| OLD | NEW |
| 1 // Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file | 1 // Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file |
| 2 // for details. All rights reserved. Use of this source code is governed by a | 2 // for details. All rights reserved. Use of this source code is governed by a |
| 3 // BSD-style license that can be found in the LICENSE file. | 3 // BSD-style license that can be found in the LICENSE file. |
| 4 | 4 |
| 5 part of dart.dom.html; | 5 part of dart.dom.html; |
| 6 | 6 |
| 7 | 7 |
| 8 /** | 8 /** |
| 9 * Class which helps construct standard node validation policies. | 9 * Class which helps construct standard node validation policies. |
| 10 * | 10 * |
| (...skipping 340 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 351 var legalAttributes = allowedAttributes.where( | 351 var legalAttributes = allowedAttributes.where( |
| 352 (x) => !_Html5NodeValidator._uriAttributes.contains(x)); | 352 (x) => !_Html5NodeValidator._uriAttributes.contains(x)); |
| 353 var extraUriAttributes = allowedAttributes.where( | 353 var extraUriAttributes = allowedAttributes.where( |
| 354 (x) => _Html5NodeValidator._uriAttributes.contains(x)); | 354 (x) => _Html5NodeValidator._uriAttributes.contains(x)); |
| 355 this.allowedAttributes.addAll(legalAttributes); | 355 this.allowedAttributes.addAll(legalAttributes); |
| 356 this.allowedUriAttributes.addAll(allowedUriAttributes); | 356 this.allowedUriAttributes.addAll(allowedUriAttributes); |
| 357 this.allowedUriAttributes.addAll(extraUriAttributes); | 357 this.allowedUriAttributes.addAll(extraUriAttributes); |
| 358 } | 358 } |
| 359 | 359 |
| 360 bool allowsElement(Element element) { | 360 bool allowsElement(Element element) { |
| 361 return allowedElements.contains(element.tagName); | 361 return allowedElements.contains(element._safeTagName); |
| 362 } | 362 } |
| 363 | 363 |
| 364 bool allowsAttribute(Element element, String attributeName, String value) { | 364 bool allowsAttribute(Element element, String attributeName, String value) { |
| 365 var tagName = element.tagName; | 365 var tagName = element._safeTagName; |
| 366 if (allowedUriAttributes.contains('$tagName::$attributeName')) { | 366 if (allowedUriAttributes.contains('$tagName::$attributeName')) { |
| 367 return uriPolicy.allowsUri(value); | 367 return uriPolicy.allowsUri(value); |
| 368 } else if (allowedUriAttributes.contains('*::$attributeName')) { | 368 } else if (allowedUriAttributes.contains('*::$attributeName')) { |
| 369 return uriPolicy.allowsUri(value); | 369 return uriPolicy.allowsUri(value); |
| 370 } else if (allowedAttributes.contains('$tagName::$attributeName')) { | 370 } else if (allowedAttributes.contains('$tagName::$attributeName')) { |
| 371 return true; | 371 return true; |
| 372 } else if (allowedAttributes.contains('*::$attributeName')) { | 372 } else if (allowedAttributes.contains('*::$attributeName')) { |
| 373 return true; | 373 return true; |
| 374 } else if (allowedAttributes.contains('$tagName::*')) { | 374 } else if (allowedAttributes.contains('$tagName::*')) { |
| 375 return true; | 375 return true; |
| (...skipping 20 matching lines...) Expand all Loading... |
| 396 allowedAttributes: allowedAttributes, | 396 allowedAttributes: allowedAttributes, |
| 397 allowedUriAttributes: allowedUriAttributes), | 397 allowedUriAttributes: allowedUriAttributes), |
| 398 this.allowTypeExtension = allowTypeExtension == true, | 398 this.allowTypeExtension = allowTypeExtension == true, |
| 399 this.allowCustomTag = allowCustomTag == true; | 399 this.allowCustomTag = allowCustomTag == true; |
| 400 | 400 |
| 401 bool allowsElement(Element element) { | 401 bool allowsElement(Element element) { |
| 402 if (allowTypeExtension) { | 402 if (allowTypeExtension) { |
| 403 var isAttr = element.attributes['is']; | 403 var isAttr = element.attributes['is']; |
| 404 if (isAttr != null) { | 404 if (isAttr != null) { |
| 405 return allowedElements.contains(isAttr.toUpperCase()) && | 405 return allowedElements.contains(isAttr.toUpperCase()) && |
| 406 allowedElements.contains(element.tagName); | 406 allowedElements.contains(element._safeTagName); |
| 407 } | 407 } |
| 408 } | 408 } |
| 409 return allowCustomTag && allowedElements.contains(element.tagName); | 409 return allowCustomTag && allowedElements.contains(element._safeTagName); |
| 410 } | 410 } |
| 411 | 411 |
| 412 bool allowsAttribute(Element element, String attributeName, String value) { | 412 bool allowsAttribute(Element element, String attributeName, String value) { |
| 413 if (allowsElement(element)) { | 413 if (allowsElement(element)) { |
| 414 if (allowTypeExtension && attributeName == 'is' && | 414 if (allowTypeExtension && attributeName == 'is' && |
| 415 allowedElements.contains(value.toUpperCase())) { | 415 allowedElements.contains(value.toUpperCase())) { |
| 416 return true; | 416 return true; |
| 417 } | 417 } |
| 418 return super.allowsAttribute(element, attributeName, value); | 418 return super.allowsAttribute(element, attributeName, value); |
| 419 } | 419 } |
| (...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 455 | 455 |
| 456 class _SvgNodeValidator implements NodeValidator { | 456 class _SvgNodeValidator implements NodeValidator { |
| 457 bool allowsElement(Element element) { | 457 bool allowsElement(Element element) { |
| 458 if (element is svg.ScriptElement) { | 458 if (element is svg.ScriptElement) { |
| 459 return false; | 459 return false; |
| 460 } | 460 } |
| 461 // Firefox 37 has issues with creating foreign elements inside a | 461 // Firefox 37 has issues with creating foreign elements inside a |
| 462 // foreignobject tag as SvgElement. We don't want foreignobject contents | 462 // foreignobject tag as SvgElement. We don't want foreignobject contents |
| 463 // anyway, so just remove the whole tree outright. And we can't rely | 463 // anyway, so just remove the whole tree outright. And we can't rely |
| 464 // on IE recognizing the SvgForeignObject type, so go by tagName. Bug 23144 | 464 // on IE recognizing the SvgForeignObject type, so go by tagName. Bug 23144 |
| 465 if (element is svg.SvgElement && element.tagName == 'foreignObject') { | 465 if (element is svg.SvgElement && element._safeTagName == 'foreignObject') { |
| 466 return false; | 466 return false; |
| 467 } | 467 } |
| 468 if (element is svg.SvgElement) { | 468 if (element is svg.SvgElement) { |
| 469 return true; | 469 return true; |
| 470 } | 470 } |
| 471 return false; | 471 return false; |
| 472 } | 472 } |
| 473 | 473 |
| 474 bool allowsAttribute(Element element, String attributeName, String value) { | 474 bool allowsAttribute(Element element, String attributeName, String value) { |
| 475 if (attributeName == 'is' || attributeName.startsWith('on')) { | 475 if (attributeName == 'is' || attributeName.startsWith('on')) { |
| 476 return false; | 476 return false; |
| 477 } | 477 } |
| 478 return allowsElement(element); | 478 return allowsElement(element); |
| 479 } | 479 } |
| 480 } | 480 } |
| OLD | NEW |