Patched sqli/static/js/materialize.js

sqli/static/js/materialize.js

@@ -374,7 +374,16 @@ jQuery.Velocity ? console.log("Velocity is already loaded. You may be needlessly
         var p = r[u].element;if (t || o.loop || ("none" === o.display && S.setPropertyValue(p, "display", o.display), "hidden" === o.visibility && S.setPropertyValue(p, "visibility", o.visibility)), o.loop !== !0 && (f.queue(p)[1] === a || !/\.velocityQueueEntryFlag/i.test(f.queue(p)[1])) && i(p)) {
           i(p).isAnimating = !1, i(p).rootPropertyValueCache = {};var d = !1;f.each(S.Lists.transforms3D, function (e, t) {
             var r = /^scale/.test(t) ? 1 : 0,
-                n = i(p).transformCache[t];i(p).transformCache[t] !== a && new RegExp("^\\(" + r + "[^.]").test(n) && (d = !0, delete i(p).transformCache[t]);
+                n = i(p).transformCache[t];
+                // Safely validate transform cache using string operations
+                if (i(p).transformCache[t] !== a) {
+                  var str = String(n);
+                  var isValidTransform = str.startsWith('(' + r) && str.length > (r + '').length + 1 && str.charAt((r + '').length + 1) !== '.';
+                  if (isValidTransform) {
+                    d = !0;
+                    delete i(p).transformCache[t];
+                  }
+                }
           }), o.mobileHA && (d = !0, delete i(p).transformCache.translate3d), d && S.flushTransformCache(p), S.Values.removeClass(p, "velocity-animating");
         }if (!t && o.complete && !o.loop && u === c - 1) try {
           o.complete.call(n, n);
@@ -538,7 +547,12 @@ jQuery.Velocity ? console.log("Velocity is already loaded. You may be needlessly
             return t.toUpperCase();
           });
         }, SVGAttribute: function (e) {
-          var t = "width|height|x|y|cx|cy|r|rx|ry|x1|x2|y1|y2";return (d || b.State.isAndroid && !b.State.isChrome) && (t += "|transform"), new RegExp("^(" + t + ")$", "i").test(e);
+          // Use a predefined Set of valid SVG attributes instead of RegExp
+          var validAttrs = new Set(['width', 'height', 'x', 'y', 'cx', 'cy', 'r', 'rx', 'ry', 'x1', 'x2', 'y1', 'y2']);
+          if (d || b.State.isAndroid && !b.State.isChrome) {
+            validAttrs.add('transform');
+          }
+          return validAttrs.has(e.toLowerCase());
         }, prefixCheck: function (e) {
           if (b.State.prefixMatches[e]) return [b.State.prefixMatches[e], !0];for (var t = ["", "Webkit", "Moz", "ms", "O"], r = 0, a = t.length; a > r; r++) {
             var n;if (n = 0 === r ? e : t[r] + e.replace(/^\w/, function (e) {
@@ -562,7 +576,19 @@ jQuery.Velocity ? console.log("Velocity is already loaded. You may be needlessly
         }, addClass: function (e, t) {
           e.classList ? e.classList.add(t) : e.className += (e.className.length ? " " : "") + t;
         }, removeClass: function (e, t) {
-          e.classList ? e.classList.remove(t) : e.className = e.className.toString().replace(new RegExp("(^|\\s)" + t.split(" ").join("|") + "(\\s|$)", "gi"), " ");
+          if (e.classList) {
+            var classes = t.split(' ');
+            for (var i = 0; i < classes.length; i++) {
+              e.classList.remove(classes[i]);
+            }
+          } else {
+            var currentClasses = e.className.split(' ');
+            var removedClasses = t.split(' ');
+            var newClasses = currentClasses.filter(function(cls) {
+              return removedClasses.indexOf(cls) === -1;
+            });
+            e.className = newClasses.join(' ').trim();
+          }
         } }, getPropertyValue: function (e, r, n, o) {
         function s(e, r) {
           function n() {