Merge branch 'main' of github.com:cure53/DOMPurify

cure53 · cure53 · commit 72c00db12214 · 2025-03-31T14:36:33.000+02:00
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -43,3 +43,5 @@ jobs:
           TEST_PROBE_ONLY: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/2.x' }}
           BS_USERNAME: ${{ secrets.BS_USERNAME }}
           BS_ACCESSKEY: ${{ secrets.BS_ACCESSKEY }}
+      - name: Verify TypeScript
+        run: npm run verify-typescript
diff --git a/README.md b/README.md
@@ -10,7 +10,7 @@ DOMPurify is written in JavaScript and works in all modern browsers (Safari (10+
 
 **Note that [DOMPurify v2.5.8](https://github.com/cure53/DOMPurify/releases/tag/2.5.8) is the latest version supporting MSIE. For important security updates compatible with MSIE, please use the [2.x branch](https://github.com/cure53/DOMPurify/tree/2.x).**
 
-Our automated tests cover [28 different browsers](https://github.com/cure53/DOMPurify/blob/main/test/karma.custom-launchers.config.js#L5) right now, more to come. We also cover Node.js v17.x, v18.x, v19.x, v29.x, v21.x and v22.x, running DOMPurify on [jsdom](https://github.com/jsdom/jsdom). Older Node versions are known to work as well, but hey... no guarantees.
+Our automated tests cover [28 different browsers](https://github.com/cure53/DOMPurify/blob/main/test/karma.custom-launchers.config.js#L5) right now, more to come. We also cover Node.js v17.x, v18.x, v19.x, v20.x, v21.x and v22.x, running DOMPurify on [jsdom](https://github.com/jsdom/jsdom). Older Node versions are known to work as well, but hey... no guarantees.
 
 DOMPurify is written by security people who have vast background in web attacks and XSS. Fear not. For more details please also read about our [Security Goals & Threat Model](https://github.com/cure53/DOMPurify/wiki/Security-Goals-&-Threat-Model). Please, read it. Like, really.
 
diff --git a/dist/purify.cjs.d.ts b/dist/purify.cjs.d.ts
@@ -1,6 +1,7 @@
-/// <reference types="trusted-types" />
 /*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
 
+import { TrustedTypePolicy, TrustedHTML, TrustedTypesWindow } from 'trusted-types/lib';
+
 /**
  * Configuration to control DOMPurify behavior.
  */
@@ -433,8 +434,7 @@ interface UponSanitizeAttributeHookEvent {
 type WindowLike = Pick<typeof globalThis, 'DocumentFragment' | 'HTMLTemplateElement' | 'Node' | 'Element' | 'NodeFilter' | 'NamedNodeMap' | 'HTMLFormElement' | 'DOMParser'> & {
     document?: Document;
     MozNamedAttrMap?: typeof window.NamedNodeMap;
-    trustedTypes?: typeof window.trustedTypes;
-};
+} & Pick<TrustedTypesWindow, 'trustedTypes'>;
 
 export { type Config, type DOMPurify, type DocumentFragmentHook, type ElementHook, type HookName, type NodeHook, type RemovedAttribute, type RemovedElement, type UponSanitizeAttributeHook, type UponSanitizeAttributeHookEvent, type UponSanitizeElementHook, type UponSanitizeElementHookEvent, type WindowLike };
 
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.d.mts b/dist/purify.es.d.mts
@@ -1,6 +1,7 @@
-/// <reference types="trusted-types" />
 /*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
 
+import { TrustedTypePolicy, TrustedHTML, TrustedTypesWindow } from 'trusted-types/lib';
+
 /**
  * Configuration to control DOMPurify behavior.
  */
@@ -433,7 +434,6 @@ interface UponSanitizeAttributeHookEvent {
 type WindowLike = Pick<typeof globalThis, 'DocumentFragment' | 'HTMLTemplateElement' | 'Node' | 'Element' | 'NodeFilter' | 'NamedNodeMap' | 'HTMLFormElement' | 'DOMParser'> & {
     document?: Document;
     MozNamedAttrMap?: typeof window.NamedNodeMap;
-    trustedTypes?: typeof window.trustedTypes;
-};
+} & Pick<TrustedTypesWindow, 'trustedTypes'>;
 
 export { type Config, type DOMPurify, type DocumentFragmentHook, type ElementHook, type HookName, type NodeHook, type RemovedAttribute, type RemovedElement, type UponSanitizeAttributeHook, type UponSanitizeAttributeHookEvent, type UponSanitizeElementHook, type UponSanitizeElementHookEvent, type WindowLike, _default as default };
diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/package.json b/package.json
@@ -19,7 +19,8 @@
     "test:jsdom": "cross-env NODE_ENV=test BABEL_ENV=rollup node test/jsdom-node-runner --dot",
     "test:karma": "cross-env NODE_ENV=test BABEL_ENV=rollup karma start test/karma.conf.js --log-level warn ",
     "test:ci": "cross-env NODE_ENV=test BABEL_ENV=rollup npm run test:jsdom && npm run test:karma -- --log-level error --reporters dots --single-run --shouldTestOnBrowserStack=\"${TEST_BROWSERSTACK}\" --shouldProbeOnly=\"${TEST_PROBE_ONLY}\"",
-    "test": "cross-env NODE_ENV=test BABEL_ENV=rollup npm run lint &&  npm run test:jsdom && npm run test:karma -- --browsers Chrome"
+    "test": "cross-env NODE_ENV=test BABEL_ENV=rollup npm run lint &&  npm run test:jsdom && npm run test:karma -- --browsers Chrome",
+    "verify-typescript": "node ./typescript/verify.js"
   },
   "main": "./dist/purify.cjs.js",
   "module": "./dist/purify.es.mjs",
diff --git a/scripts/fix-types.js b/scripts/fix-types.js
@@ -7,7 +7,6 @@ const path = require('node:path');
   // Note that this script is intended to run on the type declaration file that is
   // output by Rollup, and not the type declaration file generated from TypeScript.
   await fixCjsTypes(path.resolve(__dirname, '../dist/purify.cjs.d.ts'));
-  await fixEsmTypes(path.resolve(__dirname, '../dist/purify.es.d.mts'));
 })().catch((ex) => {
   console.error(ex);
   process.exitCode = 1;
@@ -37,22 +36,5 @@ async function fixCjsTypes(fileName) {
   // for certain configurations, so add a `@ts-ignore` comment before it.
   fixed += '\n// @ts-ignore\nexport = _default;\n';
 
-  await fs.writeFile(fileName, addTrustedTypesReference(fixed));
-}
-
-/**
- * Fixes the ESM type declarations file.
- * @param {string} fileName
- */
-async function fixEsmTypes(fileName) {
-  let types = await fs.readFile(fileName, { encoding: 'utf-8' });
-  await fs.writeFile(fileName, addTrustedTypesReference(types));
-}
-
-function addTrustedTypesReference(types) {
-  // We need to tell TypeScript that we use the type declarations from
-  // `trusted-types` so that it ends up in our type declaration type).
-  // Without this, the references to trusted-types in the type declaration
-  // file can cause compilation errors for certain configurations.
-  return `/// <reference types="trusted-types" />\n${types}`;
+  await fs.writeFile(fileName, fixed);
 }
diff --git a/src/config.ts b/src/config.ts
@@ -1,5 +1,7 @@
 /* eslint-disable @typescript-eslint/indent */
 
+import type { TrustedTypePolicy } from 'trusted-types/lib';
+
 /**
  * Configuration to control DOMPurify behavior.
  */
diff --git a/src/purify.ts b/src/purify.ts
@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/indent */
 
+import type { TrustedHTML, TrustedTypesWindow } from 'trusted-types/lib';
 import type { Config, UseProfilesConfig } from './config';
 import * as TAGS from './tags.js';
 import * as ATTRS from './attrs.js';
@@ -2006,5 +2007,4 @@ export type WindowLike = Pick<
 > & {
   document?: Document;
   MozNamedAttrMap?: typeof window.NamedNodeMap;
-  trustedTypes?: typeof window.trustedTypes;
-};
+} & Pick<TrustedTypesWindow, 'trustedTypes'>;
diff --git a/tsconfig.json b/tsconfig.json
@@ -4,7 +4,8 @@
     "target": "ESNext",
     "module": "ESNext",
     "moduleResolution": "Bundler",
-    "skipLibCheck": true
+    "skipLibCheck": true,
+    "sourceMap": true
   },
   "include": ["src/**/*.ts"]
 }
diff --git a/typescript/commonjs-with-no-types/index.ts b/typescript/commonjs-with-no-types/index.ts
@@ -0,0 +1,4 @@
+import * as dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/commonjs-with-no-types/tsconfig.json b/typescript/commonjs-with-no-types/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "CommonJS",
+    "target": "ES2015",
+    "typeRoots": ["types"]
+  }
+}
diff --git a/typescript/commonjs-with-no-types/types/readme.md b/typescript/commonjs-with-no-types/types/readme.md
@@ -0,0 +1 @@
+This simulates not having `@types/trusted-types` installed.
diff --git a/typescript/commonjs-with-specific-types/index.ts b/typescript/commonjs-with-specific-types/index.ts
@@ -0,0 +1,4 @@
+import * as dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/commonjs-with-specific-types/tsconfig.json b/typescript/commonjs-with-specific-types/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "CommonJS",
+    "target": "ES2015",
+    "types": ["node"]
+  }
+}
diff --git a/typescript/commonjs/index.ts b/typescript/commonjs/index.ts
@@ -0,0 +1,4 @@
+import * as dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/commonjs/tsconfig.json b/typescript/commonjs/tsconfig.json
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "module": "CommonJS",
+    "target": "ES2015"
+  }
+}
diff --git a/typescript/esm-with-no-types/index.ts b/typescript/esm-with-no-types/index.ts
@@ -0,0 +1,4 @@
+import dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/esm-with-no-types/package.json b/typescript/esm-with-no-types/package.json
@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}
diff --git a/typescript/esm-with-no-types/tsconfig.json b/typescript/esm-with-no-types/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "typeRoots": ["types"]
+  }
+}
diff --git a/typescript/esm-with-no-types/types/readme.md b/typescript/esm-with-no-types/types/readme.md
@@ -0,0 +1 @@
+This simulates not having `@types/trusted-types` installed.
diff --git a/typescript/esm-with-specific-types/index.ts b/typescript/esm-with-specific-types/index.ts
@@ -0,0 +1,4 @@
+import dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/esm-with-specific-types/package.json b/typescript/esm-with-specific-types/package.json
@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}
diff --git a/typescript/esm-with-specific-types/tsconfig.json b/typescript/esm-with-specific-types/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "types": ["node"]
+  }
+}
diff --git a/typescript/esm/index.ts b/typescript/esm/index.ts
@@ -0,0 +1,4 @@
+import dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/esm/package.json b/typescript/esm/package.json
@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}
diff --git a/typescript/esm/tsconfig.json b/typescript/esm/tsconfig.json
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "module": "ES2022",
+    "moduleResolution": "bundler"
+  }
+}
diff --git a/typescript/nodenext/index.ts b/typescript/nodenext/index.ts
@@ -0,0 +1,4 @@
+import dompurify from 'dompurify';
+
+dompurify.sanitize('<p>');
+dompurify().sanitize('<p>');
diff --git a/typescript/nodenext/tsconfig.json b/typescript/nodenext/tsconfig.json
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "nodenext"
+  }
+}
diff --git a/typescript/package.json b/typescript/package.json
@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "dompurify": "file:.."
+  }
+}
diff --git a/typescript/verify.js b/typescript/verify.js
@@ -0,0 +1,122 @@
+// @ts-check
+
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const ts = require('typescript');
+const { exec } = require('child_process');
+
+run().catch((ex) => {
+  console.error(ex);
+  process.exitCode = 1;
+});
+
+async function run() {
+  // Install node modules so that `dompurify` can be resolved.
+  process.stdout.write(`\x1b[30mInstalling node modules...\x1b[0m\n`);
+
+  await new Promise((resolve, reject) => {
+    exec('npm install --no-package-lock', { cwd: __dirname }, (err) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve(undefined);
+      }
+    });
+  });
+
+  process.stdout.write('\n');
+
+  let projects = await fs.readdir(__dirname, { withFileTypes: true });
+
+  for (let project of projects
+    .filter((x) => x.isDirectory())
+    .filter((x) => x.name !== 'node_modules')
+    .sort((a, b) => a.name.localeCompare(b.name))) {
+    await verify(project.name, path.join(__dirname, project.name));
+  }
+}
+
+/**
+ * Verifies that a TypeScript project compiles.
+ * @param {string} name The name of the project.
+ * @param {string} directory The project directory.
+ * @returns {Promise<void>}
+ */
+async function verify(name, directory) {
+  let line = `  ${name}...`;
+  process.stdout.write(line);
+
+  let diagnostics = await compile(path.join(directory, 'tsconfig.json'));
+  let success = diagnostics.length === 0;
+  let report = `\x1b${success ? '[32m✔' : '[31mX'}\x1b[0m`;
+
+  if (process.stdout.isTTY) {
+    process.stdout.write(`\x1b[${line.length}D${report} ${name}   \n`);
+  } else {
+    process.stdout.write(` ${report}\n`);
+  }
+
+  if (!success) {
+    printDiagnostics(diagnostics);
+    process.exitCode = 1;
+  }
+}
+
+/**
+ * Compiles a TypeScript project.
+ * @param {string} configFileName The file name of the TypeScript config file.
+ * @returns {Promise<ts.Diagnostic[]>} The diagnostics produced.
+ */
+async function compile(configFileName) {
+  let jsonParseResult = ts.parseConfigFileTextToJson(
+    configFileName,
+    await fs.readFile(configFileName, { encoding: 'utf8' })
+  );
+
+  if (!jsonParseResult.config && jsonParseResult.error) {
+    return [jsonParseResult.error];
+  }
+
+  let config = ts.parseJsonConfigFileContent(
+    jsonParseResult.config,
+    ts.sys,
+    path.dirname(configFileName)
+  );
+  if (config.errors.length > 0) {
+    return config.errors;
+  }
+
+  let program = ts.createProgram(config.fileNames, config.options);
+  let emitResult = program.emit(
+    undefined,
+    // Do not emit anything.
+    () => undefined
+  );
+
+  return ts.getPreEmitDiagnostics(program).concat(emitResult.diagnostics);
+}
+
+/**
+ * Prints the diagnostics to stdout.
+ * @param {ts.Diagnostic[]} diagnostics The diagnostics to report.
+ */
+function printDiagnostics(diagnostics) {
+  diagnostics.forEach((diagnostic) => {
+    let message = '';
+
+    if (diagnostic.file && diagnostic.start) {
+      let start = diagnostic.file.getLineAndCharacterOfPosition(
+        diagnostic.start
+      );
+
+      message += ` ${diagnostic.file.fileName} (${start.line + 1},${
+        start.character + 1
+      })`;
+    }
+
+    message +=
+      ': ' + ts.flattenDiagnosticMessageText(diagnostic.messageText, '    \n');
+
+    process.stdout.write(`\x1b[30m    ${message}\x1b[0m\n`);
+  });
+}
