/** * @license * Copyright Google LLC * SPDX-License-Identifier: Apache-2.0 */ import '../../environment/dev.js'; import { SafeHtml } from '../../internals/html_impl.js'; import { ResourceUrlPolicy } from './resource_url_policy.js'; import { SanitizerTable } from './sanitizer_table/sanitizer_table.js'; /** * An HTML5-compliant markup sanitizer that produces SafeHtml markup. * * You can build sanitizers with a custom configuration using the * HtmlSanitizerBuilder. */ export interface HtmlSanitizer { sanitize(html: string): SafeHtml; sanitizeToFragment(html: string): DocumentFragment; sanitizeAssertUnchanged(html: string): SafeHtml; } /** * CSS Sanitizer that returns a DocumentFragment with sanitized content. * * The reason why this is not part of the HtmlSanitizer is to avoid a potential * misuse of the CSS Sanitizer that would break its security guarantees. * * The CSS Sanitizer uses Shadow DOM to isolate the sanitized content from the * rest of the page. It provides an encapsulation layer for stylesheets and * ensures that there are no clashes between ids or class names. * * If the CSS Sanitizer was part of the HtmlSanitizer, it would be possible * to call `sanitize` with a string that contains both HTML and CSS, which * wouldn't be nested inside a shadow DOM. * * So to avoid this potential pitfall, the CSS Sanitizer is separated out into * its own interface. */ export interface CssSanitizer { sanitizeToFragment(htmlWithCss: string): DocumentFragment; } /** A function that sanitizes a CSS string. */ export declare type CssSanitizationFn = (css: string) => string; /** Implementation for `HtmlSanitizer` */ export declare class HtmlSanitizerImpl implements HtmlSanitizer, CssSanitizer { private readonly sanitizerTable; private readonly styleElementSanitizer?; private readonly styleAttributeSanitizer?; private readonly resourceUrlPolicy?; private readonly openShadow?; private changes; constructor(sanitizerTable: SanitizerTable, token: object, styleElementSanitizer?: CssSanitizationFn | undefined, styleAttributeSanitizer?: CssSanitizationFn | undefined, resourceUrlPolicy?: ResourceUrlPolicy | undefined, openShadow?: boolean | undefined); sanitizeAssertUnchanged(html: string): SafeHtml; sanitize(html: string): SafeHtml; sanitizeToFragment(html: string): DocumentFragment; private sanitizeWithCssToFragment; private sanitizeToFragmentInternal; private createTextNode; private sanitizeTextNode; private sanitizeElementNode; nodeFilter(node: Node): number; private recordChange; private satisfiesAllConditions; } interface SrcsetPart { url: string; descriptor: string | undefined; } /** * A structured representation of a srcset attribute. */ export interface Srcset { parts: SrcsetPart[]; } /** * Parses a srcset attribute into a structured representation. * * @param srcset The srcset attribute value. * @return The parsed srcset. */ export declare function parseSrcset(srcset: string): Srcset; /** * Serializes a srcset into a string. * * @param srcset The srcset to serialize. * @return The serialized srcset. */ export declare function serializeSrcset(srcset: Srcset): string; /** Sanitizes untrusted html using the default sanitizer configuration. */ export declare function sanitizeHtml(html: string): SafeHtml; /** * Sanitizes untrusted html using the default sanitizer configuration. Throws * an error if the html was changed. */ export declare function sanitizeHtmlAssertUnchanged(html: string): SafeHtml; /** * Sanitizes untrusted html using the default sanitizer configuration. Throws * an error if the html was changed. */ export declare function sanitizeHtmlToFragment(html: string): DocumentFragment; export {};