Skip to content

Commit 7aa332e

Browse files
hainenberHackbrettXXX
hainenber
and
HackbrettXXX
authored
fix(sec): remove MSIE support to allow upgrading to vuln-free dompurify v3 (#3827)
* fix(sec): remove MSIE support to allow upgrading to vuln-free `dompurify` v3 Signed-off-by: hainenber <[email protected]> * feat: remove all IE11 verifiers in `src` and `examples` Signed-off-by: hainenber <[email protected]> * chore(ci): remove IE11 as browser testing target Signed-off-by: hainenber <[email protected]> * chore: remove obsolete isOldIE verifiers Signed-off-by: hainenber <[email protected]> * chore(ci): remove IE as browser testing target in Karma's common config Signed-off-by: hainenber <[email protected]> --------- Signed-off-by: hainenber <[email protected]> Co-authored-by: Lukas Holländer <[email protected]>
1 parent e2c1818 commit 7aa332e

12 files changed

+37
-169
lines changed

‎CONTRIBUTING.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ preparing a pull request please follow these guidelines:
5252
- You may now (and should!) use modern JavaScript everywhere. The build step will transpile it. Most of the sources
5353
are still in ES5, but all new code should be written in ES6+.
5454
- When using newer EcmaScript or Browser APIs make sure the required polyfills are listed in
55-
`src/polyfills.js`. At the moment, the library must still run in IE11!
55+
`src/polyfills.js`.
5656
- Run `npm run prettier` before committing.
5757
- Don't update the files in `dist` in regular pull requests. These are usually only updated when creating a new release.
5858
- For the commit message, follow these guidelines:

‎bower.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
"optionalDependencies": {
2020
"canvg": "^3.0.6",
2121
"core-js": "^3.6.0",
22-
"dompurify": "^2.0.12",
22+
"dompurify": "^3.2.4",
2323
"html2canvas": "^1.0.0-rc.5"
2424
},
2525
"devDependencies": {

‎docs/libs_Blob.js.html

-20
Original file line numberDiff line numberDiff line change
@@ -459,26 +459,6 @@ <h1 class="page-title">libs/Blob.js</h1>
459459
}
460460

461461
function fixFileAndXHR() {
462-
var isIE =
463-
!!global.ActiveXObject ||
464-
("-ms-scroll-limit" in document.documentElement.style &amp;&amp;
465-
"-ms-ime-align" in document.documentElement.style);
466-
467-
// Monkey patched
468-
// IE don't set Content-Type header on XHR whose body is a typed Blob
469-
// https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/6047383
470-
var _send = global.XMLHttpRequest &amp;&amp; global.XMLHttpRequest.prototype.send;
471-
if (isIE &amp;&amp; _send) {
472-
XMLHttpRequest.prototype.send = function(data) {
473-
if (data instanceof Blob) {
474-
this.setRequestHeader("Content-Type", data.type);
475-
_send.call(this, data);
476-
} else {
477-
_send.call(this, data);
478-
}
479-
};
480-
}
481-
482462
try {
483463
new File([], "");
484464
} catch (e) {

‎examples/PDF.js/build/pdf.js

+1-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/PDF.js/pdfobject.js

+1-14
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@
3838
ua = window.navigator.userAgent,
3939
//declare booleans
4040
supportsPDFs,
41-
isIE,
4241
supportsPdfMimeType =
4342
typeof navigator.mimeTypes["application/pdf"] !== "undefined",
4443
supportsPdfActiveX,
@@ -85,16 +84,6 @@
8584
return ax;
8685
};
8786

88-
//IE11 still uses ActiveX for Adobe Reader, but IE 11 doesn't expose
89-
//window.ActiveXObject the same way previous versions of IE did
90-
//window.ActiveXObject will evaluate to false in IE 11, but "ActiveXObject" in window evaluates to true
91-
//so check the first one for older IE, and the second for IE11
92-
//FWIW, MS Edge (replacing IE11) does not support ActiveX at all, both will evaluate false
93-
//Constructed as a method (not a prop) to avoid unneccesarry overhead -- will only be evaluated if needed
94-
isIE = function() {
95-
return !!(window.ActiveXObject || "ActiveXObject" in window);
96-
};
97-
9887
//If either ActiveX support for "AcroPDF.PDF" or "PDF.PdfCtrl" are found, return true
9988
//Constructed as a method (not a prop) to avoid unneccesarry overhead -- will only be evaluated if needed
10089
supportsPdfActiveX = function() {
@@ -110,9 +99,7 @@
11099
//Modern versions of Firefox come bundled with PDFJS
111100
(isFirefoxWithPDFJS ||
112101
//Browsers that still support the original MIME type check
113-
supportsPdfMimeType ||
114-
//Pity the poor souls still using IE
115-
(isIE() && supportsPdfActiveX()));
102+
supportsPdfMimeType);
116103

117104
//Create a fragment identifier for using PDF Open parameters when embedding PDF
118105
buildFragmentString = function(pdfParams) {

‎examples/js/ace.js

+14-84
Original file line numberDiff line numberDiff line change
@@ -984,19 +984,6 @@
984984
(t.isWin = r == "win"),
985985
(t.isMac = r == "mac"),
986986
(t.isLinux = r == "linux"),
987-
(t.isIE =
988-
navigator.appName == "Microsoft Internet Explorer" ||
989-
navigator.appName.indexOf("MSAppHost") >= 0
990-
? parseFloat(
991-
(i.match(
992-
/(?:MSIE |Trident\/[0-9]+[\.0-9]+;.*rv:)([0-9]+[\.0-9]+)/
993-
) || [])[1]
994-
)
995-
: parseFloat(
996-
(i.match(/(?:Trident\/[0-9]+[\.0-9]+;.*rv:)([0-9]+[\.0-9]+)/) ||
997-
[])[1]
998-
)),
999-
(t.isOldIE = t.isIE && t.isIE < 9),
1000987
(t.isGecko = t.isMozilla =
1001988
(window.Controllers || window.controllers) &&
1002989
window.navigator.product === "Gecko"),
@@ -1167,15 +1154,6 @@
11671154
: e.detail > 1
11681155
? (o++, o > 4 && (o = 1))
11691156
: (o = 1);
1170-
if (i.isIE) {
1171-
var c = Math.abs(e.clientX - u) > 5 || Math.abs(e.clientY - a) > 5;
1172-
if (!f || c) o = 1;
1173-
f && clearTimeout(f),
1174-
(f = setTimeout(function() {
1175-
f = null;
1176-
}, n[o - 1] || 600)),
1177-
o == 1 && ((u = e.clientX), (a = e.clientY));
1178-
}
11791157
(e._clicks = o), r[s]("mousedown", e);
11801158
if (o > 4) o = 0;
11811159
else if (o > 1) return r[s](l[o], e);
@@ -1196,8 +1174,7 @@
11961174
l = { 2: "dblclick", 3: "tripleclick", 4: "quadclick" };
11971175
Array.isArray(e) || (e = [e]),
11981176
e.forEach(function(e) {
1199-
t.addListener(e, "mousedown", c),
1200-
i.isOldIE && t.addListener(e, "dblclick", h);
1177+
t.addListener(e, "mousedown", c);
12011178
});
12021179
});
12031180
var u =
@@ -1251,7 +1228,7 @@
12511228
s || (f(), r(window, "focus", f));
12521229
}
12531230
});
1254-
if (typeof window == "object" && window.postMessage && !i.isOldIE) {
1231+
if (typeof window == "object" && window.postMessage) {
12551232
var l = 1;
12561233
t.nextTick = function(e, n) {
12571234
n = n || window;
@@ -1427,7 +1404,6 @@
14271404
s = e("../lib/dom"),
14281405
o = e("../lib/lang"),
14291406
u = i.isChrome < 18,
1430-
a = i.isIE,
14311407
f = function(e, t) {
14321408
function b(e) {
14331409
if (h) return;
@@ -1447,15 +1423,12 @@
14471423
}
14481424
function R() {
14491425
clearTimeout(q),
1450-
(q = setTimeout(
1451-
function() {
1452-
p && ((n.style.cssText = p), (p = "")),
1453-
t.renderer.$keepTextAreaAtCursor == null &&
1454-
((t.renderer.$keepTextAreaAtCursor = !0),
1455-
t.renderer.$moveTextAreaToCursor());
1456-
},
1457-
i.isOldIE ? 200 : 0
1458-
));
1426+
(q = setTimeout(function() {
1427+
p && ((n.style.cssText = p), (p = "")),
1428+
t.renderer.$keepTextAreaAtCursor == null &&
1429+
((t.renderer.$keepTextAreaAtCursor = !0),
1430+
t.renderer.$moveTextAreaToCursor());
1431+
}, 0));
14591432
}
14601433
var n = s.createElement("textarea");
14611434
(n.className = "ace_text-input"),
@@ -1465,7 +1438,6 @@
14651438
n.setAttribute("autocapitalize", "off"),
14661439
n.setAttribute("spellcheck", !1),
14671440
(n.style.opacity = "0"),
1468-
i.isOldIE && (n.style.top = "-1000px"),
14691441
e.insertBefore(n, e.firstChild);
14701442
var f = "",
14711443
l = !1,
@@ -1529,27 +1501,6 @@
15291501
} catch (n) {}
15301502
return !t || t.parentElement() != e ? !1 : t.text == e.value;
15311503
}));
1532-
if (i.isOldIE) {
1533-
var S = !1,
1534-
x = function(e) {
1535-
if (S) return;
1536-
var t = n.value;
1537-
if (h || !t || t == f) return;
1538-
if (e && t == f[0]) return T.schedule();
1539-
A(t), (S = !0), w(), (S = !1);
1540-
},
1541-
T = o.delayedCall(x);
1542-
r.addListener(n, "propertychange", x);
1543-
var N = { 13: 1, 27: 1 };
1544-
r.addListener(n, "keyup", function(e) {
1545-
h && (!n.value || N[e.keyCode]) && setTimeout(F, 0);
1546-
if ((n.value.charCodeAt(0) || 0) < 129) return T.call();
1547-
h ? j() : B();
1548-
}),
1549-
r.addListener(n, "keydown", function(e) {
1550-
T.schedule(50);
1551-
});
1552-
}
15531504
var C = function(e) {
15541505
l
15551506
? (l = !1)
@@ -1591,7 +1542,7 @@
15911542
M = function(e, t, n) {
15921543
var r = e.clipboardData || window.clipboardData;
15931544
if (!r || u) return;
1594-
var i = a || n ? "Text" : "text/plain";
1545+
var i = n ? "Text" : "text/plain";
15951546
try {
15961547
return t ? r.setData(i, t) !== !1 : r.getData(i);
15971548
} catch (e) {
@@ -1619,9 +1570,7 @@
16191570
H = function(e) {
16201571
var s = M(e);
16211572
typeof s == "string"
1622-
? (s && t.onPaste(s, e),
1623-
i.isIE && setTimeout(b),
1624-
r.preventDefault(e))
1573+
? (s && t.onPaste(s, e), r.preventDefault(e))
16251574
: ((n.value = ""), (c = !0));
16261575
};
16271576
r.addCommandKeyListener(n, t.onCommandKey.bind(t)),
@@ -1723,14 +1672,12 @@
17231672
this.moveToMouse(e, !0);
17241673
}),
17251674
(this.moveToMouse = function(e, o) {
1726-
if (!o && i.isOldIE) return;
17271675
p || (p = n.style.cssText),
17281676
(n.style.cssText =
17291677
(o ? "z-index:100000;" : "") +
17301678
"height:" +
17311679
n.style.height +
1732-
";" +
1733-
(i.isIE ? "opacity:0.1;" : ""));
1680+
";");
17341681
var u = t.container.getBoundingClientRect(),
17351682
a = s.computedStyle(t.container),
17361683
f = u.top + (parseInt(a.borderTopWidth) || 0),
@@ -1745,7 +1692,7 @@
17451692
t.renderer.$keepTextAreaAtCursor &&
17461693
(t.renderer.$keepTextAreaAtCursor = null),
17471694
clearTimeout(q),
1748-
i.isWin && !i.isOldIE && r.capture(t.container, h, R);
1695+
i.isWin && r.capture(t.container, h, R);
17491696
}),
17501697
(this.onContextMenuClose = R);
17511698
var q,
@@ -2493,15 +2440,6 @@
24932440
}),
24942441
(this.onMouseDrag = function(e) {
24952442
var t = this.editor.container;
2496-
if (s.isIE && this.state == "dragReady") {
2497-
var n = l(
2498-
this.mousedownEvent.x,
2499-
this.mousedownEvent.y,
2500-
this.x,
2501-
this.y
2502-
);
2503-
n > 3 && t.dragDrop();
2504-
}
25052443
if (this.state === "dragWait") {
25062444
var n = l(
25072445
this.mousedownEvent.x,
@@ -2972,10 +2910,6 @@
29722910
),
29732911
r.addListener(u, "mousedown", n),
29742912
r.addListener(f, "mousedown", n),
2975-
i.isIE &&
2976-
e.renderer.scrollBarV &&
2977-
(r.addListener(e.renderer.scrollBarV.element, "mousedown", n),
2978-
r.addListener(e.renderer.scrollBarH.element, "mousedown", n)),
29792913
e.on("mousemove", function(n) {
29802914
if (t.state || t.$dragDelay || !t.$dragEnabled) return;
29812915
var r = e.renderer.screenToTextCoordinates(n.x, n.y),
@@ -3042,10 +2976,6 @@
30422976
f = function() {
30432977
s[s.state] && s[s.state](), (s.$mouseMoved = !1);
30442978
};
3045-
if (i.isOldIE && e.domEvent.type == "dblclick")
3046-
return setTimeout(function() {
3047-
a(e);
3048-
});
30492979
(s.$onCaptureMouseMove = o),
30502980
(s.releaseMouse = r.capture(this.editor.container, o, a));
30512981
var l = setInterval(f, 20);
@@ -12306,7 +12236,7 @@
1230612236
(e.visibility = "hidden"),
1230712237
(e.position = "absolute"),
1230812238
(e.whiteSpace = "pre"),
12309-
o.isIE < 8 ? (e["font-family"] = "inherit") : (e.font = "inherit"),
12239+
(e.font = "inherit"),
1231012240
(e.overflow = t ? "hidden" : "visible");
1231112241
}),
1231212242
(this.checkForSizeChanges = function() {
@@ -12416,7 +12346,7 @@
1241612346
var g = function(e, t) {
1241712347
var n = this;
1241812348
(this.container = e || i.createElement("div")),
12419-
(this.$keepTextAreaAtCursor = !o.isOldIE),
12349+
(this.$keepTextAreaAtCursor = true),
1242012350
i.addCssClass(this.container, "ace_editor"),
1242112351
this.setTheme(t),
1242212352
(this.$gutter = i.createElement("div")),

‎examples/js/pdfobject.min.js

+1-12
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
var pdfobjectversion = "2.1.1",
2323
ua = window.navigator.userAgent,
2424
supportsPDFs,
25-
isIE,
2625
supportsPdfMimeType =
2726
typeof navigator.mimeTypes["application/pdf"] !== "undefined",
2827
supportsPdfActiveX,
@@ -58,17 +57,7 @@
5857
}
5958
return ax;
6059
};
61-
isIE = function() {
62-
return !!(window.ActiveXObject || "ActiveXObject" in window);
63-
};
64-
supportsPdfActiveX = function() {
65-
return !!(createAXO("AcroPDF.PDF") || createAXO("PDF.PdfCtrl"));
66-
};
67-
supportsPDFs =
68-
!isIOS &&
69-
(isFirefoxWithPDFJS ||
70-
supportsPdfMimeType ||
71-
(isIE() && supportsPdfActiveX()));
60+
supportsPDFs = !isIOS && (isFirefoxWithPDFJS || supportsPdfMimeType);
7261
buildFragmentString = function(pdfParams) {
7362
var string = "",
7463
prop;

‎package-lock.json

+15-5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)