(unsafeElements, whiteList, sanitizeFn)
| 114 | } |
| 115 | |
| 116 | function sanitizeHtml (unsafeElements, whiteList, sanitizeFn) { |
| 117 | if (sanitizeFn && typeof sanitizeFn === 'function') { |
| 118 | return sanitizeFn(unsafeElements); |
| 119 | } |
| 120 | |
| 121 | var whitelistKeys = Object.keys(whiteList); |
| 122 | |
| 123 | for (var i = 0, len = unsafeElements.length; i < len; i++) { |
| 124 | var elements = unsafeElements[i].querySelectorAll('*'); |
| 125 | |
| 126 | for (var j = 0, len2 = elements.length; j < len2; j++) { |
| 127 | var el = elements[j]; |
| 128 | var elName = el.nodeName.toLowerCase(); |
| 129 | |
| 130 | if (whitelistKeys.indexOf(elName) === -1) { |
| 131 | el.parentNode.removeChild(el); |
| 132 | |
| 133 | continue; |
| 134 | } |
| 135 | |
| 136 | var attributeList = [].slice.call(el.attributes); |
| 137 | var whitelistedAttributes = [].concat(whiteList['*'] || [], whiteList[elName] || []); |
| 138 | |
| 139 | for (var k = 0, len3 = attributeList.length; k < len3; k++) { |
| 140 | var attr = attributeList[k]; |
| 141 | |
| 142 | if (!allowedAttribute(attr, whitelistedAttributes)) { |
| 143 | el.removeAttribute(attr.nodeName); |
| 144 | } |
| 145 | } |
| 146 | } |
| 147 | } |
| 148 | } |
| 149 | |
| 150 | // Polyfill for browsers with no classList support |
| 151 | // Remove in v2 |
no test coverage detected