adding HtmlEscape to dart:convert

sdk/lib/convert/html.dart

Index: sdk/lib/convert/html.dart
diff --git a/sdk/lib/convert/html.dart b/sdk/lib/convert/html.dart
new file mode 100644
index 0000000000000000000000000000000000000000..88474725a5fa6e64cc725f47b928548b534bc95b
--- /dev/null
+++ b/sdk/lib/convert/html.dart
@@ -0,0 +1,20 @@
+// Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+part of dart.convert;
+
+const HTML_ESCAPE = const HtmlEscape();
+
+class HtmlEscape extends Converter<String, String> {
+
+  const HtmlEscape();
+
+  String convert(String data) {

[Jennifer Messerly, 2013/08/26 23:01:28]

I wonder if this impl should be based on HTML5 specs:

spec:
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#esca...

and here is an impl from html5lib:
https://github.com/dart-lang/bleeding_edge/blob/af36812bd97d7b280869bbd364ce6...

the differences:
* single quote does not need to be escaped
* non-breaking space is escaped
* less-than and greater-than don't need to be escaped in attribute values, only
in other contexts

[Lasse Reichstein Nielsen, 2013/08/27 06:07:40]

We could have different escapes for different contexts.
The obvious contexts would be:
- element content (escape & and <, and maybe >)
- attribute content
  - double quoted (escape " and &)
  - single quoted (escape ' and &)
The characters that need encoding are different in each case.
We could then have a default version that escapes everything needed for every
context, but a knowledgeable user can pick a more specific one if they want.

For unquoted attribute content, we should probably not make an escape - if you
think you need escaping, you should quote it. Unquoted attribute values have a
very restricted set of characters allowed.

[Jennifer Messerly, 2013/08/27 18:26:17]

Using an enum for context SGTM. For attribute context you have single quoted,
double quoted, and unquoted as options.

I'm not sure the intent of this escaper but if it's to prevent XSS, there's good
data here:

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_S...

and here:

http://www.w3.org/International/questions/qa-escapes#use

+    return data.replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&apos;");

[Lasse Reichstein Nielsen, 2013/08/27 06:07:40]

This is horribly inefficient. It's ok as a first go, but we should really
optimize it for a single traversal, or two at most (one to check if there is
anything to replace, and if there is, copy from the start to there into a
StringBuffer and continue).

[Jennifer Messerly, 2013/08/27 18:26:17]

+1

[kevmoo-old, 2013/08/27 20:52:23]

Done.

[kevmoo-old, 2013/08/27 20:52:23]

Done.

+  }
+}