Merge pull request #496 from securityMB/main

Create a polyfill for __lookupGetter__ to make IE10 happy

src/purify.js

@@ -15,8 +15,7 @@ import {
   stringTrim,
   regExpTest,
   typeErrorCreate,
-  unapply,
-  __lookupGetter__,
+  lookupGetter,
 } from './utils';
 
 const getGlobal = () => (typeof window === 'undefined' ? null : window);
@@ -109,16 +108,10 @@ function createDOMPurify(window = getGlobal()) {
 
   const ElementPrototype = Element.prototype;
 
-  const cloneNode = unapply(ElementPrototype.cloneNode);
-  const getNextSibling = unapply(
-    __lookupGetter__(ElementPrototype, 'nextSibling')
-  );
-  const getChildNodes = unapply(
-    __lookupGetter__(ElementPrototype, 'childNodes')
-  );
-  const getParentNode = unapply(
-    __lookupGetter__(ElementPrototype, 'parentNode')
-  );
+  const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
+  const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
+  const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
+  const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
 
   // As per issue #47, the web-components registry is inherited by a
   // new document created via createHTMLDocument. As per the spec

src/utils.js

@@ -1,4 +1,10 @@
-const { hasOwnProperty, setPrototypeOf, isFrozen, getPrototypeOf } = Object;
+const {
+  hasOwnProperty,
+  setPrototypeOf,
+  isFrozen,
+  getPrototypeOf,
+  getOwnPropertyDescriptor,
+} = Object;
 
 let { freeze, seal, create } = Object; // eslint-disable-line import/no-mutable-exports
 let { apply, construct } = typeof Reflect !== 'undefined' && Reflect;
@@ -43,9 +49,6 @@ const regExpTest = unapply(RegExp.prototype.test);
 
 const typeErrorCreate = unconstruct(TypeError);
 
-/* eslint-disable-next-line no-use-extend-native/no-use-extend-native */
-const __lookupGetter__ = unapply(Object.prototype.__lookupGetter__);
-
 export function unapply(func) {
   return (thisArg, ...args) => apply(func, thisArg, args);
 }
@@ -98,6 +101,29 @@ export function clone(object) {
   return newObject;
 }
 
+/* IE10 doesn't support __lookupGetter__ so lets'
+ * simulate it. It also automatically checks
+ * if the prop is function or getter and behaves
+ * accordingly. */
+function lookupGetter(object, prop) {
+  while (object !== null) {
+    const desc = getOwnPropertyDescriptor(object, prop);
+    if (desc) {
+      if (desc.get) {
+        return unapply(desc.get);
+      }
+
+      if (typeof desc.value === 'function') {
+        return unapply(desc.value);
+      }
+    }
+
+    object = getPrototypeOf(object);
+  }
+
+  return null;
+}
+
 export {
   // Array
   arrayForEach,
@@ -108,11 +134,11 @@ export {
   // Object
   freeze,
   getPrototypeOf,
+  getOwnPropertyDescriptor,
   hasOwnProperty,
   isFrozen,
   setPrototypeOf,
   seal,
-  __lookupGetter__,
   // RegExp
   regExpTest,
   // String
@@ -123,4 +149,6 @@ export {
   stringTrim,
   // Errors
   typeErrorCreate,
+  // Other
+  lookupGetter,
 };