// @bun
var{defineProperty:T,getOwnPropertyNames:_,getOwnPropertyDescriptor:$}=Object,A=Object.prototype.hasOwnProperty;function C(q){return this[q]}var S=(q)=>{var B=(X??=new WeakMap).get(q),j;if(B)return B;if(B=T({},"__esModule",{value:!0}),q&&typeof q==="object"||typeof q==="function"){for(var F of _(q))if(!A.call(B,F))T(B,F,{get:C.bind(q,F),enumerable:!(j=$(q,F))||j.enumerable})}return X.set(q,B),B},X;var E=(q)=>q;function H(q,B){this[q]=E.bind(null,B)}var k=(q,B)=>{for(var j in B)T(q,j,{get:B[j],enumerable:!0,configurable:!0,set:H.bind(B,j)})};var R=(q,B)=>()=>(q&&(B=q(q=0)),B);var x=import.meta.require;import U from"path";function V(q){let B={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"};return q.replace(/[&<>"']/g,(j)=>B[j]||j)}function W(q,B={}){let{allowHtml:j=!1,maxLength:F=1e4,allowSpecialChars:I=!0,customSanitizer:J}=B,K=[],G=q,M=!1;if(J){let N=J(G);if(N!==G)G=N,M=!0}if(G.includes("\x00"))G=G.replace(/\0/g,""),M=!0,K.push("Null bytes removed from parameter");if(G.length>F)G=G.substring(0,F),M=!0,K.push(`Parameter truncated to ${F} characters`);if(!j&&/<[^>]+>/.test(G))G=V(G),M=!0,K.push("HTML content was escaped");let Z=[{pattern:/javascript:/gi,replacement:"",name:"javascript: URI"},{pattern:/vbscript:/gi,replacement:"",name:"vbscript: URI"},{pattern:/data:text\/html/gi,replacement:"",name:"data:text/html URI"}];for(let{pattern:N,replacement:Q,name:O}of Z)if(N.test(G))G=G.replace(N,Q),M=!0,K.push(`Removed ${O} from parameter`);if(!I){let N=G;if(G=G.split("").filter((Q)=>{let O=Q.charCodeAt(0);return O>=32&&O!==127}).join(""),G!==N)M=!0,K.push("Control characters removed")}return{value:G,modified:M,warnings:K}}function g(q,B){let j=q.replace(/\0/g,"");j=j.replace(/\\/g,"/"),j=j.replace(/^[a-z][a-z0-9+.-]*:/i,"");while(j.includes("../")||j.includes("./"))j=j.replace(/\.\.\//g,"").replace(/\.\//g,"");if(!Y.isValidFilePath(j,B))return null;return j}function f(q){let B=[],j=q.trim(),F=j!==q,I=[{pattern:/\beval\s*\(/gi,name:"eval()"},{pattern:/\bFunction\s*\(/gi,name:"Function()"},{pattern:/\bsetTimeout\s*\(/gi,name:"setTimeout()"},{pattern:/\bsetInterval\s*\(/gi,name:"setInterval()"},{pattern:/\bimport\s*\(/gi,name:"dynamic import()"},{pattern:/\brequire\s*\(/gi,name:"require()"},{pattern:/\b__proto__\b/gi,name:"__proto__"},{pattern:/\bconstructor\b/gi,name:"constructor"},{pattern:/\bprototype\b/gi,name:"prototype"}];for(let{pattern:J,name:K}of I)if(J.test(j))B.push(`Potentially dangerous pattern detected: ${K}`);if(j.includes("\x00"))j=j.replace(/\0/g,""),F=!0,B.push("Null bytes removed from expression");return{value:j,modified:F,warnings:B}}function w(q,B={}){return q.map((j)=>W(j,B))}function b(q){let B={};for(let[j,F]of Object.entries(q)){if(!Y.isValidVariableName(j))continue;if(typeof F==="string"){let I=W(F);B[j]=I.value}else if(Array.isArray(F))B[j]=F.map((I)=>typeof I==="string"?W(I).value:I);else if(typeof F==="object"&&F!==null)B[j]=b(F);else B[j]=F}return B}var Y;var L=R(()=>{Y={isValidFilePath(q,B){let j=q.replace(/\\/g,"/");if(j.includes("\x00"))return!1;if(j.includes("../")||j.includes("..\\")||j===".."||j.startsWith("../")||j.endsWith("/..")||j.includes("/..\\")||j.includes("\\../"))return!1;if(/^[a-z][a-z0-9+.-]*:/i.test(j))return!1;if(j.startsWith("/")){if(["/etc/","/root/","/var/","/usr/","/bin/","/sbin/","/proc/","/sys/","/dev/","/boot/","/home/","/private/","/Library/","/System/"].some((J)=>j===J.slice(0,-1)||j.startsWith(J)))return!1}if(/^[a-z]:/i.test(j)){if(["Windows/","Windows\\","System32/","System32\\","Program Files/","Program Files\\"].some((J)=>j.includes(J)))return!1}if(B){let I=U.resolve(B,q),J=U.resolve(B);if(!I.startsWith(J+U.sep)&&I!==J)return!1}return!0},isValidVariableName(q){return/^[a-z_$]\w*$/i.test(q)},isValidDirectiveName(q){return/^[a-z][\w-]*$/i.test(q)},isSafeContent(q){return![/<script[^>]*>[\s\S]*?<\/script>/i,/javascript:/i,/data:text\/html/i,/vbscript:/i,/on\w+\s*=/i].some((j)=>j.test(q))}}});L();export{Y as validators,g as sanitizeFilePath,f as sanitizeExpression,w as sanitizeDirectiveParams,W as sanitizeDirectiveParam,b as sanitizeComponentProps};
