diff options
Diffstat (limited to 'dist/js/bootstrap.js')
| -rw-r--r-- | dist/js/bootstrap.js | 189 |
1 files changed, 168 insertions, 21 deletions
diff --git a/dist/js/bootstrap.js b/dist/js/bootstrap.js index 7f93fa2613..da59f0e0ca 100644 --- a/dist/js/bootstrap.js +++ b/dist/js/bootstrap.js @@ -1,5 +1,5 @@ /*! - * Bootstrap v4.3.0 (https://getbootstrap.com/) + * Bootstrap v4.3.1 (https://getbootstrap.com/) * Copyright 2011-2019 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */ @@ -70,7 +70,7 @@ /** * -------------------------------------------------------------------------- - * Bootstrap (v4.3.0): util.js + * Bootstrap (v4.3.1): util.js * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) * -------------------------------------------------------------------------- */ @@ -230,7 +230,7 @@ */ var NAME = 'alert'; - var VERSION = '4.3.0'; + var VERSION = '4.3.1'; var DATA_KEY = 'bs.alert'; var EVENT_KEY = "." + DATA_KEY; var DATA_API_KEY = '.data-api'; @@ -395,7 +395,7 @@ */ var NAME$1 = 'button'; - var VERSION$1 = '4.3.0'; + var VERSION$1 = '4.3.1'; var DATA_KEY$1 = 'bs.button'; var EVENT_KEY$1 = "." + DATA_KEY$1; var DATA_API_KEY$1 = '.data-api'; @@ -549,7 +549,7 @@ */ var NAME$2 = 'carousel'; - var VERSION$2 = '4.3.0'; + var VERSION$2 = '4.3.1'; var DATA_KEY$2 = 'bs.carousel'; var EVENT_KEY$2 = "." + DATA_KEY$2; var DATA_API_KEY$2 = '.data-api'; @@ -1149,7 +1149,7 @@ */ var NAME$3 = 'collapse'; - var VERSION$3 = '4.3.0'; + var VERSION$3 = '4.3.1'; var DATA_KEY$3 = 'bs.collapse'; var EVENT_KEY$3 = "." + DATA_KEY$3; var DATA_API_KEY$3 = '.data-api'; @@ -1509,7 +1509,7 @@ */ var NAME$4 = 'dropdown'; - var VERSION$4 = '4.3.0'; + var VERSION$4 = '4.3.1'; var DATA_KEY$4 = 'bs.dropdown'; var EVENT_KEY$4 = "." + DATA_KEY$4; var DATA_API_KEY$4 = '.data-api'; @@ -2035,7 +2035,7 @@ */ var NAME$5 = 'modal'; - var VERSION$5 = '4.3.0'; + var VERSION$5 = '4.3.1'; var DATA_KEY$5 = 'bs.modal'; var EVENT_KEY$5 = "." + DATA_KEY$5; var DATA_API_KEY$5 = '.data-api'; @@ -2611,18 +2611,140 @@ }; /** + * -------------------------------------------------------------------------- + * Bootstrap (v4.3.1): tools/sanitizer.js + * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) + * -------------------------------------------------------------------------- + */ + var uriAttrs = ['background', 'cite', 'href', 'itemtype', 'longdesc', 'poster', 'src', 'xlink:href']; + var ARIA_ATTRIBUTE_PATTERN = /^aria-[\w-]*$/i; + var DefaultWhitelist = { + // Global attributes allowed on any supplied element below. + '*': ['class', 'dir', 'id', 'lang', 'role', ARIA_ATTRIBUTE_PATTERN], + a: ['target', 'href', 'title', 'rel'], + area: [], + b: [], + br: [], + col: [], + code: [], + div: [], + em: [], + hr: [], + h1: [], + h2: [], + h3: [], + h4: [], + h5: [], + h6: [], + i: [], + img: ['src', 'alt', 'title', 'width', 'height'], + li: [], + ol: [], + p: [], + pre: [], + s: [], + small: [], + span: [], + sub: [], + sup: [], + strong: [], + u: [], + ul: [] + /** + * A pattern that recognizes a commonly useful subset of URLs that are safe. + * + * Shoutout to Angular 7 https://github.com/angular/angular/blob/7.2.4/packages/core/src/sanitization/url_sanitizer.ts + */ + + }; + var SAFE_URL_PATTERN = /^(?:(?:https?|mailto|ftp|tel|file):|[^&:/?#]*(?:[/?#]|$))/gi; + /** + * A pattern that matches safe data URLs. Only matches image, video and audio types. + * + * Shoutout to Angular 7 https://github.com/angular/angular/blob/7.2.4/packages/core/src/sanitization/url_sanitizer.ts + */ + + var DATA_URL_PATTERN = /^data:(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm)|audio\/(?:mp3|oga|ogg|opus));base64,[a-z0-9+/]+=*$/i; + + function allowedAttribute(attr, allowedAttributeList) { + var attrName = attr.nodeName.toLowerCase(); + + if (allowedAttributeList.indexOf(attrName) !== -1) { + if (uriAttrs.indexOf(attrName) !== -1) { + return Boolean(attr.nodeValue.match(SAFE_URL_PATTERN) || attr.nodeValue.match(DATA_URL_PATTERN)); + } + + return true; + } + + var regExp = allowedAttributeList.filter(function (attrRegex) { + return attrRegex instanceof RegExp; + }); // Check if a regular expression validates the attribute. + + for (var i = 0, l = regExp.length; i < l; i++) { + if (attrName.match(regExp[i])) { + return true; + } + } + + return false; + } + + function sanitizeHtml(unsafeHtml, whiteList, sanitizeFn) { + if (unsafeHtml.length === 0) { + return unsafeHtml; + } + + if (sanitizeFn && typeof sanitizeFn === 'function') { + return sanitizeFn(unsafeHtml); + } + + var domParser = new window.DOMParser(); + var createdDocument = domParser.parseFromString(unsafeHtml, 'text/html'); + var whitelistKeys = Object.keys(whiteList); + var elements = [].slice.call(createdDocument.body.querySelectorAll('*')); + + var _loop = function _loop(i, len) { + var el = elements[i]; + var elName = el.nodeName.toLowerCase(); + + if (whitelistKeys.indexOf(el.nodeName.toLowerCase()) === -1) { + el.parentNode.removeChild(el); + return "continue"; + } + + var attributeList = [].slice.call(el.attributes); + var whitelistedAttributes = [].concat(whiteList['*'] || [], whiteList[elName] || []); + attributeList.forEach(function (attr) { + if (!allowedAttribute(attr, whitelistedAttributes)) { + el.removeAttribute(attr.nodeName); + } + }); + }; + + for (var i = 0, len = elements.length; i < len; i++) { + var _ret = _loop(i, len); + + if (_ret === "continue") continue; + } + + return createdDocument.body.innerHTML; + } + + /** * ------------------------------------------------------------------------ * Constants * ------------------------------------------------------------------------ */ var NAME$6 = 'tooltip'; - var VERSION$6 = '4.3.0'; + var VERSION$6 = '4.3.1'; var DATA_KEY$6 = 'bs.tooltip'; var EVENT_KEY$6 = "." + DATA_KEY$6; var JQUERY_NO_CONFLICT$6 = $.fn[NAME$6]; var CLASS_PREFIX = 'bs-tooltip'; var BSCLS_PREFIX_REGEX = new RegExp("(^|\\s)" + CLASS_PREFIX + "\\S+", 'g'); + var DISALLOWED_ATTRIBUTES = ['sanitize', 'whiteList', 'sanitizeFn']; var DefaultType$4 = { animation: 'boolean', template: 'string', @@ -2635,7 +2757,10 @@ offset: '(number|string|function)', container: '(string|element|boolean)', fallbackPlacement: '(string|array)', - boundary: '(string|element)' + boundary: '(string|element)', + sanitize: 'boolean', + sanitizeFn: '(null|function)', + whiteList: 'object' }; var AttachmentMap$1 = { AUTO: 'auto', @@ -2656,7 +2781,10 @@ offset: 0, container: false, fallbackPlacement: 'flip', - boundary: 'scrollParent' + boundary: 'scrollParent', + sanitize: true, + sanitizeFn: null, + whiteList: DefaultWhitelist }; var HoverState = { SHOW: 'show', @@ -2973,19 +3101,27 @@ }; _proto.setElementContent = function setElementContent($element, content) { - var html = this.config.html; - if (typeof content === 'object' && (content.nodeType || content.jquery)) { // Content is a DOM node or a jQuery - if (html) { + if (this.config.html) { if (!$(content).parent().is($element)) { $element.empty().append(content); } } else { $element.text($(content).text()); } + + return; + } + + if (this.config.html) { + if (this.config.sanitize) { + content = sanitizeHtml(content, this.config.whiteList, this.config.sanitizeFn); + } + + $element.html(content); } else { - $element[html ? 'html' : 'text'](content); + $element.text(content); } }; @@ -3153,7 +3289,13 @@ }; _proto._getConfig = function _getConfig(config) { - config = _objectSpread({}, this.constructor.Default, $(this.element).data(), typeof config === 'object' && config ? config : {}); + var dataAttributes = $(this.element).data(); + Object.keys(dataAttributes).forEach(function (dataAttr) { + if (DISALLOWED_ATTRIBUTES.indexOf(dataAttr) !== -1) { + delete dataAttributes[dataAttr]; + } + }); + config = _objectSpread({}, this.constructor.Default, dataAttributes, typeof config === 'object' && config ? config : {}); if (typeof config.delay === 'number') { config.delay = { @@ -3171,6 +3313,11 @@ } Util.typeCheckConfig(NAME$6, config, this.constructor.DefaultType); + + if (config.sanitize) { + config.template = sanitizeHtml(config.template, config.whiteList, config.sanitizeFn); + } + return config; }; @@ -3308,7 +3455,7 @@ */ var NAME$7 = 'popover'; - var VERSION$7 = '4.3.0'; + var VERSION$7 = '4.3.1'; var DATA_KEY$7 = 'bs.popover'; var EVENT_KEY$7 = "." + DATA_KEY$7; var JQUERY_NO_CONFLICT$7 = $.fn[NAME$7]; @@ -3495,7 +3642,7 @@ */ var NAME$8 = 'scrollspy'; - var VERSION$8 = '4.3.0'; + var VERSION$8 = '4.3.1'; var DATA_KEY$8 = 'bs.scrollspy'; var EVENT_KEY$8 = "." + DATA_KEY$8; var DATA_API_KEY$6 = '.data-api'; @@ -3802,7 +3949,7 @@ */ var NAME$9 = 'tab'; - var VERSION$9 = '4.3.0'; + var VERSION$9 = '4.3.1'; var DATA_KEY$9 = 'bs.tab'; var EVENT_KEY$9 = "." + DATA_KEY$9; var DATA_API_KEY$7 = '.data-api'; @@ -4037,7 +4184,7 @@ */ var NAME$a = 'toast'; - var VERSION$a = '4.3.0'; + var VERSION$a = '4.3.1'; var DATA_KEY$a = 'bs.toast'; var EVENT_KEY$a = "." + DATA_KEY$a; var JQUERY_NO_CONFLICT$a = $.fn[NAME$a]; @@ -4247,7 +4394,7 @@ /** * -------------------------------------------------------------------------- - * Bootstrap (v4.3.0): index.js + * Bootstrap (v4.3.1): index.js * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) * -------------------------------------------------------------------------- */ |