Refactors parse_html_subset() into i18n_behavior.

ui/webui/resources/js/i18n_behavior.js

Index: ui/webui/resources/js/i18n_behavior.js
diff --git a/ui/webui/resources/js/i18n_behavior.js b/ui/webui/resources/js/i18n_behavior.js
index 64dd57c4253f99f2faddc591acb01eac54d1a3d2..8ff884968b2e2873ef5109346322847367dcfd8f 100644
--- a/ui/webui/resources/js/i18n_behavior.js
+++ b/ui/webui/resources/js/i18n_behavior.js
@@ -16,12 +16,38 @@
 /** @polymerBehavior */
 var I18nBehavior = {
   /**
+   * Returns a translated string where $1 to $9 are replaced by values in
+   * |opt_values|.
    * @param {string} id The ID of the string to translate.
-   * @param {...string} var_args Placeholders required by the string ($0-9).
+   * @param {!Array<string>=} opt_values Optional values to replace the
+   *     placeholders $1 to $9 in the string.
    * @return {string} A translated, substituted string.
    */
-  i18n: function(id, var_args) {
-    return arguments.length == 1 ? loadTimeData.getString(id) :
-        loadTimeData.getStringF.apply(loadTimeData, arguments);
+  i18nNoSanitizeHtml: function(id, opt_values) {
+    if (opt_values) {
+      opt_values.unshift(id);

[Dan Beam, 2016/04/27 02:38:27]

don't do this, opt_values is passed by reference and now you've effectively
modified it from the call site

[Moe, 2016/04/27 15:08:46]

yep. this is pretty dumb.

+      return loadTimeData.getStringF.apply(loadTimeData, opt_values);
+    } else {
+      return loadTimeData.getString(id);
+    }
+  },
+
+  /**
+   * Returns a translated string where $1 to $9 are replaced by values in
+   * |opt_values|. Also sanitizes the output to filter out dangerous HTML/JS.
+   * @param {string} id The ID of the string to translate.
+   * @param {!Array<string>=} opt_values Optional values to replace the
+   *     placeholders $1 to $9 in the string.
+   * @param {Array<string>=} opt_extraTags Optional extra allowed tags.
+   * @param {Object<function(Node, string):boolean>=} opt_extraAttrs
+   *     Optional extra allowed attributes (all tags are run through these).
+   * @return {string} A translated, sanitized, substituted string.
+   */
+  i18n: function(id, opt_values, opt_extraTags, opt_extraAttrs) {
+    var string = this.i18nNoSanitizeHtml(id, opt_values);
+    var docFrag = parseHtmlSubset('<b>' + string + '</b>',
+                                  opt_extraTags,
+                                  opt_extraAttrs);
+    return docFrag.firstChild.innerHTML;
   },

[Dan Beam, 2016/04/27 02:38:27]

i don't really understand what you're doing here, but your code should probably
look something like this:

rename i18n -> i18nRaw

make a new i18n that calls i18nRaw() and runs the result through 

  return parseHtmlSubset('<div>' + raw + '</div>').firstChild.innerHTML;

why would the public API of this code need to change?  where are opt_extraTags
or opt_extraAttrs actually used?  they could probably be one-offs instead and
only allow the defaults of <a href={chrome,https}:// target=_blank> or whatever

[Moe, 2016/04/27 15:08:46]

This code is doing exactly that (the new function being i18nNoSanitizeHtml
instead of i18nRaw).

As far as the public API, if we were to expose opt_extraTags and opt_extraAttrs
it would have to change. 
IMO, there's no harm in exposing these optional arguments. There could well be
strings with <br>, <em>, <span> etc that will be using this. Of course, the
other option is to include any new case we come across in the parseHtmlSubset
defaults!
As per your comment though, I'll go ahead and revert the changes to public API.

 };