/**
 * @license
 * Copyright Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { CssSanitizer, HtmlSanitizer } from './html_sanitizer.js';
import { ResourceUrlPolicy } from './resource_url_policy.js';
import { SanitizerTable } from './sanitizer_table/sanitizer_table.js';
/**
 * The base class for all sanitizer builders.
 */
export declare abstract class BaseSanitizerBuilder<T extends HtmlSanitizer | CssSanitizer> {
    protected sanitizerTable: SanitizerTable;
    protected calledBuild: boolean;
    protected resourceUrlPolicy?: ResourceUrlPolicy;
    constructor();
    /** Builder option to restrict allowed elements to a smaller subset. */
    onlyAllowElements(elementSet: ReadonlySet<string>): this;
    /**
     * Builder option to allow a set of custom elements. Must be called either
     * without or after `onlyAllowElements` - will be overwritten otherwise.
     * Custom elements must contain a dash.
     */
    allowCustomElement(element: string, allowedAttributes?: ReadonlySet<string>): this;
    /**
     * Builder option to restrict allowed attributes to a smaller subset.
     *
     * If the attribute isn't currently allowed then it won't be added.
     */
    onlyAllowAttributes(attributeSet: ReadonlySet<string>): this;
    /**
     * Allows all or a definite set of data attributes passed.
     *
     * When called without arguments, all data attributes are allowed.
     * When a set of attributes is passed, its values must be prefixed with "data-"
     *
     * If called with onlyAllowElements or onlyAllowAttributes, those methods must
     * be called first.
     */
    allowDataAttributes(attributes?: string[]): this;
    /**
     * Preserves style attributes. Note that the sanitizer won't parse and
     * sanitize the values but keep them as they are. In particular this means
     * that the code will be able to call functions that could do undesirable
     * things (e.g. `url` to trigger a network request), as well as any custom
     * properties or functions defined by the application.
     */
    allowStyleAttributes(): this;
    /**
     * Preserves the class attribute on all elements. This means contents can
     * adopt CSS styles from other page elements and possibly mask themselves as
     * legitimate UI elements, which can lead to phishing.
     */
    allowClassAttributes(): this;
    /**
     * Preserves id attributes. This carries moderate risk as it allows an
     * element to override other elements with the same ID.
     */
    allowIdAttributes(): this;
    /**
     * Preserves (some) attributes that reference existing ids. This carries a
     * moderate security risk, because sanitized content can create semantic
     * associations with existing elements in the page, regardless of the layout.
     * This could be used to override the label associated with a form input by a
     * screen reader, and facilitate phishing.
     */
    allowIdReferenceAttributes(): this;
    /**
     * Sets the ResourceUrlPolicy to be used by the sanitizer.
     *
     * The ResourceUrlPolicy can be used to decide whether a given URL is allowed
     * to be loaded as an external resource. It is a function that an instance
     * of `URL` and a set of hints giving a context on why an image was loaded.
     *
     * The policy can return `null` to indicate that the resource should be
     * dropped, otherwise it should return a valid `URL` that will be used to
     * replace the original URL in the sanitized output.
     *
     * For example the following policy drops all images loaded from
     * `https://forbidden.google.com` but allows all other images.
     *
     * ```typescript
     * const resourceUrlPolicy: ResourceUrlPolicy = (url) => {
     *   if (url.origin === 'https://forbidden.google.com') {
     *     return null;
     *   }
     *   return url;
     * };
     * ```
     *
     * You can also use the `ResourceUrlPolicyHints` to make the policy more
     * informed. For example the following policy only allows images loaded
     * via an <img src> element but drops all other images.
     *
     * ```typescript
     * const resourceUrlPolicy: ResourceUrlPolicy = (url, hints) => {
     *   if (hints.type === ResourceUrlPolicyHintsType.HTML_ATTRIBUTE &&
     *       hints.attributeName === 'src' &&
     *       hints.elementName === 'IMG') {
     *     return url;
     *   }
     *   return null;
     * };
     * ```
     */
    withResourceUrlPolicy(resourceUrlPolicy: ResourceUrlPolicy): this;
    abstract build(): T;
}
/**
 * This class allows modifications to the default sanitizer configuration.
 * It builds an instance of `HtmlSanitizer`.
 */
export declare class HtmlSanitizerBuilder extends BaseSanitizerBuilder<HtmlSanitizer> {
    build(): HtmlSanitizer;
}
/**
 * This class allows modifications to the default sanitizer configuration.
 * It builds an instance of `CssSanitizer`.
 */
export declare class CssSanitizerBuilder extends BaseSanitizerBuilder<CssSanitizer> {
    private animationsAllowed;
    private transitionsAllowed;
    private openShadow;
    allowAnimations(): this;
    allowTransitions(): this;
    /**
     * Sets the shadow DOM mode to 'open'.
     *
     * While this method is not formally restricted, it can potentially be used to
     * bypass the security guarantees of the CSS sanitizer. If you need open
     * shadow DOM, please contact ise-web-members@ to discuss your use case.
     */
    withOpenShadow(): this;
    /**
     * Builds a CSS sanitizer.
     *
     * Note that this function always adds `style`, `id`, `name` and `class`
     * attributes to the allowlist as well as the `STYLE` element.
     */
    build(): CssSanitizer;
    private extendSanitizerTableForCss;
}