MCPcopy Create free account
hub / github.com/cure53/dompurify / _parseConfig

Function _parseConfig

src/purify.ts:472–702  ·  view source on GitHub ↗
(cfg: Config = {})

Source from the content-addressed store, hash-verified

470 */
471 // eslint-disable-next-line complexity
472 const _parseConfig = function (cfg: Config = {}): void {
473 if (CONFIG && CONFIG === cfg) {
474 return;
475 }
476
477 /* Shield configuration object from tampering */
478 if (!cfg || typeof cfg !== 'object') {
479 cfg = {};
480 }
481
482 /* Shield configuration object from prototype pollution */
483 cfg = clone(cfg);
484
485 PARSER_MEDIA_TYPE =
486 // eslint-disable-next-line unicorn/prefer-includes
487 SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1
488 ? DEFAULT_PARSER_MEDIA_TYPE
489 : cfg.PARSER_MEDIA_TYPE;
490
491 // HTML tags and attributes are not case-sensitive, converting to lowercase. Keeping XHTML as is.
492 transformCaseFunc =
493 PARSER_MEDIA_TYPE === 'application/xhtml+xml'
494 ? stringToString
495 : stringToLowerCase;
496
497 /* Set configuration parameters */
498 ALLOWED_TAGS = objectHasOwnProperty(cfg, 'ALLOWED_TAGS')
499 ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc)
500 : DEFAULT_ALLOWED_TAGS;
501 ALLOWED_ATTR = objectHasOwnProperty(cfg, 'ALLOWED_ATTR')
502 ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc)
503 : DEFAULT_ALLOWED_ATTR;
504 ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES')
505 ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString)
506 : DEFAULT_ALLOWED_NAMESPACES;
507 URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR')
508 ? addToSet(
509 clone(DEFAULT_URI_SAFE_ATTRIBUTES),
510 cfg.ADD_URI_SAFE_ATTR,
511 transformCaseFunc
512 )
513 : DEFAULT_URI_SAFE_ATTRIBUTES;
514 DATA_URI_TAGS = objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS')
515 ? addToSet(
516 clone(DEFAULT_DATA_URI_TAGS),
517 cfg.ADD_DATA_URI_TAGS,
518 transformCaseFunc
519 )
520 : DEFAULT_DATA_URI_TAGS;
521 FORBID_CONTENTS = objectHasOwnProperty(cfg, 'FORBID_CONTENTS')
522 ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc)
523 : DEFAULT_FORBID_CONTENTS;
524 FORBID_TAGS = objectHasOwnProperty(cfg, 'FORBID_TAGS')
525 ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc)
526 : clone({});
527 FORBID_ATTR = objectHasOwnProperty(cfg, 'FORBID_ATTR')
528 ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc)
529 : clone({});

Callers 1

createDOMPurifyFunction · 0.85

Calls 4

cloneFunction · 0.85
addToSetFunction · 0.85
isRegexOrFunctionFunction · 0.85

Tested by

no test coverage detected