MCPcopy Create free account
hub / github.com/cure53/dompurify / _checkValidNamespace

Function _checkValidNamespace

src/purify.ts:723–824  ·  view source on GitHub ↗
(element: Element)

Source from the content-addressed store, hash-verified

721 * return. Return true otherwise.
722 */
723 const _checkValidNamespace = function (element: Element): boolean {
724 let parent = getParentNode(element);
725
726 // In JSDOM, if we're inside shadow DOM, then parentNode
727 // can be null. We just simulate parent in this case.
728 if (!parent || !parent.tagName) {
729 parent = {
730 namespaceURI: NAMESPACE,
731 tagName: 'template',
732 };
733 }
734
735 const tagName = stringToLowerCase(element.tagName);
736 const parentTagName = stringToLowerCase(parent.tagName);
737
738 if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
739 return false;
740 }
741
742 if (element.namespaceURI === SVG_NAMESPACE) {
743 // The only way to switch from HTML namespace to SVG
744 // is via <svg>. If it happens via any other tag, then
745 // it should be killed.
746 if (parent.namespaceURI === HTML_NAMESPACE) {
747 return tagName === 'svg';
748 }
749
750 // The only way to switch from MathML to SVG is via`
751 // svg if parent is either <annotation-xml> or MathML
752 // text integration points.
753 if (parent.namespaceURI === MATHML_NAMESPACE) {
754 return (
755 tagName === 'svg' &&
756 (parentTagName === 'annotation-xml' ||
757 MATHML_TEXT_INTEGRATION_POINTS[parentTagName])
758 );
759 }
760
761 // We only allow elements that are defined in SVG
762 // spec. All others are disallowed in SVG namespace.
763 return Boolean(ALL_SVG_TAGS[tagName]);
764 }
765
766 if (element.namespaceURI === MATHML_NAMESPACE) {
767 // The only way to switch from HTML namespace to MathML
768 // is via <math>. If it happens via any other tag, then
769 // it should be killed.
770 if (parent.namespaceURI === HTML_NAMESPACE) {
771 return tagName === 'math';
772 }
773
774 // The only way to switch from SVG to MathML is via
775 // <math> and HTML integration points
776 if (parent.namespaceURI === SVG_NAMESPACE) {
777 return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
778 }
779
780 // We only allow elements that are defined in MathML

Callers 1

_sanitizeElementsFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected