Chromium Code Reviews Chromium Code Reviews
Issue 16374007:
First rev of Safe DOM (Closed)
Base URL: https://dart.googlecode.com/svn/branches/bleeding_edge/dart| OLD | NEW |
|---|---|
| (Empty) | |
| 1 // DO NOT EDIT- this file is generated from running tool/generator.sh. | |
| 2 | |
| 3 // Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file | |
| 4 // for details. All rights reserved. Use of this source code is governed by a | |
| 5 // BSD-style license that can be found in the LICENSE file. | |
| 6 | |
| 7 | |
| 8 /** | |
| 9 * A Dart DOM validator generated from Caja whitelists. | |
| 10 * | |
| 11 * This contains a whitelist of known HTML tagNames and attributes and will only | |
| 12 * accept known good values. | |
| 13 * | |
| 14 * See also: | |
| 15 * | |
| 16 * * https://code.google.com/p/google-caja/wiki/CajaWhitelists | |
| 17 */ | |
| 18 class _Html5NodeValidator implements NodeValidator { | |
|
Jennifer Messerly
2013/06/06 05:55:53
out of curiosity, how much size does this add?
blois
2013/06/06 16:59:42
Appears to be ~4k unzipped to Swarm.
FWIW, I orig
| |
| 19 static final Set<String> _allowedElements = new Set.from([ | |
| 20 'A', | |
| 21 'ABBR', | |
| 22 'ACRONYM', | |
| 23 'ADDRESS', | |
| 24 'AREA', | |
| 25 'ARTICLE', | |
| 26 'ASIDE', | |
| 27 'AUDIO', | |
| 28 'B', | |
| 29 'BDI', | |
| 30 'BDO', | |
| 31 'BIG', | |
| 32 'BLOCKQUOTE', | |
| 33 'BR', | |
| 34 'BUTTON', | |
| 35 'CANVAS', | |
| 36 'CAPTION', | |
| 37 'CENTER', | |
| 38 'CITE', | |
| 39 'CODE', | |
| 40 'COL', | |
| 41 'COLGROUP', | |
| 42 'COMMAND', | |
| 43 'DATA', | |
| 44 'DATALIST', | |
| 45 'DD', | |
| 46 'DEL', | |
| 47 'DETAILS', | |
| 48 'DFN', | |
| 49 'DIR', | |
| 50 'DIV', | |
| 51 'DL', | |
| 52 'DT', | |
| 53 'EM', | |
| 54 'FIELDSET', | |
| 55 'FIGCAPTION', | |
| 56 'FIGURE', | |
| 57 'FONT', | |
| 58 'FOOTER', | |
| 59 'FORM', | |
| 60 'H1', | |
| 61 'H2', | |
| 62 'H3', | |
| 63 'H4', | |
| 64 'H5', | |
| 65 'H6', | |
| 66 'HEADER', | |
| 67 'HGROUP', | |
| 68 'HR', | |
| 69 'I', | |
| 70 'IFRAME', | |
| 71 'IMG', | |
| 72 'INPUT', | |
| 73 'INS', | |
| 74 'KBD', | |
| 75 'LABEL', | |
| 76 'LEGEND', | |
| 77 'LI', | |
| 78 'MAP', | |
| 79 'MARK', | |
| 80 'MENU', | |
| 81 'METER', | |
| 82 'NAV', | |
| 83 'NOBR', | |
| 84 'OL', | |
| 85 'OPTGROUP', | |
| 86 'OPTION', | |
| 87 'OUTPUT', | |
| 88 'P', | |
| 89 'PRE', | |
| 90 'PROGRESS', | |
| 91 'Q', | |
| 92 'S', | |
| 93 'SAMP', | |
| 94 'SECTION', | |
| 95 'SELECT', | |
| 96 'SMALL', | |
| 97 'SOURCE', | |
| 98 'SPAN', | |
| 99 'STRIKE', | |
| 100 'STRONG', | |
| 101 'SUB', | |
| 102 'SUMMARY', | |
| 103 'SUP', | |
| 104 'TABLE', | |
| 105 'TBODY', | |
| 106 'TD', | |
| 107 'TEXTAREA', | |
|
Jennifer Messerly
2013/06/06 05:55:53
why no TEMPLATE?
it's an HTML5 element.
blois
2013/06/06 16:59:42
Will split this out into a separate CL. This file
Jennifer Messerly
2013/06/06 19:31:32
btw, we chatted about this. I was confused; we don
| |
| 108 'TFOOT', | |
| 109 'TH', | |
| 110 'THEAD', | |
| 111 'TIME', | |
| 112 'TR', | |
| 113 'TRACK', | |
| 114 'TT', | |
| 115 'U', | |
| 116 'UL', | |
| 117 'VAR', | |
| 118 'VIDEO', | |
| 119 'WBR', | |
| 120 ]); | |
| 121 | |
| 122 static const _standardAttributes = const <String>[ | |
| 123 '*::class', | |
| 124 '*::dir', | |
| 125 '*::draggable', | |
| 126 '*::hidden', | |
| 127 '*::id', | |
| 128 '*::inert', | |
| 129 '*::itemprop', | |
| 130 '*::itemref', | |
| 131 '*::itemscope', | |
| 132 '*::lang', | |
| 133 '*::spellcheck', | |
| 134 '*::title', | |
| 135 '*::translate', | |
| 136 'A::accesskey', | |
| 137 'A::coords', | |
| 138 'A::hreflang', | |
| 139 'A::name', | |
| 140 'A::shape', | |
| 141 'A::tabindex', | |
| 142 'A::target', | |
| 143 'A::type', | |
| 144 'AREA::accesskey', | |
| 145 'AREA::alt', | |
| 146 'AREA::coords', | |
| 147 'AREA::nohref', | |
| 148 'AREA::shape', | |
| 149 'AREA::tabindex', | |
| 150 'AREA::target', | |
| 151 'AUDIO::controls', | |
| 152 'AUDIO::loop', | |
| 153 'AUDIO::mediagroup', | |
| 154 'AUDIO::muted', | |
| 155 'AUDIO::preload', | |
| 156 'BDO::dir', | |
| 157 'BODY::alink', | |
| 158 'BODY::bgcolor', | |
| 159 'BODY::link', | |
| 160 'BODY::text', | |
| 161 'BODY::vlink', | |
| 162 'BR::clear', | |
| 163 'BUTTON::accesskey', | |
| 164 'BUTTON::disabled', | |
| 165 'BUTTON::name', | |
| 166 'BUTTON::tabindex', | |
| 167 'BUTTON::type', | |
| 168 'BUTTON::value', | |
| 169 'CANVAS::height', | |
| 170 'CANVAS::width', | |
| 171 'CAPTION::align', | |
| 172 'COL::align', | |
| 173 'COL::char', | |
| 174 'COL::charoff', | |
| 175 'COL::span', | |
| 176 'COL::valign', | |
| 177 'COL::width', | |
| 178 'COLGROUP::align', | |
| 179 'COLGROUP::char', | |
| 180 'COLGROUP::charoff', | |
| 181 'COLGROUP::span', | |
| 182 'COLGROUP::valign', | |
| 183 'COLGROUP::width', | |
| 184 'COMMAND::checked', | |
| 185 'COMMAND::command', | |
| 186 'COMMAND::disabled', | |
| 187 'COMMAND::label', | |
| 188 'COMMAND::radiogroup', | |
| 189 'COMMAND::type', | |
| 190 'DATA::value', | |
| 191 'DEL::datetime', | |
| 192 'DETAILS::open', | |
| 193 'DIR::compact', | |
| 194 'DIV::align', | |
| 195 'DL::compact', | |
| 196 'FIELDSET::disabled', | |
| 197 'FONT::color', | |
| 198 'FONT::face', | |
| 199 'FONT::size', | |
| 200 'FORM::accept', | |
| 201 'FORM::autocomplete', | |
| 202 'FORM::enctype', | |
| 203 'FORM::method', | |
| 204 'FORM::name', | |
| 205 'FORM::novalidate', | |
| 206 'FORM::target', | |
| 207 'FRAME::name', | |
| 208 'H1::align', | |
| 209 'H2::align', | |
| 210 'H3::align', | |
| 211 'H4::align', | |
| 212 'H5::align', | |
| 213 'H6::align', | |
| 214 'HR::align', | |
| 215 'HR::noshade', | |
| 216 'HR::size', | |
| 217 'HR::width', | |
| 218 'HTML::version', | |
| 219 'IFRAME::align', | |
| 220 'IFRAME::frameborder', | |
| 221 'IFRAME::height', | |
| 222 'IFRAME::marginheight', | |
| 223 'IFRAME::marginwidth', | |
| 224 'IFRAME::width', | |
| 225 'IMG::align', | |
| 226 'IMG::alt', | |
| 227 'IMG::border', | |
| 228 'IMG::height', | |
| 229 'IMG::hspace', | |
| 230 'IMG::ismap', | |
| 231 'IMG::name', | |
| 232 'IMG::usemap', | |
| 233 'IMG::vspace', | |
| 234 'IMG::width', | |
| 235 'INPUT::accept', | |
| 236 'INPUT::accesskey', | |
| 237 'INPUT::align', | |
| 238 'INPUT::alt', | |
| 239 'INPUT::autocomplete', | |
| 240 'INPUT::checked', | |
| 241 'INPUT::disabled', | |
| 242 'INPUT::inputmode', | |
| 243 'INPUT::ismap', | |
| 244 'INPUT::list', | |
| 245 'INPUT::max', | |
| 246 'INPUT::maxlength', | |
| 247 'INPUT::min', | |
| 248 'INPUT::multiple', | |
| 249 'INPUT::name', | |
| 250 'INPUT::placeholder', | |
| 251 'INPUT::readonly', | |
| 252 'INPUT::required', | |
| 253 'INPUT::size', | |
| 254 'INPUT::step', | |
| 255 'INPUT::tabindex', | |
| 256 'INPUT::type', | |
| 257 'INPUT::usemap', | |
| 258 'INPUT::value', | |
| 259 'INS::datetime', | |
| 260 'KEYGEN::disabled', | |
| 261 'KEYGEN::keytype', | |
| 262 'KEYGEN::name', | |
| 263 'LABEL::accesskey', | |
| 264 'LABEL::for', | |
| 265 'LEGEND::accesskey', | |
| 266 'LEGEND::align', | |
| 267 'LI::type', | |
| 268 'LI::value', | |
| 269 'LINK::sizes', | |
| 270 'MAP::name', | |
| 271 'MENU::compact', | |
| 272 'MENU::label', | |
| 273 'MENU::type', | |
| 274 'METER::high', | |
| 275 'METER::low', | |
| 276 'METER::max', | |
| 277 'METER::min', | |
| 278 'METER::value', | |
| 279 'OBJECT::typemustmatch', | |
| 280 'OL::compact', | |
| 281 'OL::reversed', | |
| 282 'OL::start', | |
| 283 'OL::type', | |
| 284 'OPTGROUP::disabled', | |
| 285 'OPTGROUP::label', | |
| 286 'OPTION::disabled', | |
| 287 'OPTION::label', | |
| 288 'OPTION::selected', | |
| 289 'OPTION::value', | |
| 290 'OUTPUT::for', | |
| 291 'OUTPUT::name', | |
| 292 'P::align', | |
| 293 'PRE::width', | |
| 294 'PROGRESS::max', | |
| 295 'PROGRESS::min', | |
| 296 'PROGRESS::value', | |
| 297 'SELECT::autocomplete', | |
| 298 'SELECT::disabled', | |
| 299 'SELECT::multiple', | |
| 300 'SELECT::name', | |
| 301 'SELECT::required', | |
| 302 'SELECT::size', | |
| 303 'SELECT::tabindex', | |
| 304 'SOURCE::type', | |
| 305 'TABLE::align', | |
| 306 'TABLE::bgcolor', | |
| 307 'TABLE::border', | |
| 308 'TABLE::cellpadding', | |
| 309 'TABLE::cellspacing', | |
| 310 'TABLE::frame', | |
| 311 'TABLE::rules', | |
| 312 'TABLE::summary', | |
| 313 'TABLE::width', | |
| 314 'TBODY::align', | |
| 315 'TBODY::char', | |
| 316 'TBODY::charoff', | |
| 317 'TBODY::valign', | |
| 318 'TD::abbr', | |
| 319 'TD::align', | |
| 320 'TD::axis', | |
| 321 'TD::bgcolor', | |
| 322 'TD::char', | |
| 323 'TD::charoff', | |
| 324 'TD::colspan', | |
| 325 'TD::headers', | |
| 326 'TD::height', | |
| 327 'TD::nowrap', | |
| 328 'TD::rowspan', | |
| 329 'TD::scope', | |
| 330 'TD::valign', | |
| 331 'TD::width', | |
| 332 'TEXTAREA::accesskey', | |
| 333 'TEXTAREA::autocomplete', | |
| 334 'TEXTAREA::cols', | |
| 335 'TEXTAREA::disabled', | |
| 336 'TEXTAREA::inputmode', | |
| 337 'TEXTAREA::name', | |
| 338 'TEXTAREA::placeholder', | |
| 339 'TEXTAREA::readonly', | |
| 340 'TEXTAREA::required', | |
| 341 'TEXTAREA::rows', | |
| 342 'TEXTAREA::tabindex', | |
| 343 'TEXTAREA::wrap', | |
| 344 'TFOOT::align', | |
| 345 'TFOOT::char', | |
| 346 'TFOOT::charoff', | |
| 347 'TFOOT::valign', | |
| 348 'TH::abbr', | |
| 349 'TH::align', | |
| 350 'TH::axis', | |
| 351 'TH::bgcolor', | |
| 352 'TH::char', | |
| 353 'TH::charoff', | |
| 354 'TH::colspan', | |
| 355 'TH::headers', | |
| 356 'TH::height', | |
| 357 'TH::nowrap', | |
| 358 'TH::rowspan', | |
| 359 'TH::scope', | |
| 360 'TH::valign', | |
| 361 'TH::width', | |
| 362 'THEAD::align', | |
| 363 'THEAD::char', | |
| 364 'THEAD::charoff', | |
| 365 'THEAD::valign', | |
| 366 'TR::align', | |
| 367 'TR::bgcolor', | |
| 368 'TR::char', | |
| 369 'TR::charoff', | |
| 370 'TR::valign', | |
| 371 'TRACK::default', | |
| 372 'TRACK::kind', | |
| 373 'TRACK::label', | |
| 374 'TRACK::srclang', | |
| 375 'UL::compact', | |
| 376 'UL::type', | |
| 377 'VIDEO::controls', | |
| 378 'VIDEO::height', | |
| 379 'VIDEO::loop', | |
| 380 'VIDEO::mediagroup', | |
| 381 'VIDEO::muted', | |
| 382 'VIDEO::preload', | |
| 383 'VIDEO::width', | |
| 384 ]; | |
| 385 | |
| 386 static const _uriAttributes = const <String>[ | |
| 387 'A::href', | |
| 388 'AREA::href', | |
| 389 'BLOCKQUOTE::cite', | |
| 390 'BODY::background', | |
| 391 'COMMAND::icon', | |
| 392 'DEL::cite', | |
| 393 'FORM::action', | |
| 394 'IMG::src', | |
| 395 'INPUT::src', | |
| 396 'INS::cite', | |
| 397 'Q::cite', | |
| 398 'VIDEO::poster', | |
| 399 ]; | |
| 400 | |
| 401 final UriPolicy uriPolicy; | |
| 402 | |
| 403 static final Map<String, Function> _attributeValidators = {}; | |
| 404 | |
| 405 /** | |
| 406 * All known URI attributes will be validated against the UriPolicy, if | |
| 407 * [uriPolicy] is null then a default UriPolicy will be used. | |
| 408 */ | |
| 409 _Html5NodeValidator({UriPolicy uriPolicy}): | |
| 410 this.uriPolicy = uriPolicy != null ? uriPolicy : new UriPolicy() { | |
| 411 | |
| 412 if (_attributeValidators.isEmpty) { | |
| 413 for (var attr in _standardAttributes) { | |
| 414 _attributeValidators[attr] = _standardAttributeValidator; | |
| 415 } | |
| 416 | |
| 417 for (var attr in _uriAttributes) { | |
| 418 _attributeValidators[attr] = _uriAttributeValidator; | |
| 419 } | |
| 420 } | |
| 421 } | |
| 422 | |
| 423 bool allowsElement(Element element) { | |
| 424 return _allowedElements.contains(element.tagName); | |
|
Jennifer Messerly
2013/06/06 05:55:53
I worry about the lack of custom element support h
blois
2013/06/06 16:59:42
See NodeValidationBuilder- that's the primary API
| |
| 425 } | |
| 426 | |
| 427 bool allowsAttribute(Element element, String attributeName, String value) { | |
| 428 var tagName = element.tagName; | |
| 429 var validator = _attributeValidators['$tagName::$attributeName']; | |
| 430 if (validator == null) { | |
| 431 validator = _attributeValidators['*::$attributeName']; | |
| 432 } | |
| 433 if (validator == null) { | |
| 434 return false; | |
| 435 } | |
| 436 return validator(element, attributeName, value, this); | |
| 437 } | |
| 438 | |
| 439 static bool _standardAttributeValidator(Element element, String attributeName, | |
| 440 String value, _Html5NodeValidator context) { | |
| 441 return true; | |
| 442 } | |
| 443 | |
| 444 static bool _uriAttributeValidator(Element element, String attributeName, | |
| 445 String value, _Html5NodeValidator context) { | |
| 446 return context.uriPolicy.allowsUri(value); | |
| 447 } | |
| 448 } | |
| OLD | NEW |
