/util/sanitizer.js

/**
 * --------------------------------------------------------------------------
 * Bootstrap util/sanitizer.js
 * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
 * --------------------------------------------------------------------------
 */

// js-docs-start allow-list
const ARIA_ATTRIBUTE_PATTERN = /^aria-[\w-]*$/i

export const DefaultAllowlist = {
  // Global attributes allowed on any supplied element below.
  '*': ['class', 'dir', 'id', 'lang', 'role', ARIA_ATTRIBUTE_PATTERN],
  a: ['target', 'href', 'title', 'rel'],
  area: [],
  b: [],
  br: [],
  col: [],
  code: [],
  dd: [],
  div: [],
  dl: [],
  dt: [],
  em: [],
  hr: [],
  h1: [],
  h2: [],
  h3: [],
  h4: [],
  h5: [],
  h6: [],
  i: [],
  img: ['src', 'srcset', 'alt', 'title', 'width', 'height'],
  li: [],
  ol: [],
  p: [],
  pre: [],
  s: [],
  small: [],
  span: [],
  sub: [],
  sup: [],
  strong: [],
  u: [],
  ul: []
}
// js-docs-end allow-list

const uriAttributes = new Set([
  'background',
  'cite',
  'href',
  'itemtype',
  'longdesc',
  'poster',
  'src',
  'xlink:href'
])

/**
 * A pattern that recognizes URLs that are safe wrt. XSS in URL navigation
 * contexts.
 *
 * Shout-out to Angular https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38
 */
// eslint-disable-next-line unicorn/better-regex
const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:|[^&:/?#]*(?:[/?#]|$))/i

const allowedAttribute = (attribute, allowedAttributeList) => {
  const attributeName = attribute.nodeName.toLowerCase()

  if (allowedAttributeList.includes(attributeName)) {
    if (uriAttributes.has(attributeName)) {
      return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue))
    }

    return true
  }

  // Check if a regular expression validates the attribute.
  return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp)
    .some(regex => regex.test(attributeName))
}

export function sanitizeHtml(unsafeHtml, allowList, sanitizeFunction) {
  if (!unsafeHtml.length) {
    return unsafeHtml
  }

  if (sanitizeFunction && typeof sanitizeFunction === 'function') {
    return sanitizeFunction(unsafeHtml)
  }

  const domParser = new window.DOMParser()
  const createdDocument = domParser.parseFromString(unsafeHtml, 'text/html')
  const elements = [].concat(...createdDocument.body.querySelectorAll('*'))

  for (const element of elements) {
    const elementName = element.nodeName.toLowerCase()

    if (!Object.keys(allowList).includes(elementName)) {
      element.remove()
      continue
    }

    const attributeList = [].concat(...element.attributes)
    const allowedAttributes = [].concat(allowList['*'] || [], allowList[elementName] || [])

    for (const attribute of attributeList) {
      if (!allowedAttribute(attribute, allowedAttributes)) {
        element.removeAttribute(attribute.nodeName)
      }
    }
  }

  return createdDocument.body.innerHTML
}

1	/**
2	* --------------------------------------------------------------------------
3	* Bootstrap util/sanitizer.js
4	* Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
5	* --------------------------------------------------------------------------
6	*/
7
8	// js-docs-start allow-list
9	const ARIA_ATTRIBUTE_PATTERN = /^aria-[\w-]*$/i	4✔
10
11	export const DefaultAllowlist = {	4✔
12	// Global attributes allowed on any supplied element below.
13	'*': ['class', 'dir', 'id', 'lang', 'role', ARIA_ATTRIBUTE_PATTERN],
14	a: ['target', 'href', 'title', 'rel'],
15	area: [],
16	b: [],
17	br: [],
18	col: [],
19	code: [],
20	dd: [],
21	div: [],
22	dl: [],
23	dt: [],
24	em: [],
25	hr: [],
26	h1: [],
27	h2: [],
28	h3: [],
29	h4: [],
30	h5: [],
31	h6: [],
32	i: [],
33	img: ['src', 'srcset', 'alt', 'title', 'width', 'height'],
34	li: [],
35	ol: [],
36	p: [],
37	pre: [],
38	s: [],
39	small: [],
40	span: [],
41	sub: [],
42	sup: [],
43	strong: [],
44	u: [],
45	ul: []
46	}
47	// js-docs-end allow-list
48
49	const uriAttributes = new Set([	4✔
50	'background',
51	'cite',
52	'href',
53	'itemtype',
54	'longdesc',
55	'poster',
56	'src',
57	'xlink:href'
58	])
59
60	/**
61	* A pattern that recognizes URLs that are safe wrt. XSS in URL navigation
62	* contexts.
63	*
64	* Shout-out to Angular https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38
65	*/
66	// eslint-disable-next-line unicorn/better-regex
67	const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:\|[^&:/?#]*(?:[/?#]\|$))/i	4✔
68
69	const allowedAttribute = (attribute, allowedAttributeList) => {	4✔
70	const attributeName = attribute.nodeName.toLowerCase()	319✔
71
72	if (allowedAttributeList.includes(attributeName)) {	319✔
73	if (uriAttributes.has(attributeName)) {	314✔
74	return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue))	38✔
75	}
76
77	return true	276✔
78	}
79
80	// Check if a regular expression validates the attribute.
81	return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp)	48✔
82	.some(regex => regex.test(attributeName))	6✔
83	}
84
85	export function sanitizeHtml(unsafeHtml, allowList, sanitizeFunction) {
86	if (!unsafeHtml.length) {	123✔
87	return unsafeHtml	1✔
88	}
89
90	if (sanitizeFunction && typeof sanitizeFunction === 'function') {	122✔
91	return sanitizeFunction(unsafeHtml)	1✔
92	}
93
94	const domParser = new window.DOMParser()	121✔
95	const createdDocument = domParser.parseFromString(unsafeHtml, 'text/html')	121✔
96	const elements = [].concat(...createdDocument.body.querySelectorAll('*'))	121✔
97
98	for (const element of elements) {	121✔
99	const elementName = element.nodeName.toLowerCase()	344✔
100
101	if (!Object.keys(allowList).includes(elementName)) {	344✔
102	element.remove()	2✔
103	continue	2✔
104	}
105
106	const attributeList = [].concat(...element.attributes)	342✔
107	const allowedAttributes = [].concat(allowList['*'] \|\| [], allowList[elementName] \|\| [])	342!
108
109	for (const attribute of attributeList) {	342✔
110	if (!allowedAttribute(attribute, allowedAttributes)) {	319✔
111	element.removeAttribute(attribute.nodeName)	17✔
112	}
113	}
114	}
115
116	return createdDocument.body.innerHTML	121✔
117	}

twbs / bootstrap / 9856469587

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous