Refactors parse_html_subset() into i18n_behavior.

ui/webui/resources/js/i18n_behavior.js

Index: ui/webui/resources/js/i18n_behavior.js
diff --git a/ui/webui/resources/js/i18n_behavior.js b/ui/webui/resources/js/i18n_behavior.js
index 64dd57c4253f99f2faddc591acb01eac54d1a3d2..e66f0726438b59806ee5560bd28f6f7d532511ab 100644
--- a/ui/webui/resources/js/i18n_behavior.js
+++ b/ui/webui/resources/js/i18n_behavior.js
@@ -16,12 +16,48 @@
 /** @polymerBehavior */
 var I18nBehavior = {
   /**
+   * Returns a translated string where $1 to $9 are replaced by the given
+   * values.
    * @param {string} id The ID of the string to translate.
-   * @param {...string} var_args Placeholders required by the string ($0-9).
+   * @param {...string} var_args Values to replace the placeholders $1 to $9
+   *     in the string.
    * @return {string} A translated, substituted string.
    */
-  i18n: function(id, var_args) {
+  i18nRaw: function(id, var_args) {
     return arguments.length == 1 ? loadTimeData.getString(id) :
         loadTimeData.getStringF.apply(loadTimeData, arguments);
   },
+
+  /**
+   * Returns a translated string where $1 to $9 are replaced by the given
+   * values. Also sanitizes the output to filter out dangerous HTML/JS.
+   * @param {string} id The ID of the string to translate.
+   * @param {...string} var_args Values to replace the placeholders $1 to $9
+   *     in the string.
+   * @return {string} A translated, sanitized, substituted string.
+   */
+  i18n: function(id, var_args) {
+    var rawString = this.i18nRaw.apply(this, arguments);
+    return parseHtmlSubset('<b>' + rawString + '</b>').firstChild.innerHTML;
+  },
+
+  /**
+   * Similar to 'i18n', returns a translated, sanitized, substituted string.
+   * In addition, it accepts optional sets of additional allowed tags and
+   * attributes.
+   * @param {string} id The ID of the string to translate.
+   * @param {!Array<string>=} opt_values Optional values to replace the
+   *     placeholders $1 to $9 in the string.
+   * @param {Array<string>=} opt_extraTags Optional extra allowed tags.
+   * @param {Object<function(Node, string):boolean>=} opt_extraAttrs
+   *     Optional extra allowed attributes (all tags are run through these).
+   * @return {string} A translated, sanitized, substituted string.
+   */
+  i18nExtraTagsAttrs: function(id, opt_values, opt_extraTags, opt_extraAttrs) {
+    opt_values = opt_values || [];
+    var rawString = this.i18nRaw.apply(this, [id].concat(opt_values));
+    return parseHtmlSubset('<b>' + rawString + '</b>',

[Dan Beam, 2016/05/04 16:02:35]

what if opt_extraTags or opt_extraAttrs doesn't allow 'B'?

[Moe, 2016/05/04 21:41:18]

parseHtmlSubset allows B by default. But, it safer to pass in 'B' here as well.

+                           opt_extraTags,
+                           opt_extraAttrs).firstChild.innerHTML;
+  },

[Dan Beam, 2016/05/04 16:02:35]

i don't like having to pass undefined in order to use a later-ordered parameter.
 can we make these named, optional keys in a dictionary instead?

/**
 * @param {string} id
 * @param {{substitutions: (Array<string>|undefined),
 *          attrs: (Object<function(Node, string):boolean>|undefined),
 *          tags: (Array<string>|undefined)}} opts
 */
i18nAdvanced: function(id, opts) {
  var rawString = this.i18nRaw.apply(this, [id].concat(opts.substitutions));
  var tags = (opts.tags || []).concat('B');
  var df = parseHtmlSubset('<b>' + rawString + '</b>', tags, opts.attrs);
  return df.firstChild.innerHTML;
}

[Moe, 2016/05/04 21:41:18]

Makes sense. Done!

 };