| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 /** | 5 /** |
| 6 * Parse a very small subset of HTML. This ensures that insecure HTML / | 6 * Parse a very small subset of HTML. This ensures that insecure HTML / |
| 7 * javascript cannot be injected into the new tab page. | 7 * javascript cannot be injected into the new tab page. |
| 8 * @param {string} s The string to parse. | 8 * @param {string} s The string to parse. |
| 9 * @param {Array.<string>=} opt_extraTags Optional extra allowed tags. | 9 * @param {Array<string>=} opt_extraTags Optional extra allowed tags. |
| 10 * @param {Object.<string, function(Node, string):boolean>=} opt_extraAttrs | 10 * @param {Object<string, function(Node, string):boolean>=} opt_extraAttrs |
| 11 * Optional extra allowed attributes (all tags are run through these). | 11 * Optional extra allowed attributes (all tags are run through these). |
| 12 * @throws {Error} In case of non supported markup. | 12 * @throws {Error} In case of non supported markup. |
| 13 * @return {DocumentFragment} A document fragment containing the DOM tree. | 13 * @return {DocumentFragment} A document fragment containing the DOM tree. |
| 14 */ | 14 */ |
| 15 var parseHtmlSubset = (function() { | 15 var parseHtmlSubset = (function() { |
| 16 'use strict'; | 16 'use strict'; |
| 17 | 17 |
| 18 var allowedAttributes = { | 18 var allowedAttributes = { |
| 19 'href': function(node, value) { | 19 'href': function(node, value) { |
| 20 // Only allow a[href] starting with chrome:// and https:// | 20 // Only allow a[href] starting with chrome:// and https:// |
| 21 return node.tagName == 'A' && (value.indexOf('chrome://') == 0 || | 21 return node.tagName == 'A' && (value.indexOf('chrome://') == 0 || |
| 22 value.indexOf('https://') == 0); | 22 value.indexOf('https://') == 0); |
| 23 }, | 23 }, |
| 24 'target': function(node, value) { | 24 'target': function(node, value) { |
| 25 // Allow a[target] but reset the value to "". | 25 // Allow a[target] but reset the value to "". |
| 26 if (node.tagName != 'A') | 26 if (node.tagName != 'A') |
| 27 return false; | 27 return false; |
| 28 node.setAttribute('target', ''); | 28 node.setAttribute('target', ''); |
| 29 return true; | 29 return true; |
| 30 } | 30 } |
| 31 }; | 31 }; |
| 32 | 32 |
| 33 /** | 33 /** |
| 34 * Whitelist of tag names allowed in parseHtmlSubset. | 34 * Whitelist of tag names allowed in parseHtmlSubset. |
| 35 * @type {!Array.<string>} | 35 * @type {!Array<string>} |
| 36 * @const | 36 * @const |
| 37 */ | 37 */ |
| 38 var allowedTags = ['A', 'B', 'STRONG']; | 38 var allowedTags = ['A', 'B', 'STRONG']; |
| 39 | 39 |
| 40 /** @param {...Object} var_args Objects to merge. */ | 40 /** @param {...Object} var_args Objects to merge. */ |
| 41 function merge(var_args) { | 41 function merge(var_args) { |
| 42 var clone = {}; | 42 var clone = {}; |
| 43 for (var i = 0; i < arguments.length; ++i) { | 43 for (var i = 0; i < arguments.length; ++i) { |
| 44 if (typeof arguments[i] == 'object') { | 44 if (typeof arguments[i] == 'object') { |
| 45 for (var key in arguments[i]) { | 45 for (var key in arguments[i]) { |
| (...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 96 case Node.TEXT_NODE: | 96 case Node.TEXT_NODE: |
| 97 break; | 97 break; |
| 98 | 98 |
| 99 default: | 99 default: |
| 100 throw Error('Node type ' + node.nodeType + ' is not supported'); | 100 throw Error('Node type ' + node.nodeType + ' is not supported'); |
| 101 } | 101 } |
| 102 }); | 102 }); |
| 103 return df; | 103 return df; |
| 104 }; | 104 }; |
| 105 })(); | 105 })(); |
| OLD | NEW |