Refactors parse_html_subset() into i18n_behavior.

ui/webui/resources/js/i18n_behavior.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * 'I18nBehavior' is a behavior to mix in loading of
  * internationalization strings.
  *
  * Example:
  *   behaviors: [
  *     I18nBehavior,
  *   ],
  */
 
 /** @polymerBehavior */
 var I18nBehavior = {
   /**
+   * Returns a translated string where $1 to $9 are replaced by the given
+   * values.
    * @param {string} id The ID of the string to translate.
-   * @param {...string} var_args Placeholders required by the string ($0-9).
+   * @param {...string} var_args Values to replace the placeholders $1 to $9
+   *     in the string.
    * @return {string} A translated, substituted string.
    */
-  i18n: function(id, var_args) {
+  i18nRaw: function(id, var_args) {
     return arguments.length == 1 ? loadTimeData.getString(id) :
         loadTimeData.getStringF.apply(loadTimeData, arguments);
   },
+
+  /**
+   * Returns a translated string where $1 to $9 are replaced by the given
+   * values. Also sanitizes the output to filter out dangerous HTML/JS.
+   * @param {string} id The ID of the string to translate.
+   * @param {...string} var_args Values to replace the placeholders $1 to $9
+   *     in the string.
+   * @return {string} A translated, sanitized, substituted string.
+   */
+  i18n: function(id, var_args) {
+    var rawString = this.i18nRaw.apply(this, arguments);
+    return parseHtmlSubset('<b>' + rawString + '</b>').firstChild.innerHTML;
+  },
+
+  /**
+   * Similar to 'i18n', returns a translated, sanitized, substituted string.
+   * In addition, it accepts optional sets of additional allowed tags and
+   * attributes.
+   * @param {string} id The ID of the string to translate.
+   * @param {!Array<string>=} opt_values Optional values to replace the
+   *     placeholders $1 to $9 in the string.
+   * @param {Array<string>=} opt_extraTags Optional extra allowed tags.
+   * @param {Object<function(Node, string):boolean>=} opt_extraAttrs
+   *     Optional extra allowed attributes (all tags are run through these).
+   * @return {string} A translated, sanitized, substituted string.
+   */
+  i18nExtraTagsAttrs: function(id, opt_values, opt_extraTags, opt_extraAttrs) {
+    opt_values = opt_values || [];
+    var rawString = this.i18nRaw.apply(this, [id].concat(opt_values));
+    return parseHtmlSubset('<b>' + rawString + '</b>',

[Dan Beam, 2016/05/04 16:02:35]

what if opt_extraTags or opt_extraAttrs doesn't allow 'B'?

[Moe, 2016/05/04 21:41:18]

parseHtmlSubset allows B by default. But, it safer to pass in 'B' here as well.

+                           opt_extraTags,
+                           opt_extraAttrs).firstChild.innerHTML;
+  },

[Dan Beam, 2016/05/04 16:02:35]

i don't like having to pass undefined in order to use a later-ordered parameter.
 can we make these named, optional keys in a dictionary instead?

/**
 * @param {string} id
 * @param {{substitutions: (Array<string>|undefined),
 *          attrs: (Object<function(Node, string):boolean>|undefined),
 *          tags: (Array<string>|undefined)}} opts
 */
i18nAdvanced: function(id, opts) {
  var rawString = this.i18nRaw.apply(this, [id].concat(opts.substitutions));
  var tags = (opts.tags || []).concat('B');
  var df = parseHtmlSubset('<b>' + rawString + '</b>', tags, opts.attrs);
  return df.firstChild.innerHTML;
}

[Moe, 2016/05/04 21:41:18]

Makes sense. Done!

 };