OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 /** | 5 /** |
6 * Parse a very small subset of HTML. This ensures that insecure HTML / | 6 * Parse a very small subset of HTML. This ensures that insecure HTML / |
7 * javascript cannot be injected into the new tab page. | 7 * javascript cannot be injected into the new tab page. |
8 * @param {string} s The string to parse. | 8 * @param {string} s The string to parse. |
9 * @param {Array.<string>=} opt_extraTags Optional extra allowed tags. | 9 * @param {Array<string>=} opt_extraTags Optional extra allowed tags. |
10 * @param {Object.<string, function(Node, string):boolean>=} opt_extraAttrs | 10 * @param {Object<string, function(Node, string):boolean>=} opt_extraAttrs |
11 * Optional extra allowed attributes (all tags are run through these). | 11 * Optional extra allowed attributes (all tags are run through these). |
12 * @throws {Error} In case of non supported markup. | 12 * @throws {Error} In case of non supported markup. |
13 * @return {DocumentFragment} A document fragment containing the DOM tree. | 13 * @return {DocumentFragment} A document fragment containing the DOM tree. |
14 */ | 14 */ |
15 var parseHtmlSubset = (function() { | 15 var parseHtmlSubset = (function() { |
16 'use strict'; | 16 'use strict'; |
17 | 17 |
18 var allowedAttributes = { | 18 var allowedAttributes = { |
19 'href': function(node, value) { | 19 'href': function(node, value) { |
20 // Only allow a[href] starting with chrome:// and https:// | 20 // Only allow a[href] starting with chrome:// and https:// |
21 return node.tagName == 'A' && (value.indexOf('chrome://') == 0 || | 21 return node.tagName == 'A' && (value.indexOf('chrome://') == 0 || |
22 value.indexOf('https://') == 0); | 22 value.indexOf('https://') == 0); |
23 }, | 23 }, |
24 'target': function(node, value) { | 24 'target': function(node, value) { |
25 // Allow a[target] but reset the value to "". | 25 // Allow a[target] but reset the value to "". |
26 if (node.tagName != 'A') | 26 if (node.tagName != 'A') |
27 return false; | 27 return false; |
28 node.setAttribute('target', ''); | 28 node.setAttribute('target', ''); |
29 return true; | 29 return true; |
30 } | 30 } |
31 }; | 31 }; |
32 | 32 |
33 /** | 33 /** |
34 * Whitelist of tag names allowed in parseHtmlSubset. | 34 * Whitelist of tag names allowed in parseHtmlSubset. |
35 * @type {!Array.<string>} | 35 * @type {!Array<string>} |
36 * @const | 36 * @const |
37 */ | 37 */ |
38 var allowedTags = ['A', 'B', 'STRONG']; | 38 var allowedTags = ['A', 'B', 'STRONG']; |
39 | 39 |
40 /** @param {...Object} var_args Objects to merge. */ | 40 /** @param {...Object} var_args Objects to merge. */ |
41 function merge(var_args) { | 41 function merge(var_args) { |
42 var clone = {}; | 42 var clone = {}; |
43 for (var i = 0; i < arguments.length; ++i) { | 43 for (var i = 0; i < arguments.length; ++i) { |
44 if (typeof arguments[i] == 'object') { | 44 if (typeof arguments[i] == 'object') { |
45 for (var key in arguments[i]) { | 45 for (var key in arguments[i]) { |
(...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
96 case Node.TEXT_NODE: | 96 case Node.TEXT_NODE: |
97 break; | 97 break; |
98 | 98 |
99 default: | 99 default: |
100 throw Error('Node type ' + node.nodeType + ' is not supported'); | 100 throw Error('Node type ' + node.nodeType + ' is not supported'); |
101 } | 101 } |
102 }); | 102 }); |
103 return df; | 103 return df; |
104 }; | 104 }; |
105 })(); | 105 })(); |
OLD | NEW |